U.S. Department of Justice [Type text] United States Attorney Southern District of New York The Silvio J. Mollo Building One Saint Andrew’s Plaza New York, New York 10007 July 18, 2019 BY ECF The Honorable William H. Pauley III United States District Judge Southern District of New York 500 Pearl Street New York, NY 10007 Re: United States v. Michael Cohen, 18 Cr. 602 (WHP) Dear Judge Pauley: Pursuant to the Court’s February 7, March 18, and July 17, 2019 orders, the Government attaches redacted copies of the search warrant materials that were the subject of these orders, as well as a redacted copy of the Government’s July 15, 2019 status letter. An index of the attached documents is provided below: Exhibit 1 – 18 Mag. 2969. April 8, 2018 application, affidavit, and search warrants for four premises and two cellular phones associated with Michael Cohen. Exhibit 2 – 18 Mag. 2698. April 9, 2018 application, affidavit, and search warrant for a hotel room associated with Michael Cohen. Exhibit 3 – 18 Mag. 1696. February 28, 2018 affidavit and search warrants for email accounts used by Michael Cohen and three other individuals. Exhibit 4 – 18 Mag. 1697. February 28, 2018 application, affidavit, and search warrant for a device containing the results of three prior search warrants of email accounts used by Michael Cohen. Exhibit 5 – 18 Mag. 2877. April 5, 2018 affidavit and search warrant for out of jurisdiction attachments from email search warrant included in Exhibit 3. Exhibit 6 – 18 Mag. 2958. April 7, 2018 application, affidavit and search warrant for three devices containing the results of prior search warrants of email and iCloud accounts used by Michael Cohen. Exhibit 7 – 18 Mag. 2957. April 7, 2018 application, affidavit and search warrant for cellphone location information for two cellular phones used by Michael Cohen. Page 2 Exhibit 8 – 18 Mag. 2974. April 8, 2018 affidavit and search warrant for cellphone location information for two cellular phones used by Michael Cohen. Exhibit 9 – Government’s July 15, 2019 status letter. Respectfully submitted, AUDREY STRAUSS Attorney for the United States, Acting Under Authority Conferred by 28 U.S.C. § 515 By: __________________________ Thomas McKay / Nicolas Roos Assistant United States Attorneys (212) 637-2200 cc: Counsel of Record (by ECF) A0 106 (Rev. 06/09) Application for a Search Warrant UNITED STATES DISTRICT COURT for the Southern District of New York APPLICATION FOR A SEARCH WARRANT In the Matter of the Search of (Brie?y describe the property to be searched or identij?i the person by name and address) Four Premises and TWO Electronic Devices, See Attached Af?davit and Riders I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the See Attached Af?davit and Riders located in the . Southern District of New York there is now concealed (identi?) the person or describe the property to be seized): PLEASE SEE ATTACHED AFFIDAVIT AND RIDERS. The basis for the search under Fed. R. Crim. P. 41(0) is (check one or more): [if evidence of a crime; if contraband, fruits of crime, or other items illegally possessed; [??property designed for use, intended for use, or used in committing a crime; El a person to be arrested or a person who is unlawfully restrained. The search is related to a violation of: Code Section O??ense Description 18 U.S.C. 371, 1005, 1014, Conspiracy, false bank entries, false statements to a ?nancial institution, 1343 and 1344, and wire fraud, bank fraud, and . 52 USC 30116 and 30109 illegal campaign contributions The application is based on these facts: PLEASE SEE ATTACHED AFFIDAVIT AND RIDER. Continued on the attached sheet. Cl Delayed notice of days (give exact ending date if more than 30 days: is requested under 18 U.S.C. 3103a, the basis of which is set forth on the attached Sheet. Printed home torriti tl I?r? Sworn to before me and signed in my presence. - Date: 04/08/2018 2 Lynn, . a, 1/7 Judge . City and state: till/?bres! V49 f'C . fig/til}: habit? if" B: ?PtLti-n?nl Us; ,M??if?tret?'?udge I ?Printedhameahdtitle- UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of the Application of the United States of America for a Search and Seizure Warrant for the Premises Known and Described as (1) 502 Park Avenue, ?.\Iew York, New York 10022, (2) Michael Cohen?s 5 Of?ce at 30 Rockefeller Plaza, 23rd Floor, New York, New York 10112, (3) Safe Deposit Box Located at the TD Bank Branch at 500 Park 2 Avenue, New York, New York 10019, and (4) TO BE FILED UNDER SEAL Agent Af?davit in Support of Application for Search and Seizure Warrant 1728, New York, New York 10065, and Any 3 Closed Containers/Items Contained Therein, and the Electronic Devices Known and Described as (1) an Apple iPhone with Phone Number _and (2) an Apple iPhone with Phone Number Reference No. 201 8R00127 SOUTHERN DISTRICT OF NEW YORK) ss.: deposes and says: I. Introduction A. Affiant 1. I am a Special Agent with the Federal Bureau of Investigation Ihave been a Special Agent with the FBI since 2009 In the course of my experience and training in these positions, I have participated 1n criminal investigations into federal offenses involving a Wide a1 ray of ?nancial crimes, including frauds on ?nancial institutions, as well as into offenses involving public corruption. I also have training and experience executing search warrants, including those involving electronic evidence. 2. I make this Af?davit in support of an application pursuant to Rule 41 of the Federal Rules of Criminal Procedure for a warrant to search the premises speci?ed below (the ?Subject 2 2017.08.02 _Special Agent, Federal Bureau of Investigation, being duly sworn, Premises?) and the electronic devices speci?ed below (the ?Subject Devices?) for, and to seize, the items and information described in Attachments A, B, C, D, and F. This affidavit is based upon my personal knowledge; my review of documents and other evidence; my conversations with other law enforcement personnel; and my training, experience and advice received concerning the use of electronic devices in criminal activity and the forensic analysis of electronically stored information Because this af?davit is being submitted for the limited purpose of ?Tm"?mrT' ISO 21115 it?doe ?al 1? the fact S?thatTIThaVB "16211116 durinthhe' 60111. of my investigation. Where the contents of documents and the actions, statements, and conversations of others are reported herein, they are reported in substance and in part, except where otherwise indicated. B. The Subject Premises and Subject Devices 3. Subject Premises-1, Subject Premises?2, Subject Premises-3 and Subject Premises? 4 (collectively, the ?Subject Premises?) are particularly described as: a. Subject Premisesml is Apartment-located inside the building at 502 Park Avenue, New York, New York 10022. The building located at 502 Park Avenue is a 32- ?oor brick residential building. Subject Premises-1 is located on the-?oor of the building. Based on my review of New York City property records, 1 have learned that Michael Cohen and Laura Cohen own Subject Pr?nrises?d.1 Additionally, as described below, Subject Premises?1 is Cohen? full-time residence. b. Subject Premises-Q is an of?ce located on the 23rd ?oor of the building at 30 Rockefeller Plaza, New York, New York 10112. The building located at 30 Rockefeller Plaza 1 As noted in?a, I have learned that on or about October 28, 2015, Cohen transferred Subject Premises-1 into atrust. 3 2017.03.02 is a 66-?oor of?ce building that spans the entire block between Sixth Avenue and Rockefeller IPlaza. Subject Premises-2 is located on the 23rd ?oor of the building inside of the of?ces of the law ?rm Squire Patton Boggs. The of?ce is assigned to Michael Cohen. As described below, Michael Cohen works and conducts meetings at Subject Premises?2. c. Subject Premises-=3 is a safety deposit box located inside the TD Bank branch location at 500 Park Avenue, New York, New York 10019. Based on my review of records ten inches in size, and is marked as box - The safety deposit box is in the name of Michael Cohen and Laura Cohen. d. Subject Premises-4 is Room 1728 located inside the Loews Regency Hotel at 540 Park Avenue, New York, New York 10065. The building is a luxury hotel located on Park Avenue and 6lst Street. Subject Premises?4, is located on the 17th ?oor of the hotel. Based on my review of emails obtained pursuant to search warrants described below, I have learned that on or about January 5, 2018, Cohen received an email from an employee of Loews Regency, which included a price quote for a long?term stay suite based on a three?month stay from January 8 to April 8, 2018.2 On or about January 29, 2018, Cohen sent an email to a Loews Regency employee, stating, in pertinent part: just spoke to my wife and she has scheduled the move for Thursday. Please mark down that we will be taking possession on Thursday, February lst.? Based on my review of cell phone location data, I have learned that, over the past 24 hours, two cellular phones used by Cohen have been located in the Vicinity of Subject Premises-4. In particular, on or about 2 Although the quoted price contemplated a three-month stay from anuaiy 8 to April 8, it appears that Cohen did not move in until February 1, and as of today, April 8, cellphone location information demonstrates that Cohen?s cellular phones are in still in the vicinity of Subject Premises?4. 4 2017.08.02 April 8, 2018, law enforcement agents using a device identi?ed Room 1728 as the room within the hotel in which the Subject Devices are most likely present.3 e. Therefore, I believe that Cohen is temporarily residing in Subject Premises-4. 4. Subject Device?l and Subject Device?2 (collectively, the ?Subject Devices?) are particularly described as: Based on my review of records maintained by I have learned that Subject Device-l is subscribed to Michael Cohen. Based on my review of cellphone location information maintained I have learned that Subject Device-1 is presently located in the Southern District of New York. b. Subject Device-2 is an Apple iPhone serviced by with the telephone number ased on my review of records maintained by I have learned that Subject Device~2 is subscribed to Michael Cohen. Based on my review of cellphone location information maintained by I have learned that Subject Device?2 is presently located in the Southern District of New York. c. Based on my training, experience, and research, and from consulting the manufacturer?s and service providers? advertisements and product technical speci?cations available online, I know that the Subject Devices have capabilities that allow them to, among other things: make and receive telephone calls; save and store contact information; send and receive 3 Based on my conversations with these agents, I understand that it is also possible that the Subject Devices are one ?oor below, in Room 1628. However, as noted, I understand that Cohen received a price quote for a long-term stay suite and is residing there with his family. Based on my conversations with FBI agents conducting surveillance, I understand that Room 1728 appears to be a suite, whereas Room 1628 appears to be a standard room. 5 2017.08.02 emails and text messages; download and run mobile telephone applications, including call and messaging application such as WhatsApp, Signal, and Dust; take, send, and receive pictures and videos; save and store notes and passwords; and store documents. C. The Subject Offenses 5. For the reasons detailed below, I believe that there is probable cause to believe that the Subject Premises and Subject Devices contain evidence, ??uits, and instrumentalities of 005~(falseebanle? entries); institution), 1343 (wire fraud), and 1344 (bank ?aud) (collectively, the ?Bank Fraud Offenses?), 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(l) (illegal campaign contributions) (the ?Campaign Finance Offenses?), and 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses) (collectively, the ?Subject Offenses?). D. Prior Applications 6. The FBI and the United States Attorney?s Of?ce for the Southern District of New York have been investigating several courses of criminal conduct by Michael Cohen. Cohen is an attorney who currently holds himself out as the personal attorney for President Donald Trump, and who previously served for over a decade as an executive in the Trump Organization, an international conglomerate with real estate and other holdings. 7. In connection with an investigation then being conducted by the Of?ce of the Special Counsel the FBI sought and obtained ??om the Honorable Beryl A. Howell, Chief United States District Judge for the District of Columbia, three search warrants for emails and other content information associated with two email accounts used by Cohen, and one search warrant for stored content associated with an iCloud account used by Cohen. Speci?cally: 2017.08.02 rm.. a. On or about July 18, 2017, the FBI sought and obtained a search warrant for emails in the account -@grnail.com (the ?Cohen Gmail Account?) sent or received between January 1, 2016 and July 18, 2017 (the ?First Cohen Gmail Warrant?). b. On or about August 8, 2017, the FBI sought and obtained a search warrant for content stored in the iCloud account associated with Apple ID _@grnai1.com (the ?Cohen iCloud Account? and the ?Cohen iCloud Warrant?). warrant for emails in the Cohen Gmail Account sent or received between June 1, 2015 and November 13, 2017 (the ?Second Cohen Gmail Warrant?). d. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the account -- (the ?Cohen Account?) sent or received between the opening of the Cohen Account4 and November 13, 2017 (the ?First Cohen Warrant?). 8. The SCO has since referred certain aspects of its investigation into Cohen to the USAO, which is working with the New York Field Office. As part of that referral, on or about February 8, 2018, the SCO provided the USAO with all non?privileged emails and other content information obtained pursuant to the First Cohen Gmail Warrant, Second Cohen Gmail Warrant, and Cohen Warrant. On or about March 7, 2018, the SCO provided the USAO 4 Based on my review of this warrant and the affidavit in support of it, I know that the warrant did not specify a time period, but the af?davit indicated that, pursuant to court order, the service provider had provided non?content information for the Cohen Account that indicated that the account contained emails from the approximate period of March 2017 through the date of the warrant. 2017.03.02 011:5: with all non-privileged content obtained pursuant to the Cohen iCloud Warrant.5 A ?lter team working with the SCO had previously reviewed the content produced pursuant to these warrants for privilege. 9. On or about February 28, 2018, the USAO sought and obtained search warrants for emails in the Cohen Gmail Account and the Cohen IVIDCPC Account, among other accounts, sent or received between November 14, 2017 and February 28, 2018 (the ?Third Cohen Gmail Warrant? subject to an ongoing review for privilege by an SDNY ?lter team.6 10. The emails search warrants described above are referred to collectively as the ?Cohen Email Warrants.? 11. On or about April 7, 2018, the USAO and FBI sought and obtained a warrant for prospective and historical cellphone location information for Subject Device-1 and Subject Device-2. On or about April 8, 2018, the USAO and FBI sought and obtained authority to employ an electronic technique, commonly known as a ?trig ger?sh,? to determine the location of Subject Device-1 and Subject Device?2. I II. Probable Cause A. Overview 12. The United States Attorney?s Of?ce for the Southern District of New York and FBI are investigating, among other things, schemes by Target Subject Michael Cohen to defraud multiple banks from in or about 2016 up to and including the present, and to make an illegal 5 The SCO had previously provided a subset of this non-privileged content on or about February 2, 201 8. 6 On or about February 28, 2018 and April 7, 2018, the USAO and FBI sought and obtained Rule 41 search warrants authorizing the search of emails and content obtained pursuant to previously issued warrants for additional subject offenses. 8 2017.08.02 -: campaign contribution in October 2016 to then?presidential candidate Donald Trump. As noted, Cohen is an attorney who currently holds himself out as the personal attorney for President Donald Trump, and who previously served for over a decade as an executive in the Trump Organization, an international conglomerate with real estate and other holdings. 13. The investigation has revealed that Cohen has made af?rmative misrepresentations in and omitted material information from ?nancial statements and other disclosures that Cohen 77777 ofi??m?Aw?w? approximately $22 million in debt he owed on taxi medallion loans from the banks. As set forth in detail below, in these ?nancial statements, and in his oral and other written statements to these banks, Cohen appears to have intentionally misrepresented his ability to pay cash by failing to disclose cash he began receiving in 2017 from new consulting work; (ii) signi?cantly understated his total holdings of cash and cash equivalents; failedto disclose tens of thousands of dollars he received in interest income, and (iv) failed to inform the banks from which he was seeking debt relief that he had agreed to make a $3.8 million cash payment to a third party, - _in connection with _icquisition of the taxi medallions securing Cohen?s debt. By making these misrepresentations and material omissions, Cohen avoided making payments on his loans, and attempted to fraudulently induce the banks to relieve him of certain repayment obligations and personal guarantees that Cohen and his wife had signed. 14. Additionally, the investigation has revealed that shortly before the 2016 presidential election, Cohen made a payment of $130,000 from a limited liability corporation to Stephanie Clifford, an individual who is alleged to have had an extramarital affair with then?candidate Trump. This payment was made to Clifford in exchange for an agreement not to make any public disclosures about her alleged affair with Trump. As set forth below, there is 2017.08.02 probable cause to believe that Cohen made this payment to Clifford for the purpose of in?uencing the presidential election, and therefore that the payment was an excessive in?kind contribution to the Trump campaign. 15. Based on my review of emails obtained ?om the Cohen Email Warrants, information obtained pursuant to the iCloud Warrant, and documents produced pursuant to subpoenas, as well as my review of public sources, I have learned that Cohen has used the Subject ofhis?taxi??mw ~70 WG-- medallion debt, receive documents and/or conduct meetings related to his consulting work, receive documents and/or conduct meetings relating to his ?nances and assets, some of which, as noted above and as detailed ?nther herein, he has concealed ?om the banks in connection with the re?nancing of his taxi medallion debt, receive and send documents relating to his payment to Clifford, and house and operate electronic devices that were utilized in connection with, among other things, the taxi medallion transaction, Cohen?s consulting work, and his payment to Clifford. Speci?cally, as described below, Subject Premises-l likely contains evidence concerning Cohen?s taxi medallion loans, his negotiations with banks, his personal ?nances, his consulting work, his tax returns, and his payment to Clifford, as well as electronic devices containing such evidence, all of which constitute or contain evidence of the Subject Offenses. Additionally, as described below, Subject Premises=2 likely contains evidence relating to Cohen?s consulting work, his ?nances, and his payment to Clifford, as well as electronic devices containing such evidence. Subject Premises-3, as described below, likely contains evidence relating to Cohen?s assets and ?nances, including assets that may not have been disclosed to banks in connection with the re?nancing of Cohen?s taxi medallion debt or documents relating to such assets, and documents or evidence related to Cohen?s payment to Clifford. Subject Premises-4 likely contains electronic 10 2017.08.02 devices, including Subject Device-l and Subject Device-2, which themselves contain evidence of the Subject Offenses, including concerning Cohen?s taxi medallion loans, his negotiations with banks, his personal ?nances, his consulting work, his tax returns, and his payment to Clifford. Accordingly, and as set f01th in more detail below, there is probable cause to believe that the Subject Premises and Subject Devices will include evidence of the Subject Offenses. B. Probable Cause Regarding Subjects9 Commission of the Subject Offenses7 Tim (1) Cohen Statements to Sterling National Bank 16. As set forth in detail below, in 2014, Cohen, through LLCs controlled by him and his wife, Laura Cohen, entered into a series of loans from Sterling National Bank (?Sterling?) and the Melrose Credit Union (?Melrose?), secured by taxi medallions, for approximately $20 million. Though entered into by LLCs, the loans were also secured by personal guarantees in the names of both Cohen and his wife. Over time, as the taxi industry weakened and the medallions lost value, Cohen sought to renegotiate the terms of those loans and/or relieve himself ?'om their obligations, including the personal guarantees. As part of that effort, Cohen made a series of representations to Sterling and Meh'ose about his net worth, assets, available cash and income, among other things. Speci?cally, based on my review of records maintained by- Sterling and Melrose, and public sources concerning the taxi industry and the value of taxi medallions, as well as my palticipation in interviews with a Sterling executive vice-president (the ?Sterling Employee-1?) and two other 7 In the following recitation of probable cause, I frequently refer to phone calls or text messages involving Cohen. The text messages described herein as sent or received by Cohen were all sent or received-from the telephone numbers associated with Subject Device-l or Subject Device-2. The vast majority of the phone calls described herein made or received by Cohen were made or received by the telephone numbers associated with Subject Device?l or Subject Device-2, although in certain limited instances Cohen used a landline or other phone. 11 2017.08.02 Sterling employees (?Sterling Employee?2? and V?Sterling Employee?3?), 1 have learned, among other things, the following: a. Taxi medallions are small metal plaques af?xed to taxis. Without a medallion, it is illegal to operate a taxi in cities with medallion systems, such as New York City. Cohen and his wife own multiple LLCs that collectively own 32 taxi medallions (each LLC owns two medallions).8 Cohen?s purchase of these New York taxi medallions was originally ?nanced by ?e operator, and leased his medallions to a third party. That third party made payments to Cohen, who in turn used some of those proceeds to make his loan payments to Capital One. b. In early 2014, Cohen became a customer of Sterling when he sought to refinance a mortgage on a rental property that he owned. 111 or around April 2014, Cohen raised with Sterling the prospect of re?nancing his taxi medallion loans, which were then at Capital One. By in or about September 2014, Cohen began negotiating a lending transaction with Sterling that would allow Cohen to pay off his loans at Capital One and borrow more money from the then-increase in value of the medallions. According to Sterling Employee?1, in 2014, prior to the recent upheaval in the taxi a result of the emergence of ride-sharing services, such as Uber?taxi medallion loans were Viewed by banks and investors as safe, short term credits, as the market value of taxi medallions was consistently rising. Consequently, taxi medallion loans?like the loans held by Cohen?were frequently re?nanced at increasing amounts as the value of the medallions rose. According to Sterling Employee?1, borrowers typically cashed out the increase in the loan amount 8 One of these companies, Mad Dog Cab Corp, was jointly owned by Sondra Cohen, who I believe is Cohen?s mother. 12 2017.08.02 and used the additional funds for other purposes. Cohen appears to have followed this approach in 2014, when he agreed to re?nance his medallion loans for approximately $22 million, which?? according to letters from Capital One in Sterling?s ?les?was greater than his previous debt at Capital One Bank ($21 million, of which $14.6 million was a line of credit to Cohen). This allowed Cohen to cash out the proceeds from the transaction. c. Based on my review of records maintained by Sterling, I have learned that on or Coh'en? entere dinto?lo anagreements and promissory notes with Sterling for the principal sum of $1,375,000, with repayment due on December 8, 2016. Each loan was signed by Michael or Laura Cohen, depending on who was the sole shareholder of the LLC. The address listed for each of the LLCS was the address for Subject Premises-1 . The loans were also each secured by a security agreement, dated the same day, making the medallions collateral for the notes. To give Sterling additional security, Michael and Laura Cohen signed personal guarantees and confessions of judgment, giving Sterling the right to pursue collection against the Cohens? personal assets were their corporations to default under the loan agreements. The personal guaranty agreements stated that the LLCs had offices at the address for Subject Premises?1, and contained a notice provision that stated that any notices required by the agreements should be mailed to Subject Premises?1. In total, Sterling agreed to lend approximately $22 million to the Cohens? companies. (1. Pursuant to participation agreements, Sterling transferred 45 percent of Cohen?s taxi medallion debt to Melrose.9 9 Melrose, which had a business principally focused on taxi medallion loans, is now in conservatorship by the National Credit Union Administration 13 2017.03.02 e. In evaluating Cohen?s requested re?nancing of the taxi medallions, Sterling (and Melrose, consistent with its participation in the deal) conducted due diligence. At Sterling?s request, Cohen provided Sterling with a statement of ?nancial condition, dated August 1, 2014 (the ?August 2014 Financial Statement?), which indicated that Cohen had $100,740,000 in total assets, $23,550,000 in total liabilities, and a net worth of $77,190,000.10 From my review of a Sterling credit memorandum, dated September 29, 2014, I know that Sterling viewed the transaction iavorablybecause, accounting projected to be positive, the value of the collateral (as estimated by Sterling) exceeded $42 million, and the net worth of Cohen?who was the direct obligor under the guarantee agreements?-was over $77 million. An internal Sterling credit and risk rating analysis report, dated October 20, 2014, recommended approval of the loans for substantially the same reasons. f. Based on my review of records maintained by Sterling and public sources, I have learned that over time, the collateral backing Cohen?s loans (taxi medallions) lessened in value due to the rise in ride-sharing companies. Additionally, Cohen began falling behind on loan payments to Sterling and Melrose. Iknow from records maintained by Sterling and an interview with Sterling Employee?2 that, beginning in or around September 2015, Cohen told Sterling, in sum and substance, that the individual leasing Cohen?s medallions had fallen behind in making payments to Cohen, and that as a result, the cash ?ow ?rom his taxi medallions had been reduced, leaving him with a shortfall of approximately $16,000 each month. For instance, I have reviewed an email from Sterling Employee?2, dated September 9, 2015, summarizing a call with Cohenr? which according to the email and toll records for Cohen?s cellphone occurred on September 8, 10 Cohen subsequently provided Sterling with a revised statement of ?nancial condition, also dated August 1, 2014, which reported assets of $99,420,000, total liabilities of $23,550,000, and a net worth of $75,870,000. 14 2017.03.02 2015?during which Cohen told Sterling Employee-2, in sum and substance, about his cash ?ow problems and a shortfall of approximately $16,000. In that same email, Sterling Employee-2 commented that despite Cohen?s statements, his personal ?nancial information ?indicate[d] a strong ability to make up the difference in payments.? Cohen, however, according to Sterling Employee-2, pushed the bank for a reduction in Cohen? 3 payments. g. From my review of records maintained by Sterling and my participation in an interview with?Sterlmg again on September 28, 2015, and that during the call Cohen stated, in sum and substance, that the individual to whom Cohen leases the medallions had again reduced payments to Cohen. 1 know from my review of records maintained by Sterling that between in or about September 2015 and November 2015, Sterling raised the possibility?both internally and with Cohen?of Cohen posting his real estate holdings, personal residence, or some other collateral as additional security for the banks.11 According to these records, however, Cohen resisted these requests. From my review of loan documents and records maintained by Sterling, I know that in or about November 2015, as a result of I Cohen?s representation that he was not earning suf?cient returns on his medallions to cover interest payments, Sterling and Melrose agreed to amend their loans with Cohen by, among other things, reducing the interest rate Cohen paid to Melrose and extending the loan maturity date to December 8, 2017. h. I know from interviews with Sterling Employee?1 and Sterling Employee?2, as well as emails I have reviewed, that in or about October 2016, Cohen told Sterling Employee?1 that Cohen had a potential buyer of his taxi medallions, named ?who would agree to 11 Based on my review of property records, I know that on or about October 28, 2015, around the time period when Sterling raised the possibility of Cohen posting his personal residence?w- Subject Premises- l?as collateral, Cohen transferred Subject Premises?1 into a trust. 15 2017.03.02 assume Cohen?s debt with Sterling and Melrose. Based on my review of records maintained by Sterling, as well as the interviews with Sterling Employee?1 and Sterling Employee-2 referenced above, I know that by or before October 2016, Cohen had entered into negotiations to sell his sixteen corporate taxi medallion entities to for the balance of the loans, which at the time was $21,376,000. I know from my review of records maintained by Sterling, and my participation in an interview with Sterling Employee?2, that as a _??Sterling requested that Cohen make a substantial principal payment on the loan, of approximately one million dollars, prior to the transfer. Cohen rejected this request initially. But on or about January 31, 2017 Cohen told Sterling Employee?l, in sum and substance, that he would make a one million dollar principal reduction payment in order to move forward with the medallion transfer deal with -. Indeed, in an email sent by Cohen to Sterling Employee-2 on or about February 22, 2017, Cohen con?rmed that he ?agreed to pay down 1 million from the loan amount.? i. Pursuant to the participation agreements between Sterling and Melrose, Sterling was required to secure Melrose?s agreement to participate in the transfer of the taxi medallion debt ?'om Cohen to On or about April 17, 2017, Sterling sent a memorandum to Melrose summarizing the terms of the proposed transaction, and noting the requirement that Melrose agree to the terms. On 01' about May 2, 2017, Sterling Employee?1 told that Meh?ose had agreed to the deal in principle, and that Sterling would be sending the parties a term sheet shortly. j. In order for the banks to conduct diligence and evaluate the proposed transaction fully, they requested financial information from the parties. On or about June 7, 2017, Sterling 16 2017.08.02 Employee-1 emailed Cohen to request an ?updated personal ?nancial statemen completed jointly with Cohen?s Wife, and Cohen?s most recent federal income tax return. On or about June 8, 2017, Cohen emailed Sterling Employee-1 a Sterling personal ?nancial statement form that had been ?lled out by hand, which referenced a statement of ?nancial condition, dated May 1, 2017 (the ?May 2017 Financial Statement?) that was also attached. The May 2017 Financial Statement included a cover letter from Cohen?s accountant, Jef?ey Getzel, stating, in sum and substance, that W??finf'o?rmati?on? 1111113 statementrcame-??om- eohen?and?th athetzelrrhad notveen?rmeddts?accuracy?? or completeness. The May 2017 Financial Statement stated that Cohen had total assets of $41,955,000, total liabilities of $39,130,000, and a net worth of $2,825,000. The May 2017 Financial Statement indicated that Cohen?s assets were comprised of $1,250,000 in cash, $26,155,000 in closely held companies (such as the taxi medallion entities and his real estate holdings), $3,200,000 in real estate investments, and his $11,000,000 personal residence.12 Based on my review of reports of law enforcement interviews of Sterling Employee-1, I have learned that Sterling Employee-1 reviewed the May 2017 Financial Statement with Cohen to, among other things, verify its accuracy, and Sterling Employee-1 asked Cohen about speci?c line items on the ?nancial statement, including the cash amount, value of medallions, and total liabilities. Cohen stated to Sterling Employee?1, in sum and substance, that the May 2017 Financial Statement was accurate. 1. On or aboutiAugust 16, 2017, Sterling Employee-l emailed Cohen and 1- attaching a non?binding term sheet memorializing the potential transaction between 12 Based on my review of Cohen?s ?nancial statements, 1 know that the precipitous decline in assets from his 2014 ?nancial statement to his 2017 ?nancial statements can be explained primarily by reported depreciation in the value of Cohen?s real estate assets and medallion investments. 17 2017.08.02 Sterling, Melrose, Cohen, and - The term sheet included a cover letter addressed to Cohen at Subject Premises-1. The parties negotiated the provisions of the term sheet and, on or about September 5, 2017, Sterling Employee-1 sent 1?1nd Cohen a copy of the executed term sheet. According to the term sheet,_would borrow $20,000,000 from Sterling and Melrose, to be secured by the medallions that -7vas to acquire ??om Cohen. m. As partof the agreement, is what would remain after the $20,000,000 payment on the outstanding loan balance) would be repaid by Cohen and the two banks, with Cohen paying ?fty percent and the banks dividing the remaining half of the balance. Based on my review of an internal Sterling credit memorandum, dated October 4, 2017, the parties reached a preliminary agreement that Cohen would pay $632,956 of the remaining $1,265,912 principal loan balance, and Sterling and Melrose would absorb $357,167 and $275,789, respectively, in the form of charge-offs. According to Sterling Employee- 1, Sterling was willing to divide therepayment of the outstanding principal balancew?despite its prior insistence that Cohen make a principal pay?down of at least one million dollars?because Cohen represented on a telephone call with Sterling Employee?1, in sum and substance, that he had insufficient liquidity to pay the ?ill outstanding principal balance. As part of the agreement, Sterling and Melrose also agreed to relieve Cohen and his wife of the personal guarantees that they made on behalf of the LLCs. Thus, after completing the ?-transaction, Cohen would no longer have had any outstanding obligations to Sterling or Melrose. 11. Based on my review of emails sent by Sterling employees, I have learned that because the transaction between the parties was subject to full credit undeiwriting by Sterling and Melrose (as well as Melrose?s regulators at NCUA), in August and September 2017, Sterling 18 2017.08.02 - required and requested additional ?nancial statements and tax returns for Cohen and for its credit underwriting process. In response to Sterling?s requests, on or about September 25, 2017, Cohen emailed Sterling Employee?2 a copy of his 2016 tax return. I The tax return listed Cohen?s mailing address as Subject Premises-1. Additionally, on or about October 5, 2017, Cohen re-sent Sterling Employee-2 a copy of his May 2017 Financial Statement. A day later, on October 6, 2017, Cohen emailed Sterling Employee-2 a statement of ?nancial condition, dated September A 0. Like the May 2017 Financial Statement, the September 2017 Financial Statement included a cover letter from Jeffrey Getzel, Cohen? accountant, stating, in sum and substance, that the information in the statement came from Cohen, and that Getzel had not con?rmed its accuracy or completeness. The September 2017 Financial Statement stated that Cohen had total assets of $33,430,000, total liabilities of $45,630,000, and a negative net worth of $12,200,000.13 Notably, unlike Cohen?s May 2017 Financial Statement, the September 2017 Financial Statement represented to Sterling that Cohen had a negative net worth. The September 2017 Financial Statement indicated that Cohen?s assets were comprised of $1,250,000 in cash, $17,630,000 in closely held companies (including the taxi medallion entities and his real estate holdings),14 $3,200,000 in real estate investments, and his $11,000,000 personal residence (which, for the ?rst 13 Based on my review of Cohen?s ?nancial statements, I know that this further decline in assets can be explained primarily by reported depreciation in the value of Cohen?s real estate assets and medallion investments. 14 Notably, the September 2017 Financial Statement valued each of Cohen?s thirty?two New York taxi medallions at approximately $180,187.50, which was considerably less than the $650,000 valuation ascribed to each medallion in the sheet. 19 2017.08.02 time, he indicated was held by a trust).15 The September 2017 Financial Statement included assets and liabilities not held in Cohen?s name, such as various entities associated with his taxi medallions and some of his real estate investment entities. p. From my participation in an interview with Sterling Employee~2, and my review of records maintained by Sterling, I have also learned that around the time Cohen provided Sterling with these ?nancial statements?Le, in or around September 2017?Cohen stopped paying montlilyrloan?paym?ents on his 2, Cohen informed Sterling, in sum and substance, that he had insufficient funds to pay the principal and interest payments on his medallion loans. By in or about December 2017, Sterling and Melrose had not been paid approximately $276,937.92 in principal and interest payments on the medallion loans. Based on Cohen?s ?nancial condition as conveyed in the September 2017 Financial Statement, and his delinquency in making payments to Sterling, among other things, the bank?s credit underwriting committee determined (and memorialized in a December 2017 memorandum) that the Cohen??- transaction was favorable for the bank that is, that-would be a better borrower than Cohen. 1 q. 011 or about December 26, 2017, Sterling sent Cohen a demand letter requesting the immediate receipt of past-due loan payments. The demand letter was addressed to Cohen at Subject Premises-l. On December 29, 2017, Sterling sent Cohen a letter stating that he was in default under the loans between Sterling and Cohen?s medallion corporations. The notice of default was addressed to Cohen at Subject Premises?l. Cohen did not make an immediate payment on the loans, but instead sent an email to Sterling Employee?l on or about January 24, 2018, 15 Based on my review of property records maintained by the City of New York, and my participation in an interview with Getzel, I know that in 2015, Cohen transferred his residence to a trust. He did not disclose that transaction to Getzel or Sterling until in or about September 2017. 20 2017.08.02 stating that during the closing of the Cohen=- transaction, Cohen would ?bring all payments up to date as well as deposit the payoff differential.? Cohen also requested by email on January 24, 2018, that at the closing of the Cohen-?-transaction, Sterling provide a letter stating that all of Cohen?s debts have been satis?ed and that Cohen?s personal guarantees of the medallion loans had been terminated. r. The Cohen-'-transaction, however, did not close. On or about January emailed-attorneySWforSterling? and? stated~thatiatithisw time there is no deal with Michael Cohen. Some of the numbers have changed and we are not prepared to go forward.? 7 s. Based on my participation in the interview with Sterling Employee-2 and my review of records maintained by Sterling, I know that after the Cohen--;leal fell apart, Sterling assigned Cohen?s loans to Sterling Employee?3, who specializes in collecting on defaulting loans. From my participation in an interview with Sterling Employee-3, my review of telephone call notes taken by Sterling Employee-3, and my review of telephone records, I know that Sterling Employee-3 spoke several times to Cohen on or about January 30, 2018 about paying down and/or restructuring Cohen?s outstanding taxi medallion loans. On the calls, which in total lasted more than an hour, Cohen stated in sum and substance that he did not have more than $1,525 0,000 to pay toward the medallion loans. On the call, in the course of reviewing the failed Cohen-- transaction, Sterling Employee?3 questioned Cohen about the price -vas to have paid for each medallion, and whether there was a side agreement between Cohen and -. Cohen denied that there was any side agreement with t. On or about January 31, 2018, Cohen emailed Sterling Employee-3 and proposed paying $500,000 to bring the loans current and $750,000 to bring the principal balance to 21 2017.03.02 $20,500,000. Cohen also suggested revised interest payment amounts. The signature block on the email indicated that Cohen?s address was the address for Subject Premises-=2. On or about January 31, 2018, Sterling Employee-3 responded to Cohen and stated, in sum and substance, that Cohen would need to pay the entirety of the overdue payments and pay down the principal balance of the loan to $20,000,000 (in total, a payment of approximately $1,750,000), and would need to make larger interest payments. 11. 011an ?b?i??alTl?? 01 8; A and?pl?opo 36 77"" I ?[p]ayn1ent of $1.250m which ALL can be used to pay down principal, if [Sterling] will waive past due amounts,? but stated do NOT have more than the $1 .250m.? (Emphasis in original.) Cohen also stated, in sum and substance, that he had insuf?cient ?nancial resources to post additional collateral or pre??md payments. The signature block on the email indicated that Cohen?s address was the address for Subject Premises?2. Based on my participation in an interview with Sterling Employee?3, I have learned that since January 30, 2018, Sterling has continued to renegotiate the medallion loans with Cohen based on Cohen?s representations about his current ?nancial position. In particular, according to Sterling Employee?3, Cohen and Sterling have an agreement in principal to restructure Cohen?s loans based in part of Cohen?s agreement to make a principal payment of approximately $750,000, to make a payment of $500,000 to become current on interest payments, and to post $192,000 in cash collateral for his future payments on the loan. Cohen also agreed to pledge an interest he had in a property, Sterling Employee-3 has stated that had Cohen indicated he had more than $1,250,000 available to him, Sterling would have, among other things, negotiated for a larger reduction to the principal amount of the loan. 22 2017.08.02 (ii) Cohen Made Material Misrepresentations About His Finances in Banks Cohen Concealed from Sterling and Melrose Cash Derived from Consulting Work 17. As set forth in detail below, despite multiple written and oral representations by Cohen to Sterling (and, by extension, Melrose?) that he had insuf?cient funds to pay down the principal balance of the medallion loans, make interest payments, or pay past-due amounts, it appears that between 2016 and the present, Cohen opened and maintained bank ankw in consulting payments in these accounts, which he did not disclose to Sterling. Cohen set up these accounts and received these funds during the very period in which he made disclosures to Sterling about his personal ?nances (including his assets and liabilities) and his ability to make payments on the medallion loans. In these disclosures to Sterling?and despite being asked about these bank accounts by his accountant?Cohen misled the bank by claiming he had insuf?cient liquidity to satisfy his obligations or meet the bank?s demands, while withholding information about these ongoing revenue streams and liquid ?nancial assets at First Republic. 18. Speci?cally, based on my review of documents and bank records produced pursuant to a subpoena by First Republic, and my participation in and review of reports of interviews with a First Republic sales manager (?First Republic Employee?1?) and a First Republic senior managing director (?First Republic Employee?2?), I have learned, among other things, the following: 16 Based on my review of a report of an interview conducted with an employee of Melrose, I have learned that, pursuant to the participation agreement between Sterling and Melrose, Cohen? 5? ?nancial statements and other records in Sterling?s possession were forwarded to Melrose so that Melrose could make a determination as to whether to approve of the Cohen; transaction. Based on my review of reports of interviews with Melrose employees, 1 also know that Cohen called employees at Melrose regarding the 23 2017.08.02 2. a. Cohen and his wife have been customers of First Republic since approximately June 2011. Cohen controls several checking and loan accounts at First Republic, some in his own name and others in the names of corporate entities. According to First Republic?s know~your- customer records on Cohen,17 his primary physical address is the address for Subject Premises-1. b. On or about October 26, 2016, in Manhattan, New York, Cohen opened a new checking account at First Republic in the name of Essential Consultants LLC (the ?Essential Consultants Account?). Cohen was the only . account opening documents, the primary address for Essential Consultants LLC was the address for Subject Premises-1. When Cohen opened the Essential Consultants Account, First Republic Employee-1 conducted an in?person interview of Cohen. In response to a series of know-your- customer questions about the purpose of the accountw?the answers to which First Republic Employee-1 entered into a f01m18??Cohen stated, in sum and substance, that he was opening Essential Consultants as a real estate consulting company to collect fees for investment consulting work, and all of his consulting clients would be domestic individuals based in the United States. Cohen also stated, in sum and substance, that his purpose in setting up the account was to keep the revenue ?'om his consulting business?which he said was not his main source of income?separate from his personal ?nances. As set forth below, there is probable cause to believe that Cohen?s statements about the intended purpose of the account and source of funds for the account were false. Speci?cally, as described below, the account was not intended to receive?and does not 17 Certain fmancial institutions are required to conduct such procedures pursuant to the Bank Secrecy Act and its implementing regulations. See 31 U.S.C. 5318; 31 CPR. 1020.220. 13 First Republic Employee-1 first ?lled out the form on the day he interviewed Cohen, October 26, 2016. On or about December 19, 2016, at the request of bank compliance personnel, First Republic Employee-1 updated the form to add more detail about Cohen?s statements. 24 2017.08.02 appear to have received?money in connection with real estate consulting work; in addition, the account has received substantial payments from foreign sources. c. I know from my review of First Republic bank records that were scheduled by an FBI forensic accountant that after Cohen opened the Essential Consultants Account, Cohen received payments into that account ??om foreign businesses and entities that do not re?ect the stated client pro?le for the residential and commercial real?estate consulting services. Speci?cally, from my review following: i. Beginning on or about January 31, 2017, Cohen began receiving payments of $83,333 into the Essential Consultants Account from an entity called Columbus Nova LLC. According to public sources, Columbus Nova is an investment management ?rm controlled by Renova Group, an industrial holding company based in Zurich, Switzerland that is controlled by Russian national Viktor Vekselberg. From January 2017 to August 2017, the Essential Consultants Account received seven payments totaling $583,332.98 from Columbus Nova LLC. ii. Beginning on or about April 5, 2017, the Essential Consultants Account began receiving payments from Novartis Investments, SARL, which I believe to be the in?house ?nancial subsidiary of the Swiss pharmaceutical company Novartis International AG (?Novartis?). Between April 2017 and February 2018, the Essential Consultants Account received eleven wire payments from a Swiss bank account held in the name of Novartis, each in the amount of $99,980, for atotal of $1,099,780. Beginning in or about April 2017, the Essential Consultants Account started receiving wire payments from a bank account associated with the telecommunications company Inc. Speci?cally, on or about April 14, 2017, sent $100,000 to the 25 2017.08.02 Essential Consultants Account and, from in or about June 2017 to in or about January 2018, the Essential Consultants Account received ten $50,000 payments ?'om In total, sent $600,000 to the Essential Consultants Account. iv. On or about May 10, 2017, June 9, 2017, July 10, 2017, and November'27, 2017, the Essential Consultants Account received four deposits in the amount $150,000 (totaling $600,000) from a bank account in South Korea. The account holder from which the money was sent is Korea Aerospace produces and sells fixed?wing aircraft, helicopter aircraft, and satellites to the United States Department of Defense, among other customers. v. On or about May 22, 2017, the Essential Consultants Account received a $150,000 deposit from an account at Kazkonunertsbank, a Kazakhstani bank. The listed account holder at Kazkommertsbank was a second Kazakhstani bank named BTA Bank, A0. A message accompanying the wire payment indicated that the payment was a consulting fee as per Inv DD May 10, 2017 consulting agreement DD 08 05 2017 CNTR 2 08/05/2017.? vi. In total, from on or about January 31, 2017 to on or about February 1, 2018, the Essential Consultants Account received approximately $3,033,112.98 in transfers and checks from the aforementioned entities. As of on or about anualy 10, 2018, the balance in the Essential- Consultants Account was $1,369,474.23. Cohen?s withdrawals from the Essential Consultants account reveal that it was used for largely personal purposes, including to pay, among other things, American Express bills and fees from ?the Core Club,? a private social club in New York. d. On or about April 4, 2017, Cohen opened another new checking account at First Republic, this one in the name of Michael D. Cohen Associates, PC. (the Accoun 26 2017.03.02 Cohen was the only authorized signatory on the account. According to account opening documents, the primary address for Account was the address for Subject Premises?1. Among other things, the Account received ten wire transfers and one check from an account in the name of Squire Patton Boggs, a law ?rm. As noted above, Subject Premises?2 is located inside the New York of?ce of Squire Patton Boggs. In total, from on or about April 5, 2017, to on or about January 2, 2018, the Account received $426,097.70 in deposits, and never disclosed any of the balance in the Essential Consultants or accounts to Sterling during the negotiations with respect to the - transaction or the subsequent loan re?nancing negotiations, including in his May 2017 Financial Statement and September 2017 Financial Statement. 19. Based on my review of emails that were seized pursuant to the Cohen Email 'Warrants, and my review of reports of interviews with employees of and Novartis, it appears that the aforementioned payments to the Essential Consultants Account and Account were for political consulting work, including consulting for international clients on issues pending before the Trump administration. Speci?cally, from my review of emails ?'om the Cohen Gmail Account, the Cohen Account, and public sources, I have learned the following: a. On or about April 28, 2017, Cohen sent an email to an individual whom I believe is af?liated with KAI. In the email, Cohen attached a ?Consulting Agreement? between KAI and Essential Consultants dated as of about May 1, 2017. The agreement indicates that Essential Consultants had the address of Subject Premises?2. The document indicates that Essential Consultants would render ?consulting and advisory services, as requested? by KAI, and that KAI would pay Essential Consultants ?a consulting fee of One Million Two Hundred Thousand 27 2017.03.02 US Dollars,? disbursed through eight $150,000 installments between May 2017 and December 2017. I have also reviewed invoices in amounts of $150,000 that Cohen emailed to an individual whom I believe is af?liated with KAI. At the top of the invoices the address listed for Essential Consultants is the address for Subject Premises?2. b. On or about May 8, 2017, Cohen sent an email to an individual whom I believe is af?liated with BTA Bank. The signature block on Cohen?s email listed ?Essential Consultants and ect~PremisesLm 2. In the email, Cohen attached a document purp01ting to be a ?Consulting Agreement? between BTA Bank and Essential Consultants dated as of about May 8, 2017. The agreement indicates that Essential Consultants had the address of Subject Premises?2. The document indicates that Essential Consultants would render ?consulting and advisory services? to BTA Bank, and that BTA Bank would pay Essential Consultants ?a consulting fee of One Million Eight Hundred Thousand US Dollars,? disbursed through payments of $150,000. On or about May 10, 2017, Cohen sent an email to an employee of BTA Bank, and attached to the email an invoice to BTA Bank in the name of Essential Consultants, with the address of Subject Premises- 2. The invoice contemplated a $150,000 payment to Essential Consultants for a consulting fee.? 0. On or about January 23, 2017, Cohen appears to have entered into a consulting agreement with which contemplates that Essential Consultants ?shall render consulting and advisory services to and that would ?advise [Essential Consultants] of those issues . and matters with respect to which Services desires [Essential Consultants]?s assistance and advice.? The agreement indicates that Essential Consultants had the address of Subject Premises- 1. The contract calls for ?to pay the Consultant for his services . . . a consulting fee of Fifty 28 2017.08.02 Thousand ($50,000) Dollars . . . per month.? Based on my review of reports of intelviews with employees, I have learned that retained Cohen to consult on political issues, including net neutrality, the merger between and Time Warner, and tax reform. d. On or about March 1, 2017, Cohen appears to have entered into a contract between Novartis and Essential Consultants, which provides that Essential Consultants will ?provide consulting and advisory services to Novartis on matters that relate to the repeal and replacement of the Affordable Care Act in [Essential Consultants] and Novartis.? The contract provides for a ?consulting fee of One Million Two Hundred Thousand ($1,200,000) US dollars,? to be paid to Essential Consultants in equal installments over the course of a year. Based on my review of reports of interviews with Novartis employees, I have learned that Novartis retained Cohen to provide political consulting services and to gain access to relevant policymakers in the Trump Administration. e. In or about February 2017, Cohen began negotiating the terms of a ?strategic alliance? with Squire Patton Boggs. On or about March 4, 2017, Squire Patton Boggs emailed Cohen a ?strategic alliance agreement.? Under the terms of the agreement, Cohen agreed to generate business for the law ?rm, and Squire Patton Boggs agreed to pay to Cohen ?an annual strategic alliance fee of $500,000, payable in twelve (12) equal installments.? Squire Patton Boggs also agreed to provide Cohen with ?dedicated and segregated of?ce space in [Squire Patton Boggs?s] New York and Washington DC. of?ces, which of?ce space shall be physically separate from [Squire Patton Boggs?s] of?ces and have locked doors and its own locked ?le cabinets.? On or about April 3, 2017, Squire Patton Boggs announced on its website that is had formed a ?strategic alliance? with Michael D. Cohen Associates and would ?jointly represent clients.? 29 2017.03.02 20. Despite the signi?cant amount of money that Cohen received into the Essential Consultants Account and the Account, and the cash balance in both accounts, Cohen did not disclose that information to Sterling or Melrose. Speci?cally, based on my review of documents provided by Getzel (as noted above, Cohen?s accountant at the time), my participation in an interview with Getzel, and my review of notes and I have learned the following: aT?In? Cohenwati Sub - the meeting, Cohen told Getzel, in sum and substance, that he had set up a law practice called Michael D. Cohen Associates RC, and a consulting company called Essential Consultants LLC. Cohen told Getzel, in sum and substance, that he expected to earn $75,000 per month in connection with his law practice, and that he expected gross revenues for the consulting business to be between ?ve and six million dollars annually. b. In or about October 2017, if not earlier, Getzel was preparing a personal fmancial statement for Cohen. On or about October 6, 2017, Getzel sent an email to Cohen in which Getzel wrote that ?[a]ttached is a draft of the new PFS as of September 30, 2017? and attached a draft of the September 2017 Financial Statement. The draft statement re?ected that as of September 30, 2017, Cohen had only $1,250,000 in cash, total assets of approximately $33,430,000 (comprised of taxi medallion interests, real estate interests, and his personal residence and propeity), and liabilities of approximately $45,630,000, leaving him purportedly over $12 million in debt. In the?same email, Getzel questioned Cohen, in sum and substance, about the fact that the financial statement did not list any value associated with either the Essential Consultants Account or the Account: did not add any value for you[r] two operating entities - Michael D. Cohen Associates 30 2017.08.02 uni. POC [sic] and Essential Consultants LLC. Please advise whether or not these should be disclosed and what value.? On or about October 6, 2017, Cohen called Getzel by telephone?which is re?ected on toll records for Cohen?s cellphone_and told Getzel, in sum and substance, not to include Essential Consultants or in the September 2017 Financial Statement because they had no value. On or about October 6, 2017, following the call with Getzel, Cohen, using the Cohen Account, responifed to (jetzel?s directed Getzel to make any changes to his cash position as listed in the September 2017 Financial Statement. In a letter dated October 6, 2017, addressed to Getzel, Cohen stated, have reviewed the attached statement of ?nancial condition and it to be correct and consistent with the representations that I made to your ?rm. The attached is an accurate re?ection of my assets, liabilities and net worth (de?cit) as of September 30, 2017.? Attached to that letter was the September 2017 Financial Statement, which, as noted above, was then transmitted to Sterling in connection with the proposed taxi medallion transaction between Sterling, Cohen, and 21. Based on my review of a report of an interview with Sterling Employee-1, I have learned that Cohen did not disclose his income stream ?'om Essential Consultants to Sterling Employee?1 or, to his knowledge, anyone else at Sterling. According to Sterling Employee-1, knowledge of such an income stream would have affected Sterling?s demands during the negotiations, particularly with respect to the amount of a principal paydown of Cohen?s debt. Cohen Understated His Available Cash 22. In addition to withholding the existence of his Essential Consultants income ?om Sterling and Melrose, it appears that Cohen also substantially understated his available cash and cash equivalents in his fmancial disclosures. Speci?cally, I know ?om my review of the September 31 2017.08.02 2017 Financial Statement that Cohen provided to Sterling that Cohen represented that he had $1,250,000 in cash as of September 30, 2017. I also know that on or about January 30, 2018, in a telephone call with Sterling Employee?3, and on February 1, 2018, in an email to Sterling Employee?3, Cohen represented that he did not have more than $1,250,000 in cash. But, from my review of a summary of bank records that were scheduled by forensic accountants, I have learned that Cohen had approximately $5,000,000 in cash and cash equivalents as of September 30, 2017. Additionally, as of ?F?bruary I, equivalents. Speci?cally, ?om my review of the account schedule and bank records, I have learned the following: a. Cohen has three checking and/or savings accounts at Capital One Bank, one of which is in his wife?s name. As of September 30, 2017, Cohen had $1,105,680.35 in his savings account, and $1,262,982.29 in total in the three accounts at Capital One Bank. As of February 1, 2018, Cohen had a total of $1,3 89,245.78 in these accounts. b. Cohen has three accounts at Morgan Stanley in his name. As of September 30, 2017, the combined total in cash and cash equivalents in those three accounts was $1,270,600.41. As of February 1, 2018, Cohen had $1,284.996.13 in these accounts. c. As of September 30, 2017, Cohen had $260,689.18 in an account at Signature Bank. As of February 1, 2018, Cohen had $261,517.55 in this account. d. In addition to the Essential Consultants Account and Account at First Republic, Cohen also had two joint checking accounts with Laura Cohen at First Republic. In total, as of September 30, 2017, Cohen had at least $1,876,209.27 in total in his four accounts at First Republic. As of February 1, 2018, Cohen had $3,332,992.95 in these accounts. 32 2017.08.02 ?ii! - e. Cohen has an account at Bethpage Credit Union with $25,931.39 in it as of September 30, 2017. f. As of September 30, 2017, Cohen had $17,542.54 in accounts at Sterling. g. Cohen has two accounts at TD Bank?one in his name and one held jointly with his wife. Cohen also has a safety deposit box at TD Bank?Subject Premises?3. The safety deposit box was opened on December 13, 2017 in the names of Michael and Laura Cohen. at Capital One Bank, City National Bank, Signature Bank, Sterling Bank, Bethpage Credit Union, First Republic, and Morgan Stanley. As of February 1, 2018, Cohen had $6,268,732.59 in his accounts at Capital One Bank, City National Bank, Signature Bank, First Republic, and Morgan Stanley.? 23. Accordingly, based on the foregoing, it appears that Cohen?s written and oral representations to Sterling and Meh'ose that he did not have more than $1,250,000 were false, and that Cohen withheld information regarding approximately $5 million in funds from Sterling and Melrose in order to secure favorable terms in his renegotiation of his medallion loan. Based on my participation in an interview with Sterling Employee=~2, and my review of reports of interviews with Sterling Employee-1 and two Meh?ose employees, it is my understanding that that Sterling and Melrose would view Cohen?s understating of his assets as material to its decision whether to renegotiate Cohen?s medallion loans and on what terms, or to its decision whether approve of the transfer of those loans to - 19 Based on my review of the account schedules described above, Iknow that, as of the date of this af?davit, the account balances for TD Bank have not yet been included in the schedule for either date and the account balances for Sterling National Bank and Bethpage Credit Union have not yet been included in the schedule for February 1, 2018. Thus, to the extent that these accounts have positive balances, Cohen?s total balances in fact were even higher on these dates. 33 2017.08.02 hf?In-total; asofS eptemberS 0 8-rinihisr accounts7777 7 7 7 7 Cohen Has Unreported Interest Income 24. It appears that Cohen also hid ?rom Sterling interest income that he was receiving in connection with a six million dollar loan he made to another individual. Speci?cally, I know from my review of the May 2017 Financial Statement and September 2017 Financial Statement that Cohen provided to Sterling that Cohen did not disclose that he had made a note receivable in the amount of approximately $6 million, or that he was earning approximately $60,000 per month in 011 a ankrec that were reviewed by another law enforcement agent, my review of property records and documents obtained pursuant to the Cohen Email Warrants, and my participation in an interview with Getzel, I have learned the following: a. Based on my review of property records, I have learned that on or about March 12, 2012, Cohen agreed to lend _?1pproximately $2,000,000.20 It appears that the promissory note was unsecured by any real property. On or about April 28, 2014, Cohen and - amended the promissory note, and restructured the loan to increase the principal amount to approximately $5,000,000. Under the terms of the amended promissory note, the loan was secured by_ apartment in Sunny Isles Beach, Florida. On or about April 8, 2015, Cohen and -restated the promissory note to increase the principal amount to $6,000,000.21 b. Based on my review of a copy of the restated note, which was obtained pursuant to the Cohen Email Warrants, I have learned that under the terms of the amended and restated ?1 learned from Getzel that 21 The note states that the loan IS to husband and Wlfea jointly and severally. For ease of reference, I refer simply to ?-1erein. 34 2017.08.02 promissory note, Cohen?s loan to _s an interest~only loan, and that the principal balance of the loan bears interest at an annual rate of 12.25 percent. I also know that the amended and restated promissory note includes a schedule of payments that require -to pay Cohen approximately $61,250 per month beginning in April 2015 and ending in April 2019. The note also requires t11a1-'epay the principal balance of $6,000,000 on April 28, 2019. c. Based on my review of bank records, I have learned that, consistent with the terms the amende d?and?re statedvpromiss ory~ Anoter- ,7 77-1?- approximately $61,250 since April 2015. Speci?cally, based on my review of records maintained by Capital One Bank, I have learned that from April 2015 to October 2015, Cohen received checks ?'om an entity called?. totaling $61,250 per month, which he deposited into his personal bank account at Capital One Bank.22 It appears from my review of bank records and public sources that 1-13 the owner of From my review of records maintained by Capital One Bank, I have also learned that since October 2015, Cohen has received checks from an entity called totaling $61,250 per month, which he deposited into his personal bank account at Capital One Bank. It appears from my review of bank records and public sources that -.s also the owner of 1- ?In total, it appears that Cohen receives approximately $735,000 per year in interest payments ?om - d. Based on my review of Cohen?s May 2017 and September 2017 Financial Statements, my review of his 2015 - and 2016 tax returns obtained via subpoena and from the Cohen 'Email Warrants, and my participation in an interview with Getzel, I have learned that Cohen did 22 In April 2015, Cohen received a pro-rated payment. For all months thereafter, the total payment equaled $61,250, but made the payment in multiple checks. 35 2017.08.02 not disclose this interest income he was receiving from-to Sterling or Melrose, or list it on his tax returns. I have also learned that while this interest income is taxable, Cohen did not tell Getzel??his accountant?about the income, and Getzel only learned about the income because he began doing _taxes in 2017.23 25. . Accordingly, based on the foregoing, it appears that Cohen?s representations to Sterling and Melrose that he did not have more than $1,250,000 were false, and that Cohen withheld information relating to the 1nterest incomeWh'em secure favorable terms in his renegotiation of his medallion loan. Cohen Had a Side Agreement With 26. As set forth in detail below, during the course of Cohen?s negotiations to sell his interest in taxi medallions and the associated debt to Cohen not only misrepresented his ?nancial position to Sterling, but also failed to disclose a side agreement he had negotiated with_: it appears that '_.greed to pay an above?market price for Cohen?s taxi cab medallions, and in exchange, Cohen agreed to pay _tpproximately $3 .8 million in cash. Speci?cally, from my review of documents produced pursuant to a subpoena by Sterling, and my participation in interviews with Sterling Employee-l, Sterling Employee?2, and Sterling Employee?3, I have learned, among other things, the following: a. On or about September 5, 2017, an executed term sheet was circulated by Sterling Employee?l to Cohen and - The term sheet listed Cohen?s address as the address for Subject Premises?l. According to the term sheet, _would borrow $20,000,000 ?om Sterling and Melrose, to be secured by the medallions that _was to acquire from 23 Accordingly, this interest income?Which should have been reported as such on Cohen?s tax returns?is included herein in calculations of Cohen?s true cash position. 36 2017.08.02 Cohen. At a price of $20 million for thirty-two taxi medallions, the proposed transaction valued each medallion as worth $625,000. The term sheet also contemplated a $1,265,913 pay?down of the principal balance of the loan. The term sheet made no mention of a $3.8 million payment Cohen to or any other form of payment or ?nancial transaction between the parties. b. Additionally, an internal Sterling credit memorandum, dated October 4, 2017, describing the terms of the and the new loan to i?did not mention any payments from memorandum also noted that the ?loan amount of indicates a purchase price per medallion? but ?it is recognized that this is not in line with current market values.? Indeed, according to an internal Sterling memorandum dated February 5, 2018, in the month of January 2018, taxi medallions sold for amounts ranging from $120,000 to $372,000. According to Sterling Employee-1 and Sterling Employee-2, they were never told that -1greed to a purchase price of $625,000 in exchange for a lump sum payment from Cohen, or that Cohen would make any payment to - c. On or about January 30, 2018, Sterling Employee-3 asked Cohen whether Cohen had a side agreement with pay -a sum of money for entering into the medallion transaction, Sterling Employee-3 asked Cohen about such an arrangement because, according to Sterling Employee-3, the price that -was paying for each medallion appeared to be well above the market price. Cohen stated, in sum and substance, that he had no side agreement?and never had a side agreementH?with - 27. While Cohen and_ did not disclose any payment from Cohen to _in communications with Sterling, it appears that such a payment was contemplated. Indeed, based on my review of records maintained by Getzel, and my participation in an interview 37 2017.03.02 with Getzel, I have learned the following, in substance and in part, regarding the proposed side payment ??om Cohen to? a. On or about September 19, 2017, Getzel prepared a memorandum for Cohen entitled, ?Sale of NYC Medallion Entities and Debt Assumption? (the ?Getzel Memorandum?). The Getzel Memorandum summarized the proposed transaction between Cohen and in part, as follows: ?Michael and Laura Cohen will transfer ownership of their 13 NYC medallion entities to a Buyerkwho will-"assume their b?k?irl?debte?dnessmpon the debt portfolio of the 13 entities by $500,000 and a cash payment to the Buyer of b. According to Getzel, Cohen told him the parameters of the deal, including the payment of $3,800,000 to -but Getzel did not know where Cohen was going to obtain $3,800,000 to pay - As noted above, Cohen had more than $5,000,000 in cash and cash equivalents as of September 2017, but had only disclosed in his September 2017 Financial Statement that he had $1.25 million in cash. I 28. Based on my review of records maintained by Sterling (as well as Melrose, the bank with the participating interest in the loans) and reports of interviews of representatives of Sterling (and Melrose), I have seen no evidence that Sterling, Melrose, or any other financial institution involved in the potential deal with Cohen and -was aware of the planned $3.8 million side payment from Cohen to- The Illegal Campaign Contribution Scheme 29. The USAO and FBI are also investigating a criminal violation of campaign finance laws by Michael Cohen. As set forth below, there is probable cause to believe that Cohen made 24 The reference to thirteen medallions appears to be an error by Getzel. Cohen and his wife together owned sixteen corporations, which in turn owned 32 taxi medallions. 38 2017.03.02 an excessive in-kind contribution to the presidential election campaign of then?candidate Donald Trump in the form of a $130,000 payment to Stephanie Clifford, an individual who was rumored to have had an extramarital affair with Trump, in exchange for her agreement not to disclose that alleged affair. As set forth below, there is probable cause to believe that this payment was intended to keep Clifford ?om making public statements about the rumored affair on the eve of the 2016 presidential election, and thus constitutes a campaign contribution in excess of the applicable limit. 307.7 From my revrew a. In or around October 2011, there were rumors published on the gossip websites heDirty. com that Trump had had an extramarital affair with Clifford, an adult ?lm actress whose screen name is Stormy Daniels, in or around July 2006. In or about October 2011, Life (it Style Magazine, a tabloid sold in supermarkets, also published an article, based on the report in heDirty.com, alleging an affair had occurred between Trump and Clifford. Both Trump and Clifford, through their representatives, issued denials in response to the articles. b. Speci?cally, on or about October 11, 2011, Keith Davidson, who identi?ed himself as Clifford?s attorney, sent a cease and desist letter to heDirty.com, demanding that the article regarding Trump and Clifford be removed from the website. Additionally, on or about October 12, 2011, Cohen, who was then Executive Vice?President and Special Counsel to the Trump Organization, stated to News that ?[t]he totally untrue and ridiculous story . . . emanated from a sleazy and disgusting website. . . . The Trump Organization and Donald J. Trump will be bringing a lawsuit . . . [and] Mr. Trump and the Trump Organization would like to thank and commend Stormy Daniels and her attorneys for their honesty and swift actions.? 31. On or about June 16, 2015, Trump formally launched his 2016 presidential campaign. On or about May 4, 2016, Trump became the presumptive Republican Party nominee 39 2017.03.02 for president, and on July 19, 2016, Trump of?cially became the nominee. Based on my review of public sources, I have learned that while it does not appear that Cohen had an official title as part of the Trump campaign, on multiple occasions Cohen made public statements on behalf of Trump or his campaign. For instance, on or about August 18, 2016, Cohen appeared on CNN to defend Trump?s polling numbers. 32. On or about October 7, 2016, he Washington Post published online a video and accompanying audio-Vin which Trump rEferred to Women in terms? in a 2005 conversation with Billy Bush, who was then the host of Access Hollywood. The following day, on October 8, 2016, Trump appeared in a video in which he stated, among other things, ?I?ve said and done things I regret and words released today on this more than a decade old video are one of them. Anyone who knows me knows these words don?t re?ect who I am. I said it. I was wrong and I apologize.? Based on my review of public sources, I also know that representatives of the Trump Campaign stated, in sum and substance, that the Access Hollywood comment was an old and isolated incident. 33. Based on my review of public sources, including an article published in Slate magazine by a reporter who interviewed Clifford, I have learned that around this same time, in or about October 2016, Clifford was in discussions with Good Morning America show and Slate magazine, among other media sources, to provide these media outlets with her statement about her alleged relationship with Trump. According to the article in Slate, which the author based on conversations with Clifford over the telephone and by text message, Clifford wanted to be paid for her story or be paid by Trump not to disclose her accusation. As Cohen summarized in a 2018 email obtained pursuant to the Cohen Email Warrants: ?In October 2016, I was contacted 40 2017.08.02 by counsel for Ms. Clifford stating that news outlets, including ABC News, were pursuing the 2011 story of an alleged affair between Mr. Trump and Ms. Clifford.? 34. From my review of telephone toll records25 and information produced pursuant to the iCloud Warrant and Cohen Email Warrants, I have learned that in the days following the Access Hollywood video, Cohen exchanged a series of calls, text messages, and emails with Keith Davidson, who was then Clifford? attorney, David Pecker and Dylan Howard of American Media, andeope- Hicks; who-wasithen? W, ireimwem?e?en- press secretary for Tlump?s presidential campaign. Based on the timing of these calls, and the content of the text messages and emails, I believe that at least some of these communications concerned the need to prevent Clifford ?om going public, particularly in the wake of the Access Hollywood story. In particular, I have learned the following: a. On October 8, 2016, at approximately 7:20 pm, Cohen received a call from Hicks. Sixteen seconds into the call, Trump joined the call, and the call continued for over four minutes.27 Based on the toll records that the USAO has obtained to date, I believe that this was the ?rst call 25 My attribution of certain telephone numbers to certain individuals as described in this affidavit is based on my review of the vCard (virtual contact ?le) and text messages obtained from Cohen?s telephone pursuant to the iCloud Warrant. 26 Pecker is President of AMI and, according to his own statements in public reports, a personal friend of Trump. Howard is the chief content of?cer of AMI, who according to public records reports directly to Pecker. 27 I believe that Trump joined the call between Cohen and Hicks based on my review of toll records. Speci?cally, I know that a call was initiated between Cohen?s telephone number and Trump?s telephone number at the same time the records indicate that Cohen was talking to Hicks. After the CohenuTrump call was initiated, it lasted the same period of time as the Cohen-Hicks call. Additionally, the toll records indicate a and then Trump?s telephone number, which, based on my training and experience, means that the call was either transferred to Trump, or that Trump was added to the call as a conference or three?way call participant. In addition, based on my conversations with an FBI agent who has interviewed Hicks, I have learned that Hicks stated, in substance, that to the best of her recollection, she did not learn about the allegations made by Clifford until early November 2016. Hicks was not specifically asked about this three?way call. 41 2017.08.02 Cohen had received or made to Hicks in at least multiple weeks, and that Cohen and Trump spoke about once a month prior to this date speci?cally, prior to this call on October 8, 2016, Cohen and Trump had spoken once in May, once in June, once in July, zero times in August, and twice in September. b. Approximately ten minutes after the call ended, Hicks and Cohen spoke again for about two minutes. David Pecker (as noted above, the President of American Media Inc., or AMI) and they connected for thilty seconds. Approximately four minutes later, Cohen called Pecker again and they spoke for more than a minute. Three minutes after ending his call with Pecker, Cohen received a call ?om Dylan Howard (as noted above, the Chief Content Of?cer of AMI), and they spoke for approximately a minute. According to toll records, it does not appear that Cohen and Howard spoke regularly prior to October 8, 2016, as it had been over a month since they had called each other. d. At 7:56 approximately eight minutes after his call with Howard ended, Cohen called Hicks and they connected for two minutes. At approximately the same time this call ended, Cohen received a call from Pecker, and they spoke for about two minutes. At 8:03 about three minutes after ending his call with Pecker, Cohen called Trump, and they spoke for nearly eight minutes. e. At 8:39 pm. and 8:57 Cohen received calls from Howard and spoke to him for about four and six minutes, respectively. At 9:13 about ten minutes after Cohen and Howard hung up from the second of these calls, Howard sent Cohen a text message that said: ?Keith will do it. Let?s reconvene tomorrow.? Based on my involvement in this investigation, I 42 2017.03.02 believe that when Howard wrote ?Keith,? he was referring to Keith Davidson, the attorney for Stephanie Clifford. At 3:31 now on October 9, 2016, Cohen sent Howard a text message in response that said: ?Thank you.? Eight minutes later, Cohen sent Howard atext message that said: ?Resolution Consultants LLC. is the name of the entity 1 formed a week ago. Whenever you wake, please call my cell.? f. The following day, on October 10, 2016, at 10:58 am, Howard sent a text message to Cohen and Davidson, which business opportunity. Spoke to the client this AM and they?re confirmed to proceed with the opportunity. Thanks. Dylan. Over to you two.? At 12:25 pm, Davidson sent Cohen atext message that stated: ?Michael if we are ever going to close this deal In my opinion, it needs to be today. Keit Davidson and Cohen then spoke by phone for about three minutes. Based on my participation in this investigation, I believe that when Howard wrote that the ?client? was ?con?rmed to proceed with the opportunity,? he was referring to Clifford?s agreement in principle to accept money from Cohen in exchange for her agreement not to discuss any prior affair with then-candidate Trump.28 g. Based on my review of records obtained pursuant to the Cohen Email Warrants, I know that on or about October 10, 2016, Clifford and Davidson appear to have signed a ?side letter agreemen that stated it was an exhibit to a ?con?dential settlement agreement and mutual release? between ?Peggy Peterson? and ?David Dennison.? The purpose of the document, 28 As set forth below, AMI was also involved in a payment to model Karen McDougal. However, because these communications were in close temporal proximity to the events involving the negotiation of a payment to Clifford, the execution of the agreement with Clifford, and the payment of money to Clifford, I believe that these communications were related to Clifford. Additionally, based on my review of public statements by McDougal, I have learned that she negotiated an agreement with AMI several months prior to these communications between Cohen and Pecker, Howard, and Davidson; 43 2017.03.02 according to the agreement, was to de?ne the ?true name and identity? of persons named by pseudonym in ?con?dential settlement agreement and mutual release.? The side letter agreement specifies the identity of ?Peggy Peterson? to be Clifford, but the space for ?Dennison?s? identity is blank. The agreement also includes a signature page for ?Peterson,? ?Dennison,? and their attorneys. The signature page is signed by ?Peterson? and his attorney, Davidson, but the document is unsigned by ?Dennison? and his attorney. Based on my involvement in this investigation, I believe that in order to facilitate the closing of a deal between Davidson?s client and Cohen or his client on October 10, 2016. 35. It appears that on October 13, 2016, and the days that followed, Cohen took steps to complete a transaction with Davidson, including attempting to open an account from which Cohen could transfer funds to Davidson. Speci?cally, from my review of toll records, information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, records maintained by First Republic, as well as my participation in interviews with First Republic employees, I have learned the following: a. On the?morning of October 13, 2016, at 8:54 am, Cohen sent Pecker atext message that stated: need to talk to you.? At 9:06 am, Pecker sent a text message to Cohen that stated, called please call me back.? The tolls between Cohen and Pecker do not show a telephone call between 8:54 am. and 9:06 am. However, based on my review of text messages, I have learned that Cohen and Pecker communicate with each other over Signal, which is an communications cellphone application that allows users to send text messages and make calls. 44 2017.08.02 .: um! b. At 9:23 Cohen sent an email that stated ?call me? to First Republic Employee? 2. The email attached documents from the Secretary of State of Delaware indicating that Cohen had formed a limited liability company called ?Resolution Consultants on September 30, 2016. As noted above, ?Resolution Consultants? is the name of the entity that Cohen had told Howard he had formed recently after Howard said Davidson would ?do it.? At 10:44 am, Cohen called First Republic Employee-2 and told him, in sum and substance, that he needed an account in the name of ?ResolutiOn Consultants? - - -- on the checks written out of the account. Later that day, another employee at First Republic emailed Cohen account opening paperwork to complete. Cohen returned the account opening documents partially completed, but failed to provide a copy of his driver? 5 license or passport, and did not respond to the employee?s question of how he wanted to fund the account. As a result, the account was never opened. c. On October 17, 2016, Cohen incorporated Essential Consultants LLC in Delaware. That same day, he filed paperwork to dissolve Resolution Consultants LLC. 36. Despite these steps taken by Cohen, it appears that the negotiation between Cohen and Davidson was not progressing sufficiently fast enough for Davidson or his client, Clifford, and they threatened to go public with Clifford?s allegations just days before the presidential election. Speci?cally, based on my review of toll records, information obtained pursuant to the iCloud Warrant, and public sources, I know the following: a. According .to an article in The Washington Post, which quoted emails sent from Cohen?s email account hosted by the Trump Organization, on October 17, 2016, Davidson emailed Cohen and threatened to cancel the aforementioned ?settlement agreement2017.08.02 if Cohen did not complete the transaction.29 According to the article, Davidson sent Cohen a second email later in the day that stated in part, ?Please be advised that my client deems her settlement agreement canceled and void.? At 4:00 pm. that day, Cohen called Davidson and they spoke for over ?ve minutes. b. Cohen?s 4:00 pm. call with Davidson and/or Davidson?s threats to cancel the ?settlement agreemen appear to have touched off a ?urry of communications about the settlement agreement and whether i. At 4:43 Howard sent Cohen a text message that stated: ?I?m told they?re going with DailyMail. Are you aware?? One minute later, Cohen responded: ?Call me.? Based on my involvement in this investigation, I understand Howard?s text to mean that he heard that Clifford was going to take her story of an extramarital affair with Trump to the Daily Mail, a tabloid newspaper. ii. At 4:45 Howard called Cohen and they spoke for over two minutes. Moments later, Davidson and Cohen spoke for about two minutes. At 5:03 Cohen attempted to call Trump, but the call only lasted eight seconds. This was Cohen?s ?rst call after he spoke with Davidson. iv. At 5:25 Cohen texted Howard, stating: v. At 6:44 pm, Howard responded to Cohen?s text, stating: ?Not taking my calls.? Cohen responded one minute later: ?You?re kidding. Who are you trying to reach?? Howard responded one minute later: ?The ?agent.?? Based on my involvement in this 29 Due to the partially covert nature of the investigation to this date, the USAO has not requested documents ?om the Trump Organization or Davidson, and thus does not possess the email referenced in this article. . 46 2017.08.02 investigation, I understand Howard?s text messages to mean that he attempted to contact Davidson about the matter involving Clifford, but that Davidson was not taking Howard?s calls. vi. At 6:49 pm, Cohen called Howard and they spoke for nearly four minutes. 0. The following day, on October 18, 2016, heSmokingGun. com, a website that publishes legal documents and mugshots, published an article called: ?Donald Trump and the Porn Superstar,? which alleged that Trump had an extramarital affair with Clifford. However, the article noted that Clifford had declined to comment-IN .. 37. On or about October 25, 2016, the communications between Cohen, Davidson, Howard and Pecker picked up again, apparently concerning a transaction involving Clifford. Speci?cally, based on my review of toll records, information obtained pursuant to the COhen Email Warrants and iCloud Wan'ant, as well as my review of public sources, I have learned the following: a. On October 25, 2016, at 6:09 Howard sent Cohen a text message stating: ?Keith calling you urgently. We have to coordinate something on the matter he?s calling you about or its [sic] could look awfully bad for everyone.? One minute later, Davidson sent Cohen a text message stating ?Call me.? Cohen and Davidson called each other several times over the next half hour but appear not to have connected. At 6:42 pm, Cohen and Davidson spoke for about eight minutes. At 7:11 pm, they spoke for another two minutes. b. The next morning, on or about October 26, 2016, at 8:26 am, Cohen called Trump and spoke to him for approximately three minutes. At 8:34 am, Cohen called Trump again and connected for a minute and a half. c. At approximately 9:04 a.m.~less than thirty minutes after speaking with Trump?? Cohen sent two emails to the person who had incorporated Resolution Consultants and Essential Consultants for him, and stated ?can you send me asap the ?ling receipt? and then, in the second 47 2017.03.02 email, ?for Essential Consultants That person responded with the filing receipt two minutes later at 9:06 am. and with the certi?cation of formation 23 minutes later, at 9:27 am. d. Shortly after that, Cohen contacted First Republic Employee-2 and told him, in sum and substance, that he decided not to open an account in the name of ?Resolution Consulting? and instead would be opening a real estate consulting comp any in the name of ?Essential Consultants.? Cohen told First Republic Employee-2 that he was at Trump Tower, and wanted to go to a First Republic branch across the street to open the. account, so Republic Employee?1, a preferred banker at that branch, assist Cohen. At 11:00 First Republic Employee-1 called Cohen. I know from my participation in an interview with First Republic Employee?1, that around the time of the call he Went to Cohen?s of?ce in Trump Tower?? on the same ?oor as the Trump Organizationwand went through account opening questions, including know your customer questions, with Cohen. In response to a series of know?your? customer questions about the purpose of the account??the answers to which First Republic Employee-l entered into a form?Cohen stated, in sum and substance, that he was opening Essential Consultants as a real estate consulting company to collect fees for investment consulting work, and all of his consulting clients would be domestic individuals based in the United States. Based on my review of records obtained ?om First Republic, it appears that this account (the ?Essential Consultants Account?) was created at a time between 11:00 am. and 1:00 pm. e. At 1:47 Cohen called Davidson and they spoke for approximately two minutes. At approximately 1:49 Davidson emailed Cohen wiring instructions for an attorney client trust account at City National Bank. f. After the Essential Consultants Account was opened on October 26, 2016, Cohen transferred $131,000 from a home equity line of credit that Cohen had at First Republic to the 48 2017.08.02 Essential Consultants Account. Following the transfer, at approximately 4:15 pm. on October 26, 2016, First Republic Employee-2?s assistant emailed Cohen at his Trump Organization email address to tell him that the funds had been deposited into the Essential Consultants Account. Cohen forwarded that email to the Cohen Gmail Account and then forwarded it to Davidson. g. At 6:37 pm, Cohen asked Pecker by text message, ?Can we speak? Important.? Cohen called Pecker at 6:49 pm. and connected for thirty seconds. At 6:57 Cohen sent Howard a text message, stating: ?Please call me. and connected for about thirty seconds. At 7:06 Cohen called Pecker again and they Spoke for nearly thirteen minutes. At 7:24 pm, Howard sent a text message to Cohen that: ?He said he?d call me back in 20 minutes. I told him what you are asking for his [sic] reasonable. I?ll get it sorted.? Approximately an hour later, at 8:23 pm, Howard told Cohen by text message to ?check your Gmail for email from my private account.? In an email sent at 8:23 pm. by Howard to Cohen and Davidson, with the subject line ?Con?rmation,? Howard stated, ?Thank you both for chatting with me earlier. Continuing agreement on: Executed agreement, hand?signed by Keith?s client and returned via overnight or same?day FedEx to Michael, - Change of agreement to re?ect the correct LLC, Transfer of funds on Thursday AM to be held in escrow until receipt of agreement.? After receiving that email, at approximately 8:27 pm, Cohen asked Howard by text message, ?Can you and David [Pecker] give me a call.? Howard responded: ?David is not around I think. I?ll call.? At 8:28 pm, Howard called Cohen and they spoke for three minutes. 3 8. On October 27, 2016, Cohen made a payment to Davidson of $130,000?with the funds intended for Clifford?for the purpose of securing her ongoing silence with respect to the allegations that she had an extramarital affair with Trump. Speci?cally, based on my review of 49 2017.03.02 toll records, bank records, and information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, I have learned the following: a. At 9:47 Cohen sent Davidson an email, stating: ?Keith, kindly con?rm that the wire received today, October 27, 2016 shall be held by you in your attorney?s trust account until such time as directed for release by me, in writing. Additionally, please ensure that all papelwork contains the correct name of Essential Consultants LLC. I thank you in advance for your assistance and look forward to hearing from you later.? b. At approXimately 10:01 according to records provided by First Republic Bank, Cohen completed paperwork to wire $130,000 ?om the Essential Consultants Account-? which had been funded a day prior from Cohen?s home equity line of credit??to the attorney client trust account at City National Bank that Davidson had speci?ed in the wiring instructions he sent to Cohen. The wire transfer was made sho1tly thereafter. c. At 10:02 Davidson responded to Cohen?s email from 9:47 stating: con?rm that I will work in good faith that no funds shall be disbursed unless until the plaintiff personally signs all necessary settlement paperwork, (the form of which will match the prior agreement). The settlement docs will name the correct corporation, (Essential Consultants LLC). Plaintiff? signature will be notarized and returned to you via FedEx. Only after you receive FedEx will I disburse. Fair?? d. At 10:50 First Republic Employee?1 sent Cohen an email con?rming that the payment had been sent and providing him with the wire number. 39. On October 28, 2016, and the days that followed, Cohen ?nalized the transaction with Davidson. Speci?cally, based on my review of toll records, information obtained pursuant to the iCloud Warrant, public sources, and bank records, I know the following: 50 2017.08.02 a. On October 28, 2016, at 11:48 Cohen spoke to Trump for approximately ?ve minutes. Beginning at 1:21 Cohen attempted a series of phone calls to Davidson, Pecker, and Howard throughout the day, although it appears he may only have connected with Howard. b. Later that day, at approximately 7:01 Davidson stated to Cohen by text message that ?all is AOK. I should have signed, notarized does on Monday. You should have them on Tuesday.? Cohen thanked him and said hope we are good.? Davidson responded, assure you. We are very good.? Howard also texted Cohen at 7308 ?KEitlT [Davi?dson?fsays? we are good.? Cohen then responded to Howard and ?Excellent? to Davidson. At approximately 10:30 Cohen spoke to Hicks for three minutes. c. On October 31, 2016, Cohen called Howard at 8:22 pm. and they spoke for over three minutes. At 8:32 Cohen received text messages from both Howard and Davidson. Howard said: ?You?ll have paperwork tomorrow says Davidson said: ?We are AOK. You will be receiving a package tomorrow.? Cohen responded ?Thank you? to Howard and ?Thanks Keith. Will call you then? to Davidson. From my involvement in this investigation, I believe Davidson was referring to a signed nondisclosure agreement when he told Cohen that he would receive a package. d. Based on my review of court ?lings that became public in 2018, I have learned that on or about October 28, 2016, LLC and/or David Dennison? entered into a ?con?dential settlement agreement and mutual release? with ?Peggy Peterson,? pursuant to which ?Peterson? agreed not to disclose certain ?con?dential information pertaining to [Dennison]? in exchange for $130,000. The agreement provided that would wire the funds to ?Peterson? s? attorney, who would then transfer funds to ?Peterson.? Cohen signed the agreement on behalf of 51 2017.08.02 The agreement stated that the address for Which was later referred to in the agreement as ?Essential Consultants, was Cohen?s residence. e. Consistent with the ?con?dential Settlement agreement and mutual release,? on or about November 1, 2016, Davidson transferred $96,645 from his attorney client trust account at City National Bank to a bank account in Clifford?s name. The Wire had the annotation ?net settlement.? On the same day, at approximately 9:48 am. Davidson sent Cohen a text message with a picture of a FedEx delivery con?rmation, stating that at approximately 9:09 am. a package shipped by Davidson the previous day had arrived for Cohen at his Trump Organization address. On the same day, at approximately 6:14 pm, Davidson sent Cohen an email with an audio ?le attached and said ?Give this a lesson [sic] and then call me.? The audio attachment was titled ?Stormy.mp3? and was a ?ve?minute recording of Davidson interviewing Clifford about recent public allegations made by an adult ?lm star named Jessica Drake regarding her alleged past affair with Trump; in the recording, Clifford explained the reasons she believed that Drake was not credible. Less than an hour later, at approximately 7:05 pm, Cohen called Trump, but it appears that they did not connect. Cohen then called a telephone number belonging to Kellyanne Conway, who at the time was Trump?s campaign manager. They did not connect. At approximately 7:44 pm, however, Cohen received a return call from Conway, which lasted for approximately six minutes. 40. On November 4, 2016, just three days after the Clifford transaction was completed and just four days before the presidential election, the Wall Street Journal published an article alleging that the National Enquirer had ?Shielded Donald Trump? ??om allegations by Playboy model Karen McDougal that she and-Trump had an affair. The article alleged that AMI had agreed to pay McDougal to bury her story. McDougal, like Clifford, had been represented by Davidson. 52 2017.08.02 Based on my review of toll records, information obtained pursuant to the Cohen EmailWarrants and iCloud Warrant, and public sources, it appears that Cohen spoke frequently to Davidson, Howard, Pecker, and Hicks around the time of this article?s publication?just days before Election Day?about the importance of preventing the McDougal and Clifford stories from gaining national traction. Speci?cally, I have learned the following: a. Between 4:30 and 8:00 pm. on November 4, Cohen communicated several times ?Ii! -.. ""W?iivitli ari?stauce?at approEi?n?ElY4f49??mTC6hen sent Howard a text message with a screenshot of an email forwarded to him by another Trump Organization lawyer. The forwarded email was from a Wall Street Journal reporter, and asked for comment from Trump andlor the campaign on the story. Cohen also spoke with Hicks several times, including shortly before and/or after calls with Pecker, Howard and Davidson. Indeed, at approximately 7:33 using different cellphones subscribed to him, Cohen appears to have been talking to Davidson and Hicks at the same time. b. At approximately 8:51 pm, Cohen sent Howard a message, stating: ?She?s being really dif?cult with giving Keith a statement. Basically went into hiding and unreachable.? One minute later, Howard responded: ?I?ll ask him again. We just need her to disappear.? Cohen responded, ?She definitely disappeared but refuses to give a statement and Keith cannot push her.? At approximately 8:55 pm, Howard responded to Cohen?s text: ?g?Let?s let the dust settle. We don?t want to push her over the edge. She?s on side at present and we have a solid position and a plausible position that she is rightfully employed as a columnist.? Based on my involvement in this investigation, I believe Cohen and Howard were referring to Karen McDougal when they were discussing ?she? and ?her.? Additionally, I believe Howard?s statement that ?we have . . . a 53 2017.03.02 plausible position that she is rightfully employed as a columnist? was a reference to the fact that AMI had given McDougal payments for her role as a purported columnist for the company. 0. At approximately 8:58 pm. on November 4, 2016, Howard attempted to reassure Cohen about the effect of the forthcoming Wall Street Journal article, texting, think it?ll be ok pal. I think it?ll fade into the distance.? Cohen responded, ?He?s pissed.? Howard wrote back, ?I?m pissed! You?re pissed. Pecker is pissed. Keith is pissed. Not much we can do.? Based on my involvement investigation, libelieve Cohen was referring to "Trump when he stated ?he? pissed.? Cohen asked Howard at approximately 9:00 p.111. how the Wall Street Journal could publish its article if ?eveiyone denies.? Howard responded, ?Because there is the payment from It looks suspicious at best.? d. At approximately 9:03 pm, Hicks called Cohen and they spoke for two minutes. At approximately 9:11 pm, Cohen called Howard and spoke to him for five minutes. At approximately 9:15 Hicks called Cohen and they spoke for nearly seven minutes. Again, Cohen used different phones for these two calls, such that he appears to have been on both calls for about a minute of overlap. At approximately 9:32 pm, Cohen texted Pecker, ?The boss just tried calling you. Are you free?? A minute later, Cohen texted Howard, ?Is there a way to ?nd David quickly?? e. At approximately 9:50 pm, the Wall Street Journal alticle was published online. Howard and Hicks both sent web links for the article to Cohen. Over the next half hour, Cohen and Howard exchanged several text messages commenting on how the story came across. The next morning on November 5, 2016, at approximately 7:35 Cohen texted Hicks, ?So farI see only 6 stories. Getting little to no traction.? Hicks responded, ?Same. Keep prayingil It?s working!? Cohen wrote back, ?Even CNN not talking about it. No one believes it and if necessary, I have a 54 2017.08.02 statement by Storm denying everything and contradictingthe other porn stars statement. I wouldn?t use it now or even discuss with him as no one is talking about this or cares!? Based on my involvement in this investigation, I believe Cohen was referring to the above-referenced recorded audio statement by Clifford that he obtained from Davidson, and was stating that such a statement could be used to in?uence potential'negative media relating to Trump, but was unnecessary at that time. Based on a text message from Hicks to Cohen, I believe that later that morning, Pecker spoke to Trump. 41. On or about November 8, 2016, Trump won the election for President of the United States. 42. On or about January 12, 2018, the Wall Street Journal ?rst reported that Cohen arranged a payment to Clifford. On or about January 22, 2018, Common Cause, a government watchdog group, ?led a complaint with the Federal Election Commission, alleging that Cohen had violated campaign ?nance laws by making the payment to Clifford. Based on my review public sources following that report, as well as emails obtained pursuant to the Cohen Email Warrants, I have learned the following: a. On or about January 23, 2018, the day after Common Cause ?led its complaint, Cohen began emailing himself drafts of statements describing his payment to Clifford. Additionally, on January 23, 2018, Cohen emailed the following draft of that statement to an individual who appears to be writing a book on Cohen?s behalf: In October 2016, I was contacted by counsel for Ms. Clifford stating that news outlets, including ABC news, were pursuing the 2011 story of an alleged affair between Mr. Trump and Ms. Clifford. Despite the fact that both parties had already denied the allegation, as Mr. Trump?s longtime special counsel and protector, I took it upon myself to match the offer and keep the story from breaking. I knew the allegation to be false, but I am also a realist who understands that just because something is false doesn mean that it doesn?t create harm and damage. I could not allow this to 55 2017.03.02 occur. I negotiated a non?disclosure agreement with Ms. Clifford?s counsel and tendered the funds. I did this through my Delaware LLC and transferred personal funds to cover the agreement. I was not reimbursed any monies from Mr. Trump, the Trump Organization, any third party or the Presidential campaign. At no point did I ever advise Mr. Trump of my communications or actions regarding this agreement. As outlandish and unusual as this may appear, the Trumps have been like family to me for over a decade. It?s what you do for family. (Emphasis added.) Based on my involvement in this investigation, I believe that the above email is an acknowledgement that the allegation of the affair had existed for some time . .the 2011 Story. . but that Cohen was motivated to ?keep the story ?om breaking? again in October2016. b. On or about February 13, 2018, Cohen said in a statement to The New York Times that ?Neither the Trump Organization nor the Trump campaign was a party to the transaction with Ms. Clifford. The payment to Ms. Clifford was lawful, and was not a campaign contribution or a campaign expenditure by anyone.? Cohen declined to answer follow~up questions including whether Trump had been aware of the payment, why Cohen made the payment, or whether similar payments had been made to other people. c. On or about February 14, 2018, Cohen was asked by The New York imes whether Trump had reimbursed him, whether he and Trump had made any arrangement at the time of the payment, or whether he had made payments to other women. Cohen stated in response, can?t get into any of tha On or about February 14, 2018, Cohen also stated to The Washington Post that: ?In a private transaction in 2016, I used my own personal funds to facilitate a payment of $130,000 to Ms. Stephanie Clifford. Neither the Trump Organization nor the Trump campaign was a party to the transaction with Ms. Clifford, and neither reimbursed me for the payment, either directly or indirectly.? 43. On or about March 9, 2018, Cohen stated to ABC News that ?the funds were taken from my home equity line and transferred internally to my LLC account in the same bank.? 56 2017.03.02 44. Accordingly, for the foregoing reasons, there is probable cause to believe that Cohen committed violations of the Campaign Finance Offenses by making an in?kind contribution to Trump or the Trump campaign in the form of a $130,000 payment to Clifford on the eve of the election. Indeed, while he denies having given an unlawful contribution, in his own statements Cohen has admitted that he paid $130,000 of his ?personal funds? to Clifford and that the payment occurred less than two weeks before the election, as Trump was facing negative media allegations about his behavior toward women, even t?o?glr'allegatrors of ?a?niaffairrbetWeeanrump-andw Clifford existed since 2011. In addition, the communication records set forth above make evident that Cohen communicated with members of the Trump campaign about his negotiation with Clifford?s attorney and the need to preclude Clifford from making a statement that would have re?ected negatively on the candidate in advance of the forthcoming election. C. Probable Cause Justifying Search of the Subject Premises and Subject Devices 45. Based on the foregoing, my review of records produced pursuant to subpoenas and the Cohen Email Warrants, and the iCloud Warrant, and my training and experience, there is probable cause to believe that the Subject Premises and Subject Devices have been used in furtherance of the Subject Offenses and are likely to contain instrumentalities, evidence, and fruits of the Subject Offenses. Speci?cally, there is probable cause to believe that Cohen permanently resides at Subject Premises?1 and, at least in part, works at both Subject Premises-1 and Subject Premises?2, and that those locations contain evidence relating to the Sterling taxi medallion transaction, Cohen?s assets, Cohen?s consulting work for Essential Consultants LLC, and his payment to Clifford. Additionally, there is probable cause to believe that Subject Premises-S contains evidence of Cohen?s assets and his payment to Clifford. Finally, there is probable cause to believe that Subject Premises?4, in which Cohen is temporarily residing, contains electronic 57 2017.08.02 devices, including Subject Device-l and Subject Device-2, which, in turn, contain evidence of the Subject Offenses, such as evidence relating to the Sterling taxi medallion transaction, Cohen?s assets, Cohen?s consulting work for Essential Consultants LLC, and his payment to Clifford. 46. First, there is probable cause to believe that Cohen lives and operates his businesses, at least in part, at Subject Premises?1. Specifically, from my review of property records, I know that Michael Cohen and Laura Cohen own (in trust) Subject Premises?l. From my review of Cohen?s tax r?etums, fknow he ect-PremisessilfAdditionally, from my review of emails produced pursuant to the Cohen Email Warrants, I know that Cohen routinely refers to Subject Premises-1 as his home. For example, on or about September 28, 2017 and October 6, 2017, Cohen emailed individuals that his home address is the address for Subject Premises-l. I also know from my review of emails that Cohen receives package delivery notifications that list Cohen?s address as the address for Subject Premises-l. Cohen has also provided the address of Subject Premises?l as the address for Essential Consultants and Michael D. Cohen Associates, PC. For example, the certi?cates of incorporation and account opening documents at First Republic for both entities list their addresses as the address for Subject Premises-l. See supra 18(b), 18(d). The consulting agreement between Essential Consultants and also indicated the address for Essential Consultants is the address for Subject Premises- 1. See supra 19(c). 47. There is also probable cause to believe that Subject Premises-1 is likely to contain instrumentalities, evidence, and ?uits of the Subject Offenses, Specifically, from my review of emails produced pursuant to subpoena and the Cohen Email Warrants and iCloud Warrant, as well as my training and experience, I know the following: 58 2017.08.02 a. According to records maintained by Sterling, the address for all of Cohen?staxi medallion is the address for Subject Premises-1. See supra 16(c). Additionally, the medallion loan documents indicate that any mailings related to the loans should be sent to Subject Premises-1. See id. Based on my training and experience, as well as my review of public sources, I know that individuals keep records of properties and assets in which they have ownership interests. Accordingly, I submit that Subject Premises?1 likely contains evidence of Cohen?s ownership of the taxi medallion transaction with Sterling in 2014 to re?fmance the medallion loans that were then with Capital One Bank. b. From my review of records maintained by Sterling, I also know that Sterling addressed documents relating to the -transaction and Cohen?s attempts to modify the terms of the medallion loans to Subject Premises-1. For instance, Sterling addressed the transaction term sheet, see supra 1] 16(1), and its demand letter and notice of default, see supra 16(q), to Subject Premises-1. Accordingly, Subject Premises~1 likely contains evidence concerning the -transaction and Cohen?s negotiations with Sterling. Some of those records?such as records relating to a payment from Cohen to -#~were concealed from Sterling and cannot be obtained via subpoena to Sterling. Additionally, even Where documents were sent to Cohen by Sterling (and therefore are available ?'om Sterling via subpoena), the fact that they may be found in Subject Premises-l will be relevant to Cohen? possession or knowledge of the documents. c. From my review of recOrds maintained by First Republic, I know that Cohen provided the address for Subject Premises?l as the mailing addresses for the Essential Consultants Account and Account. See supra 18(b), 18(6). Accordingly, it is likely that Subject 59 2017.08.02 Premises-l contains records relating to the Essential Consultants Account and Account, including, among other things, account opening documents, bank statements, documents provided as part of the know?your-customer process, any notes made by Cohen when he was opening the accounts, wire transfer records, and canceled checks. Even where these records can be obtained from First Republic, the fact that they may be found in Subject Premises?l will be relevant to, among other things, Cohen?s ownership of the accounts, or his knowledge of transactions or the existence of funds in accounts. d. Based on my review of records maintained by Capital One Bank, TD Bank, Morgan Stanley, City National Bank, Signature Bank, and Bethpage Credit Union, I know that Cohen provided the address for Subject Premises-l as the mailing for his accounts at each of these ?nancial institutions. Accordingly, it is likely that Subject Premises?l contains records relating to these accounts, including, among other things, bank statements that list account balances. The existence of these records in Subject Premises?1 will be relevant to, among other things, Cohen?s ownership of the accounts and his knowledge of the balances in these accounts. e. Additionally, Cohen may have records of other bank accounts or assets that were not disclosed to Sterling and are not presently known by law enforcement. For example, as described above, Cohen has received interest income since 2015 that he has not disclosed to Sterling or paid taxes on. Also, on Cohen?s August 2014 Financial Statement, see supra {l 16(e), he disclosed $10,000,000 in ?investments in overseas entities.?30 The value of these investments was omitted from subsequent ?nancial statements. However, for the reasons outlined above, there is probable cause to believe that Cohen omitted the value of those investments from his 2017 3? Based on my participation in an interview with Sterling Employee?3, have learned that Cohen told Sterling Employee?3 that the reference to ?investments in overseas entities? on his 2014 Financial Statement was to serve merely as a ?placeholder? for potential future investments. 60 2017.03.02 ?nancial statements in order to understate his assets. As Subject Premises?1 is Cohen?s primary residence and he uses Subject Premises-1 as the mailing address for bank records, there is probable cause to believe that account statements for unknown bank accounts or assets concealed ?om Sterling are likely to be found in Subject Premises?1. f. Based on my review of records maintained by and produced pursuant to the Cohen Email Warrants, Iknow that the address Cohen provided to for Essential Consultants is the address for Subject Premises?linee supra 1119(6)? believe that Subject Premises-l will contain evidenCe concerning the operation of Essential Consultants or money that Cohen received, through Essential Consultants, ?om Additionally, because Cohen used the address for Subject Premises-l for at least one consulting arrangement involving Essential Consultants, there is probable cause to believe that Subject Premises?l may contain recordsof other consulting arrangements that Cohen, through Essential Consultants, has with other individuals or entities. g. Based on my review of records maintained by Getzel? accounting ?rm, and emails produced pursuant to the Cohen Email Warrants, I have learned that Getzel? accounting ?rm sent documents to Subject Premises-1 and used the address for Subject Premises-=1 as the address listed on Cohen?s personal and corporate tax retulns. See supra 11 16(n). For instance, on or about October 6, 2017, an employee at Getzel?s accounting ?rm emailed Cohen that she had sent Cohen?s September 2017 Financial Statement by FedEx to Cohen?s attention. Accordingly, Cohen?s tax records are likely to be found in Subject Premises?1. h. Based on my review of bank records and publiclynavailable documents, Iknow that Cohen used $130,000 ?om a home equity line of credit on Subject Premises-l to pay Clifford. I also know that on the settlement and nondisclosure agreement between ?Peggy Peterson? and C, 61 2017.03.02 the address for Essential Consultants is Subject Premises-1.. Accordingly, Subject Premises?l is likely to contain evidence of the Campaign Finance Offenses, including settlement and nondisclosure agreements, payment records, written and email correspondence, and records pertaining to the home equity line of credit. i. Based on my review of emails produced pursuant to the Cohen Email Warrants and iCloud Warrant, I know that Cohen used at least one Apple iPhone, an Apple iPad Mini, and a MacBook Pro to access his iCloud account. Based on my review Apple pursuant to the iCloud Warrant, I know that electronic devices linked to Cohen?s iCloud account were used at Subject Premises-l to, among other things, place telephone calls and backup ?les to Cohen?s iCloud account. Accordingly, there is probable cause to believe that Subject Premises?l contains electronic devices, including certain Apple products, that for reasons discussed below are likely to contain evidence of the Subject Offenses. j. Based on my review of emails produced pursuant to the Cohen Email Warrants, I understand that Subject Premises-:1 recently sustained water damage to certain parts of the premises, and that Cohen has engaged contractors to perform certain remediation work on the premises. In addition, as set? forth above, I believe that Cohen and his family are temporarily residing at Subject Premises?4 in the Loew?s Regency Hotel, which is approximately two blocks from Subject Premises?l. However, based on my review of a work order sent to Cohen?s email by a contractor, I understand that the ?rst phase of the work order called for the contractor to ?Pack Remove all items furnishings in Living Room, Kitchen, Sons Room Dining Room? and store them off-site. In addition, based on my review of drawings sent to Cohen by the contractor, it appears that the work is primarily being done in these rooms. Thus, I believe that the construction to the extent it is still ongoing would not necessarily have caused Cohen to move 62 2017.03.02 all documents or evidence responsive to the warrant out of Subject Premises-l, because it does not appear that work is being done to the portion of Subject Premises-l, such as a home of?ce or Cohen?s own room, where such documents or evidence would most likely be found.31 48. Second, there is probable cause to believe that Cohen uses Subject Premises?2 as of?ce space, and also that Subject Premises?2 contains certain electronic devices. Speci?cally, ?om my review of the ?strategic alliance agreemen between Squire Patton Boggs and Cohen, and my rev1ew of the press of?ce at Subject Premises?2. See supra 18(d), 19(e). Indeed, Ihave learned that pursuant to Cohen?s agreement with the law ?rm, he has ?dedicated and segregated of?ce space? in Squire Patton Boggs? of?ces on the 23rd ?oor of 30 Rockefeller Plaza, and that the space is ?physically separate? ?om the ?rm?s of?ces and has ?locked doors and its own locked ?le cabinets.? See supra {l 19(e). Additionally, I know that under the terms of the agreement, Cohen agreed to ?arrange for [his] own computer server system that is not connected to [Squire Patton Boggs?s] computer network system.? I know from my participation in an interview with Getzel, who met Cohen at Subject Premises-2 in 2017, that Subject Premises-2 is an of?ce with a door, it appears to be used only by Cohen, and it contains, among other things, a computer and paper ?les. According to Getzel, when Getzel saw Cohen at Subject Premises-2, he had two cellular telephones in Subject Premises-2. I also know ?om my review of emails produced pursuant to the Cohen Email Warrants that Cohen uses the address for Subject Premises-:2 in the signature block 31 As noted below, based on my training and experience, I believe that individuals who travel or stay in hotels for short-=term periods commonly bring some items with them, such as portable electronic devices or sensitive items, meaning that Cohen has likely taken some evidence from Subject Premises?l to Subject Premises?4. Nevertheless, given the temporary nature of Cohen?s stay at Subject Premises?4 and the scope of the work being done at Subject Premises?l, I believe it is unlikely that Cohen has taken all evidence that would be subject to seizure out of Subject Premiseswl. 63 2017.08.02 ?it! i on his emails. Based on my review of notes of a call between Cohen and First Republic Employee- 2 (which notes were taken by another First Republic employee, who was participating in the call and taking notes), I know that, on or about November 15, 2017, Cohen told First Republic Employee?2 that he had a new of?ce at 30 Rock. Moreover, I know from an article in Vanity Fair published on or about February 14, 2018, that Cohen was interviewed by the magazine in Subject Premises-2 in or about February 2018. I 49. Thereisalmrobableeanseto instrumentalities, evidence, and fruits of the Subject Offenses. Speci?cally, from my review of emails produced pursuant to subpoena and the Cohen Email Warrants and iCloud Warrant, as well as my training and experience, I know the following: a. According to records maintained by Sterling, when Cohen was emailing with Sterling Employee?3 in 2018 about a modi?cation to his existing loan from Sterling, Cohen listed his address in his email as the address for Subject Premises-2. See supra 16(t), 16(u). Accordingly, Subject Premises-2 likely contains evidence concerning Cohen?s loan modi?cation negotiations with Sterling. b. Based on my review of records obtained pursuant to the Cohen Email Warrants, I know that the address Cohen provided to KAI and BTA for Essential Consultants is the address for Subject Premises-2. See supra 111] 19(a), 19(b). Therefore, there is probable cause to believe that Subject Premises-2 will contain evidence concerning the operation of Essential Consultants or money that Cohen received, through Essential Consultants, ?om KAI and ETA, among other entities with which Cohen had a consulting arrangement. Additionally, based on my review of emails sent in 2018 that were obtained pursuant to the Cohen Email Warrants, I know that Cohen continues to enter into consulting arrangements through Essential Consultants, and agreements 64 2017.08.02 relating to those arrangements indicate that Essential Consultants is located at Subject Premises? 2. Additionally, because Cohen used the address for Subject Premises?2 for multiple consulting arrangements involving Essential Consultants, there is probable cause to believe that Subject Premises?2 may contain records of other unknown consulting arrangements that Cohen has with other individuals or entities. c. Based on my review of records maintained by Getzel?s accounting ?rm, and emails produced pursuant to the Cohen EmailmWarrants, as well as my Getzel, I have learned that Getzel visited Subject Premises-2 to meet with Cohen about his taxes. See supra 1] 20(a). At that meeting, Getzel discussed with Cohen whether Cohen should disclose Essential Consultants on his personal ?nancial statement to banks. According, there is probable cause to believe that Subject Premises?2 will contain evidence relating to Cohen?s taxes, or notes of his conversation with Getzel. Moreover, the fact that Cohen used Subject Premises?2 for a meeting regarding his personal ?nancial matters provides probable cause to believe that documents and information regarding his ?nances will be found in Subject Premises-2. d. Based on my participation in an interview with Getzel, I know that Cohen maintains a computer in Subject Premises-2. From my review of IP data produced pursuant to a subpoena and pen register to Google, it appears that Cohen is logging into his Gmail account from Subject Premises-=2. Accordingly, there is probable cause to believe that Subject Premises?2 contains electronic devices, that for reasons discussed below are likely to contain evidence of the Subject Offenses. 6. Based upon my training and experience, I have learned that individuals who maintain businesses typically keep records relating to the business?such as contracts with clients and records of payments?at the business? identi?ed location. I am not aware of any addresses 65 2017.08.02 0m. associated with Essential Consultants other than Subject Premises?l and Subject Premises-2. Accordingly, there is probable cause to believe that Subject Premises-l and Subject Premises-2 will contain business records for Essential Consultants. 50. Third, there is probable cause to believe that Subject Premises-3 is likely to contain instrUInentalities, evidence, and fruits of the Subject Offenses. In particular: a. As noted above, Cohen has two bank accounts at TD Bank. In or about November 2017, as Cohen was receiving substant1al 1ncome from consulting to Sterling?Cohen opened the safety deposit box at TD Bank, which is Subject Premises-3. In light of the aforementioned evidence that Cohen conceals assets, including assets at TD Bank, there is probable cause to believe that Subject Premises?3 contains ?nancial assets, objects of value and/or documents relating to such assets or objects of value that Cohen likely did not disclose to Sterling. Indeed, based on my training and experience, I am aware that people often conceal valuable items in safety deposit boxes. Accordingly, there is probable cause to believe that Subject Premises?3 will contain evidence of the Bank Fraud Offenses. b. In addition, based on my review of records produced by TD Bank, I know that Cohen has accessed the vault in which Subject Premises-3 is stored on two occasions. The first such occasion was on November 10, 2017. Cohen signed into the vault at approximately 5:35 and out of vault at approximately 5:39 on that date.32 Based on my review of toll records, I know that Cohen?s ?rst call after he signed out of the safety deposit box approximately 45 minutes later was to Keith Davidson. Specifically, at 6:25 pm. Cohen called Davidson and they spoke for less than a minute; three minutes later, Davidson called Cohen back and they spoke for approximately 32 The entry in the bank? log book does not specify whether this is AM. or P.M. However, I infer that it is P.M., because it is unlikely that the bank would have been open 2017.08.02 22 minutes. The second such occasion was on February 2, 2018, which is during the time period numerous media reports about Cohen?s payment to Clifford were being published, and is one day after it appears that Cohen?s family moved into Subject Premises?4, as set forth above. The timing of Cohen?s two visits to the vault one shortly before a call to Keith Davidson and the other around the time that Cohen came under media scrutiny in connection with the payment to Davidson?s client gives rise to probable cause to believe that Subject Premises?3 will contain evidence of the - Camp aign Finance Offenses, such as do'Cuments Davidson and the payment to Clifford, including documents or evidence that Cohen did not want to leave in his apartment where construction workers would be present.33 51. Based on my review of emails obtained pursuant to the Cohen Email Warrants and cell phone location information, I believe that Cohen is temporarily residing in Subject Premises- 4. See supra 111] There is also probable cause to believe that Subject Premises-4 contains instrumentalities and evidence of the Subject Offenses, including, the following: a. As described above, it appears that Cohen moved to Subject Premises-4 on or about February 1, 2018, at which time numerous media reports about Cohen?s involvement in the payment to Clifford were being published. See supra During this time same period, Cohen was frequently corresponding with the media and sent himself and others statements about his involvement in the payment to Clifford. See supra Thus, there is probable cause that Cohen took at least some documents and evidence relating to the Clifford payment with him to Subject Premises-4, in order to reference and consult them in connection with these statements. 3'3 As noted above, Subject Premises?3 is approximately ?ve inches by ten inches. Accordingly, I do not believe that it would fit a large volume of hard copy documents; however, a small number of hard?copy documents, or a large volume of documents contained on a ?ash drive or other portable storage device, would ?t in Subject Premises-3. 67 2017.08.02 b. As described above, at the time Cohen moved to Subject Premises?4, he was also in the midst of ongoing negotiations with Sterling regarding the re?nancing of his medallion debts. For example, on January 30, 2018, Cohen had a phone call with Sterling Employee?3 about his ?nances and the proposed restructuring, and on February 1, 2018, Cohen sent an email to Sterling Employee-3 claiming that he did not have more than $1.25 million in cash. See supra 16(u). Thus, there is probable cause that Cohen took at least some documents and evidence relating to his ongoing negoti?ions to reference and consult them in connection?with these negotiations. c. As described above, Cohen used at least one Apple iPhone, an Apple iPad Mini, and a MacBook Pro to access his iCloud account, and these electronic devices linked to Cohen?s iCloud account were used at Subject Premises?1 Cohens? permanent residence to place telephone calls and backup ?les to Cohen?s iCloud account. See supra 1H1 47(i). Although Cohen? 5 stay at Subject Premises-:4 is temporary, based on my training and experience I know that individuals who travel or stay in hotels for short?term periods commonly bring portable electronic devices with them, such as cellular phones, tablets, or laptops. Accordingly, there is probable cause to believe that Subject Premises-=4, where Cohen currently appears to be residing, contains electronic devices, including Subject Device?1, Subject Device~2, and/or certain Apple products, that for the reasons discussed herein are likely to contain evidence of the Subject Offenses. (1. Moreover, as set forth above, based on cellphone location information I know that Subject Device?1 and Subject Device=2 were in the vicinity of Subject Premises-?4 as recently as this morning (April 8, 2018). As set forth above, there is probable cause to believe that Cohen used the Subject Devices in furtherance of the Subject Offenses, including to communicate with Sterling employees regarding the medallion transaction, with First Republic employees regarding 68 2017.08.02 the Essential Consultants Account, with his accountant regarding his ?nances, and with individuals, such as Davidson, Howard and Pecker, involved in the $130,000 payment to Clifford. 52. Although Cohen appears to be residing currently in Subject Premises-4, it is unknown whether Cohen will be physically present within Subject Premises?4 at the moment the warrant sought herein are executed. If Cohen is within Subject Premises-4 at that moment, Subject Device?l and Subject Device?2 his cellphones will likely also be within Subject Premisesn4. If Cohen is not within Subject Premises-4mat that moment, the devices will?likely'beon'hisperson, wherever he is located (which, based on location data for Subject Device-l and Subject Device?2 as recently as today, is likely .to be in the Southern District of New York). As such, this warrant seeks separate authority to seize Subject Device-l and Subject Device?2, in the event that those devices are not located within Subj ectPremises?4 (or another Subject Premises) at the moment the warrants sought herein are executed. D. Probable Cause Justifying Search of E81 53. Based on the foregoing, there is probable cause to believe that Subject Premises-l, Subject Premises?2 and Subject Premises?4 contain electronic devices that are likely to contain evidence, fruits, and instrumentalities of the Subject Offenses (and, as set forth above, that Subject Device-1' and Subject Device-2 are themselves electronic devices that are likely to contain evidence of the Subject Offenses). Specifically, based on my review of information produced- pursuant to the Cohen Email Warrants, the iCloud Warrant, and subpoenas, as well as pen register data, I submit that there is probable cause that Subject Premises-d contains an Apple iPad Mini, a MacBook Pro, and has, at various times, contained Apple cellphones; similarly, there is probable cause that Subject Premises-2 contains a computer and has, at various times, contained Apple 69 2017.08.02 . cellphones. These devices are likely to include evidence, fruits, and instrumentalities of the Subject Offenses for the following reasons: a. As described throughout this affidavit, Cohen used email to send and receive communications related to the Subject Offenses. In particular, Cohen used email to send and receive communications with Sterling, First Republic, Getzel, the entities to which he is providing consulting services, Davidson, and Howard, among others. While some of these emails have obfalned via subpoenas and semch?wanmts, I know from my training that individuals can and do delete emails from their Internet-based inboxes but retain copies of those emails on their hard drives. I also know that individuals often have multiple email accounts, some of which may not be known to law enforcement, and as a result electronic devices can be a unique repository of all emails relevant to certain Subject Offenses. Indeed, from my involvement in this investigation, I know that Cohen had an email account with the Trump Organization, but the USAO and FBI have not been able to obtain the contents of that account to date. Thus, emails relevant to the Subject Offenses are likely stored on electronic devices in Subject Premises-l, Subject Premises-2 and/or Subject Premises?4. b. Additionally, Subject Premises-l, Subject Premise?2 and Subject Premises?4 likely contain electronic copies of documents relevant to the Subject Offenses. Indeed, I know ??om my training and experience that individuals often retain copies of important documents on their computers or other electronic devices capable of storing information, including cellphones (such as the Subject Devices) and tablets. Here, there are a number of documents that Cohen has likely retained that will be relevant to the Subject Offenses. For example, electronic devices may include documentation of Cohen?s true net worth, a listing of his assets, an accounting of his available 70 2017.08.02 cash, consulting agreements with third parties, and documentation of his payment to Clifford, among other evidence of the Subject Offenses. c. Third, I know from my review of emails obtained pursuant to the Cohen Email Warrants that Cohen sent up online banking with First Republic. Based on my training and experience, I know that individuals who set up online banking o?en receive electronic notices concerning ?nancial transactions and, on occasion, save records of their ?nancial transactions to their devices. Accordingly, there is probable cause to Believe that Col?e??s??l?'ctronic device's contain evidence of banking activity, including the existence of bank accounts or assets that Cohen did not disclose to Sterling or Melrose. d. Fourth, ?om my review of records produced by Apple, I know that Cohen communicates using text message as well as communications applications. These applications that Cohen has downloaded onto a phone include, but are not limited to, WhatsApp, Signal, and Dust. I know from my review of toll records and text messages that, in particular, Cohen communicated with Pecker using these applications. Accordingly, there is probable cause to believe that Cohen?s cellphones the Subject Devices will contain messages that are not otherwise accessible relating to the Subject Offenses. 54. Based on my training and experience, I know that individuals Who engage in ?nancial crimes commonly use computers to communicate with co-conspirators, keep ?nancial ledgers, and retain fraudulent documents. As a result, they often store data on their computers related to their illegal activity, which can include logs of online or cellphone=based ?chats? with co?conspirators; email correspondence; contact information of conconspirators, including telephone numbers, email addresses, and identi?ers for instant messaging and social medial accounts; bank account numbers; and/or records of uses of funds. 71 2017.08.02 55. Based on my training andexperience, I also know that, where computers are used in furtherance of criminal activity, evidence of the criminal activity can often be found months or even years after it occurred. This is typically true because: 0 Electronic ?les can be stored on a hard drive for years at little or no cost and users thus have little incentive to delete data that may be useful to consult in the future. 0 Even when a user does choose to delete data, the data can often be recovered months or years later with the appropriate forensic tools. When a ?le is ?deleted? on a home - computer, the data contained in the ?le does not actually disappear,but instead remains on the hard drive, in ?slack Space,? until it is overwritten by new data that cannot be" stored elsewhere on the computer. Similarly, files that have been viewed on the Internet are generally downloaded into a temporary Internet directory or ?cache,? which is only overwritten as the ?cache? ?lls up and is replaced with more recently viewed Internet pages. Thus, the ability to retrieve from a hard drive or other electronic storage media depends less on when the ?le was created or viewed than on a particular user?s operating system, storage capacity, and computer habits. a In the event that a user changes computers, the user will typically transfer files from I the old computer to the new computer, so as not to lose data. In addition, users often keep backups of their data on electronic storage media such as thumb drives, ?ash memory cards, (JD-ROMS, or portable hard drives. 56. ?Based on the foregoing, I respectfully submit there is probable cause to believe that Cohen engaged in the Subject Offenses, and that evidence Of this criminal activity is likely to be found in the Subject Premises, on computers and electronic media found in the Subject Premises, and on the Subject Devices. In particular, there is probable cause to believe that the Subject Premises and Subject Devices will contain evidence, fruits, and instrumentalities of violations of the Subject Offenses, as more fully described in Section II of Attachments A, B, C, D, and to the proposed warrants, including the following: a. Evidence necessary to establish the occupancy or ownership of the Subject Premises, including without limitation, utility and telephone bills, mail envelopes, addressed correspondence, bank statements, identi?cation documents, and keys. b. Evidence relating to Sterling, Melrose, and/or taxi medallions. 72 20170302 0. Evidence relating to a plan, proposal, or agreement for Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to _.nd/or entities associated with him. d. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/ or Melrose. e. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essentialeonsultants or the nature of any Work done by Cohen or any other individuals in connection with Essential Consultants. f. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or ?om Michael D. Cohen 85 Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. g. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, Whether held personally or through entities, including tax returns, personal ?nancial statements, and bank: records. h. Evidence relating to agreements, loans, and/or ?nancial transactions between Cohen and_ and any payments by-Lo Cohen. i. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. j. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. 73 2017.08.02 k. Evidence of communications involving Michael Cohen, American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougal. I 1. Evidence relating to Cohen?s role in the Tinmp Campaign, and coordination or consultation with the Trump Campaign. 1n. Evidence of communications with Donald Trump and] or agents or associates of the Tlump Campaign about the Access ?tape and?Other publicity involving Trump? 5 relationship in the run up to the election. n. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 0. Evidence relating to Cohen?s knowledge of the campaign finance laws, campaign contribution reporting requirements, and campaign contribution limits. p. Communications with others, including ef?ey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances; q. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; r. Evidence of Cohen?s intent, as it relates to theSubject foenses under investigation. I Procedures for Searching ESE A. Execution of Warrant for E31 5 7. Federal Rule of Criminal Procedure provides that a warrant to search for and seize property ?may authorize the seizure of electronic storage media or the seizure or 74 2017.08.02 copying of electronically stored information . . . for later review.? Consistent with Rule 41, this application requests authorization to seize any computer devices and storage media and transport them to an appropriate law enforcement facility for review. This is typically necessary for a number of reasons: a First, the volume of data on computer devices and storage media is often impractical for law enforcement personnel to review in its entirety at the search location. a Second, because computer data is particularly vulnerable to inadvertent or intentional modi?cation or destruction, cemputer d?ices are ideally examined";in' {Controlled environment, such as a law enforcement laboratory, where trained personnel, using specialized software, can make a forensic copy of the storage media that can be subsequently reviewed in a manner that does not change the underlying data. a Third, there are so many types of computer hardware and software in use today that it can be impossible to bring to the search site all of the necessary technical manuals and specialized personnel and equipment potentially required to safely access the underlying computer data. 0 Fourth, many factors can complicate and prolong recovery of data ?om a computer device, including the increasingly common use of passwords, or other features or con?gurations designed to protect or conceal data on the computer, which often take considerable time and resources for forensic personnel to detect and resolve. 58. As discussed herein, Squire Patton Boggs is a functioning law ?rm that conducts legitimate business unrelated to Cohen?s commission of the Subject Offenses. Subject Premises- 2 is an of?ce located inside of Squire Patton Boggs?s New York of?ce. In order to execute the warrant in the most reasonable fashion, law enforcement personnel will attempt to investigate on the scene of what computers or storage media, if any, must be seized or copied, and what computers orcopied. Law enforcement personnel will speak with Squire Patton Boggs personnel on the scene as may be appropriate to determine which ?les and electronic devices within Subject Premises-2 belong to or were used by Cohen. While, based on the foregoing, it does not appear that Cohen shared electronic devices or a server with Squire Patton Boggs, where appropriate, law enforcement personnel will copy data, rather than physically seize 75 2017.08.02 computers, to reduce the extent of any disruption of Squire Patton Boggs?s operations. If, after inspecting the seized computers off?site, it is determined that some or all of this equipment is no longer necessary to retrieve and preserve the evidence, the Government will return it. 59. Additionally, because Cohen is an attorney, and claims to serve as a personal attorney for Trump, the review of evidence seized ??om the Subject Premises and Subject Devices will be conducted pursuant to established screening procedures to ensure that the law enforcement personnel involved in the investigation, including" attorneys for in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures will include use of a designated ??lter team,? separate and apart from the investigative team, in order to review potentially privileged communications and determine which communications to release to the investigation and prosecution team. B. Accessing ESI on the Subject Devices 60. As described above, the Subject Devices are both Apple brand devices. 61. I know from my training and experience, as well as from information found in publicly available materials including those published by Apple, that some models of Apple devices such as iPhones and iPads offer their users the ability to unlock the device via the use of a ?ngerprint or thumbprint (collectively, ?fmgerprint?) in lieu of a numeric or alphanumeric passcode or password. This feature is called Touch ID. I also know that the Apple iPhone offers its users the ability to unlock the device via the use of facial recognition (through infrared and visible light scans) in lieu of a numeric or alphanumeric passcode or password. This feature is called Face ID. 62. If a user enables Touch ID on a given Apple device, he or she can register up to 5 ?ngerprints that can be used to unlock that device. The user can then use any of the registered 76 2017.08.02 ?ngerprints to unlock the device by pressing the relevant f1nger(s) to the device?s Touch ID sensor, which is found in the round button (often referred to as the ?home? button) found at the bottom center of the front of the device. If a user enables Face ID on a given Apple device, he or she can unlock the device by raising the iPhone to his or her face, or tapping the screen. In my training and experience, users of Apple devices that offer Touch ID or Face ID often enable it because it is considered to be a more convenient way to unlock the device than by entering a numeric or alphanumeric passcode or password, as well as ail-more secure way to protect the deviceis contents. 63. In some circumstances, Touch ID or Face ID cannot be used to unlock a device that has either security feature enabled, and a passcode or password must be used instead. These circumstances include: (1) when the device has just been turned on or restarted; (2) when more than 48 hours has passed since the last time the device was unlocked; (3) when the passcode or password has not been entered in the last 6 days, and the device has not been unlocked via Touch ID in the last 8 hours or the device has not been unlocked via Face ID in the last 4 hours; (4) the device has received a remote lock command; or (5) five unsuccess?il attempts to unlock the device via Touch ID or Face ID are made. 64. The passcodes or passwords that would unlock the Subject Devices are not known to law enforcement. Thus, it will likely be necessary to press the fingers of the user of the Subject Devices to the devices? Touch ID sensor, or hold the Subject Devices in ?'ont of the user?s face to activate the Face ID sensor, in an attempt to unlock the devices for the purpose of executing the search authorized by this warrant. Attempting to unlock the relevant Apple devices via Touch ID with the use of the ?ngerprints of the user, or via Face ID by holding the device in front of the user?s face, is necessary because the government may not otherwise be able to access the data contained on those devices for the purpose of executing the search authorized by this warrant. 77 2017.08.02 an! 65. Based on these facts and my training and experience, it is likely that Cohen is the user of the Subject Devices, and thus that his ?ngerprints are among those that are able to unlock the Subject Devices via Touch ID or his face is able to unlock the Subject Devices via Face ID. 66. Although I do not know which of a given user?s 10 ?ngerprints is capable of unlocking a particular device, based on my training and experience I know that it is common for a user to unlocka Touch lD-enabled Apple device via the ?ngerprints on thumbs or index ?ngers. In the event that law enforcement is unable to unlock within the ?ve attempts permitted by Touch ID, this will simply result in the device requiring the entry of a password or passcode before it can be unlocked. 67. I also know from my training and experience, and my review of publicly available materials published by Apple that Apple brand devices, such as the Subject Devices, have a feature that allows a user to erase the contents of the device remotely. By logging into the Internet, the user or any other individual who possesses the user?s account information can take steps to completely wipe the contents of the device, thereby destroying evidence of criminal conduct, along with any other information on the device. The only means to prevent this action is to disable the device?s ability to connect to the Internet immediately upon seizure, which requires either access to the device itself to alter the settings, or the use of specialized equipment that is not consistently available to law enforcement agents at every arrest. 68. Due to the foregoing, I request that the Court authorize law enforcement to press the ?ngers (including thumbs) of Cohen to the Touch ID sensors the Subject Devices, or hold the Subject Devices in ?ont of Cohen?s face, for the purpose of attempting to unlock the Subject Devices via Touch ID or Face ID in order to search the contents as authorized by this warrant. 7 8 2017.08.02 C. Review of E81 69. Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (including, in addition to law enforcement officers and agents, and depending on the nature of the E81 and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) will rev1ew tli ESIEb?tai??Ed?tlErE'? for information responsive tothe warrant. 70. In conducting this review, law enforcement personnel may use various techniques to determine which ?les or other .1381 contain evidence or ?'uits of the Subject Offenses. Such techniques may include, for example: a surveying directories or folders and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); a conducting a ?le-by??le review by ?opening? or reading the ?rst few ?pages? of such ?les in order to determine their precise contents (analogous to performing a cursory examination of each document in a ?le cabinet to determine its relevance); 0 ?scanning? storage areas to discover and possibly recover recently deleted data or deliberately hidden ?les; and performing electronic keyword searches through all electronic storage areas to determine the existence and location of data potentially related to the subject matter of the investigation?; and a reviewing metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. 3?4 Keyword searches alone are typically inadequate to detect all relevant data. For one thing, keyword searches work only for text data, yet many types of ?les, such as images and videos, do not store data as searchable text. Moreover, even as to text data, there may be information properly subject to seizure but that is not captured by a keyword search because the information does not contain the keywords being searched. 79 2017.08.02 ?71. Law enforcement personnel will make reasonable efforts to restrict their search to data falling within the categories of evidence speci?ed in the warrant. Depending on the circumstances, however, law enforcement personnel may need to conduct a complete review of all the E81 from seized devices or storage media to evaluate its contents and to locate all data responsive to the warrant. D. Return of ESI 72. If the Government determines that the to retrieve and preserve the data, and the devices themselves are not subject to seizure pursuant to Federal Rule of Criminal Procedure 41(c), the Government will return these items, upon request. Computer data that is or unreadable will not be returned unless law enforcement personnel have determined that the data is not an instrumentality of the offense, (ii) a ??uit 0f the criminal activity, contraband, (iv) otherwise unlawfully possessed, or evidence of the Subject Offenses. 80 2017.08.02 1V. Conclusion and Ancillary Provisions 73. Based on the foregoing, I respectfully request the court to issue a warrant to seize the items and information speci?ed in Attachments A, B, C, D, and to this af?davit and to the . Search and Seizure Warrants. 74. In light of the con?dential nature of the continuing investigation, I respectfully request that this af?davit and all papers submitted herewith be maintained under seal until the Court orders otherwise. Special Agent FBI 7 Sworn to before me on 8th day oprr? 2018 5'3/ . 91?in Mfg/?aw HON HENRV x: UNITED MAGIWRATE IUDGE 81 2017.03.02 ATTACHMENT A I. Premises to be Searched?Subject Premises-=1 The premises to be searched (?Subject Premises?1?) are described as follows, and include electronic devices, and all locked and closed containers found therein: Apartment .10cated inside the building at 5 02 Park Avenue, New York, New York 10022. The building located at 502 Park Avenue is a 32??oor brick residential building. Subject Premises?1 is located on the the building. 11. Items to Be 5?ch A. Evidence, Fruits, and Instrumentalities of the Subject Offenses I The items to be seized from Subject Premises?1 are evidence, fruits, and instrumentalities of violations of 18 371 (conspiracy, as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(l)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?), described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to _and/or entities associated with him. c. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/ or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or ?om Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. f, Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal financial statements, and bank records, from January 1, 2013 to the present. g. Evidence relating to agreements, loans, and/or financial transactions between Cohen and?and/or entities controlled by the? 2 2017.08.02 ?1:11? and anypayments by Cohen from January 1, 2612 to the present. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc, David Pecker, and/or mum?um, Clifford, and/or Karen McDougal. k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/ or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 11. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January 1, 2013 to the present. p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution, from January 1, 2013 to the present. q. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. B. Search and Seizure of Electronically Stored Information The items to be seized from Subject Premises?1 also include any computer devices and storage media that may contain any electronically stored information falling within the categories set forth in Section 11A of this Attachment above, including, but not limited to, a MacBook Pro, any other desktop and laptop computers, any Apple iPhone or other cellphone or smartphone 3 2017.03.02 belonging to Michael Cohen or in his possession, an Apple iPad Mini, portable hard drives, disk drives, thumb drives, and personal digital assistants. In lieu of seizing any such computer devices or storage media, this warrant also authorizes the copying of such devices or media for later review. The items to be seized from Subject Premises-1 also include: 1. Any items or recOrds needed to access the data stored on any seized or copied computer devices or storage media, including but not limited to any physical keys, devices, or records of login credentials, passwords, private keys, or similar information. 2. Any items or records that may facilitate a forensic examination of the computer devices or storage media, including any hardware or software manuals or other information g' the- con-ti gurationeofthe seized or~ copied?computer. devicesronstoragemedia. 3. Any evidence concerning the identities or locations of those persons with access to, control over, or ownership of the seized or copied computer devices or storage media. C. Review of ESI Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (which may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the ESI contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: 2017.08.02 surveying various file ?directories? and the individual files they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); opening or cursorily reading the first few ?pages? of such ?les in order to determine their precise contents; scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden ?les; performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and reviewing metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. Law enforcement personnel Will make reasonable efforts to search only for ?les, documents, or other electronically stored information within the categories identi?ed in Sections HA and ILB of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the E81 from seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 2017.08.02 5? ATTACHMENT I. Premises to be Searched??Silly? eet Premises-2 The premises to be searched (?Subject Premises?2?) are described as follows, and include electronic devices, and all locked and closed containers found therein: An of?ce belonging to or assigned to Michael Cohen located on the 23rd floor of the building at 30 Rockefeller Plaza, New York, New York 10112, inside of the of?ces of the law ?rm Squire Patton Boggs. The building located at 30 Rockefeller Plaza is a 66??oor of?ce building that spans the entire block between Sixth Avenue and Rockefeller Plaza. II. Items to Be Seized A. Evidence, Fruits, and Instrumentalities of the Subject Offenses The items to be seized from Subject Premises?2 are evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 301l6(a)(1)(A) and 30109(d)(l)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?) described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to ?111d/ or entities associated with him. c. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, ?om January 1, 2013 to the present. 2.. Evidence relating to agreements, loans, and/or ?nancial transactions between Cohen and?311?" 01? entities ?mm by 6 2017.08.02 andanypaymems by-ro Cohen, ?omJanuary 1, 2612 to the present. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. Evidencmofcommunications betweenMichael Cohen and American Media, Inc, David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougal. k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. n. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including ef?ey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, ??om January 1, 2013 to the . present. p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution, from January 1, 2013 to the present. q. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. B. Search and Seizure of Electronically Stored Information The items to be seized ?'om Subject Premises-2 also include any computer devices and storage media that may contain any electronically stored information falling within the categories set forth in Section ILA of this Attachment above, including, but not limited to, any desktop and laptop computers, any Apple iPhone or other cellphone or smartphone belonging to Michael Cohen 7 2017.08.02 or in his possession, portable hard drives, disk drives, thumb drives, and personal digital assistants. In lieu of seizing any such computer devices or storage media, this warrant also authorizes the copying of such devices or media for later review. The items to be seized from Subject Premises?Q. also include: 1. Any items or records needed to access the data stored on any seized or copied computer devices or storage media, including but not limited to any physical keys, devices, or records of login credentials, passwords, private keys, or similar information. I 2. Any items or records that may facilitate a forensic examination of the computer devices or storage media, including any hardware or software manuals or other information concerning the con?guration of the seized or 3. Any evidence concerning the identities or locations of those persons with access to, control over, or ownership of the seized or copied computer devices or storage media. C. Review of ESI Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (which may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: 0 surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outside of a file cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); 9 opening or cursorily reading the ?rst few ?pages? of such ?les in order to determine their precise contents; a scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden ?les; performing key word searches through all electronic storage areas to determine whether occurrences of language contamed in such storage areas exist that are intimately related to the subject matter of the investigation; and reviewing metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. 2017.08.02 Law enforcement personnel will make reasonable efforts to search only for ?les, documents, or other electronically stored information Within the categories identi?ed in Sections ILA and ILB of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the E81 from seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ?filter team,? separate and apart from the investigative team, in order to address potential privileges. 2017.08.02 ATTACHMENT I. Premises to be Searched?Subject Premises-n3 The premises to be searched (?Subject Premises-3?) are described as follows, and include all looked and closed containers found therein: A safe deposit box located inside the TD Bank branch location at 500 Park Avenue, New York, New York 10019, marked as box it. The safe deposit box is in the name of Michael Cohen and Laura Cohen. II. Items to Be Seized A. Evidence, Fruits, and Instrumentalities of the Subject Offenses The items to be seized ?om Subject Premises-3 are evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses), 1005 (falsebank entries), 1014 (false statements to a ?nancial institution), 1343 (wire ?aud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?), described as follows: . 1. Evidence relating to Michael Cohen?s net worth, available cash and cash equivalents, assets, and annual income, and income sources, from January 1, 2013 to the present. 2. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. 4. Evidence of communications between Michael Cohen and American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougal. 5. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 6. Evidence of communications with Donald and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. 7. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 10 2017.08.02 8. Evidence relating to Cohen?s knowledge of?the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 9. Any portable electronic storage device. B. Search of Seized Electronic Devices Probable cause exists to search any seized electronic storage device for the items set forth in Section above. C. Review of ESI Following seizure of any electronic storage device, law enforcement personnel (which may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the 1381 contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate inf01mation responsive to the warrant, including, for example: a surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); 0 opening or cursorily reading the ?rst few ?pages? of such ?les in order to determine their precise contents; a scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden ?les; a performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and a reviewing metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. Law enforcement personnel will make reasonable efforts to search only for ?les, documents, or other electronically stored information within the categories identi?ed in Sections ILA and 11.3 of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the E81 from seized devices if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect 11 2017.08.02 any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 12 2017.03.02 ATTACHMENT I. Premises to be Searched?Subj ect Premises?4 The premises to be searched (?Subject Premises-4?) are described as follows, and include electronic devices, and all locked and closed containers found therein: Room 1728 located inside the Loews Regency Hotel at 540 Park Avenue, New York, New York 10065. The building is a luxury hotel located on Park Avenue and 6lst Street. Subject Premises?4 is located on the 17th ?oor of the hotel. H. Items to Be Seiged Evidence, Fruits, and Instrumentalities of the Subject Offenses The items to be seized ??om Subject Premises-4 are evidence, ?'uits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy, as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?), described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to ind/or entities associated with him. c. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, from January 1, 2013 to the present. g. Evidence relating to agreements, loans, and/or ?nancial transactions between Cohen and ?and/or entities controlled by 13 2017.03.02 _and any payments by _to Cohen, from January 1, 2012 to the present. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump Sand/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. of communications between Michael Cohen and American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campalgn, Stephanie Clifford, and] or Karen McDougal. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 11. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January 1, 2013 to the present. p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution, from January 1, 2013 to the present. q. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. B. Search and Seizure of Electronically Stored Information The items to be seized from Subject Premises?4 also include any computer devices and storage media that may contain any electronically stored information falling Within the categories set forth in Section ILA of this Attachment above, including, but not limited to, a MacBook Pro, any other desktop and laptop computers, any Apple iPhone or other cellphone or smartphone l4 2017.08.02 belonging to Michael Cohen or in his possession, an Apple iPad Mini, portable hard drives, disk drives, thumb drives, and personal digital assistants. In lieu of seizing any such computer devices or storage media, this warrant also authorizes the copying of such devices or media for later review. The items to be seized ?om Subject Premises-=4 also include: 1. Any items or records needed to access the data stored on any seized or copied computer devices or storage media, including but not limited to any physical keys, en01yption devices, or records of login credentials, passwords, private keys, or similar information. 2. Any items or records that may facilitate a forensic examination of the computer devices or storage media, including any hardware or software manuals or other information concerning the configuration of the 3. Any evidence concerning the identities or locations of those persons with access to, control over, or ownership of the seized or copied computer devices or storage media. C. Review of ESI Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (which may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: a surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); 0 opening or cursorily reading the ?rst few ?pages? of such ?les in order to determine their precise contents; 0 scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden ?les; a performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and reviewing metadata, system information, con?guration ?les, registry data, and any other information reflecting how, when, and by whom the computer was used. 15 2017.08.02 Law enforcement personnel will make reasonable efforts to search only for ?les, documents, or other electronically stored information within the categories identi?ed in Sections HA and 11B of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the E81 from seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 16 2017.08.02 ATTACHREENT I. Device Subject to Search and Seizure Subject Device-1 The device that is the subject of this search and seizure warrant (?Subject Device-1?) is described as follows: An Apple iPhone serviced by with the telephone number- During the execution of this search warrant, law enforcement personnel are authorized to depress the ?ngerprints and/or thumbprints of Michael Cohen onto the Touch ID sensor of Subject 7 Device?1, or hold Subject Device-1 in front of Cohen?s face to activate the ace 1D sensor, in order to gain access to the contents of ?any such device as warrant. II. Review of E81 011 the Subject Device Law enforcement personnel (including, in addition to law enforcement officers and agents, and depending on the nature of the E81 and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained on Subject Device~1 for evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?) described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from anuaiy 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to ?and/or entities associated with him. . 0. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/ or Melrose. (1. Evidence relating to Essential Consultants, LLC, including any documents or communications that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents or communications that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. 17. 2017.03.02 f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, from January 1, 2013 to the present. g. Evidence relating to agreements, loans, and/or ?nancial transactions between Cohen and ?and/or entities controlled by and any payments by Cohen, ?om January 1, 2012 to the present. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougal. k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. in. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jef?ey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, ?om January 1, 2013 to the present. p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution, from January 1, 2013 to the present. 18 2017.08.02 ?Pals: If the Government determines that Subject Device-l is no longer necessary to retrieve and preserve the data on the device, and that Subject Device-1 is not subject to seizure pursuant to Federal Rule of Criminal Procedure 41(c), the Govemment will return Subject Device-4, upon request. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart ?om the investigative team, in order to address potential privileges. 19 2017.08.02 ATTACHIVIENT I. Device Subject to Search and Seizure Subject Device-=2 The device that is the subject of this search and seizure warrant (?Subject Device-2?) is described as follows: An Apple iPhone serviced by with the telephone number- During the execution of this search warrant, law enforcement personnel are authorized to depress the ?ngerprints and/or thumbprints of Michael Cohen onto the Touch ID sensor of Subject Device-2, or hold Subject Device?2 in front of Cohen?s face to activate the Face ID sensor, in order to gain access to the contents of any such device as authorlzed by this warrant. H. Review of ESI on the Subject Device Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the E81 and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the ESI contained on Subject Device?2 for evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30lO9(d)(l)(A)(l) (illegal campaign contributions) (the ?Subject Offenses?) described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, ?om January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to ?and/or entities associated with him. c. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents or communications that indiCate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents or communications that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen 85 Associates. 20 2017.08.02 f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax retums, personal fmancial statements, and bank records, from Januaiy 1, 2013 to the present. g- Evidence relating to agreements, loans, and/or ?nancial transactions between Cohen and _and/or entities controlled by and any payments by Cohen, from January 1, aura to me present. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDou gal. j. Evidence of communications between Michael Cohen and American Media, Inc., David Peclter, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/ or Karen McDougal. k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. n. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from Janualy l, 2013 to the present. p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that financial institution, from January 1, 2013 to the present. 21 2017.08.02 If the Government determines that Subject Device-2 is no longer necessary to retrieve and preserve the data on the device, and that Subject Device-2 is not subject to seizure pursuant to Federal Rule of Criminal Procedure 41(c), the Government will return Subject Device-Q, upon request. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the 1nvestigative team, in order to address potential privileges. 22 2017.08.02 A0 106 (Rev. 06/09) Application for a Search Warrant UNITED STATES DISTRICT COURT for the Southern District of New York In the Matter of the Search of (Brie?y describe the property to be searched or identi?l the person by name and address) Case NO. Four Premises and Two Electronic Devices, See Attached Affidavit and Riders APPLICATION FOR A SEARCH WARRANT - I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under mam penaltyofperjuryjhat 1 have reason to believe that on the following person or property (identi?J the person or describe the pr 156d?) Eidmfdingdiorgriibnbevices, See Attached Affidavit and Riders located in the Southern District of New York there is now concealed (identij?l the person or describe the property to be seized): PLEASE SEE ATTACHED AFFIDAVIT AND RIDERS. The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): l?f evidence of a crime; Sf contraband, fruits of crime, or other items illegally possessed; Mproperty designed for use, intended for use, or used in committing a crime; El a person to be arrested or a person who is unlawfully restrained. The search is related to a violation of: Code Section O?ense Description 18 U.S.C. 371, 1005, 1014, Conspiracy, false bank entries, false statements to a financial institution, 1343 and 1344, and wire fraud, bankfraud, and 52 USC 30116 and 30109 illegal campaign contributions The application is based on these facts: PLEASE SEE ATTACHED AND REDER. [if Continued on the attached sheet. Delayed notice of days (give exact ending date if more than 30 days: is requested under 18 U.S.C. 3103a, the basis of which is set forth on the attached sheet. Printed name and title Sworn to before me and signed in my presence. Date: 04/08/2018 ant?y 6 ?s signature City and state: CW K, 7, Hon. Henry B. Pitman, U.S. Magistrate Judge I I Printed name and title UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of the Application of the United 3 TO BE FILED UNDER SEAL States of America for a Search and Seizure Warrant for the Premises Known and Described 2 Agent Af?davit in Support of as (1) 502 Park Avenue ?\Iew Application for Search and Seizure York, New York 10022, (2) Michael Cohen? Warrant Office at 30 Rockefeller Plaza, 23rd Floor, New 3 York, New York 10112, (3) Safe Deposit Box Located at the TD Bank Branch at 500 Park 3 Avenue, New York, New York 10019, and (4) Loews Regency Hotel, 540 Park Avenue, Room 1728, New York, New York 10065, and Any 3 Closed Containers/Items Contained Therein, and the Electronic Devices Known and Described as 1) an Apple iPhone with Phone Number and (2) an Apple iPhone with Phone Number? Reference No. 2018R00127 SOUTHERN DISTRICT OF NEW YORK) 33.: Special Agent, Federal Bureau of Investigation, being duly sworn, deposes and says: I. Introduction A. Af?ant 1. I am a Special Agent with the Federal Bureau of Investigation I have been a Special Agent with the FBI since 2009. In the course of my experience and training in these positions, I have participated in criminal investigations into federal offenses involving a wide array of financial crimes, including frauds on financial institutions, as well as into offenses involving public corruption. I also have training and experience executing search warrants, including those involving electronic evidence. 2. I make this Af?davit in support of an application pursuant to Rule 41 of the Federal Rules of Criminal Procedure for a warrant to search the premises speci?ed below (the ?Subject 2 2017.08.02 Premises?) and the electronic devices speci?ed below (the ?Subject Devices?) for, and to seize, the items and information described in Attachments A, B, C, D, and F. This af?davit is based upon my personal knowledge; my review of documents and other evidence; my conversations with other law enforcement personnel; and my training, experience and advice received concerning the use of electronic devices in criminal activity and the forensic analysis of electronically stored information Because this af?davit is being submitted for the limited purpose of establishing probable cause, it does not include all 015 facts that-1 have learned?d?i?g?the course of my investigation. Where the contents of documents and the actions, statements, and conversations of others are reported herein, they are reported in substance and in part, except where otherwise indicated. B. The Subject Premises and Subject Devices 3. Subject Premises?1, Subject Premises?2, Subject Premises?3 and Subject Premises? 4 (collectively, the ?Subject Premises?) are particularly described as: a. Subject Premises?1 is Apartment .located inside the building at 502 Park Avenue, New York, New York 10022. The building located at 502 Park Avenue is a 32? ?oor brick residential building. Subject Premises-1 is located on the-floor of the building. Based on my review of New York City property records, I have learned that Michael Cohen and Laura Cohen own Subject Premises-l.1 Additionally, as described below, Subject Premises?1 is Cohen?s full-time residence. b. Subject Premises-2 is an of?ce located on the 23rd ?oor of the building at 30 Rockefeller Plaza, New York, New York 10112. The building located at 30 Rockefeller Plaza 1 As noted in?a, I have learned that on or. about October 28, 2015, Cohen transferred Subject Premises?1 into a trust. 3 2017.08.02 is a 66??oor office building thatspans the entire block between Sixth Avenue and Rockefeller Plaza. Subject Premises-2 is located on the 23rd ?oor of the building inside of the offices of the law firm Squire Patton Boggs. The office is assigned to Michael Cohen. As described below, Michael Cohen works and conducts meetings at Subject Premises-2. c. Subject Premises-3 is a safety deposit box located inside the TD Bank branch location at 500 Park Avenue, New York, New York 10019. Based on my review of records maintained by TD 13351:,1 have learned that the safety deposit box 1s approximately?veii?nchesb ten inches in size, and is marked as box- The safety deposit box is in the name of Michael Cohen and Laura Cohen. (1.. Subject Premises-4 is Room 1728 located inside the Loews Regency Hotel at 540 Park Avenue, New York, New York 10065. The building is a luxury hotel located on Park Avenue and 61st Street. Subject Premises-4 is located on the 17th ?oor of the hotel. Based on my review of emails obtained pursuant to search warrants described below, I have learned that on or about January 5, 2018, Cohen received an email from an employee of Loews Regency, which included a price quote for a long?term stay suite based on a three-month stay from January 8 to April 8, 2018.2 On or about January 29, 2018, Cohen sent an email to a Loews Regency employee, stating, in pertinent part: just spoke to my wife and she has scheduled the move for Thursday. Please mark down that we will be taking possession on Thursday, February 1st.? Based on my review of cell phone location data, I have learned that, over the past 24 hours, two cellular phones used by Cohen have been located in the vicinity of Subject Premises?4. In particular, on or about 2 Although the quoted price contemplated a three-month stay from January 8 to April 8, it appears that Cohen did not move in until February 1, and as of today, April 8, cellphone location information demonstrates that Cohen?s cellular phones are in still in the vicinity of Subject Premises?4. 4 2017.08.02 April 8, 2018, law enforcement agents using a ?triggerfish? device identi?ed Room 1728 as the room within the hotel in which the Subject Devices are most likely present.3 e. Therefore, I believe that Cohen is temporarily residing in Subject Premises-4. 4. Subject Device?1 and Subject Device-2 (collectively, the ?Subject Devices?) are particularly described as: a. Subject Device-1 is an Apple iPhone service?d by - Based on my review of records maintained by 1 have learned that Subject Device-1 is subscribed to Michael Cohen. Based on my review of cellphone location information maintained by 1 have learned that Subject Device-l is presently located in the Southern District of New York. b. Subject Device-2 is an Apple iPhone serviced by with the telephone number Based on my review of records maintained by 1 have learned that Subject Device-2 is subscribed to Michael Cohen. Based on my review of cellphone location information maintained by 1 have learned that Subject Device-2 is presently located in the Southern District of New York. 0. Based on my training, experience, and research, and from consulting the manufacturer?s and service providers? advertisements and product technical specifications available online, 1 know that the Subject Devices have capabilities that allow them to, among other things: make and receive telephone calls; save and store contact information; send and receive 3 Based on my conversations with these agents, I understand that it is also possible that the Subject Devices are one ?oor below, in Room 1628. However, as noted, I understand that Cohen received a price quote for a long-term stay suite and is residing there with his family. Based on my conversations with FBI agents conducting surveillance, I understand that Room 1728 appears to be a suite, whereas Room 1628 appears to be a standard room. 5 2017.08.02 emails and text messages; download and run mobile telephone applications, including call and messaging application such as WhatsApp, Signal, and Dust; take, send, and receive pictures and videos; save and store notes and passwords; and store documents. The Subject Offenses 5. For the reasons detailed below, I believe that there is probable cause to believe that the Subject Premises and Subject Devices contain evidence, fruits, and instrumentalities of violations of 18 use. 1005 (false bank institution), 1343 (wire fraud), and 1344 (bank fraud) (collectively, the ?Bank Fraud Offenses?), 52 U.S.C. 30116(a)(l)(A) and 30109(d)(l)(A)(l) (illegal campaign contributions) (the ?Campaign Finance Offenses?), and 18 U.S.C. 371 (conspiracy as it pertains to the other- Subject Offenses) (collectively, the ?Subject Offenses?). D. Prior Applications 6. The FBI and the United States Attorney?s Office for the Southern District of New York have been investigating several courses of criminal conduct by Michael Cohen. Cohen is an attorney who currently holds himself out as the personal attorney for President Donald Trump, and who previously served for over a decade as an executive in the Trump Organization, an international conglomerate with real estate and other holdings. 7. In connection with an investigation then being conducted by the Office of the Special Counsel the FBI sought and obtained from the Honorable Beryl A. Howell, Chief United States District Judge for the District of Columbia, three search warrants for emails and other content information associated with two email accounts used by Cohen, and one search warrant for stored content associated with an iCloud account used by Cohen. Speci?cally: 2017.08.02 a. On or about July 18, 2017, the FBI sought and obtained a search warrant for emails in the account (the ?Cohen Gmail Account?) sent or received between January 1, 2016 and July 18, 2017 (the ?First Cohen Gmail Warrant?). b. On or about August 8, 2017, the FBI sought and obtained a search warrant for content stored in the iCloud account associated with Apple ID -@gmail.com (the ?Cohen iCloud Account? and the ?Cohen iCloud Warrant?). c. On or about November 13, 20717, the FBI sought and?obtained?a?se'archv* warrant for emails in the Cohen Gmail Account sent or received between June 1, 2015 and November 13, 2017 (the ?Second Cohen Gmail Warrant?). I d. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the account (the ?Cohen or received between the opening of the Cohen Account4 and November 13, 2017 (the ?First Cohen Warran A 8. The SCO has since referred certain aspects of its investigation into Cohen to the USAO, which is working with the New York Field Of?ce. As part of that referral, on or about February 8, 2018, the SCO provided the USAO with all non-privileged emails and other content information obtained pursuant to the First Cohen Gmail Warrant, Second Cohen Gmail Warrant, and Cohen Warrant. On or about March 7, 2018, the SCO provided the USAO 4 Based on my review of this warrant and the af?davit in support of it, I know that the warrant did not specify a time period, but the affidavit indicated that, pursuant to court order, the service provider had provided non-content information for the Cohen Account that indicated that the account contained emails from the approximate period of March 2017 through the date of the warrant. 2017.08.02 with all non?privileged content obtained pursuant to the Cohen iCloud Warrant.5 A ?lter team working with the SCO had previously reviewed the content produced pursuant to these warrants for privilege. 9. On or about February 28, 2018, the USAO sought and obtained search warrants for emails in the Cohen Gmail Account and the Cohen Account, among other accounts, sent or received between November 14, 2017 and February 28, 2018 (the ?Third Cohen Gmail Warrant? and the ?Second Cohen IVIDCPC content produced subject to an ongoing review for privilege by an SDNY ?lter team.6 10. The emails search warrants described above are referred to collectively as the ?Cohen Email Warrants.? 11. On or about April 7, 2018, the USAO and FBI sought and obtained a warrant for prospective and historical cellphone location information for Subject Device?1 and Subject I Device?2. On or about April 8, 2018, the USAO and FBI sought and obtained authority to employ an electronic technique, commonly known as a ?trigger?sh,? to determine the location of Subject Device-1 and Subject Device-2. II. Probable Cause A. Overview 12. The United States Attorney? 5 Of?ce for the Southern District of New York and FBI are investigating, among other things, schemes by Target Subject Michael Cohen to defraud multiple banks from in or about 2016 up to and including the present, and to make an illegal 5 The SCO had previously provided a subset of this nonuprivileged content on or about February 2, 2018. 6 On or about February 28, 2018 and April 7, 2018, the USAO and FBI sought and obtained Rule 41 search warrants authorizing the search of emails and content obtained pursuant to previously issued warrants for additional subject offenses. 2017.08.02 campaign contribution in October 2016 to then?presidential candidate Donald Trump?. As noted, Cohen is an attorney who currently holds himself out as the personal attorney for President Donald Trump, and who previously served for over a decade as an executive in the Trump Organization, an international conglomerate with real estate and other holdings. 13. The investigation has revealed that Cohen has made affirmative misrepresentations in and omitted material information from financial statements and other disclosures that Cohen provided to ?multiple. banks in connection with a transaction relieve Cohen of approximately $22 million in debt he owed on taxi medallion loans from the banks. As set forth in detail below, in these financial statements, and in his oral and other written statements to these banks, Cohen appears to have intentionally misrepresented his ability to pay cash by failing to disclose cash he began receiving in 2017 from new consulting work; (ii) significantly understated his total holdings of cash and cash equivalents; failed to disclose tens of thousands of dollars he received in interest income, and (iv) failed to inform the banks from which he was seeking debt relief that he had agreed to make a $3.8 million cash payment to a third party, - in connection with- acquisition of the taxi medallions securing Cohen?s debt. By making these misrepresentations and material omissions, Cohen avoided making payments on his loans, and attempted to fraudulently induce the banks to relieve him of certain repayment obligations and personal guarantees that Cohen and his wife had signed. 14: Additionally, the investigation has revealed that shortly before the 2016 presidential election, Cohen made a payment of $130,000 from a limited liability corporation to Stephanie Clifford, an individual who is alleged to have had an extramarital affair with then?candidate Trump. This paymentwas made to Clifford in exchange for an agreement not to make any public disclosures about her alleged affair with Trump. As set forth below, there is 2017.08.02 probable cause to believe that Cohen made this payment to Clifford for the purpose of in?uencing the presidential election, and therefore that the payment was an excessive in?kind contribution to the Trump campaign. 15. Based on my review of emails obtained from the Cohen Email Warrants, information obtained pursuant to the iCloud Warrant, and documents produced pursuant to subpoenas, as well as my review of public sources, I have learned that Cohen has used the Subject I Premises to receive documents related to the transactionwintendewdto relieve Cbhen of his taxi medallion debt, receive documents and/or conduct meetings related to his consulting work, (0) receive documents and/or conduct meetings relating to his ?nances and assets, some of which, as noted above and as detailed further herein, he has concealed from the banks in connection with the re?nancing of his taxi medallion debt, receive and send documents relating to his payment to Clifford, and (6) house and operate electronic devices that were utilized in connection with, among other things, the taxi medallion transaction, Cohen? consulting work, and his payment to Clifford. Speci?cally, as described below, Subject Premises-1 likely contains evidence concerning Cohen?s taxi medallion loans, his negotiations with banks, his personal ?nances, his consulting work, his tax returns, and his payment to Clifford, as well as electronic devices containing such evidence, all of which constitute or contain evidence of the Subject Offenses. Additionally, as described below, Subject Premises?2 likely contains evidence relating to Cohen?s consulting work, his ?nances, and his payment to Clifford, as well as electronic devices containing such evidence. Subject Premises-3, as described below, likely contains evidence relating to Cohen?s assets and ?nances, including assets that may not have been disclosed to banks in connection with the re?nancing of Cohen?s taxi medallion debt or documents relating to such assets, and documents or evidence related to Cohen?s payment to Clifford. Subject Premises?4 likely contains electronic 10 2017.08.02 devices, including Subject Device?1 and Subject DeviCe?Z, which themselves contain evidence of the Subject Offenses, including concerning Cohen?s taxi medallion loans, his negotiations with banks, his personal ?nances, his consulting work, his tax returns, and his payment to Clifford. Accordingly, and as set forth in more detail below, there is probable cause to believe that the Subject Premises and Subject Devices will include evidence of the Subject Offenses. B. Probable Cause Regarding Subjects? Commission of the Subject Offenses7 b?raud'SElieme Cohen ?s Statements to Sterling National Bank 16. As set forth in detail below, in 2014, Cohen, through LLCs controlled by him and his wife, Laura Cohen, entered into a series of loans from Sterling National Bank (?Sterling?) and the Melrose Credit Union (?Melrose?), secured by taxi medallions, for approximately $20 million. Though entered into by LLCs, the loans were also secured by personal guarantees in the names of both Cohen and his wife. Over time, as the taxi industry wealrened and the medallions lost value, Cohen sought to renegotiate the terms of those loans and] or relieve himself from their obligations, including the personal guarantees. As part of that effort, Cohen made a series of representations to Sterling and Melrose about his net worth, assets, available cash and income, among other things. Speci?cally, based on my review of records maintained by Sterling and Melrose, and public sources concerning the taxi industry and the value of taxi medallions, as well as my participation in interviews with a Sterling executive vice-president (the ?Sterling Employee?1?) and two other 7 In the following recitation of probable cause, I frequently refer to phone calls or text messages involving Cohen. The text messages described herein as sent or received by Cohen were all sent or received from the telephone numbers associated with Subject Device-l or Subject Devicen2. The vast majority of the phone calls described herein made or received by Cohen were made or received by the telephone numbers associated with Subject Device-1 or Subject Device-2, although in certain limited instances Cohen used a landline or other phone. 11 20170302 Sterling employees (?Sterling Employee?2? and ?Sterling Employee?3?), I have learned, among other things, the following: a. Taxi medallions are small metal plaques af?xed to taxis. Without a medallion, it is illegal to operate a taxi in cities with medallion systems, such as New York City. Cohen and his wife own multiple LLCs that collectively own 32 taxi medallions (each LLC owns two medallions).8 Cohen?s purchase of these New York taxi medallions was originally ?nanced by operator, and leased his medallions to a third party. That third party made payments to Cohen, who in turn used some of those proceeds to make his loan payments to Capital One. b. In early 2014, Cohen became a customer of Sterling when he sought to re?nance a mortgage on a rental property?that he owned. In or around April 2014, Cohen raised with Sterling the prospect of re?nancing his taxi medallion loans, which were then at Capital One. By in or about September 2014, Cohen began negotiating a lending transaction with Sterling that would allow Cohen to pay off his loans at Capital One and borrow more money from the then-increase in value of the medallions. According to Sterling Employee-1, in 2014, prior to the recent upheaval in the taxi industry~?as a result of the emergence of ride-sharing services, such as Uber?taxi medallion loans were Viewed by banks and investors as safe, short term credits, as the market value of taxi medallions was consistently rising. Consequently, taxi medallion loans#like the loans held by Cohen?were frequently re?nanced at increasing amounts as the value of the medallions rose. According to Sterling Employee?1, borrowers typically cashed out the increase in the loan amOunt 8 One of these companies, Mad Dog Cab Corp., was jointly owned by Sondra Cohen, who I believe is Cohen?s mother. 12 20170802 and used the additional funds for other purposes. Cohen appears to have followed this approach in 2014, when he agreed to re?nance his medallion loans for approximately $22 million, which? according to letters from Capital One in Sterling?s ?les#was greater than his previous debt at Capital One Bank ($21 million, of which $14.6 million was a line of credit to Cohen). This allowed Cohen to cash out the proceeds ?om the transaction. c. Based on my review of records maintained by Sterling, 1 have learned that on or about December 8, 2014, each ofCBhE?? Sixteen taxi medallion LECs and promissory notes with Sterling for the principal sum of $1,375,000, with repayment due on December 8, 2016. Each. loan was signed by Michael or Laura Cohen, depending on who was the sole shareholder of the LLC. The address listed for each of the LLCs was the address for Subject Premises?1. The loans were also each secured by a security agreement, dated the same day, making the medallions collateral for the notes. To give Sterling additional security, Michael and Laura Cohen signed personal guarantees and confessions of judgment, giving Sterling the right to pursue collection against the Cohens? personal assets were their corporations to default under the loan agreements. The personal guaranty agreements stated that the LLCs had of?ces at the address for Subject Premises-1, and contained a notice provision that stated that any notices required by the agreements should be mailed to Subject Premises?1. In total, Sterling agreed to lend approximately $22 million to the Cohens? companies. d. Pursuant to participation agreements, Sterling transferred 45 percent of Cohen?s taxi medallion debt to Melrose? 9 Melrose, which had a business principally focused on taxi medallion loans, is now in conservatorship by the National Credit'Union Administration 13 2017.08.02 e. In evaluating Cohen?s requested re?nancing of the taxi medallions, Sterling (and Melrose, consistent with its participation in the deal) conducted due diligence. ~At Sterling?s request, Cohen provided Sterling with a statement of ?nancial condition, dated August 1, 2014 (the ?August 2014 Financial Statement?), which indicated that Cohen had $100,740,000 in total assets, $23,550,000 in total liabilities, and a net worth of $77,190,000.10 From my review of a Sterling credit memorandum, dated September 29, 2014, I know that Sterling viewed the transaction favorably because,iaccounting for'loan payments, cash 131ch from the?me?dalli?ons were projected to be positive, the value of the collateral (as estimated by Sterling) exceeded $42 million, and the net worth of Cohen?who was the direct obligor under the guarantee agreements?was over $77 million, An internal Sterling credit and risk rating analysis report, dated October 20, 2014, recommended approval of the loans for substantially the same reasons. f. Based on my review of records maintained by Sterling and public sources, I have learned that over time, the collateral backing Cohen?s loans (taxi medallions) lessened in value due to the rise in ride-sharing companies. Additionally, Cohen began falling behind on loan payments to Sterling and Melrose. 1 know from records maintained by Sterling and an interview with Sterling Employee?2 that, beginning in or around September 2015, Cohen told Sterling, in sum and substance, that the individual leasing Cohen?s medallions had fallen behind in making payments to Cohen, and that as a result, the cash ?ow from his taxi medallions had been reduced, leaving him with a shortfall of approximately $16,000 each month. For instance, I have reviewed an email from Sterling Employee?2, dated September 9, 2015, summarizing a call with Cohenm? which according to the email and toll records for Cohen?s cellphone occurred on September 8, 10 Cohen subsequently provided Sterling with a revised statement of ?nancial condition, also dated August 1, 2014, which reported assets of $99,420,000, total liabilities of $23,550,000, and a net worth of $75,870,000. 14 2017.08.02 2015?during which Cohen told Sterling Employee?2, in sum and substance, about his cash ?ow problems and a shortfall of approximately $16,000. In that same email, Sterling Employee?2 commented that despite Cohen?s statements, his personal ?nancial information ?indicate[d] a strong ability to make up the difference in payments.? Cohen, however, according to Sterling Employee?2, pushed the bank for a reduction in Cohen?s payments. g. From my review of records maintained by Sterling and my participation in an ?interview again on September 28, 2015, and that during the call Cohen stated, in sum and substance, that the individual to whom Cohen leases the medallions had again reduced payments to Cohen. I know from my review of records maintained by Sterling that between in or about September 2015 and November 2015, Sterling raised the possibility?both internally and with Cohen?of Cohen posting his real estate holdings, personal residence, or some other collateral as additional security for the banks.11 According to these records, however, Cohen resisted these requests. From my review of loan documents and records maintained by Sterling, I know that in or about November 2015, as a result of Cohen?s representation that he was not earning sufficient returns on his medallions to cover interest payments, Sterling and Melrose agreed to amend their loans with Cohen by, among other things, reducing the interest rate Cohen paid to Melrose and extending the loan maturity date to December 8, 2017. h. I know from interviews with Sterling Employee-1 and Sterling Employee-2, as well as emails I have reviewed, that in or about October 2016, Cohen told Sterling Employee-1 that. Cohen had a potential buyer of his taxi medallions, named Fred Weingarten, who would agree to 11 Based on my review of property records, I know that on or about October 28, 2015, around the time period when Sterling raised the possibility of Cohen posting his personal residence?? Subject Premises?l?as collateral, Cohen transferred Subject Premises?1 into a trust. 15 2017.08.02 assume Cohen?s debt with Sterling and Melrose. Based on my review of records maintained by Sterling, as well as the interviews with Sterling Employee?1 and Sterling Employee?2 referenced above, I know that by or before October 2016, Cohen had entered into negotiations to sell his sixteen corporate taxi medallion entities to for the balance of the loans, which at the time was $21,3 7 6,000. I know from my review of records maintained by Sterling, and my participation in an interview with Sterling Employee?2, that as a condition of the transfer of the medallion loans?4and'because Sterling was unfamiliarwith'I??m?w 2222.-.; -?Sterling requested that Cohen make a substantial principal payment on the loan, of approximately one million dollars, prior to the transfer. Cohen rejected this request initially. But on or about January 31,2017, Cohen told Sterling Employee?1, in sum and substance, that he would make a one million dollar principal reduction payment in order to move forward with the medallion transfer deal with- Indeed, in an email sent by Cohen to Sterling Employee-2 on or about February 22, 2017, Cohen con?rmed that he ?agreed to pay down 1 million from the loan amount.? i. Pursuant to the participation agreements between Sterling and Melrose, Sterling was required to secure Melrose?s agreement to participate in the transfer of the taxi medallion debt from Cohen to - On or about April 17, 2017, Sterling sent a memorandum to Melrose summarizing the terms of the proposed transaction, and noting the requirement that Melrose agree to the terms. On or about May 2, 2017, Sterling Employee-1 told that Melrose had agreed to the deal in principle, and that Sterling would be sending the parties a term sheet shortly. j. In order for the banks to conduct diligence and evaluate the proposed transaction fully, they requested financial information from the parties. On or about June 7, 2017, Sterling 16 2017.08.02 Employee-1 emailed Cohen to request an ?updated personal ?nancial statement,? completed jointly with Cohen?s wife, and Cohen?s most recent federal income tax return. On or about June 8, 2017, Cohen emailed Sterling Employee?l a Sterling personal ?nancial statement form that had been ?lled out by hand, which referenced a statement of ?nancial condition, dated May 1, 2017 (the ?May 2017 Financial Statement?) that was also attached. The May 2017 Financial Statement included a cover letter from Cohen?s accountant, Jeffrey Getzel, stating, in sum and substance, that the information in the statement-came from Cohen and that Getzel?lia?d not con?rmedits accuracy or completeness. The May 2017 Financial Statement stated that Cohen had total assets of $41,955,000, total liabilities of $39,130,000, and a net worth of $2,825,000. The May 2017 Financial Statement indicated that COhen?s assets were comprised of $1,250,000 in cash, $26,155,000 in closely held companies (such as the taxi medallion entities and his real estate holdings), $3,200,000 in real estate investments, and his $11,000,000 personal residence.12 k. Based on my review of reports of law enforcement interviews of Sterling Employee-1, 1 have learned that Sterling Employee-1 reviewed the May 2017 Financial Statement with Cohen to, among other things, verify its accuracy, and Sterling Employee~1 asked Cohen about speci?c line items on the ?nancial statement, including the cash amount, value of medallions, and . total liabilities. Cohen stated to Sterling Employee?l, in sum and substance, that the May 2017 Financial Statement was accurate. 1. On or about August 16, 2017, Sterling Employee-l emailed Cohen and Allen Weingarten, attaching a non?binding term sheet memorializing the potential transaction between 12 Based on my review of Cohen?s ?nancial statements, I know that the precipitous decline in assets ?om his 2014 ?nancial statement to his 2017 ?nancial statements can be explained primarily by reported depreciation in the value of Cohen?s real estate assets and medallion investments. 17 2017.08.02 Sterling, Melrose, Cohen, anc'_ The term sheet included a cover letter addressed to Cohen at Subject Premises-1. The parties negotiated the provisions of the term sheet and, on or about September 5, 2017, Sterling Employee-1 sent i_and Cohen a copy of the executed term sheet. According to the term sheet, 1-0u1d borrow $20,000,000 from Sterling and Melrose, to be secured by the medallions that _vas to acquire from Cohen. m. As part of the agreement," according to the term sheet, principal (which is what would remain after the $20,000,000 payment on the outstanding loan balance) would be repaid by Cohen and the two banks, with Cohen paying ?fty percent and the banks dividing the remaining half of the balance. Based on my review of an internal Sterling credit memorandum, dated October 4, 2017, the parties reached a preliminary agreement that Cohen would pay $632,956 of the remaining $1,265,912 principal loan balance, and Sterling and Melrose would absorb $357,167 and $275,789, respectively, in the form of charge?offs. According to Sterling Employee? 1, Sterling was willing to divide the repayment of the outstanding principal balance?despite its prior insistence that Cohen make a principal pay?down of at least one million dollars?because Cohen represented on a telephone call with Sterling Employee-l in sum and substance, that he had insuf?cient liquidity to pay the full outstanding principal balance. As part of the agreement, Sterling and Melrose also agreed to relieve Cohen and his wife of the personal guarantees that they made on behalf of the LLCs. Thus, after completing the -transaction, Cohen would no longer have hadany outstanding obligations to Sterling or Melrose. n. Based on my review of emails sent by Sterling employees, I have learned that because the transaction between the parties was subject to full credit underwriting by Sterling and Melrose (as well as Melrose?s regulators at NCUA), in August and September 2017, Sterling 18 2017.08.02 required and requested additional ?nancial statements and tax returns for Cohen and - for its credit underwriting process. In response to Sterling?s requests, on or about September 25, 2017, Cohen emailed Sterling Employee-2 a copy of his 2016 tax return. The tax return listed Cohen?s mailing address as Subject Premises-1. Additionally, on or about October 5, 2017, Cohen re?sent Sterling Employee-2 a copy of his May 2017 Financial Statement. A day later, on October 6, 2017, Cohen emailed Sterling Employee-2 a statement of ?nancial condition, dated September 30, 20.17 (thet?September 2017 Financial Statement?). 0. Like the May 2017 Financial Statement, the September 2017 Financial Statement included a cover letter from Jeffrey Getzel, Cohen? accountant, stating, in sum and substance, that the information in the statement came from Cohen, and that Getzel had not con?rmed its accuracy or completeness. The September 2017 Financial Statement stated that Cohen had total assets of $33,430,000, total liabilities of $45,630,000, and a negative net worth of $12,200,000.? Notably, unlike Cohen?s May 2017 Financial Statement, the September 2017 Financial Statement represented to Sterling that Cohen had a negative net worth. The September 2017 Financial Statement indicated that Cohen?s assets were comprised of $1,250,000 in cash, $17,630,000 in closely held companies (including the taxi {medallion entities and his real estate holdings), 14 $3,200,000 in real estate investments, and his $11,000,000 personal residence (which, for thej?rst 13 Based on my review of Cohen?s ?nancial statements, I know that this further decline in assets can be explained primarily by reported depreciation in the value of Cohen?s real estate assets and medallion investments. 14 Notably, the September 2017 Financial Statement valued each of Cohen?s thirty~two New York taxi medallions at approximately $180,187.50, which was considerably less than the $650,000 valuation ascribed to each medallion in the Cohen-Weingarten term sheet. 19 2017.08.02 time, he indicated was held by a trust).15 The September 2017 Financial Statement included assets and liabilities not held in Cohen?s name, such as various entities associated with his taxi medallions and some of his reallestate investment entities. p. From my participation in an interview with Sterling Employee-2, and my review of records maintained by Sterling, I have also learned that around the time Cohen provided Sterling with these ?nancial statements?Le, in or around September 2017-?Cohen stopped paying payments on his taxi 2, Cohen informed Sterling, in sum and substance, that he had insuf?cient funds to pay the principal and interest payments on his medallion loans. By in or about December 2017, Sterling and Melrose had not been paid approximately $276,937.92 in principal and interest payments. on the medallion loans. Based on Cohen?s ?nancial condition as conveyed in the September 2017 Financial Statement, and his delinquency in making payments to Sterling, among other things, the bank?s credit underwriting committee determined (and memorialized in a December 2017 memorandum) that the was favorable for the bank that is, that ?_would be a better borrower than Cohen. q. On or about December 26, 2017, Sterling sent Cohen a demand letter requesting the immediate receipt of past?due loan payments. The demand letter was addressed to Cohen at Subject Premises-1. On December 29, 2017, Sterling sent Cohen a letter stating that he was in default under the loans between Sterling and Cohen?s medallion corporations. The notice of default was addressed to Cohen at Subject Premises-1. Cohen did not make an immediate payment on the loans, but instead sent an e-mail to Sterling Employee-l on or about January 24, 2018, 15 Based on my review of property records maintained by the City of New York, and my participation in an interview with Getzel, I know that in 2015, Cohen transferred his residence to a trust. He did not disclose that transaction to Getzel or Sterling until in or about September 2017. 20 2017.08.02 stating that during the closing of the Cohen would ?bring all payments up to date as well as deposit the payoff differential.? Cohen also requested by email on January 24, 2018, that at the closing of the Cohen?J- transaction, Sterling provide a letter stating that all of Cohen?s debts have been satis?ed and that Cohen?s personal guarantees of the medallion loans had been terminated. r. The Cohen?J-transaction, however, did not close. On or about January 29, 2018, the - attorney emailed attorneys for Sterling and stated?th'at??afthi?s?tim ?vmw?r there is no deal with Michael Cohen. Some of the numbers have changed and we are not prepared to go forward.? s. Based on my participation in the interview with Sterling Employee?2 and my review of records maintained by Sterling, I know that after the Cohen--deal fell apart, Sterling assigned Cohen?s loans to Sterling Employee-3, who specializes in collecting on defaulting loans. From my participation in an interview with Sterling Employee?3, my review of telephone call notes taken by Sterling Employee?3, and my review of telephone records, I know that Sterling Employee-3 spoke several times to Cohen on or about January 30, 2018 about paying down and/or restructuring Cohen?s outstanding taxi medallion loans. On the calls, which in total lasted more than an hour, Cohen stated in sum and substance that he did not have more than $1,250,000 to pay toward the medallion loans. On the call, in the course of reviewing the failed Cohen- transaction, Sterling Employee?3 questioned Cohen about the price -Jas to have paid for each medallion, and whether there was a side agreement between Cohen and - Cohen denied that there was any side agreement with - t. On or about January 31, 2018, Cohen emailed Sterling Employee-3 and proposed paying $500,000 to bring the loans current and $750,000 to bring the principal balance to 21 2017.08.02 $20,500,000. Cohen also suggested revised interest payment amounts. The signature block on the email indicated that Cohen?s address was the address for Subject Premises-2. On or about January 31, 2018, Sterling Employee-3 responded to Cohen and stated, in sum and substance, that Cohen would need to pay the entirety of the overdue payments and pay down the principal balance of the loan to $20,000,000 (in total, a payment of approximately $1,750,000), and would need to make larger interest payments. ?[p]ayment of $1.250m which ALL can be used to pay down principal, if [Sterling] will waive past due amounts,? but stated do NOT have more than the $1.25 0m.? (Emphasis in original.) Cohen also stated, in sum and substance, that he had insuf?cient ?nancial resources to post additional collateral or pre?fund payments. The signature block on the email indicated that Cohen?s address was the address for Subject Premises-2. Based on my participation in an interview with Sterling Employee?3, I have learned that since January 30, 2018, Sterling has continued to renegotiate the medallion loans with Cohen based on Cohen?s representations about his current ?nancial position. In particular, according to Sterling Employee?3, Cohen and Sterling have an agreement in principal to restructure Cohenis loans based in part of Cohen?s agreement to make a principal payment of approximately $750,000, to make a payment of $500,000 to become current on interest payments, and to post $192,000 in cash collateral for his future payments on the loan. Cohen also agreed to pledge an interest he had in a property. Sterling Employee-3 has stated that had Cohen indicated he had more than $1,250,000 available to him, Sterling would have, among other things, negotiated for a larger reduction to the principal amount of the loan. 22 2017.08.02 (ii) Cohen Made Material Misrepresentations About His Finances to Banks Cohen Concealed from Sterling and Melrose Cash Derived ?rom Consulting Work 17. As set forth in detail below, despite multiple written and oral representations by Cohen to Sterling (and, by extension, Melrose?) that he had insuf?cient funds to pay down the principal balance of the medallion loans, make payments, or pay past?due amounts, it appears that between 2016 and the present, Cohen opened and maintained bank accounts at First consulting payments in these accounts, which he did not disclose to Sterling. Cohen set up these accounts and received these funds during the very period in which he made disclosures to Sterling about his personal ?nances (including his assets and liabilities) and his ability to make payments on the medallion loans. In these disclosures to Sterling?and despite being asked about these bank accounts by his accountant?Cohen misled the bank by claiming he had insuf?cient liquidity to satisfy his obligations or meetthe bank?s demands, while withholding information about these ongoing revenue streams and liquid ?nancial assets at First Republic. 18. Speci?cally, based on my- review of documents and bank records produced pursuant to a subpoena by First Republic, and my participation in and review of reports of interviews with a First Republic sales manager (?First Republic Employee-1?) and a First Republic senior managing director (?First Republic I have learned, among other things, the following: ?3 Based on my review of a report of an interview conducted with an employee of Melrose, I have learned that, pursuant to the participation agreement between Sterling and Melrose, Cohen? 3 ?nancial statements and other records in Sterling?s possession were forwarded to Melrose so that Melrose could make a determination as to whether to approve of the Cohen-? transaction. Based on my review of reports of interviews with Melrose employees, I also know that Cohen called emplOyees at Melrose regarding the Cohen??_transaction. 23 2017.08.02 a. Cohen and his wife have been customers of First Republic since approximately June 2011. Cohen controls several checking and loan accounts at First Republic, some in his own name and others in the names of corporate entities. According to First Republic?s know?your? customer records on Cohenfi his primary physical address is the address for Subject Premises?1. On or about October 26, 2016, in Manhattan, New York, Cohen opened a new checking account at First Republic in the name of Essential Consultants LLC (the ?Essential Consultants IAcco-un Cohen Was the only authoriiEdsignatory "on the account. According to account opening documents, the primary address for Essential Consultants LLC was the address for Subject Premises-1. When Cohen opened the Essential Consultants Account, First Republic Employee-1 conducted an in?person interview of Cohen. In response to a series of know-your? customer questions about the purpose of the account?the answers to which First Republic Employee?1 entered into a formlg?Cohen stated, in sum and substance, that he was opening Essential Consultants as a real estate consulting company to collect fees for investment consulting work, and all of his consulting clients would be domestic individuals based in the United States. Cohen also stated,?in sum and substance, that his purpose in setting up the account was to keep the revenue from his consulting business?which he said was not his main source of incomewseparate from his personal ?nances. As set forth below, there is probable cause to believe that Cohen?s statements about the intended purpose of the account and source of funds for the account were false. Speci?cally, as described below, the account was not intended to receive?and does not 17 Certain ?nancial institutions are required to conduct such procedures pursuant to the Bank Secrecy Act and its implementing regulations. See 31 U.S.C. 5318; 31 C.F.R. 1020.220. 18 First Republic Employee-1 ?rst ?lled out the form on the day he interviewed Cohen, October '26, 2016. On or about December 19, 2016, at the request of bank compliance personnel, First Republic Employee?1 updated the form to add more detail about Cohen?s statements. 24 2017.08.02 appear to have receivedwmoney in connection with real estate consulting work; in addition, the account has received substantial payments from foreign sources. c. I know from my review of First Republic bank records that were scheduled by an FBI forensic accountant that after Cohen opened the Essential Consultants Account, Cohen received payments into that account from foreign businesses and entities that do not re?ect the stated client profile for the residential and commercial real?estate consulting services. Specifically, from my review of the Essential Consultants Account schedule ?a?ffd?blic scurces, I"know the following: i. Beginning on or about January 31, 2017, Cohen began receiving payments of $83,33 3 into the Essential Consultants Account from an entity called Columbus Nova LLC. According to public sources, Columbus Nova is an investment management firm controlled by Renova Group, an industrial holding company based in Zurich, Switzerland that is controlled by Russian national Viktor Vekselberg. From January 2017 to August 2017, the Essential Consultants Account received seven payments totaling $583,332.98 from Columbus Nova LLC. ii. Beginning on or about April 5, 2017, the Essential Consultants Account began receiving payments from Novartis Investments, SARL, which I believe to be the in?house financial subsidiary of the Swiss pharmaceutical company Novartis'lnternational AG (?Novartis?). Between April 2017 and February 2018, the Essential Consultants Account received eleven wire payments from a Swiss bank account held in the name of Novartis, each in the amount of $99,980, for a total of $1,099,780. Beginning in or about April 2017, the Essential Consultants Account started receiving wire payments from a bank account associated with the telecommunications company Inc. Speci?cally, on or about April 14, 2017, sent $100,000 to the 25 2017.08.02 Essential Consultants Account and, from in or about June 2017 to in or about January 2018, the Essential Consultants Account received ten $50,000 payments from In total, sent $600,000 to the Essential Consultants Account. iv. On or about May 10, 2017, June 9, 2017, July 10, 2017, and November 27, 2017, the Essential Consultants Account received four deposits in the amount $150,000 (totaling $600,000) from a bank account in South?Korea. The account holder from which the money was produces and sells fixed-wing aircraft, helicopter aircraft, and satellites to the United States Department of Defense, ameng other customers. v. On or about May 22, 2017, the Essential Consultants Account received a $150,000 deposit from an account at Kazkommertsbank, a Kazakhstani bank. The listed account holder at Kazkommertsbank was a second Kazakhstani bank named BTA Bank, A0. A message accompanying the wire payment indicated that the payment was a consulting fee as per Inv ETA-101 DD May 10, 2017 consulting agreement DD 08 05 2017 CNTR 08/05/2017.? vi. In'total, from on or about January 31, 2017 to on or about February 1, 2018, the Essential Consultants Account received approximately $3,033,112.98 in transfers and checks from the aforementioned entities. As of on or about January 10, 2018, the balance in the Essential Consultants Account was $1,369,474.23. Cohen?s withdrawals from the Essential Consultants account reveal that it was used for largely personal purposes, including to pay, among other things, American Express bills and fees from ?the Core Club,? a private social club in New York. d. On or about April 4, 2017, Cohen opened another new checking account at First Republic, this one in the name of Michael D. Cohen Associates, PC. (the Account?). 26 2017.03.02 Cohen was the only authorized signatory on the account. According to account opening documents, the primary address for Account was the address for Subject Premises?1. Among other things, the Account received ten wire transfers and one check from an account in the name of Squire Patton Boggs, a law ?rm. As noted above, Subject Premises-2 is located inside the New York of?ce of Squire Patton Boggs. In total, from on or about April 5, 2017, to on or about January 2, 2018, the Account received $426,097.70 in deposits, and the balance in the account as of January 2, 2018', was never disclosed any of the balance in the Essential Consultants or accounts to Sterling during the negotiations with respect to the - transaction or the subsequent loan re?nancing negotiations, including in his May 2017 Financial Statement and September 2017 Financial Statement. 19. Based on my review of emails that were seized pursuant to the Cohen Email warrants, and my review of reports of interviews with employees of and Novartis, it appears that the aforementioned payments to the Essential Consultants Account and Account were for political consulting work, including consulting for international clients on issues pending before the Trump administration. Speci?cally, from my review of emails from the Cohen Gmail Account, the Cohen Account, and public sources, I have learned the following: a. On or about April 28, 2017, Cohen sent an email to an individual whom I believe is af?liated with KAI. In the email, Cohen attached a ?Consulting Agreement? between KAI and Essential Consultants dated as of about May 1, 2017. The agreement indicates that Essential Consultants had the address of Subject Premises?2. The document indicates that Essential Consultants would render ?consulting and advisory services, as requested? by KAI, and that KAI would pay Essential Consultants ?a consulting fee of One Million Two Hundred Thousand 27 2017.08.02 US Dollars,? disbursed through eight $150,000 installments between May 2017 and December 2017. I have also reviewed invoices in amounts of $150,000 that Cohen emailed to an individual whom I believe is af?liated with KAI. At the top of the invoices the address listed for Essential Consultants is the address for Subject Premises-2. . b. On or about May 8, 2017, Cohen sent an email to an individual whom I believe is af?liated with BTA Bank. The signature block on Cohen?s email listed ?Essential Consultants and ?Michael DiCohen Associates, and providE'dThe address fde?bject?Premises~ 2. In the email, Cohen attached a document purporting to be a ?Consulting Agreement? between BTA Bank and Essential Consultants dated as of about May 8, 2017. The agreement indicates that Essential Consultants had the address of Subject Premises~2. The document indicates that Essential Consultants would render ?consulting and advisory services? to BTA Bank, and that BTA Bank would pay Essential Consultants ?a consulting fee of One Million Eight Hundred Thousand US Dollars,? disbursed through payments'of $150,000. On or about May 10, 2017, Cohen sent an email to an employee of BTA Bank, and attached to the email an invoice to BTA Bank in the name of Essential Consultants, with the address of Subject Premises- 2. The invoice contemplated a $150,000 payment to Essential Consultants for a consulting fee.? c. On or about January 23, 2017, Cohen appears to have entered into a consulting agreement with which contemplates that Essential Consultants ?shall render consulting and advisory services to and that would ?advise [Essential Consultants] of those issues and matters with respect to which Services desires [Essential Consultants]?s assistance and advice.? The agreement indicates that Essential Consultants had the address of Subject Premises? 1. The contract calls for ?to pay the Consultant for his services . . . a consulting fee of Fifty 28 2017.08.02 Thousand ($50,000) Dollars . . . per mont Based on my review of reports of interviews with employees, I have learned that retained Cohen to consult on political issues, including net neutrality, the merger between and Time Warner, and tax reform. d. On or about March 1, 2017, Cohen appears to have entered into a contract between Novartis and Essential Consultants, which provides that Essential Consultants will ?provide consulting and advisory services to Novartis on matters that relate to the repeal and replacement of otheriissueswmutual-ly? Consultants] and Novartis.? The contract provides for a ?consulting fee of One Million Two Hundred Thousand ($1,200,000) US dollars,? to be paid to Essential Consultants in equal installments over the course of a year. Based on my review of reports of interviews with Novartis employees, I have learned that Novartis retained Cohen to provide political consulting services and to gain access to relevant policymakers in the Trump Administration. e. In or about February 2017, Cohen began negotiating the terms of a ?strategic alliance? with Squire Patton Boggs. On or about March 4, 2017, Squire Patton Boggs emailed Cohen a ?strategic alliance agreement.? Under the terms of the agreement, Cohen agreed to generate business for the law ?rm, and Squire Patton Boggs agreed to pay to Cohen ?an annual strategic alliance fee of $500,000, payable in twelve (12) equal installments.? Squire Patton Boggs also agreed to provide Cohen with ?dedicated and segregated of?ce space in [Squire Patton Boggs?s] New York and Washington DC. of?ces, which of?ce space shall be physically separate from [Squire Patton Boggs?s] of?ces and have locked doors and its own locked ?le cabinets.? On or about April 3, 2017, Squire Patton Boggs announced on its website that is had formed a ?strategic alliance? with Michael D. Cohen Associates and would ?jointly represent clients.? 29 2017.03.02 20. Despite the signi?cant amount of money that Cohen received into the Essential Consultants Account and the WCSLA Account, and the cash balance in both accounts, Cohen did not disclose that information to Sterling or Melrose. Speci?cally, based on my review of documents provided by Getiel (as noted above, Cohen?s accountant at the time), my participation in an interview with Getzel, and my review of notes ant?I have learned the following: meeting, Cohen told Getzel, in sum and substance, that he had set up a law practice called Michael D. Cohen Associates RC, and a consulting company called Essential Consultants LLC. Cohen told Getzel, in sum and substance, that he expected to earn $75,000 per month in connection with his law practice, and that he expected gross revenues for the consulting business to be between ?ve and six million dollars annually. b. In or about October 2017, if not earlier, Getzel was preparing a personal ?nancial statement for Cohen. On or about October 6, 2017, Getzel sent an email to Cohen in which Getzel wrote that ?[a]ttached is a draftof the new PFS as of September 30, 2017? and attached a draft of the September 2017 Financial Statement. The draft statement re?ected that as of September 30, 2017, Cohen had only $1,250,000 in cash, total assets of approximately $33,430,000 (comprised of taxi medallion interests, real estate interests, and his personal residence and property), and liabilities of approximately $45,630,000, leaving him purportedly over $12 million in debt. In the same email, Getzel questioned Cohen, in sum and substance, about the fact that the ?nancial statement did not list any value associated with either the Essential Consultants Account or the Account: did not add any value for you[r] two operating entities Michael D. Cohen Associates 30 2017.08.02 POC [sic] and Essential Consultants LLC. Please advise whether or not these should be disclosed and what value.? c. On or about October 6, 2017, Cohen called Getzel by telephone?which is re?ected on toll records for Cohen?s cellphone?~and told Getzel, in sum and substance, not to include Essential Consultants or in the September 2017 Financial Statement because they had no value. On or about October 6, 2017,.following the call with Getzel, Cohen, using the Cohen Account, responded toGetzel?s email with the answer good to Getzel to make any changes to his cash position as listed in the September 2017 Financial Statement. In a letter dated October 6, 2017, addressed to Getzel, Cohen stated, ?1 have reviewed the attached statement of ?nancial condition and ?nd it to be correct and consistent with the representations that I made to your ?rm. The attached is an accurate re?ection of my assets, liabilities and net worth (de?cit) as of September 30, 2017.? Attached to that letter was the September 2017 Financial Statement, which, as noted above, was then transmitted to Sterling in connection with the proposed taxi medallion transaction between Sterling, Cohen, and- 21. Based on my review of a report of an interview with Sterling Employee?1, I have learned that Cohen did not disclose his income stream from Essential Consultants to Sterling Employee?1 or, to his knowledge, anyone else at Sterling. According to Sterling Employee?1, knowledge of such an income stream would have affected Sterling?s demands during the negotiations, particularly with respect to the amount of a principal paydown of Cohen?s debt. Cohen Understated His Available Cash 22. In addition to withholding the existence of his Essential Consultants income from Sterling and Melrose, it appears that Cohen also substantially understated his available cash and cash equivalents in his ?nancial disclosures. Speci?cally, I know from my review of the September . 31 2017.08.02 2017 Financial Statement that Cohen provided to Sterling that Cohen represented that he had $1,250,000 in cash as of September 30, 2017. I also know that on or about January 30, 2018, in a telephone call with Sterling Employee-3, and on February 1, 2018, in an email to Sterling Employee?3, Cohen represented that he did not have more than $1,250,000 in cash. But, from my review of a summary of bank records that were scheduled by forensic accountants, Ihave learned that Cohen had approximately $5,000,000 in cash and cash equivalents as of September 30, 2017. Additionally,'as of mFEbruary had equivalents. Speci?cally, from my review of the account schedule and bank records, I have learned the following: a. Cohen has three checking and/or savings accounts at Capital One Bank, one of which is in his wife?s name. As of September 30, 2017, Cohen had $1,105,680.35 in his savings account, and $1,262,982.29 in total in the three "accounts at Capital One Bank. As of February 1, 2018, Cohen had a total of $1,389,245.78 in these accounts. b. Cohen has three accounts at Morgan Stanley in his name. As of September 30, 2017, the combined total in cash and cash equivalents in those three accounts was $1,270,600.41. As of February 1, 2018, Cohen had $1,284.996.13 in these accounts. 0. As of September 30, 2017, Cohen had $260,689.18 in an account at Signature Bank. As ofFebruary 1, 2018, Cohen had $261,517.55 in this account. d. In addition to the Essential Consultants Account and Account at First Republic, Cohen also had two joint checking accounts with Laura Cohen at First Republic. In total, as of September 30, 2017, Cohen had at least $1,876,209.27 in total in his four accounts at First Republic. As of February 1, 2018, Cohen had $3,332,992.95 in these accounts. 32 2017.08.02 e. Cohen has an account at Bethpage Credit Union with $25,931.39 in it as of . September 30, 2017. f. As of September 30, 2017, Cohen had $17,542.54 in accounts at Sterling. g. Cohen has two accounts at TD Bank?one in his name and one heldjointly with his wife. Cohen also has a safety deposit box at TD Bank-?Subject Premises?3. The safety deposit box was opened on December 13, 2017 in the names of Michael and Laura Cohen. at Capital One Bank, City National Bank, Signature Bank, Sterling Bank, Bethpage Credit Union, First Republic, and Morgan Stanley. As of February 1, 2018, Cohen had $6,268,732.59 in his accounts at Capital One Bank, City National Bank, Signature Bank, First Republic, and Morgan Stanley.19 23. Accordingly, based on the foregoing, it appears that Cohen?s written and oral representations to Sterling and Melrose that he did not have more than $1,250,000 were false, and that Cohen withheld information regarding approximately $5 million in funds from Sterling and Melrose in order to secure favorable terms in his renegotiation of his medallion loan. Based on my participation in an interview with Sterling Employee-2, and my review of reports of interviews with Sterling Employee-1 and two Melrose employees, it is my understanding that that Sterling and Melrose would view Cohen?s understating of his assets as material to its decision whether to renegotiate Cohen?s medallion loans and on what terms, or to its decision whether approve of the transfer of those loans to - 19 Based on my review of the account schedules described above, I know that, as of the date of this affidavit, the account balances for TD Bank have not yet been included in the schedule for either date and the account balances for Sterling National Bank and Bethpage Credit Union have not yet been included in the schedule for February 1, 2018. Thus, to the extent that these accounts have positive balances, Cohen?s total balances in fact were even higher on these dates. 33 2017.08.02 "whivlntotaljasrofSeptembert3 Cohen Has Unreported Interest Income 24. It appears that Cohen also hid from Sterling interest income that he was receiving in connection with a six million dollar loan he made to another individual.. Speci?cally, I know from my review of the May 2017 Financial Statement and September 2017 Financial Statement that Cohen provided to Sterling that Cohen did not disclose that he had made a note receivable in the amount of approximately $6 million, or that he was earning approximately $60,000 per month in . Butfro mmyrevi'eW'o fa summary-ofb ank-records?i 77*- m?m that were reviewed by another law enforcement agent, my review of property records and documents obtained pursuant to the Cohen Email Warrants, and my participation in an interview with Getzel, I have learned the following: a. Based on my review of property records, I have learned that on or about March 12, 2012, Cohen agreed to lend ?approximately $2,000,000.20 It appears that the promissory note was unsecured by any real property. On or about April 28, 2014, Cohen and-' amended the promissory note, and restructured the loan to increase the principal amount to approximately $5,000,000. Under the terms of the amended promissory note, the loan was secured b3- apartment in Sunny Isles Beach, Florida. On or about April 8, 2015, Cohen and -:estated the promissory note to increase the principal amount to $6,000,000.21 b. Based on my review of a copy of the restated note, which was obtained pursuant to the Cohen Email Warrants, I have learned that under the terms of the amended and restated ?1 learned from Getzel that 21 The note states that the loan is to_ husband and wife, jointly and severally. For ease of reference, I refer simply to herein. 34 2017.08.02 promissory note, Cohen?s loan to an interest?only loan, and that the principal balance of the loan bears interest at an annual rate of 12.25 percent. I also know that the amended and restated promissory note includes a schedule of payments that require -to pay Cohen approximately $61,250 per month beginning in April 2015 and ending in April 2019. The note also requires that -7epay the principal balance of $6,000,000 on April 28, 2019. c. Based on my review of bank records, I have learned that, consistent with the terms of the amended and restated promissory note, approximately $61,250 since April 2015. Speci?cally, based on my review of records maintained by Capital One Bank, 1 have learned that from April 2015 to October 2015, Cohen received checks from an entity callec? totaling $61,250 per month, which he deposited into his personal bank account at Capital One ank.22 It appears from my review of bank records and public sources tha1- is the owner of From my review of records maintained by Capital One Bank, 1 have also learned that since October 2015, Cohen has received checks from an entity called totaling $61,250 per month, which he deposited into his personal bank account at Capital One Bank. It appears from my review of bank records and public sources that- is also the owner of I 4? In total, it appears that Cohen receives approximately $735,000 per year in interest payments from - d. Based on my review of Cohen?s May 2017 and September 2017 Financial Statements, my review of his 2015 and 2016 tax returns obtained via subpoena and from the Cohen Email Warrants, and my participation in an interview with Getzel, I have learned that Cohen did 29? In April 2015, Cohen received a pro?rated payment. For all months thereafter, the total payment equaled $61,250, but - often made the payment in multiple checks. 35 2017.08.02 not disclose this interest income he was receiving from -to Sterling or Melrose, or list it on his tax returns. I have also learned that while this interest income is taxable, Cohen did not tell Getzel?his accountant?about the income, and Getzel only learned about the income because he began doing 255-. axes in 2017 23 Accordingly, based on the foregoing, it appears that Cohen representations to Sterling and Melrose that he did not have more than $1,250,000 were false, and that Cohen withheld information relating to the interest income he is receiving from t-n order to secure favorable terms in his renegotiation of his medallion loan. Cohen Had a Side Agreement Wit]- 26. As set forth in detail below, during the course of Cohen?s negotiations to sell his interest in taxi medallions and the associated debt to Cohen not only misrepresentedhis ?nancial position to Sterling, but also failed to disclose a side agreement he had negotiated with- it appears that-agreed to pay an above-market price for Cohen?s taxi cab medallions, and in exchange, Cohen agreed to pay '-1pproximately $5.8 million in cash. Speci?cally, from my review of documents produced pursuant to a subpoena by Sterling, and my participation in interviews with Sterling Employee-l, Sterling Employee?2, and Sterling Employee?3, I have learned, among other things, the following: 0 a. On or about September 5, 2017, an executed term sheet was circulated by Sterling Employee?1 to Cohen and - The term sheet listed Cohen?s address as the address for Subject Premises-l. According to the term sheet,_1 would borrow $20,000,000 from Sterling and Melrose, to be secured by the medallions that -was to acquire from 23 Accordingly, this interest income?which should have been reported as such on Cohen?s tax returns?is included herein in calculations of Cohen?s true cash position. 36 2017.08.02 Cohen. At a price of $20 million for thirty-two taxi medallions, the proposed transaction valued each medallion as worth $625,000. The term sheet also contemplated a $1,265,913 pay?down of the principal balance of the loan. The term sheet made no mention of a $3.8 million payment from Cohen to - or any other form of payment or financial transaction between the parties. b. Additionally, an internal Sterling credit memorandum, dated October. 4, 2017, describing the terms of the Cohen-transaction and the new loan to did not mention any payments from Cohen-to _i?cl?ding a memorandum also noted that the ?loan amount of indicates a purchase price per medallion? but ?it is recognized that this is not in line with current market values.? Indeed, according to an internal Sterling memorandum dated February 5, 2018, in the month of January 2018, taxi medallions sold for amounts ranging from $120,000 to $372,000. According to Sterling Employee-1 and Sterling Employee?2, they were never told tha?_agreed to a purchase price of $625,000 in exchange for a lump sum payment from Cohen, or that Cohen would make - any payment to - c. On or about January 30, 2018, Sterling Employee?3 asked Cohen whether Cohen had a side agreement with-to pay _a sum of money for entering into the medallion transaction. Sterling Employee?3 asked cohen about such an arrangement because, according to Sterling Employee?3, the price that '-was paying for each medallion appeared to be well above the market price. Cohen stated, in sum and substance, that he had no side agreement?wand never had a side agreement?with - 27. While Cohen and?did not disclose any payment from Cohen to _in communications with Sterling, it appears that such a payment was contemplated. Indeed, based on my review of records maintained by Getzel, and my participation in an interview 37 2017.03.02 with Getzel, 1 have learned the following, in substance and in part, regarding the proposed side payment from Cohen to a. On or about September 19, 2017, Getzel prepared a memorandum for Cohen entitled, ?Sale of NYC Medallion Entities and Debt Assumption? (the ?Getzel Memorandum?). The Getzel Memorandum summarized the proposed transaction between Cohen and- in part, as follows: ?Michael and Laura Cohen will transfer ownership of their 13 NYC medallion entities to a Buyer who will-assume their bank?'mdebtedness, upon debt portfolio of the 13 entities by $500,000 and a cash payment to the Buyer of b. According to Getzel, Cohen told-him the parameters of the deal, including the payment of $3,800,000 to -but Getzel did not know where Cohen was going to obtain $3,800,000 to pay - As noted above, Cohen had more than $5,000,000 in cash and cash equivalents as of September 2017, but had only disclosed in his September 2017 Financial Statement that he had $1.25 million in cash. 28. Based on my review of records maintained by Sterling (as well as Melrose, the bank with the participating interest in the loans) and reports of interviews of representatives of Sterling (and Melrose), 1 have seen no evidence that Sterling, Melrose, or any other financial institution involved in the potential deal with Cohen and-was aware of the planned $3.8 million side payment from Cohen to i The Illegal Campaign Contribution Scheme 29. The USAO and FBI are also investigating a criminal violation of campaign finance laws by Michael Cohen. As set forth below, there is probable cause to believe that Cohen made 24 The reference to thirteen medallions appears to be an error by Getzel. Cohen and his wife together owned sixteen corporations, which in turn owned 32 taxi medallions. . 38 2017.08.02 an excessive in-kind contribution to the presidential election. campaign of then-candidate Donald Trump in the form of a $130,000 payment to Stephanie Clifford, an individual who was rumored to have had an extramarital affair with Trump, in exchange for her agreement not to disclose that alleged affair. As set forth below, there is probable cause to believe that this payment was intended to keep Clifford from making public statements about the rumored affair on the eve of the 2016 presidential election, and thus constitutes a campaign contribution in excess of the applicable limit. 30. ?i From my a. In or around October 2011, there were rumors published on the gossip websites heDz'rty. com that Trump had had an extramarital affair with Clifford, an adult ?lm actress whose screen name is Stormy Daniels, in or around July 2006. In or about October 2011, Life Style Magazine, a tabloid sold in supermarkets, also published an article, based on the report in heDz?rty. com, alleging an affair had occurred between Trump and Clifford. Both Trump and Clifford, through their representatives, issued denials in response to the articles. b. Speci?cally, on or about October 11, 2011, Keith Davidson, who identi?ed himself as Clifford?s attorney, sent a cease and desist letter to TheDz?rty. com, demanding that the article regarding Trump and Clifford be removed from the website. Additionally, on or about October 12, 2011, Cohen, who was then Executive Vice?President and Special Counsel to the Trump Organization, stated to News that ?[t]he totally untrue and ridiculous story . . . emanated from a sleazy and disgusting website. . . . The Trump Organization and Donald J. Trump will be bringing a lawsuit . . . [and] Mr. Trump and the Trump Organization would like to thank and commend Stormy Daniels and her attorneys for their honesty and swift actions.? 31. On or about June 16, 2015, Trump formally launched his 2016 presidential campaign. On or about May 4, 2016, Trump became the presumptive Republican Party nominee 39 2017.08.02 for president, and on July 19, 2016, Trump of?cially became the nominee. Based on my review of public sources, I have learned that while it does not appear that Cohen had an official title as part of the Trump campaign, on multiple occasions Cohen made public statements on behalf of Trump or his campaign. For instance, on or about August 18, 2016, Cohen appeared on CNN to defend Trump?s polling numbers. I 32. On or about October 7, 2016, The Washington Post published online a video and anying. audio terms? in a 2005 conversation with Billy Bush, who was then the host of Access Hollywood. The following day, on October 8, 2016, Trump appeared in a video in which he stated, among other 7 things, ?I?ve said and done things I regret and words released today on this more than a decade old video are one rof them. Anyone who knows me knows these words don?t re?ect who I am. I said it. I was wrong and I apologize.? Based on my review of public sources, I also know that representatives of the Trump Campaign stated, in sum and substance, that the Access Hollywood comment was an old and isolated incident. 33. Based on my review of public sources, including an article published in Slate magazine by a reporter who interviewed Clifford, I have learned that around this same time, in or about October 2016, Clifford was in discussions with Good Morning America show and Slate magazine, among other media sources, to provide these media outlets with her statement about her alleged relationship with Trump. According to the article in Slate, which the author based on conversations with Clifford over the telephone and by text message, Clifford wanted to be paid for her story or be paid by Trump not to disclose her accusation. As Cohen summarized in a 2018 email obtained pursuant to the Cohen Email Warrants: ?In October 2016, I was contacted 40 2017.08.02 by counsel for Ms. Clifford stating that news outlets, including ABC News, were pursuing the 2011 story of an alleged affair between Mr. Trump and Ms. Clifford.? 34. From my review of telephone toll records:25 and information produced pursuant to the' iCloud Warrant and Cohen Email Warrants, I have learned that in the days following the Access Hollywood video, Cohen exchanged a series of calls, text messages, and emails with Keith 1 Davidson, who was then Clifford?s attorney, David Pecker and Dylan Howard of American Media, Inc? - press secretary for Trump?s presidential campaign. Based on the timing of these calls, and the content of the text messages and emails, I believe that at least some of these communications concerned the need to prevent Clifford from going public, particularly in the wake of the Access Hollywood story. In particular, I have learned the following: a. On October 8, 2016, at approximately 7:20 pm, Cohen received a call from Hicks. Sixteen seconds into the call, Trump joined the call, and the call continued for over four minutes.27 Based on the toll records that the USAO has obtained to date, I believe that this was the ?rst call 25 My attribution of certain telephone numbers to certain individuals as described in this affidavit is based on my review of the vCard (virtual contact file) and text messages obtained from Cohen?s telephone pursuant to the iCloud_ Warrant. 26 Pecker is President of AMI and, according to his own statements in public reports, a personal friend of Trump. Howard is the chief content o?icer of AMI, who according to public records reports directly to Pecker. 27 I believe that Trump joined the call between Cohen and Hicks based on my review of toll records. Specifically, I know that a call was initiated between Cohen?s telephone number and Trump?s telephone number at the same time the records indicate that Cohen was talking to Hicks. After the Cohen-Trump call was initiated, it lasted the same period of time as the Cohen?Hicks call. Additionally, the toll records indicate a and then Trump?s telephone number, which, based on my training and experience, means that the call was either transferred to Trump, or that Trump was added to the call as a conference or three-way call participant. In addition, based on my conversations with an FBI agent who has interviewed Hicks, I have learned that Hicks stated, in substance, that to the best of her recollection, she did not learn about the allegations made by Clifford until early November 2016. Hicks was not specifically asked about this three-way call. 41 2017.08.02 Cohen had received or made to Hicks in at least multiple weeks, and that Cohen and Trump spoke about once a month prior to this date speci?cally, prior to this call on October 8, 2016, Cohen and Trump had spoken once in May, once in June, once in July, zero times in August, and twice in September. b. Approximately ten minutes after the call ended, Hicks and Cohen spoke again for about two minutes. c. At 7:39 David Pecker (as noted above, the President of American Media Inc, or AMI) and they connected for thirty seconds. Approximately four minutes later, Cohen called Pecker again and they spoke for more than a minute. Three minutes after ending his call with Pecker, Cohen received a call from Dylan Howard (as noted above, the Chief Content Of?cer of AMI), and they spoke for approximately a minute. According to toll records, it does not appear that Cohen and Howard spoke regularly prior to October 8, 2016, as it had been over a month since they had called each other. I d. At 7:56 pm, approximately eight minutes after his call with Howard ended, Cohen called Hicks and they connected for two minutes. At approximately the same time this call ended, Cohen received a call from Pecker, and they spoke for about two minutes. At 8:03 pm, about three minutes after ending his call with Pecker, Cohen called Trump, and they spoke for nearly eight minutes. e. At 8:39 pm. and 8:57 pm, Cohen received calls from Howard and spoke to him for about four and six minutes, respectively. At 9:13 pm, about ten minutes after Cohen and Howard hung up from the second of these calls, Howard sent Cohen a text message that said: ?Keith will do it. Let?s reconvene tomorrow.? Based on my involvement in this investigation, I 42 20170302 believe that when Howard wrote ?Keith,? he was referring to Keith Davidson, the attorney for Stephanie Clifford. At 3 :31 now on October 9, 2016, Cohen sent Howard a text message in response that said: ?Thank you.? Eight minutes later, Cohen sent Howard a text message that said: ?Resolution Consultants LLC. is the name of the entity I formed a week ago. Whenever you wake, please call my cell.? f. The following day, on October 10, 2016, at 10:58 am, Howard sent a text message to Cohen and Davidson, which stated: ?Keitthich?a?l: connecting you both in regards towth?at?w business opportunity. Spoke to the client this AM and they?re confirmed to proceed with the opportunity. Thanks. Dylan. Over to you two.? At 12:25 pm, Davidson sent Cohen a text message that stated: ?Michael if we are ever going to close this deal In my opinion, it needs to be today. Keith.? Davidson and Cohen then spoke by phone for about three minutes. Based on my participation in this investigation, I believe that when Howard wrote that the ?client? was ?confirmed to proceed with the opportunity,? he was referring to Clifford?s agreement in principle to accept money from Cohen in exchange for her agreement not to discuss any prior affair with then-candidate Trurnp.28 g. Based on my review of records obtained pursuant to the Cohen Email Warrants, I know that on or about October 10, 2016, Clifford and Davidson appear to have signed a ?side letter agreement? that stated it was an exhibit to a ?confidential settlement agreement and mutual release? between ?Peggy Peterson? and ?David Dennison.? The purpose of the document, 28 As set forth below, AMI was also involved in a payment to model Karen McDougal. However, because these communications were in close temporal proximity to the events involving the negotiation of a payment to Clifford, the execution of the agreement with Clifford, and the payment of money to Clifford, I believe that these communications were related to Clifford. Additionally, based on my review of public statements by McDougal, I have learned that she negotiated an agreement with AMI several months prior to these'communications between Cohen and Pecker, Howard, and Davidson. 43 2017.03.02 according to the agreement, was to de?ne the ?true name and identity? of persons named by pseudonym in ?confidential settlement agreement and mutual release.? The side letter agreement specifies the identity of ?Peggy Peterson? to be Clifford, but the space for ?Dennison?s? identity is blank. The agreement also includes a signature page for ?Peterson,? ?Dennison,? and their attorneys. The signature page is signed by ?Peterson? and his attorney, Davidson, but the document is unsigned by ?Dennison? and his attorney. Based on my involvement in this I order to facilitate the closing of a deal between Davidson?s client and Cohen or his client on October 10, 2016. 35. It appears that on October 13, 2016, and the days that followed, Cohen took steps to complete a transaction with Davidson, including attempting to open an account from which Cohen could transfer funds to Davidson. Speci?cally, from my review of toll records, information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, records maintained by First Republic, as well as my participation in interviews with First Republic employees, I have learned the following: a. On the morning of October 13, 2016, at 8:54 am, Cohen sent Pecker a text message that stated:??1 need to talk to you.? At 9:06 am, Pecker sent a text message to Cohen that stated, called please call me back.? The tolls between Cohen and Pecker do not show a telephone call between 8:54 am. and 9:06 am. However, based on my review of text messages, I have learned that Cohen and Pecker communicate with each other over Signal, which is an communications cellphone application that allows users to send text messages and make calls. 44 2017.08.02 b. At 9 :23 Cohen sent an email that stated ?call me? to First Republic Employee- 2. The email attached documents from the Secretary of State of Delaware indicating that Cohen had formed a limited liability company called ?Resolution Consultants on September 30, 2016. As noted above, ?Resolution Consultants? is the name of the entity that Cohen had told Howard he had formed recently after Howard said Davidson would ?do it.? At 10:44 Cohen called First Republic Employee?2 and told him, in sum and substance, that he needed an account- - -- did ,notawant; an_addr.ess on the checks written out of the account. Later that day, another employee at First Republic emailed Cohen account opening paperwork to complete. Cohen returned the account opening documents partially completed, but failed to provide a copy of his driver?s license or passport, and did not respond to the employee?s question of how he wanted to fund the account. As a result, the account was never opened. c. On October 17, 2016, Cohen incorporated Essential Consultants LLC in Delaware. That same day, he ?led paperwork to dissolve Resolution Consultants LLC. 36. Despite these steps taken by Cohen, it appears that the negotiation between Cohen and Davidson was not progressing suf?ciently fast enough for Davidson or his client, Clifford, and they threatened to go public with Clifford?s allegations just days before the presidential election. Speci?cally, based on my review of toll records, information obtained pursuant to the iCloud Warrant, and public sources, I know the following: a. According to an article in The Washington Post, which quoted emails sent from Cohen?s email account hosted by the Trump Organization, on October 17, 2016, Davidson emailed Cohen and threatened to cancel the aforementioned ?settlement agreement? by the end of the day ~45 2017.08.02 if Cohen did not complete the transaction.29 According to the article, Davidson sent Cohen a second email later in the day that stated in part, ?Please be advised that my client deems her settlement agreement canceled and void.? At 4:00 pm. that day, Cohen called Davidson and they spoke for over five minutes. b. Cohen?s 4:00 pm. call with Davidson and/or Davidson?s threats to cancel the ?settlement agreement? appear to have touched off a ?urry of communications about the settlement agreement and Whether Clifford would go public. Speci?cally: i. At 4:43 pm, Howard sent Cohen a text message that stated: ?I?m told they?re going with DailyMail. Are you aware?? One minute later, Cohen responded: ?Call me.? Based on my involvement in this investigation, I understand Howard?s text to mean?that he heard that Clifford was going to take her story of an extramarital affair with Trump to the Daily Mail, a tabloid newspaper. ii. At 4:45 Howard called Cohen and they spoke for over two minutes. Moments later, Davidson and Cohen spoke for about two minutes. At 5:03 pm, Cohen attempted to call Trump, but the call only lasted eight seconds. This was Cohen?s ?rst call after he spoke with Davidson. iv. At 5:25 pm, Cohen texted Howard, stating: v. At 6:44 pm, Howard responded to Cohen?s text, stating: ?Not taking my calls.? Cohen responded one minute later: ?You?re kidding. Who are you trying to reach?? 573 Howard responded one minute later: ?The 6agent. Based on my involvement in this 29 Due to the partially covert nature of the investigation to this date, the USAO has not requested documents from the Trump Organization or Davidson, and thus does not possess the email referenced in this article. 46 2017.08.02 investigation, I understand Howard? 3 text messages to mean that he attempted to contact Davidson about the matter involving Clifford, but that Davidson was not taking Howard?s calls. vi. At 6:49 pm, Cohen called Howard and they spoke for nearly four minutes. c. The following day, on October 18, .2016, heSmokingGun. com, a website that publishes legal documents and mugshots, published an article called: ?Donald Trump and the Porn Superstar,? which alleged that Trump had an extramarital affair with Clifford. However, the article noted that Clifford had declined to comment. 37. On or about October 25, 2016, the communications between Cohen, Davidson, Howard and Pecker picked up again, apparently concerning a transaction involving Clifford. Specifically, based on my review of toll records, information obtained pursuant to the Cohen Email Warrants and iCloud Warrant, as well as my review of public sources, I have learned the following: a. On October 25, 2016, at 6:09 pm, Howard sent Cohen a text message stating: ?Keith calling you urgently. We have to coordinate something on the matter he?s calling you about or its [sic] could look awfully bad for everyone.? One minute later, Davidson sent Cohen a text message stating ?Call me.? Cohen and Davidson called each other several times over the next half hour but appear not to have connected. At 6:42 pm, Cohen and Davidson spoke for about eight minutes. At 7 :l 1 pm, they spoke for another two minutes. b. The next morning, on or about October 26, 2016, at 8:26 Cohen called Trump and spoke to him for approximately three minutes. At 8:34 am, Cohen called Trump again and connected for a minute and a half. c. At approximately 9:04 a.m.~less than thirty minutes after speaking with Trump? Cohen sent two emails to the person who had incorporated Resolution Consultants and Essential Consultants for him, and stated ?can you send measap the filing receipt? and then, in the second 47 2017.08.02 email, ?for Essential Consultants That person responded with the ?ling receipt two minutes later, at 9:06 am. and with the certi?cation of formation 23 minutes later, at 9:27 am. (1. Shortly after that, Cohen contacted First Republic Employee-2 and told him, in sum and substance, that he decided not to open an account in the name of ?Resolution Consulting? and instead would be opening a real estate consulting company in the name of ?Essential Consultants.? Cohen told First Republic Employee-2 that he was at Trump Tower, and wanted to go to a First Republic branch'across the street to open the account, so Republic Employee?l, a preferred banker at that branch, assist Cohen. At 11:00 am, First Republic Employee?l called Cohen. 1 know from my participation in an interview with First Republic Employee?l, that around the time of the call he went to Cohen?s of?ce in Trump Tower?H on the same ?oor as the Trump Organization?and went through account opening questions, including know your customer questions, with Cohen. In response to a series of know-your- customer questions about the purpose of the account?the answers to which First Republic Employee?1 entered into a form?u?Cohen stated, in sum and substance, that he was opening Essential Consultants as a real estate consulting company to collect fees for investment consulting work, and all of his consulting clients would be domestic individuals based in the United States. Basedon my review of records obtained from First Republic, it appears that this account (the ?Essential Consultants Account?) was created at a time between 11:00 am. and 1:00 pm. 6. At 1:47 Cohen called Davidson and they spoke for approximately two minutes. At approximately 1:49 Davidson emailed Cohen wiring instructions for an attorney client trust account at City National Bank. f. After the Essential ConsultantsAccount was opened on October 26, 2016, Cohen transferred $131,000 from a home equity line of credit that Cohen had at First Republic to the 48 2017.03.02 Essential Consultants Account. Following the transfer, at approximately 4: 15 pm. on October 26, 2016, First Republic Employee-2?s assistant emailed Cohen at his Trump Organization email address to tell him that the funds had been deposited into the Essential Consultants Account. Cohen forwarded that email to the Cohen Gmail Account and then forwarded it to Davidson. g. At 6:37 pm, Cohen asked Pecker by text message, ?Can we speak? Importan Cohen called Pecker at 6:49 pm. and connected for thirty seconds. At 6:57 pm, Cohen sent Howard a text message, statinglzu ?Please call me. and connected for about thirty seconds. At 7:06 pm, Cohen called Pecker again and they spoke for nearly thirteen minutes. At 7:24 pm, Howard sent a text message to Cohen that: ?He said he?d call me back in 20 minutes. I told him what you are asking for his [sic] reasonable. I?ll get it sorted.? Approximately an hour later, at 8:23 pm, Howard told Cohen by text message to ?check your Gmail for email from my private account.? In an email sent at 8:23 pm. by Howard to Cohen and Davidson, with the subject line ?Confirmation,? Howard stated, ?Thank you both for chatting with me earlier. Confirming agreement on: - Executed agreement, hand-signed by Keith?s client and returned via overnight or same?day FedEx to Michael, - Change of agreement to re?ect the correct LLC, Transfer of funds on Thursday AM to be held in escrow until receipt of agreemen After receiving that email, at approximately 8:27 pm, Cohen asked Howard by text message, ?Can you and David [Pecker] give me a call.? Howard responded: ?David is not around I think. I?ll call.? At 8:28 pm, Howard called Cohen and they spoke for three minutes. I 38. On October 27, 2016, Cohen made a payment to Davidson of $130,000?with the funds intended for Clifford?for the purpose of securing her ongoing silence with respect to the allegations that she had an extramarital affair with Trump. Speci?cally, based on my review of 49 2017.03.02 toll records, bank records, and information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, 1 have learned the following: a. At 9:47 am, Cohen sent Davidson .an email, stating: ?Keith, kindly con?rm that the wire received today, October 27, 2016 shall be held by you in your attorney?s trust account until such time as directed for release by me, in writing. Additionally, please ensure that all paperwork contains the correct name of Essential Consultants LLC. 1 thank you in advance for I your assistance and look from you later.? b. At approximately 10:01 am, according to records provided by First Republic Bank, Cohen completed paperwork to wire $130,000 from the Essential Consultants Account?? which had been funded a day prior from Cohen.? home equity line of credit?to the attorney client trust account at City National Bank that Davidson had speci?ed in the wiring instructions he sent to Cohen. The wire transfer was made shortly thereafter. 0. At 10:02 am, Davidson responded to Cohen?s email from 9:47 am, stating: con?rm that I will work in good faith that no funds shall be disbursed unless until the plaintiff personally signs all necessary settlement paperwork, (the form of which will match the prior agreement). The settlement docs will name the correct corporation, (Essential Consultants LLC). Plaintiff signature will be notarized and returned to you via FedEx. Only after you receive FedEx will I disburse. Fair?? d. At 10:50 am, First Republic Employee?1 sent Cohen an email con?rming that the payment had been sent and providing him with the wire number. 39. On October 28, 2016, and the days that followed, Cohen ?nalized the transaction with Davidson. Speci?cally, based on my review of toll records, information obtained pursuant to the iCloud Warrant, public sources, and bank records, I know the following: 50 2017.08.02 a. On October 28, 2016, at 11:48 am, Cohen spoke to Trump for approximately ?ve minutes. Beginning at 1:21 pm, Cohen attempted a series of phone calls to Davidson, Pecker, and Howard throughout the day, although it appears he may only have connected with Howard. b. Later that day, at approximately 7:01 pm, Davidson stated to Cohen by text message that ?all is AOK. I should have signed, notarized docs on Monday. You should have them on Tuesday.? Cohen thanked him and said hope we are good.? Davidson responded, assure you. We are very good.? Howard also texted Cohen at 7:08 pm, ?Keith [Davidson] says . we are good.? Cohen then responded to Howard and ?Excellent? to Davidson. At approximately 10:30 pm, Cohen spoke to Hicks for three minutes. c. On October 31, 2016, Cohen called Howard at 8:22 pm. and they spoke for over three minutes. At 8:32 pm, Cohen received text messages from both Howard and Davidson. Howard said: ?You?ll have paperwork tomorrow says Davidson said: ?We are AOK. You will be receiving a package tomorrow.? Cohen responded ?Thank you? to Howard and ?Thanks Keith. Will call you then? to Davidson. From my involvement in this investigation, I believe Davidson was referring to a signed nondisclosure agreement when he told Cohen that he would receive a package. d. Based on my review of court ?lings that became public in 2018, I havelearned that on or about October 28, 2016, LLC and/or David Dennison? entered into a ?con?dential settlement agreement and mutual release? with ?Peggy Peterson,? pursuant to which ?Peterson? agreed not to disclose certain ?con?dential information pertaining to [Dennison]? in exchange for $130,000. The agreement provided that would wire the funds to ?Peterson? 5? attorney, who would then transfer funds to ?Peterson.? Cohen signed the agreement on behalf of 51 2017.08.02 The agreement stated that the address for which was later referred to in the agreement as ?Essential Consultants, was Cohen?s residence. e. Consistent with the ?con?dential settlement agreement and mutual release,? on or about November 1, 2016, Davidson transferred $96,645 from his attorney client trust account at City National Bank to a bank account in Clifford?s name. The wire had the annotation ?net settlement.? On the same day, at approximately 9:48 am. Davidson sent Cohen a text message with a picture of a FedEx delivery confirmatlon, statlng that at apprOXimately 9":09 shipped by Davidson the previous day had arrived for Cohen at his Trump Organization address. On the same day, at approximately 6:14 pm, Davidson sent Cohen an email with an 1 audio file attached and said ?Give? this a lesson [sic] and then call me.? The audio attachment was titled ?Stormy.mp3? and was a ?ve-minute recording of Davidson interviewing Clifford about recent public allegations made by an adult film star named Jessica Drake regarding her alleged past affair with Trump; in the recording, Clifford explained the reasons she believed that Drake was not credible. Less than an hour 1ater,?at approximately 7:05 pm, Cohen called Trump, but it appears that they did not connect. Cohen then called a telephone number belonging to Kellyanne Conway, who at the time was Trump?s campaign manager. They did not connect. At approximately 7:44 pm, however, Cohen received a return call from Conway, which lasted for approximately six minutes. 40. On November 4, 2016, just three days after the Clifford transaction was completed and just four days before the presidential election, the Wall Street Journal published an article alleging that the National Enquirer had ?Shielded Donald Trump? from allegations by Playboy model Karen McDougal that she and Trump had an affair. The article alleged that AMI had agreed to pay McDougal to bury her story. McDougal, like Clifford, had been represented by Davidson. 52 2017.08.02 Based on my review of toll records, information obtained pursuant to the Cohen Email Warrants and iCloud Warrant, and public sources, it appears that Cohen spoke frequently to Davidson, Howard, Pecker, and Hicks around the time of this article?s publication?just days before Election Day?about the importance of preventing the McDougal and Clifford stories from gaining national traction. Speci?cally, I have learned the following: a. Between 4:30 and 8:00 pm. on November 4, Cohen communicated several times with Howard, Pecker and Davidson. For instance, at approximately 4:49 pm, Cohen sent Howard a text message with a screenshot of an email forwarded to him by another Trump Organization lawyer. The forwarded email was from a Wall Street Journal reporter, and asked for comment from Trump and/or the campaign on the story. Cohen also spoke with Hicks several times, including shortly before and/or after calls with Pecker, Howard and Davidson. Indeed, at "approximately 7:33 pm, using two different cellphones subscribed to him, Cohen appears to have been talking to Davidson and Hicks at the same time. b. At approximately 8:51 pm, Cohen sent Howard a message, stating: ?She?s being really difficult with giving Keith a statement. Basically went into hiding and unreachable.? one minute later, Howard responded: ?I?ll ask him again. We just need her to disappear.? Cohen responded, ?She de?nitely disappeared but refuses to give a statement and Keith cannot push her.? At approximately 8 :55 pm, Howard responded to Cohen?s text: ?Let?s let the dust settle. We don?t want to push her over the edge. She? on side at present and we have a solid position and a plausible position that she is rightfully employed as a columnist.? Based on my involvement in this investigation, I believe Cohen and Howard were referring to Karen McDougal when they were discussing ?she? and ?her.? Additionally, I believe Howard?s statement that ?we have. . . a 53 2017.08.02 plausible position that she is rightfully employed as a columnist? was a reference to the fact that AMI had given McDougal payments for her role as a purported columnist for the company. 0. At approximately 8:58 pm. on November 4, 2016, Howard attempted to reassure Cohen about the effect of the forthcoming Wall Street Journal article, texting, think it?ll be ok pal. Ithink it?ll fade into the distance.? Cohen responded, ?He?s pissed.? Howard wrote back, ?I?m pissed! You?re pissed. Pecker is pissed. Keith is pissed. Not much we can do.? Based on my involvement in this investigation, I believe Cohen was referring to Trump when he stated ?he? pissed.? Cohen asked Howard at approximately 9:00 pm. how the Wall Street Journal could publish its article if ?evelyone denies.? Howard responded, ?Because there is the payment ??om AM. It looks suspicious at best.? d. At approximately 9:03 Hicks called Cohen and they spoke for two minutes. At approximately 9:11 Cohen called Howard and spoke to him for five minutes. At approximately 9:15 Hicks called Cohen and they spoke for nearly seven minutes. Again, Cohen used different phones for these two Calls, such that he appears to have been on both calls for about a minute of overlap. At approximately 9:32 Cohen texted Pecker, ?The boss just tried calling you. Are you free?? A minute later, Cohen texted Howard, ?Is there a way to find David quickly?? e. At approximately 9:50 the Wall Street Journal article was published online. Howard and Hicks both sent web links for the article to Cohen. Over the next half hour, Cohen and Howard exchanged several text messages commenting on how the story came across. The next morning on November 5, 2016, at approximately 7:35 am, Cohen texted Hicks, ?So farl see only 6 stories. Getting little to no traction.? Hicks responded, ?Same. Keep prayingll It?s working!? Cohen wrote back, ?Even CNN not talking about it. No one believes it and if necessary, I have a 54 20170302 statement by Storm denying everything and contradicting the other porn stars statement. I wouldn?t use it now or even discuss with him as no one is talking about this or cares!? Based on my involvement in this investigation, I believe Cohen was referring to the above?referenced recorded audio statement by Clifford that he obtained ?'om Davidson, and was stating that such a statement could be used to in?uence potential negative media relating to Trump, but was unnecessary at that time. Based on a text message ?om Hicks to Cohen, I believe that later that morning, Pecker s; spokeitoilfrump. 41. On or about November 8, 2016, Trump won the election for President of the United States. 42. On or about January 12, 2018, the Wall Street Journal ?rst reported that Cohen arranged a payment to Clifford. On or about January 22, 2018, Common Cause, a government watchdog group, ?led a complaint with the Federal Election Commission, alleging that Cohen had violated campaign ?nance laws by making the payment to Clifford. Based on my review public sources following that report, as well as emails obtained pursuant to the Cohen Email Warrants, I have learned the following: a. On or about January 23, 2018, the day after Common Cause ?led its complaint, Cohen began emailing himself drafts of statements describing his payment to Clifford. Additionally, on January 23, 2018, Cohen emailed the following draft of that statement to an individual who appears to be writing a book on Cohen?s behalf: In October 2016, I was contacted by counsel for Ms. Clifford stating that news outlets, including ABC news, were pursuing the 2011 story of an alleged affair between Mr. Trump and Ms. Clifford. Despite the fact that both parties had already denied the allegation, as MLTrump?s longtime special counsel and protector, I took it upon myself to match the offer and keep the story ?om breaking. I knew the allegation to be false, but I am also a realist who understands that just because something is false doesn ?t mean that it doesn?t create harm and damage. I could not allow this to 55 2017.03.02 occur. I negotiated a non?disclosure agreement with Ms. Clifford?s counsel and tendered the funds. I did this through my Delaware LLC and transferred personal funds to cover the agreement. 1 was not reimbursed any monies from Mr. Trump, the Trump Organization, any third party or the Presidential campaign. At no point did 1 ever advise Mr. Trump of my communications or actions regarding this agreement. As outlandish and unusual as this may appear, the Trumps have been like family to me for over a decade. It?s what you do for family. (Emphasis added.) Based on my involvement in this investigation, I believe that the above email is an acknowledgement that the allegationof the affair had existed for some time 20]] stOry. . but that Cohen was motivated to ?keep the story from breaking? again in October 2016. b. On or about February 13, 2018, Cohen said in a statement to The New York Times that ?Neither the Trump Organization nor the Trump campaign was a party to the transaction with Ms. Clifford. The payment to Ms. Clifford was lawful, and was not a campaign contribution or a campaign expenditure by anyone.? Cohen declined to answer follow?up questions including whether Trump had been aware of the payment, why Cohen made the payment, or whether similar payments had been made to other people. c. On or about February 14, 2018, Cohen was asked by The New York Times whether Trump had reimbursed him, whether he and Trump had made any arrangement at the time of the payment, or whether he had made payments to other women. Cohen stated in response, can?t get into any of that.? On or about February 14, 2018, Cohen also stated to The Washington Post that: ?In a private transaction in 2016, I used my own personal funds to facilitate a payment of $130,000 to Ms. Stephanie Clifford. Neither the Trump Organization nor the Trump campaign was a party to the transaction with Ms. Clifford, and neither reimbursed me for the payment, either directly or indirectly.? 43. On or about March 9, 2018, Cohen stated to ABC News that ?the funds were taken from my home equity line and transferred internally to my LLC account in the same bank.? 56 2017.08.02 44. Accordingly, for the foregoing reasons, there is probable cause to believe that Cohen committed violations of the Campaign Finance Offenses by making an in?kind contribution to Trump or the Trump campaign in the form of a $130,000 payment to Clifford on the eve of the election. Indeed, while he denies having given an unlawful contribution, in his own statements Cohen has admitted that he paid $130,000 of his ?personal funds? to Clifford and that the payment 7 occurred less than two weeks before the election, as Trump was facing negative media allegations about his behavior toward women, even though allegatlons of an affa?if?bettveen? Clifford existed since 2011. In addition, the communication records set forth above make evident that Cohen communicated with members of the Trump campaign about his negotiation with Clifford?s attorney and the need to preclude Clifford from making a statement that would have re?ected negatively on the candidate in advance of the forthcoming election. C. Probable Cause Justifying Search of the Subject Premises and Subject Devices 45. Based on the foregoing, my review of records produced pursuant to subpoenas and the Cohen Email Warrants, and the iCloud Warrant, and my training and experience, there is probable cause to believe that the Subject Premises and Subject Devices have been used in furtherance of the Subject Offenses and are likely to contain instrumentalities, evidence, and fruits of the Subject Offenses. Speci?cally, there is probable cause to believe that Cohen permanently resides at Subject Premises-l and, at least in part, works at both Subject Premises?l and Subject Premises?2, and that those locations contain evidence relating to the Sterling taxi medallion transaction, Cohen?s assets, Cohen?s consulting work for Essential Consultants LLC, and his payment to Clifford. Additionally, there is probable cause to believe that Subject Premises?3 contains evidence of Cohen?s assets and his payment to Clifford. Finally, there is probable cause to believe that Subject Premises-4, in which Cohen is temporarily residing, contains electronic 57 20170302 devices, including Subject Device-l and Subject Device-2, which, in turn, contain evidence of the Subject Offenses, such as evidence relating to the Sterling taxi medallion transaction, Cohen?s assets, Cohen?s consulting work for Essential Consultants LLC, and his payment to Clifford. 46. First, there is probable cause to believe that Cohen lives and operates his businesses, at least in part, at Subject Premises?l. Speci?cally, from my review of property records, I know that Michael Cohen and Laura Cohen own (in trust) Subject Premises?l. From my review of from my review of emails produced pursuant to the Cohen Email Warrants, I know that Cohen routinely refers to Subject Premises-l as his home. For example, on or about September 28, 2017 and October 6, 2017, Cohen emailed individuals that his home address is the address for Subject Premises-l. I also know from my review of emails that Cohen receives package delivery noti?cations that list Cohen?s address as the address for Subject Premises-l. Cohen has also provided the address of Subject Premises-l as the address for Essential Consultants and Michael D. Cohen Associates, PC. For example, the certi?cates of incorporation and account opening documents at First Republic for both entities list their addresses as the address for Subject Premises?l. See supra 18(b), 18(d). The consulting agreement between Essential Consultants and also indicated the address for Essential Consultants is the address for Subject Premises- 1. See supra 11 19(c). 47. There is also probable cause to believe that Subject Premises~l is likely to contain instrumentalities, evidence, and fruits of the Subject Offenses. Speci?cally, from my review of emails produced pursuant to subpoena and the Cohen Email Warrants and iCloud Warrant, as well as my training and experience, I know the following: 58 2017.08.02 a. According to records maintained by Sterling, the address for all of Cohen?s taxi medallion LLCs is the address for Subject Premises-1. See supra 11 16(c). Additionally, the medallion loan documents indicate that any mailings related to the loans should be sent to Subject Premises-1. See id. Based on my training and experience, as well as my review of public sources, I know that individuals keep records ofpropelties and assets in which they have ownership interests. Accordingly, I submit that Subject Premises?1 likely contains evidence of Cohen?s ~77 transaction with Sterling in 2014 to re?finance the medallion loans that were then with Capital One Bank. b. From my review of records maintained by? Sterling, I also know that Sterling addressed documents relating to the -transaction and Cohen?s attempts to modify the terms of the medallion loans to Subject Premises?1. For instance, Sterling addressed the transaction term sheet, see supra 11 16(1), and its demand letter and notice of default, see supra jj 16(q), t0 Subject Premises?1. Accordingly, Subject Premises-1 likely contains evidence concerning the -:ransaction and Cohen?s negotiations with Sterling. Some of those records?such as records relating to a payment from Cohen to-?were concealed from Sterling and cannot be obtained via subpoena to Sterling. Additionally, even where documents were sent to Cohen by Sterling (and therefore are available from Sterling via subpoena), the fact that they may be found in Subject Premises?1 will be relevant to Cohen?s possession or knowledge of the documents. c. From my review of records maintained by First Republic, I know that Cohen provided the address for Subject Premises?1 as the mailing addresses for the Essential Consultants Account and Account. See supra 18(b), 18(e). Accordingly, it is likely that Subject 59 2017.08.02 Premises-l contains records relating to the Essential Consultants Account and Account, including, among other things, account opening documents, bank statements, documents provided as part of the know-your-customer process, any notes made by Cohen when he was opening the accounts, wire transfer records, and canceled checks. Even where these records can be obtained from First Republic, the fact that they may be found in Subject Premises-l will be relevant to, among other things, Cohen?s ownership of the accounts, or his knowledge of transactions or the existence of funds in accounts. d. Based on my review of records maintained by Capital One Bank, TD Bank, Morgan Stanley, City National Bank, Signature Bank, and Bethpage Credit Union, I know that Cohen provided the address for Subject Premises-l as the mailing for his accounts at each of these ?nancial institutions. Accordingly, it is likely that Subject Premises-l contains records relating to these accounts, including, among other things, bank statements that list account balances. The existence of these records in Subject Premises-1 will be relevant to, among other things, Cohen?s ownership of the accounts and his knowledge of the balances in these accounts. e. Additionally, Cohen may have records of other bank accounts or assets that were not disclosed to Sterling and are not presently known by law enforcement. For example, as described above, Cohen has received interest income since 2015 that he has not disclosed to Sterling or paid taxes on. Also, on Cohen?s August 2014?Financial Statement, see supra 16(e), he disclosed $10,000,000 in ?investments in overseas entities.?30 The value of these investments was omitted from subsequent ?nancial statements. However, for the reasons outlined above, there is probable cause to believe that Cohen omitted the value of those investments from his 2017 30 Based on my participation in an interview with Sterling Employee?3, have learned that Cohen told Sterling Employee?3 that the reference to ?investments in overseas entities? on his 2014 Financial Statement was to serve merely as a ?placeholder? for potential future investments. 60 2017.08.02 ?nancial statements in order to understate his assets. As Subject Premises-l is Cohen?s primary residence and he uses Subject Premises?l as the mailing address for bank records, there is probable cause to believe that account statements for unknown bank accounts or assets concealed from Sterling arellikely to be found in Subject Premises~1. f. Based on my review of records maintained, by and produced pursuant to the Cohen Email Warrants, I know that the address Cohen provided to for Essential Consultants is the address for supra 1 there believe that Subject Premises?l will contain evidence concerning the operation of Essential Consultants or money that Cohen received, through Essential Consultants, from Additionally, because Cohen used the address for Subject Premises?l for at least one consulting arrangement involving Essential Consultants, there is probable cause to believe that Subject Premises?l may contain records of other consulting arrangements that Cohen, through Essential Consultants, has with other individuals or entities. g. Based on my review of records maintained by Getzel?s accounting ?rm, and emails produced pursuant to the Cohen Email Warrants, I have learned. that Getzel?s accounting ?rm sent documents to Subject Premises?l and used the address for Subject Premises-l as the address listed on Cohen?s personal and corporate tax returns. See supra 16(n). For instance, on or about October 6, 2017, an employee at Getzel?s accounting ?rm emailed Cohen that she had sent Cohen?s September 2017 Financial Statement by FedEx to Cohen?s attention. Accordingly, Cohen?s tax records are likely to be found in Subject Premises?l h. Based on my review of bank records and publicly-available documents, I know that Cohen used $130,000 from a home equity line of credit on Subject Premises?l to pay Clifford. I also know that on the settlement and nondisclosure agreement between ?Peggy Peterson? and 61 2017.08.02 the address for Essential Consultants is Subject Premisesul. Accordingly, Subject Premises-l is likely to contain evidence of the Campaign Finance Offenses, including settlement and nondisclosure agreements, payment records, written and email correspondence, and records pertaining to the home equity line of credit. i. Based on my review of emails produced pursuant to the Cohen Email Warrants and iCloud Warrant, I know that Cohen used at least one Apple iPhone, an Apple iPad Mini, and a Apple pursuant to the iCloud Warrant, I know that electronic devices linked to Cohen?s iCloud account were used at Subject Premises?l to, among other things, place telephone calls and backup ?les to Cohen?s iCloud account. Accordingly, there is probable cause to believe that Subject Premises?l contains electronic devices, including certain Apple products, that for reasons discussed below are likely to contain evidence of the Subject Offenses. j. Based on my review of emails produced pursuant to the Cohen Email Warrants, I understand that Subject Premises?l recently sustained water damage to certain parts of the premises, and that Cohen has engaged contractors to perform certain remediation work on the premises. In addition, as set forth above, I believe that Cohen and his family are temporarily residing at Subject Premises-4 in the Loew?s Regency Hotel, which is approximately two blocks from Subject Premises?1. However, based on my review of a work order sent to Cohen?s email by a contractor, I understand that the ?rst phase of the work order called for the contractor to ?Pack Remove all items furnishings in Living Room, Kitchen, Sons Room Dining Room? and store them off?site. In addition, based on my review of drawings sent to Cohen by the contractor, it appears that the work is primarily being done in these rooms. Thus, I believe that the construction - to the extent it is still ongoing would not necessarily have caused Cohen to move 62 2017.08.02 and;mygreviiewrr ofthe- pres s_releas an all documents or evidence responsive to the warrant out of Subject Premises-1, because it does not appear that work is being done to the portion of Subject Premises-l, such as a home of?ce or Cohen?s own room, where such documents or evidence would most likely be found.31 48. Second, there is probable cause to believe that Cohen uses Subject Premises?2 as of?ce space, and also that Subject Premises?2 contains certain electronic devices. Speci?cally, from my review of the ?strategic alliance agreement? between Squire Patton Boggs and Cohen, of?ce at Subject Premises-2. See supra 18(d), 19(ej. Indeed, I have learned that pursuant to Cohen?s agreement with the law ?rm, he has ?dedicated and segregated of?ce space? in Squire Patton Boggs?s of?ces on the 23rd floor of 30 Rockefeller Plaza, and that the space is ?physically separate?ifrom the ?rm?s of?ces and has ?locked doors and its own locked ?le cabinets? See supra 11 19(6). Additionally, I know that under the terms of the agreement, Cohen agreed to ?arrange for [his] own computer server system that is not connected to [Squire Patton Boggs?s] computer network system.? 1 know from my participation in an interview with Getzel, who met Cohen at Subject Premises-2 in 2017, that Subject Premises?2 is an of?ce with a door, it appears to be used only by Cohen, and it contains, among other things, a computer and paper ?les. According to Getzel, when Getzel saw Cohen at Subject Premises~2, he had two cellular telephones in Subject Premises-2. 1' also know from my review of emails produced pursuant to the Cohen Email Warrants that Cohen uses the address for Subject Premises?2 in the signature block 31As noted below, based on my training and experience, I believe that individuals who travel or stay in hotels for short?term periods commonly bring some items with them, such as portable electronic devices or sensitive items, meaning that Cohen has likely taken some evidence from Subject Premises-1 to Subject Premises~ 4. Nevertheless, given the temporary nature of Cohen 3 stay at Subject Premises-4 and the scope of the work being done at Subject Premises?1,1bel1eve . it is unlikely that Cohen has taken all evidence that would be subject to seizure out of Subject Premises?l . 63 2017.08.02 on his emails. Based on my review of notes of a call between Cohen and First Republic Employee- 2 (which notes were taken by another First Republic employee, who was participating in the call and taking notes), I know that, on or about November 15, 2017, Cohen told First Republic Employee?2 that he had a new of?ce at 30 Rock. Moreover, I know from an article in Vanity air published on or about February 14, 2018, that Cohen was interviewed by the magazine in Subject Premises?2 in or about February 2018. instrumentalities, evidence, and fruits of the Subject Offenses. Specifically, from my review of emails produced pursuant to subpoena and the Cohen Email Warrants and iCloud Warrant, as well as my training and experience, I know the following: a. According to records maintained by Sterling, when Cohen was emailing with Sterling Employee-3 in 2018 about a modi?cation to his existing, loan from Sterling, Cohen listed his address in his email as the address for Subject Premises?2. See supra fl 16(t), 16(u). Accordingly, Subject Premises-2 likely contains evidence concerning Cohen?s loan modi?cation negotiations with Sterling. b. Based on my review of records obtained pursuant to the Cohen Email Warrants, I know that the address Cohen provided to KAI and BTA for Essential Consultants is the address for Subject Premises?2. See supra 19(a), 19(b). Therefore, there is probable cause to believe that Subject Premises-2 will contain evidence concerning the operation of Essential Consultants or money that Cohen received, through Essential Consultants, from KAI and BTA, among other entities with which Cohen had a consulting arrangement. Additionally, based on my review of emails sent in 2018 that were obtained pursuant to the Cohen Email Warrants, I know that Cohen continues to enter into consulting arrangements through Essential Consultants, and agreements 64 2017.08.02 relating to those arrangements indicate that Essential Consultants is located at Subject Premises? 2. Additionally, because Cohen used the address for Subject Premises?2 for multiple consulting arrangements involving Essential Consultants, there is probable cause to believe that Subject Premises-2 may contain records of other unknown consulting arrangements that Cohen has with other individuals or entities. 0. Based on my review of records maintained by Getzel?s accounting ?rm, and emails produced pursuant to the Cohen Email Warrants, as well as my participation in an intErview with Getzel, I have learned that Getzel visited Subject Premises?2 to meet with Cohen about his taxes. See supra jj 20(a). At that meeting, Getzel discussed with Cohen whether Cohen should disclose Essential Consultants on his personal ?nancial statement to banks. According, there is probable cause to believe that Subject Premises-2 will contain evidence relating to Cohen?s taxes, or notes of his conversation with Getzel. Moreover, the fact that Cohen used Subject Premises?2 for a meeting regarding his personal ?nancial matters provides probable cause to believe that documents and information regarding his ?nances will be found in Subject Premises-2. d. Based on my participation in an interview with Getzel, I know that Cohen maintains a computer in Subject Premises?2. From my review of IP data produced pursuant to a subpoena and pen register to Google, it appears that Cohen is logging into his Gmail account from Subject Premises?2. Accordingly, there is probable cause to believe that Subject Premises?2 contains electronic devices, that for reasons discussed below are likely to contain evidence of the Subject Offenses. e. Based upon my training and experience, I have learned that individuals who maintain businesses typically keep records relating to the business?such as contracts with clients and records of payments?at the business? identi?ed location. I am not aware of any addresses 65 2017.08.02 associated with Essential Consultants other than Subject Premises-l and Subject Premises?2. Accordingly, there is probable cause to believe that Subject Premises?l and Subject Premises?2 will contain business records for Essential Consultants. 50. Third, there is probable cause to believe that Subject Premises-3 is likely to contain instrumentalities, evidence, and fruits of the Subject Offenses. In particular: a. As noted above, Cohen has two bank accounts at TD Bank. In or about November 2017, as Cohen was receiving substantial income from consulting to Sterling??Cohen opened the safety deposit box at TD Bank, which is Subject Premises?3. In light of the aforementioned evidence that COhen conceals assets, including assets at TD Bank, there is probable cause to believe that Subject Premises-3 contains ?nancial assets, objects of value and/or documents relating to such assets or objects of value that Cohen'likely did not disclose to Sterling. Indeed, based on my training and experience, I am aware that people often conceal valuable items in safety deposit boxes. Accordingly, there is probable cause to believe that Subject Premises?3 will contain evidence of the Bank Fraud Offenses. b. In addition, based on my review of records produced by TD Bank, I know that Cohen has accessed the vault in which Subject Premises?3 is stored on two occasions. The ?rst such occasion was on November 10, 2017. Cohen signed into the vault at approximately 5:35 and out of vault at approximately 5:39 on that date};2 Based on my review of toll records, I know that Cohen?s ?rst call after he signed out of the safety deposit box approximately 45 minutes later - was to Keith Davidson. Speci?cally, at 6:25 pm. Cohen called Davidson and they spoke for less than a minute; three minutes later, Davidson called Cohen back and they spoke for approximately 3?2 The entry in the bank?s log book does not specify whether this is or P.M. However, I infer that it is because it is unlikely that the bank would have been open at 5:35 and 5:39 am. 66 2017.08.02 22 minutes. The second such occasion was on February 2, 2018, which is during the time period numerous media reports about Cohen?s payment to Clifford were being published, and is one day' after it appears that Cohen?s family moved into Subject Premises-4, as set forth above. The timing of Cohen?s two visits to the vault one shortly before a call to Keith Davidson and the other around I the time that Cohen came under media scrutiny in connection with the payment to Davidson?s client gives rise to probable cause to believe that Subject Premises-3 will contain evidence of the Campaign Finance Cffenses, such as documents. relevant to Davidson and the payment to Clifford, including documents or evidence that Cohen did not want to leave in his apartment where construction workers would be present-9?3 51. Based on my review of emails obtained pursuant to the Cohen Email Warrants and cell phone location information, I believe that Cohen is temporarily residing in Subject Premises- 4. See supra There is also probable cause to believe that Subject Premises-4 contains instrumentalities and evidence of the Subject Offenses, including, the following: a. As described above, it appears that Cohen moved to Subject Premises-4 on or about February 1, 2018, at which time numerous media reports about Cohen?s involvement in the payment to Clifford were being published. See supra During this time same period, Cohen was frequently corresponding with the media and sent himself and others statements about his involvement in the payment to Clifford. See supra Thus, there is probable cause that Cohen took at least some documents and evidence relating to the Clifford payment with him to Subject Premises-4, in order to reference and consult them in connection with these statements. 33 As noted above, Subject Premises?3 is approximately five inches by ten inches. Accordingly, I. do not believe that it would fit a large volume of hard copy documents; however, a small number of hard?copy documents, or a large volume of documents contained on a ?ash drive or other portable storage device, would fit in Subject Premises?3. 67 2017.08.02 b. As described above, at the time Cohen moved to Subject Premises-4, he was also in the midst of ongoing negotiations with Sterling regarding the re?nancing of his medallion debts. For example, on January 30, 2018, Cohen had a phone call with Sterling Employee-3 about his ?nances and the proposed restructuring, and on February 1, 2018, Cohen sent an email to Sterling Employee?3 claiming that he did not have more than $1.25 million in cash. See supra 16(u). Thus, there is probable cause that Cohen took at least some documents and evidence relating consult them in connection with these negotiations. c. As described above, Cohen used at least one Apple iPhone, an Apple iPad Mini, and a MacBook Pro to access his iCloud account, and these electronic devices linked to Cohen?s iCloud account were used at Subject Premises-l Cohens? permanent residence to place telephone calls and backup ?les to Cohen?s iCloud account. See supra 1N 47(i). Although Cohen?s stay at Subject Premises-4 is temporary, based on my training and experience I know that individuals who travel or stay in hotels for short-term periods commonly bring portable electronic devices with them, such as cellular phones, tablets, or laptops. Accordingly, there is probable cause to believe that Subject Premises-4, where Cohen currently appears to be residing, contains electronic devices, including Subject Device?1, Subject Device?2, and/or certain Apple products, that for the reasons discussed herein are likely to contain evidence of the Subject Offenses. d. Moreover, as set forth above, based on cellphone location information I know that Subject Device?1 and Subject Device-2 were in the vicinity of Subject Premises?4 as recently as this morning (April 8, 2018). As set forth above, there is probable cause to believe that Cohen 7 used the Subject Devices in furtherance of the Subject Offenses, including to communicate with Sterling employees regarding the medallion transaction, with First Republic employees regarding 68 2017.08.02 the Essential Consultants Account, with his accountant regarding his ?nances, and with individuals, such as Davidson, Howard and Pecker, involved in the $130,000 payment to Clifford. 52. Although Cohen appears to - be residing currently in Subject Premises?4, it is unknown whether Cohen will be physically present within Subject Premises-4 at the moment the warrant sought herein are executed. If Cohen is within Subject Premises-4 at that moment, Subject Device?l and Subject Device?2 his cellphones will likely also be within Subject Premises?4. Cohen is not within Subject Premises-4 at that moment, th?'flevices Will?lik?ely?b?e"?on?hisperso wherever he is located? (which, based on location data for Subject Device?l and Subject Device-2 as recently as today, is likely to be in the Southern District of New York). As such, this warrant seeks separate authority to seize Subject Device-l and Subject Device?2, in the event that those devices are not located within Subject Premises?4 (or another Subject Premises) at the moment the warrants sought herein are executed. D. Probable Cause Justifying Search of E81 53. Based on the foregoing, there is probable cause to believe that Subject Premises-l, Subject Premises?2 and Subject Premises-4 contain electronic devices that are likely to contain evidence, fruits, and instrumentalities of the Subj ectOffenses (and, as set forth above, that Subject Device-l and Subject Device?2 are themselves electronic devices that are likely to contain evidence of the Subject Offenses). Specifically, based on my review of information produced pursuant to the Cohen Email Warrants, the iCloud Warrant, and subpoenas, as well as pen register data, I submit that there is probable cause that Subject Premises-l contains an Apple iPad Mini, a - MacBook Pro, and has, at various times, contained Apple cellphones; similarly, there is probable cause that Subject Premises-2 contains a computer and has, at various times, contained Apple 69 2017.08.02 cellphones. These devices are likely to include evidence, fruits, and instrumentalities of the Subject Offenses for the following reasons: a. As described throughout this affidavit, Cohen used email to send and receive communications related to the Subject Offenses. In particular, Cohen used email to send and receive communications with Sterling, First Republic, Getzel, the entities to which he is providing consulting services, Davidson, and Howard, among others. While some of these emails have that individuals can and do delete emails from their Internet-based inboxes but retain copies of those emails on their hard drives. I also know that individuals often have multiple email accounts, some of which may not be known to law enforcement, and as a result electronic devices can be a unique repository of all emails relevant to certain Subject Offenses. Indeed, from my involvement in this investigation, I know that Cohen had an email account with the Trump Organization, but the USAO and FBI have not been able to obtain the contents of that account to date. Thus, emails relevant to the Subject Offenses are likely stored on electronic devices in Subject Premises?1, Subject Premises?2 and/or Subject Premises~4. b. Additionally, Subject Premises-1, Subject Premise?2 and Subject Premises?4 likely contain electronic copies of documents relevant to the Subject Offenses. Indeed, I know from my training and experience that individuals often retain copies of important documents on their computers or other electronic devices capable of storing information, including cellphones (such as the Subject Devices) and tablets. Here, there are a number of documents that Cohen has likely retained that will be relevant to the Subject Offenses. For example, electronic devices may include documentation of Cohen?s true net worth, a listing of his assets, an accounting of his available 70 2017.08.02 cash, consulting agreements with third parties, and documentation of his payment to Clifford, among other evidence of the Subject Offenses. c. Third, I know from my review of emails obtained pursuant to the Cohen Email Warrants that Cohen sent up online banking with First Republic. Based on my training and experience, I know that individuals who set up online banking often receive electronic notices concerning financial transactions and, on occasion, save records of their financial transactions to their devices. Accordingly, there is probable cause to believe that contain evidence of banking activity, including the existence of bank accounts or assets that Cohen did not disclose to Sterling or Melrose. d. Fourth, from my review of records produced by Apple, know that Cohen communicates using text message as well as communications applications. These applications that Cohen has downloaded onto a phone include, but are not limited to, WhatsApp, Signal, and Dust. I know from my review of toll records and text messages that, in particular, Cohen communicated with Pecker using these applications. Accordingly, there is probable cause to believe that Cohen?s cellphones the Subject Devices will contain . messages that are not otherwise accessible relating to the Subject Offenses. 54. Based on my training and experience, I know that individuals who engage in financial crimes commonly use computers to communicate with co?conspirators, keep financial . ledgers, and retain fraudulent documents. As a result, they often store data on their computers related to their illegal activity, which can include logs of online or cellphone?based ?chats? with co-conspirators; email correspondence; contact information of co?conspirators, including telephone numbers, email addresses, and identifiers for instant messaging and social medial accounts; bank account numbers; and/or records of uses of funds. 71 2017.08.02 55. Based on my training and experience, I also know that, where computers are used in furtherance of criminal activity, evidence of the criminal activity can often be found months or even years after it occurred. This is typically true because: I Electronic ?les can be stored on a hard drive for years at little or no cost andusers thus have little incentive to delete data that may be useful to consult in the future. 0 Even when a user does choose to delete data, the data can often be recovered months or years later with the appropriate forensic tools. When a ?le is ?deleted? on a home. computer,.the.dataucontained in the file does not actually disappear, but instead remains on the hard drive, in ?slack space,? .untilit is PX nsw?ata that cannot'be stored elsewhere on the computer. Similarly, ?les that have been viewed-on the Internet 7 7 are generally downloaded into a temporary Internet directory or ?cache,? which is only overwritten as the ?cache? fills up and is replaced with more recently viewed Internet pages. Thus, the ability to retrieve from a hard drive or other electronic storage media depends less on when the file was created or viewed than on a particular user?s operating system, storage capacity, and computer habits. In the event that a user changes computers, the user will typically transfer files from the old computer to the new computer, so as not to lose data. In addition, users often keep backups of their data on electronic storage media such as thumb drives, ?ash memory cards, or portable hard drives. 56. Based on the foregoing, I respectfully submit there is probable cause to believe that Cohen engaged in the Subject Offenses, and that evidence of this criminal activity is likely to be found in the Subject Premises, on computers and electronic media found in the Subject Premises, and on the Subject Devices. In particular, there is probable cause to believe that the Subject Premises and Subject Devices will contain evidence, fruits, and instrumentalities of violations of the Subject Offenses, as more fully described in Section II of Attachments A, B, C, D, and to the proposed warrants, including the following: a. Evidence necessary to establish the occupancy or ownership of the Subject Premises, including without limitation, utility and telephone bills, mail envelopes, addressed correspondence, bank statements, identi?cation documents, and keys. b. Evidence relating to Sterling, Melrose, and/or taxi medallions. 72 2017.08.02 c. Evidence relating to a plan, proposal, or agreement for Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including tc?and/or entities associated with him. d. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. e. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential?Consultants or th?e??atu?re"t?? of any work done by Cohen or any other individuals in connection with Essential Consultants. f. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. g. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns,personal ?nancial statements, and bank records. h. Evidence relating to agreements, loans, and/or ?nancial transactions between Cohen and? and any payments bj-to Cohen. i. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. A j. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or. associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. 73 2017.08.02 k. Evidence of communications involving Michael Cohen, American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/ or Karen ougal. 1. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. i m. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. 11. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 0. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. p. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen? bank accounts, taxes, debts, and/or ?nances; q. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or! nature of any ?nancial transactions involving that ?nancial institution; r. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. Procedures for Searching ESI A. Execution of Warrant for E81 57. Federal Rule of Criminal Procedure provides that a warrant to search for and seize property ?may authorize the seizure of electronic storage media or the seizure or 74 2017.03.02 copying of electronically stored information . . . for later review.? Consistent with Rule 41, this application requests authorization to seize any computer devices and storage media and transport them to an appropriate law enforcement facility for review. This is typically necessary for a number of reasons: I 0 First, the volume of data on computer devices and storage media is often impractical for law enforcement personnel to review in its entirety at the search location. 0 Second, because computer data is particularly vulnerable to inadvertent or intentional modi?cation or dest?tion, computETdevices are environment, such as a law enforcement laboratory, where trained personnel, using specialized software, can make a forensic copy of the storage media that can be . subsequently reviewed in a manner that does not change the underlying data. a Third, there are so many types of computer hardware and software in use today that it can be impossible to bring to the search site all of the necessary technical manuals and specialized personnel and equipment potentially required to safely access the underlying computer data. 0 Fourth, many factors can complicate and prolong recovery of data from a computer device, including the increasingly common use of passwords, or other features or con?gurations designed to protect or conceal data on the computer, which often take considerable time and resources for forensic personnel to detect and resolve. 58. As discussed herein, Squire Patton Boggs is a functioning law ?rm that conducts legitimate business unrelated to Cohen?s commission of the Subject Offenses. Subject Premises? 2 is an of?ce located inside of Squire PattOn Boggs?s New York of?ce. In order to execute the warrant in the most reasonable fashion, law enforcement personnel will attempt to investigate on the scene of what computers or storage media, if any, must be seized or copied, and what computers or storage media need not be seized or copied. Law enforcement personnel will speak with Squire Patton Boggs personnel on the scene as may be appropriate to determine whiCh ?les and electronic devices within Subject Premises?2 belong to or were used by Cohen. While, based on the foregoing, it does not appear that Cohen shared electronic devices or a server with Squire Patton Boggs, where appropriate, law enforcement personnel will copy data, rather than physically seize . 75 2017.08.02 computers, to reduce the extent of any disruption of Squire Patton Boggs?s operations. If, after inspecting the seized computers off-site, it is determined that some or all of this equipment is no longer necessary to retrieve and preserve the evidence, the Government will return it. 59. Additionally, because Cohen is an attorney, and claims to serve as a personal attorney for Trump, the review of evidence seized from the Subject Premises and Subject Devices will be conducted pursuant to established screening procedures to ensure that the law enforcement personnel involved in the investigation, including attorneys for the in a manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures will include use of a designated ??lter team,? separate and apart from the investigative team, in order to review potentially privileged communications and determine which communications to release to the investigation and prosecution team. B. Accessing ESI on the Subject Devices 60. As described above, the Subject Devices are both Apple brand devices. 61. I know from my training and experience, as well as from information found in publicly available materials including those published by Apple, that some models of Apple devices such as iPhones and iPads offer their users the ability to unlock the device via the use of a fingerprint or thumbprint (collectively, ?fingerprint?) in lieu of a numeric or alphanumeric passcode or password. This feature is called Touch ID. I also know that the Apple iPhone Offers its users the ability to unlock the device via the use of facial recognition (through infrared and visible light scans) in lieu of a numeric or alphanumeric passcode or password. This feature is called Face ID. 62. If a user enables Touch ID on a given Apple device, he or she can register up to 5 fingerprints that can be used to unlock that device. The user can then use any of the registered 76 2017.08.02 ?ngerprints to unlOck the device by pressing the relevant finger(s) to the device?s Touch ID sensor, which is found in the round button (often referred to as the ?home? button) found at the bottom - center of the front of the device. If a user enables Face ID on a given Apple device, he or she can unlock the device by raising the iPhone to his or her face, or tapping the screen. In my training and experience, users of Apple devices that offer Touch ID or Face ID often enable it because it is considered to be a more convenient way to unlock the device than by entering a numeric or alphanumeric passcode or password, as wellas a more 63. In some circumstances, Touch ID or Face ID cannot be used to unlock a device that has either security feature enabled, and a-passcode or password must be used instead. These circumstances include: (1) when the device has just been turned on or restarted; (2) when more than 48 hours has passed since the last time the device was unlocked; (3) when the passcode or password has not been entered in the last 6 days, and the device has not been unlocked via Touch ID in the last 8. hours or the device has not been unlocked via Face ID in the last 4 hours; (4) the device has received a remote lock command; or (5) five unsuccessful attempts to unlock the device via Touch ID or Face ID are made. 64. The passcodes or passwords that would unlock the Subject Devices are not known to law enforcement. Thus, it will likely be necessary to press the ?ngers of the user of the Subject Devices to the devices? Touch ID sensor, or hold the Subject Devices in front of the user?s face to activate the Face ID sensor, in an attempt to unlock the devices for the purpose of executing the search authorized by this warrant. Attempting to unlock the relevant Apple devices via Touch ID with the use of the fingerprints of the user, or via Face ID by holding the device in front of the user?s face, is necessary because the government may not'otherwise be able to access the data contained on those devices for the purpose of executing the search authorized by this warrant. 77 2017.08.02 65. Based on these facts and my training and experience, it is likely that Cohen is the user of the Subject Devices, and thus that his ?ngerprints are among those that are able to unlock the Subject Devices via Touch ID or his face is able to unlock the Subject Devices via Face ID. 66. Although I do not know which of a given user?s 10 ?ngerprints is capable of unlocking a particular device, based on my training and experience Iknow that it is common for a user to unlock a Touch ID?enabled Apple device via the ?ngerprints on thumbs or index ?ngers. In the event that law enforcement is unable to unlock the SubjectDRinescrinabovew' within the ?ve attempts permitted by Touch ID, this will simply result in the device requiring the entry of a password or passcode before it can be unlocked. 67. I also know from my training and experience, and my review of publicly available materials published by Apple that Apple brand devices, such as the Subject Devices, have a feature that allows a user to erase the contents of the device remotely. By logging into the Internet, the user or any other individual who possesses the user?s account information can take steps to completely wipe the contents of the device, thereby destroying evidence of criminal conduct, along with any other information on the device. The only means to prevent this action is to disable the device?s ability to connect to the Internet immediately upon seizure, which requires either access to the device itself to alter the settings, or the use of specialized equipment that is not consistently available to law enforcement agents at every arrest. 68. Due to the foregoing, I request that the Court authorize law enforcement to press the ?ngers'(including thumbs) of Cohen to the Touch ID sensors the Subject Devices, or hold the Subject Devices in front of Cohen?s face, for the purpose of attempting to unlock the Subject Devices via Touch ID or Face ID in order to search the contents as authorized by this warrant. 78 2017.03.02 C. Review of E81 69. Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (including, in addition to law enforcement officers and agents, and depending on the nature of the E81 and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) will review the E81 contained therein for information-responsive to thewarrant. 70. In conducting this review, law enforcement personnel may use various techniques to determine which files or other ESI contain evidence or fruits of the Subject Offenses. Such techniques may include, for example: 0 surveying directories or folders and the individual files they contain (analogous to looking at the outside of a file cabinet for the markings it contains and opening a drawer believed to contain pertinent files); - conducting a ?le-by-flle review by ?opening? or reading the first few ?pages? of such ?les in order to determine their precise contents (analogous to performing a cursory examination of each document in a file cabinet to determine its relevance); - ?scanning? storage areas to discover and possibly recover recently deleted data or deliberately hidden files; and 0 performing electronic keyword searches through all electronic storage areas to determine the existence and location of data potentially related to the subject matter of the investigation?; and - reviewing metadata, system information, configuration files, registry data, and any other information re?ecting how, when, and by whom the computer was used. 34 Keyword searches alone are typically inadequate to detect all relevant data. For one thing, keyword searches work only for text data, yet many types of files, such as images and videos, do not store data as searchable text. Moreover, even as to text data, there may be information properly subject to seizure but that is not captured by a keyword search because the information does not contain the keywords being searched. 79 2017.08.02 71. Law enforcement personnel will make reasonable efforts to restrict their search to data falling within the categories of evidence speci?ed in the warrant. Depending on the circumstances, however, law enforcement personnel may need to conduct a complete review of all the ESI from seized devices or storage media to evaluate its contents and to locate all data responsive to the warrant. Return of ESI 72. If the Government determines that the to retrieve and preserve the data, and the devices themselves are not subject to seizure pursuant to Federal Rule of Criminal Procedure 41(c), the Government will return these items, upon request. Computer data that is or unreadable will not be returned unless law enforcement personnel have determined that the data is not an instrumentality of the offense, (ii) a fruit of the criminal activity, contraband, (iv) otherwise unlawfully picssessed, or evidence of the Subject Offenses. 80 2017.08.02 IV. Conclusion and Ancillary Provisions 73. Based on the foregoing, I respectfully request the court to issue a warrant to seize the items and. information speci?ed in Attachments A, B, C, D, and to this af?davit and to the Search and Seizure Warrants. 74. In light of the con?dential nature of the continuing investigation, I respectfully request that this af?davit and all papers submitted herewith be maintained under seal until the . r" E131 Sworn to before me on 8th day of April, 2018 Ht?i?y EN. HENRY B. PITMAN UNITED STATES MAGISTRATE JUDGE 81 2017.08.02 ATTACHMENT A I. Premises to be Searched?Subject Premises-1 The premises to be searched (?Subject Premises?1?) are described as follows, and include electronic devices, and all locked and closed containers found therein: Apartment-.ocated inside the building at 502 Park Avenue, New York, New York 10022. The building located at 502 Park Avenue is a 32-floor brick residential building. Subject Premises?1 is located on the-?oor of the building. 11. to Be Seized A. Evidence, Fruits, and Instrumentalities of the Subject Offenses The items to be seized from Subject Premises?1 are evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy, as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(l)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?), described as follows: . a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including tc?and/or entities associated with him. c. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, from January 1, 2013 to the present. Evidence relating to agreements, loans, and/or financial transactions between Cohen and?1nd/or entities controlled by the 2 2017.03.02 l, 2012 to the present. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen MCDougal. Evidence of communications between Michael Cohen and American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Clifford, and/ or Karen ougal. k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/ or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence, relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. n. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January 1, 2013 to the present. p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution, from January 1, 2013 to the present. q. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. B. Search and Seizure of Electronically Stored Information The items to be seized from Subject Premises?l also include any computer devices and storage media that may contain any electronically stored information falling Within the categories set forth in Section ILA of this Attachment above, including, but not limited to, a MacBook Pro, any other desktop and laptop computers, any Apple iPhone or other cellphone or smartphone 3 20170802 belonging to Michael Cohen or in his possession, an Apple iPad Mini, portable hard drives, disk drives, thumb drives, and personal digital assistants. In lieu of seizing any such computer devices or storage media, this warrant also authorizes the copying of such devices or media for later review. The items to be seized from Subject Premises?l also include: 1. Any items or records needed to access the data stored on any seized or copied computer devices or storage media, including but not limited to any physical keys, devices, or records of login credentials, passwords, private keys, or similar information. 2. Any items or records that may facilitate a forensic examination of the computer devices or storage media, including any hardware or software manuals or other information ?~??~~W~W~Weoncerningthe or. storage media. 3. Any evidence concerning the identities or locations of those persons with access to, control over, or ownership of the seized or copied computer devices or storage media. C. Review of ESI Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (which may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the 1381 contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: 2017.08.02 surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); opening or cursorily reading the ?rst few ?pages? of such ?les in order to determine their precise contents; scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden ?les; performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and reviewing metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. Law enforcement personnel will make reasonable efforts to search only for ?les, documents, or other electronically stored information within the categories identi?ed in Sections HA and ILB of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the E81 from seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ?filter team,? separate and apart from the investigative team, in order to address potential privileges. 2017.08.02 ATTACHMENT I. Premises to be Searched?Subject Premises?2 The premises to be searched (?Subject Premises?2?) are described as follows, and include electronic devices, and all looked and closed containers found therein: An of?ce belonging to or assigned to Michael Cohen located on the 23rd ?oor of the building at 30 Rockefeller Plaza, New York, New York 101 12, inside of the of?ces of the law ?rm Squire Patton Boggs. The building located at 30 Rockefeller Plaza is a 66-floor of?ce building that spans the entire block between Sixth Avenue and Rockefeller Plaza. 11. Items to Be Seized A. Evidence, Fruits, and of the Subj eCt Offenses The items to be seized from Subject Premises?2 are evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?) described as follows: a. (Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the present. - b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including tc_ and/or entities associated with him. c. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. (1. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, from January 1, 2013 to the present. g. Evidence relating to agreements, loans, and/or ?nancial transactions between Cohen and?and/or controlled by 6 2017.08.02 and any payments by t_to Cohen: from January h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. in Evidence of communications between Michael Cohen and American Media, Inc, David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Clifford, and/or Karen McDougal. k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. . 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. n. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January 1, 2013 to the present.? p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account'or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution, from January 1, 2013 to the present. q. Evidence of Cohen?s intent as it relates to the Subject Offenses under'investigation. B. Search and Seizure of Electronically Stored Information The items to be seized from Subject Premises?2 also include any computer devices and storage media that may contain any electronically stored information falling within the categories set forth in Section ILA of this Attachment above, including, but not limited to, any desktop and laptop computers, any Apple iPhone or other cellphone or smartphone belonging to Michael Cohen 7 20170802 or in his possession, portable hard drives, disk drives, thumb drives, and personal digital assistants. In lieu of seizing any such computer devices or, storage media, this warrant also authorizes the copying of such devices or media for later review. The items to be seized from Subject Premises?2 also include: 1. Any items or records needed to access the data stored on any seized or copied computer devices or storage media, including but not limited to any physical keys, devices, or records of login credentials, passwords, private keys, or similar information. 2. Any items or records that may facilitate a forensic examination of the computer devices or storage media, including any hardware or software manuals or other information concerning the con?guratron of the seized??or?C?opi'ed?computer- devicesorwstoragemedia. 3. Any evidence concerning the identities or locations of those persons with access to, control over, or ownership of the seized or copied computer devices or storage media. C. Review of ESI Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (which may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: - - Surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); 0 opening or cursorily reading the ?rst few ?pages? of such ?les in order to determine their precise contents; scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden ?les; . - performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and - reviewing metadata, system information, con?guration ?les, registry data, and any other information reflecting how, when, and by whOm the computer was used. 2017.08.02 Law enforcement personnel will make reasonable efforts to search only for files, documents, Or other electronically stored information within the categories identified in Sections HA and ILB of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the E81 from seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 2017.08.02 ATTACHMENT I. Premises to be Searchedeubject Premises?3 The premises to be searched (?Subject Premises?3?) are described as follows, and include all locked and closed containers found therein: A safe deposit box located inside the TD Bank branch location at 500 Park Avenue, New York, New York 10019, marked as box II The safe deposit box is in the name of Michael Cohen and Laura Cohen. II. Items to Be Seized A. Evidence, Fruits, and Instrumentalities of the Subject Offenses The items to be seized from Subject Premises-3 are evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(l)(A) and 30109(d)(l)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?), described as follows: 1. Evidence relating to Michael Cohen?s net worth, available cash and cash equivalents, assets, and annual income, and income sources, from January 1, 2013 to the present. 2. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. 3. - Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. 4. Evidence of communications between Michael Cohen and American Media, Inc, David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/ or Karen McDougal. 5. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 6. Evidence of communications with Donald Trump and/ or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. 7. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 10 2017.03.02 8. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 9. Any portable electronic storage device. B. Search of Seized Electronic Devices Probable cause exists to search any seized electronic storage device for the items set forth in Section above. C. . Review of ESI Following seizure of any electronic storage device, law enforcement personnel (which may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained therein for information responsive to the warrant. In conducting this review,.law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: - surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); 0 opening or cursorily reading the ?rst few ?pages? of such ?les in order to determine their precise contents; - scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden ?les; - performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and - reviewing metadata, system information, con?guration ?les, registry data, and any other information reflecting how, when, and by whom the, computer was used. Law enforcement personnel will make reasonable efforts to search only for ?les, documents, or other electronically stored information within the categories identi?ed in Sections HA and ILB of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the ESI from seized devices if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect 11 2017.08.02 procedures shall include any attorney?client or other applicable privilege. When appropriate, th team, in order to address use of a designated ??lter team,? separate and apart from the investigativ potential privileges. 12 2017.08.02 ATTACHMENT I. Premises to be Searchedeubject Premises?4 The premises to be searched (?Subject Premises?4?) are described as follows, and include electronic devices, and all looked and closed containers found therein: Room 1728 located inside the Loews Regency Hotel at 540 Park Avenue, New York, New York 10065. The building is a luxury hotel located on Park Avenue and 6lst Street. Subject Premises?4 is located on the 17th ?oor of the hotel. II. Items to Be Seized A. Evidence, Fruits, and Instrumentalities of the Subject Offenses The items to be seized from Subject Premises-4 are evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy, as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a financial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?), described as follows: 21. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to tranFRr interest in taxi medallions, and any associated debts or liabilities, to others, including tc nd/ or entities associated with him. 0. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. - f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal financial statements, and bank records, from January 1, 2013 to the present. 9. Evidence relating to agreements, loans, and/or financial transactions between Cohen and LI?ld/Ol? entities controlled by 13 2017.08.02 and any payments by _to Cohen, from January 1, 2012 to the present. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including-any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. communications between Michael Cohen and American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephani Clifford, and/ or Karen McDougal. k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. n. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January 1, 2013 to the present. - p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution, from January 1, 2013 to the present. q. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. B. Search and Seizure of Electronically Stored Information The items to be seized from Subject Premises-4 also include any computer devices and storage media that may contain any electronically stored information falling within the categories set forth in Section ILA of this Attachment above, including, but not limited to, a MacBook Pro, any other desktop and laptop computers, any Apple iPhone or other cellphone 0r smartphone 14 2017.03.02 belonging to Michael Cohen or in his possession, an Apple iPad Mini, portable hard drives, disk drives, thumb drives, and personal digital assistants. In lieu of seizing any such computer devices or storage media, this warrant also authorizes the copying of such devices or media for later review. The items to be seized from Subject Premises?4 also include: 1. Any items or records needed to access the data-stored on any seized or copied computer devices or storage media, including but not limited to any physical keys, devices, or records of login credentials, passwords, private keys, or similar information. 2. Any items or records that may facilitate a forensic examination of the computer devices, or storage media, including any hardware or software manuals or other information concerning the con?guration of the 3. Any evidence concerning the identities or locations of those persons with access to, control over, or ownership of the seized or copied computer devices or storage media. C. Review of ESI Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (which may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: - surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); 0 opening or cursorily reading the first few ?pages? of such ?les in order to determine their precise contents; - scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden ?les; - performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and 0' reviewing metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. 15 2017.08.02 Law enforcement personnel will make reasonable efforts to search only for files, documents, or other electronically stored information within the categories identi?ed in Sections HA and ILB of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the E81 from seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. A 16 2017.08.02 ATTACHMENT 1. Device Subject to Search and Seizure Subject Device?1 The device that is the subject of this search and seizure warrant (?Subject Device-1?) is described as follows: An Apple iPhone serviced by with the telephone number? During the execution of this search warrant, law enforcement personnel are authorized to depress the ?ngerprints and/or thumbprints of Michael Cohen onto the Touch ID sensor of Subject Device-1, or hold Subject Device?1 in front of Cohen? 5 face to activate the Face ID sensor, in order to gain access to the contents of any sucH?dev1ce as authorizeid?by'thiswarrant. II. Review of ESI on the Subject Device Law enforcement personnel (including, in addition to law enforcement officers and agents, and depending on the nature of the EST and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E31 contained on Subject Device?1 for evidence, fruits, and instrumentalities of . violations of 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(l) (illegal campaign contributions) (the ?Subject Offenses?) described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to and/or entities associated with him. c. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. 7 d. Evidence relating to Essential Consultants, LLC, including any documents or communications that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. 6. Evidence of income to Michael D. Cohen Associates, including any documents or communications that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. 17 2017.08.02 f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, from January 1, 2013 to the present. - 9. Evidence relating to agreements, loans, and/or ?nancial transactions between Cohen and_ and/or entities controlled by? and any payments by t1-D Cohen, from January 1, 2012 to the present. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougal. k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. - 11. Evidence relating to Cohen?s knowledge of the campaign finance laws, campaign contribution reporting requirements, and campaign contribution limits. - 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January 1, 2013 to the present. p. Communications, records, documents, and other files re?ecting false representations to a financial institution related to the intended purpose of an account or loan at that financial institution; the nature of any business or entity associated with an account at a financial institution; the source of funds ?owing into an account; or the purpose or nature of any financial transactions involving that financial institution, from January 1, 2013 to the present. 18 2017.08.02 If the Government determines that Subject Device-1 is no longer necessary to retrieve and preserve the data on the device, and that Subject Device-l is not subject to seizure pursuant to Federal Rule of Criminal Procedure 41(c), the Government will return Subject Device?l, upon request. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 19 2017.08.02 ATTACHMENT I. Device Subject to Search and Seizure Subject Device?2 The device that is the subject of this search and seizure warrant (?Subject Device-2?) is described as follows: An Apple iPhone serviced by with the telephone number? During the execution of this search warrant, law enforcement personnel are authorized to depress the ?ngerprints and/or thumbprints of Michael Cohen onto the Touch ID sensor of Subject Device-2, or hold Subject Device-2 in front of Cohen?s face to activate the Face ID sensor, in order to gain access to the contents of any such 11. Reviewer ESI on the Subject Device . Law enforcement personnel-(including, in addition to law enforcement of?cers and agents, and depending on the nature of the ESI and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained on Subject Device?2 for evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(l)(A) and 30109(d)(1)(A)(l) (illegal campaign contributions) (the ?Subject Offenses?) described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to ?nd/or entities associated with him. c. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. d. Evidence relating to Essential Consultants, including any documents or communications that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents or communications that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. 20 2017.08.02 f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, from January 1, 2013 to the present. 9, Evidence relating to agreements, loans, and/or ?nancial transactions between Cohen ant?W0r entities controlled by ?and any payments by' to Cohen, from January 1, 2012 to the present. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougal. k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 11. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January 1, 2013 to the present. p. Communications, records, documents, and other ?les reflecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds flowing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution, from January 1, 2013 to the present. 21 2017.08.02 If the Government determines that Subject Device-2 is no longer necessary to retrieve and preserve the data on the device, and that Subject Device?2 is not subject to seizure pursuant to Federal Rule of Criminal Procedure 41(0), the Government will return Subject Device?2, upon request. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ?filter team,? separate and apart from the investigative team, in order to address potential privileges. 22 2017.08.02 A0 93 (SDNY Rev. 05/10) Search and Seizure Wapant UNITED STATES DISTRICT COURT for the Southern District of New York I In the Matter of the Search of (Brie?y describe the property to be searched . or identij?z the pension by name and address) Case 502 Park Avenue, Apartment - New York, New York 10022, and any ciosed containers/items contained therein, See Attachment A SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement of?cer A11 application by a federal law enforcement of?cei 01 an attorney for the goveinment quuests the sealch I of the following 1361 son 01 p1 ope1ty located 1n the Southern District of New York (identy?l thepens'on 01 describe the pr mm' to be searched and give its location): . 502 Park Avenue Apartment .New York, New York 10022 and any closed containers/items contained therein, See Attachment A The person 01' property to be searched, described above, is believed to conceal (idemy?: the person or describe the property to be seizeaD: See Attachment A i I ?nd that the 01 any 1ecolded testimony, establish probable cause to seem oh and seize the person 01 plopelty . I.- . .. II . YOU ARE COMMANDED to execute this warrant on 01' before at: 55;? :9 if I I (Motto exceedl' any; Bi in the daytime 6:00 am. to 10 pm. at any time in the day 01 night as It had reasonable cause has been establishedUnless delayed notice is authotized below, you must give a copy of the wart ant and a 1 ece1pt 161.1113 property taken to the poison ?om whom, or from whose p1e1mses, the property Was taken, or'i? cave the copy and 1 ?ceipt at the place where the p1 opelty Was taken. I - . . . The of?ce1 executing this wan ant 01 an of?cer p1 esent duting the execution of the watrant must prepare an I inventory as 1equi1ed by law and 1ettun this warrant and inventory to the CieIk of the Court. Upon its 1'etu111, this warrant and invento1y should be ?led unde1 seal by the Clerk of the Court. . LUInftiais I ?nd that immediate noti?cation may have an adve1 se result listed In 18 S. C. (except fo1 delay of trial), and autho1ize the of?ce1 executing this warrant to delay notice Ito the person who; or whose p1',ope1ty will be searched 01 seized (check the appi'opr fate box) iijI days (notI to axe een . . ijuntil, the facts tllIe- later'specIf 0 date Date and ttme Issued: if g; .5 $.1me . .- ?ctive" sI'si rune e- . . . . t: Wild; f7 -IICity and state: New York. NY Ho'n.? Henry P-itman Us Maoistrate Judde Primed 1111111 and title A0 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) Return Case No.: Date and time wan?ant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: Certification I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the Court. Date: Executing o?tcer Signature Printed name and title ATTACHMENT A I. Premises to be Searched?Subject Premises-?1 The premises to be searched (?Subject Premises?l?) are described as follows, and include electronic devices, and all locked and closed containers found therein: Apartment-located inside the building at 502 Park Avenue, New York, New York 10022. The building located at 502 Park Avenue is a 32??oor brick residential building. Subject Premises?1 is located on the -of the building. 11. Items to Be Seized The items to be seized from Subject Premises-1 are evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy, as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(l)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?), described as follOWS: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to and/or entities associated with him. 0. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax retains, personal financial statements, and bank records, from January 1, 2013 to the present. g. Evidence relating to agreements, loans, and/or financial transactions between Cohen and ?md/or entities controlled by 1? 2 2017.08.02 and any payments by 1, 2012 to the present. -to Cohen, ?'om January h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc., David Pecker, andfor Dylanl-loward about Donald Clifford, and/or Karen MoDougal. k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. . 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. In. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. n. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January 1, 2013 to the present. 13. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution, ?'om January 1, 2013 to the present. q. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. B. Search and Seizure of Electronically Stored Information The items to be seized from Subject Premises-?1 also include any computer devices and storage media that may contain any electronically stored information falling within the categories set forth in Section ILA of this Attachment above, including, but not limited to, a MacBook Pro, any other desktop and laptop computers, any Apple iPhone or other cellphone or smartphone 3 2017.08.02 belonging to Michael Cohen or in his possession, an Apple iPad Mini, portable hard drives, disk drives, thumb drives, and personal digital assistants. In lieu of seizing any such computer devices or storage media, this warrant also authorizes the copying of such devices or media for later review. The items to be seized from Subject Premises~l also include: 1. Any items or records needed to access the data stored on any seized or copied computer devices or storage media, including but not limited to any physical keys, devices, or records of login credentials, passwords, private keys, or similar information. 2. Any items or records that may facilitate a forensic examination of the computer devices or storage media, including any hardware or software manuals or other information concerning the con?guration of the seized or copied computer devices or storage media. 3. Any evidence concerning the identities or locations of those persons with access to, control over, or ownership of the seized or copied computer devices or storage media. Review of ESI Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (which may include, in addition to law enforcement officers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the ESI contained therein for information resp onsivc to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: a surveying various ?le ?directories? and the individual files they contain (analogous to looking at the outside of a file cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les) a opening or cursorily reading the ?rst few ?pages? of such files in order to determine their precise contents; scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden ?les; a performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and reviewing metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. 2017.08.02 Law enforcement personnel will make reasonable eff01ts to search only for ?les, documents, or other electronically stored information within the categories identi?ed in Sections HA and II.B of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the E81 from seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney~client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart ?ow; the investigative team, in order to address potential privileges. 2017.08.02 A0 93 (SDNY Rev. 05/10) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of New York In the Matter of the Search of (Brie?y describe the property to be searched or identify the person by name and address) Case No, 502 Park Avenue, Apartment- New York, New York 10022 and any closed containers/items contained therein See AttachmentA SEARCH AND SEIZURE-WARRANT To: I Any authorized law enforcement officer An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or property located in the Southern District of New York (identify the person or describe the pronertv to be searched and give its location). 502 Park Avenue, Apartment -New York New York 10022, and any closed containers/items contained thereIn See Attachment A The person or property to be searched, described above, is believed to conceal (identify the person or describe the property to be seized): I See Attachment A .. I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property. YOU ARE COMMANDED to execute this warrant on or before Li 3-3? 8 (not to exceed 14 days) if in the daytime 6:00 am. to 10 pm. at any time in the day or night as I ?nd reasonable cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The officer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to the Clerk of the Court. Upon its return, this warrant and inventory should be ?led under seal by the Clerk of the Court. USMJ Initials I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C. 2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose property, will be searched OI (check the appropriate box) ij01? days (not to exceed 30). Duntil, the facts justifying, the later speci?c date of Date and time issued: 7254??ng f) Judge?s signature City and state: New York. NY Hon. Henry B. Pitman. U.S. Maoistrate Judoe Printed name and title A0 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) - Return Case No.: Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: Certi?cation I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the Court. Date: Executing o??icer signature Printed name and title ATTACHMENT A I. Premises to be Searchedeubject Premises-1 The premises to be searched (?Subject Premises?1?) are described as follows, and include electronic devices, and all locked and closed containers found therein: Apartment-located inside the building at 502 Park Avenue, New York, New York 10022. The building located at 502 Park Avenue is a 32-?oor brick residential building. Subject Premises?1 is located on the?of the building. II. Items to Be Seized The items to be seized from Subject Premises?1 are evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy, as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?), described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to _and/ or entities associated with him. c. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with EsSential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, from January 1, 2013 to the present. g. Evidence relating to agreements, loans, and/or ?nancial transactions between and?moor by 2 2017.08.02 ?ana any payments by -n Conan, nan Jannaay 1, 2012 to the present. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie nd/ or Karen McDOugal. k; Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/ or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump 5 relationship 1n the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. n. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January 1, 2013 to the present. p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution, from January 1, 2013 to the present. q. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. B. Search and Seizure of Electronically Stored Information The items to be seized from Subject Premises?1 also include any computer devices and storage media that may contain any electronically stored information falling within the categories set forth in Section ILA of this Attachment above, including, but not limited to, a MacBook Pro, any other desktop and laptop computers, any Apple iPhone or other cellphone or smartphone 3 2017.08.02 belonging to Michael Cohen or in his possession, an Apple iPad Mini, portable hard drives, disk drives, thumb drives, and personal digital assistants. In lieu of seizing any such computer devices or storage media, this warrant also authorizes the copying of such devices or media for later review. The items to be seized from Subject Premises-l also include: 1. Any items or records needed to access the data stored on any seized or copied computer devices or storage media, including but not limited to any physical keys, devices, or records of lo gin credentials, passwords, private keys, or similar information. 2. Any items or records that may facilitate a forensic examination of the computer devices or storage media, including any hardware or software manuals or other information concerning the con?guration of the seized or copied computer devices or storage media. 3. Any evidence concerning the identities or locations of those persons with access to, control over, or ownership of the seized or copied computer devices or storage media. C. Review of ESI Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (which may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may?use various techniques to locate information responsive to the warrant, including, for example: I surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); 0 opening or cursorily reading the ?rst few ?pages? of such ?les in order to determine their precise contents; - scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden ?les; 0 performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and - reviewing metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. 2017.08.02 Law enforcement personnel will make reasonable efforts to search only for ?les, documents, or other electronically stored information within the categories identi?ed in Sections HA and EB of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the E81 from seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence ina manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 2017.08.02 A0 93 (SDNY Rev. 05/10) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of New Yo1k In the Matter of the Search of (Brie?y describe the property 10 be searched 01' identi?r tl1epe111'011 by name and address) Michael Cohen?s Office at 30 Rockefeller Plaza, 23rd Floor, New York, New York 10112, and any closed containers/items contained therein, See Attachment 13111ch AND SEIZURE WARRANT To: Any authorized law enforcement of?cer An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or property located in the Southern District of New York. (ident?j) the person 01? describe the property 1?0 be searched and giVe its location): Michael Cohen?s Office at 30 Rockefeller Plaza, 23rd Floor, New York, New York 10112, and any closed containers/items contained therein, See Attachment The person or property to be searched, described above, is believed to conceal (identity the person or describe the properly 1'0 be seizeaD.? See Attachment I ?nd that the or any recorded testimony, establish probable cause to sench nd 1331 as the pawn or p1 operty I I YOU ARE COMNIANDED to execute this warrant on or before 5? ?313? ?We? I I 33?" (110! 1?0 exceed. 14 do ya) if in the daytime 6:any time in the day or night as I find leasonable cause has been established I, iI 1. Unless delayed notice is authorized below, you must git/e a copy of the warr ant and a 1ece1 pt for the pronuty taken to the peison flora whom, 01 from whose premises the p10perty was taken, or leave the copy and receipt at the place where the p1 opelty was taken . 1 2. The of?ce1 executing this warrant 01 an of?cer present during the execution of the wanant inust prepale an inventmy as required by law and p1 1eturn this warrant and inventory to the Clerk of the Court. Upon its return, this warrant and inventory should be ?led under seal by the Clerk of the Court. US MU II1 trials I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C. 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be searched 01' seized (check the appropriate box) lijI? days (110110 exceed 30). ?until, the facts justifying, the later speci?c date of Date and time issued: t/ rziltt?nacrs; 1,4. .1 1 . 1 i 1.1V.IsI?ISIguafwe 7 II City and state: New York. NY Hob. Henrva. Pltman Madistrate Judae . .IIP1 fated mate and title A0 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: Certification I declare under penalty of perjury that this inventory is correct and was retulned along with the original warrant to the Court. Date: Executing o??r?cer ?s signature Primed name and title ATTACHMENT I. Premises to be Searched??Subject Premises?2 The premises to be searched (?Subject Premisesu2?) are described as follows, and include electronic devices, and all locked and closed containers found therein: An of?ce belonging to or assigned to Michael Cohen located on the 23rd ?oor of the building at 3 0 Rockefeller Plaza, New York, New York 101 12, inside of the of?ces of the law ?rm Squire Patton Boggs. The building located at 30 Rockefeller Plaza is a 66-?oor of?ce building that spans the entire block between Sixth Avenue and Rockefeller Plaza. II, Items to Be Seized A. Evidence, Fruits, and Instrumentalities of the Subject Offenses The items to be seized ??om Subject Premises?2 are evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?) described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taXi medallions, ?'om January 1, 2013 to the present. be. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with himto transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to_1ndfor entities associated with him. 0. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or from Michael D. Cohen 8.: Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, from January 1, 2013 to the present. 52. Evidence relating to agreements, loans, and/or ?nancial transactions between Cohen and ?and/ or entities controlled by 6 2017.08.02 and any payments by _to Cohen, from January 1, 2012 to the present. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Tlump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc., David Pecker. and/or Dylan Howard about Donald Trump, the Campaign, Stephanie Clifford, and/or Karen ougal. k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Ti'innp and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 11. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications With others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January 1, 2013 to the present. p; Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution, from January 1, 2013 to the present. q. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. B. Search and Seizure of Electronically Stored Information The items to be seized from Subject Premises-2 also include any computer devices and storage media that may contain any electronically stored information falling within the categories set forth in Section ILA of this Attachment above, including, but not limited to, any desktop and laptop computers, any Apple iPhone or other cellphone or smartphone belonging to Michael Cohen 7 2017.08.02 or in his possession, portable hard drives, disk drives, thumb drives, and personal digital assistants. In lieu of seizing any such computer devices or storage media, this warrant also authorizes the copying of such devices or media for later review. The items to be seized from Subject Premises?2 also include: 1. Any items or records needed to access the data stored on any seized or copied computer devices or storage media, including but not limited to any physical keys, devices, or records of 10 gin credentials, passwords, private keys, or similar information. 2. Any items or records that may facilitate a forensic examination of the computer devices or storage media, including any hardware or software manuals or other information concerning the configuration of the seized or copied computer devices or storage media. 3. Any evidence concerning the identities or locations of those persons with access to, control over, or ownership of the seized or copied computer devices or storage media. C. Review of ESI Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (which may include, in addition to law enforcement officers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained therein for information responsive to the warrant. - In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: a surveying various ?le ?directories? and the individual files they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); 9 opening or cursorily reading the ?rst few ?pages? of such ?les in order to determine their precise contents; a scanning storage areas to discover and possibly recover recently deleted files or deliberately hidden ?les a performing key word searches tln'ough all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and a reviewing metadata, system information, con?guration files, registry data, and any other information re?ecting how, when, and by whom the computer was used. 2017.08.02 Law enforcement personnel will make reasonable efforts to search only for ?les, documents, or other electronically stored information Within the categories identified in Sections ILA and ILB of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the E81 ?om seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 2017.08.02 Hi: i: Wt A0 93 (SDNY Rev. 05/10) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of New York In the Matter of the Search of (Brie?y describe the property to be searched or identi?z the person by name and address) 333 N0. Michael Cohen?s Office at 30 Rockefeller Plaza, 23rd Floor, New York, New York 10112, and any closed containers/items contained therein, See Attachment SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement officer An application by a federal law enforcement officer or an attorney for the government requests the search of the following person or property located in the Southern District of New York (identy?j) the person or describe the property to be searched and give its location): Michaei Cohen?s Of?ce at 30 Rockefeller Plaza, 23rd Floor, New York, New York 10112, and any closed containers/items contained therein, See Attachment The person or property to be searched, described above, is believed to conceal (identi?) the person or describe the property to be seizec?: See Attachment I ?nd that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property. YOU ARE COMMANDED to execute this warrant on or before A 9? ?6 (not to exceed 14 days) ii in the daytime 6:00 am. to 10 pm. at any time in the day or night as I find reasonable cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The officer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to the Clerk of the Court. Upon its return, this warrant and inventory should be ?led under seal by the Clerk of the Court. USMJ Initials I find that immediate notification may have an adverse result listed in 18 U.S.C. 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be SeaI'Ched seized (check the appropriate box) lijI? days (not to exceed 30). Cluntil, the facts justifying, the later speci?c date of Dateandtimeissued: H?hxl?v A Judge is signature City and state: New York, NY Hon. Henry B. Pitman, U.S. Maelstrate Judoe Printed name and title A0 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: Certi?cation I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the Court. Date: Executing o??z?cer ?3 Signature Printed name and title .x :31! ATTACHMENT I. Premises to be Searched?Subject Premises-2 The premises to be searched (?Subject Premises?2?) are described as follows, and include electronic devices, and all locked and closed containers found therein: An office belonging to or assigned to Michael Cohen located on the 23rd ?oor of the building at 3 0 Rockefeller Plaza, New York, New York 10112, inside of the offices of the law firm Squire Patton Boggs. The building located at 30 Rockefeller Plaza is a 66-?oor office building that spans the entire block between Sixth Avenue and Rockefeller Plaza. II. Items to Be Seized A. Evidence, Fruits, and Instrumentalities of the Subject Offenses The items to be seized from Subject Premises?2 are evidenCe, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses), 1005- (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank ?aud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?) described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the?present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to ?md/ or entities associ?atedrwith him. c. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen 85 Associates, including any documents that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal financial statements, and bank records, from January 1, 2013 to the present. I g. Evidence relating to agreements, loans, and/or ?nancial transactions between Cohen and ?and/or entities controlled by? 6 2017.08.02 and any payments by -to Cohen, from January h. Evidence relating to payments to Stephanie Clifford, Karen McDougal', or their agents or legal representatives including any nondisclosure agreements and related documents, and any communications related to such agreements l, 2012 to the present. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougaly k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 11. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/0r fmances, from January 1, 2013 to the present. . p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution, from January 1, 2013 to the present. q. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. B. Search and Seizure of Electronically Stored Information The items to be seized from Subject Premises-2 also include any computer devices and storage media that may contain any electronically stored information falling within the categories set forth in Section ILA of this Attachment above, including, but not limited to, any desktop and laptop computers, any Apple iPhone or other cellphone or smartphone belonging to Michael Cohen 7 2017.08.02 1 . 1' Hill". or in his possession, portable hard drives, disk drives, thumb drives, and personal digital assistants. In lieu of seizing any such computer devices or storage media, this warrant also authorizes the copying of such devices or media for later review. The items to be seized from Subject Premises?2 also include: 1. Any items or records needed to access the data stored on any seized or copied computer devices or storage media, including but not limited to any physical keys, devices, or records of lo gin credentials, passwords, private keys, or similar information. 2. Any items or records that may facilitate a forensic examination of the computer devices or storage media, including any hardware or software manuals or other information concerning the con?guration of the seized or copied computer devices or storage media. 3. Any evidence concerning the identities or locations of those persons with access to, control over, or ownership of the seized or copied computer devices or storage media. C. Review of ESI Following seizure of any computer devices and storage-media and/orthe creation of forensic image copies, law enforcement personnel (which may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: 0 surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); 0 opening or cursorily reading the first few ?pages? of such ?les in order to determine their precise contents; 0 scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden ?les; - performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and reviewing metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. 2017.08.02 Law enforcement personnel will make reasonable efforts to search only for ?les, documents, or other electronically stored information within the categories identi?ed in Sections HA and ILB of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the E81 from seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attomey?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ?filter team,? separate and apart from the investigative team, in order to address potential privileges. 2017.08.02 min-e A0 93 (SDNY Rev. 05/ 10) search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of New York Case No. In the Matter of the Search of (Brie?y describe the property 1'0 be sear'ched or identi?r the person by name and address) Safe Deposit Box-coated at the TD Bank Branch at 500 Park Avenue, New York, New York 10019, and any closed containers/items contained therein, See Att. SEARCH AND snrzu - To: Any authm 1zed law enforcement of?cel An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or propelty located in the Southern District of New York (identi?r ihepeison 01 ?we! fhe the proper 1:1) to be sear chea? and give its location): Safe Deposit BO) -ocated at the TD Bank Branch at 500 Park Avenue New York, New York 10019, and any closed containersntems contained therein See Attachment The person or property to be searched, described above, is believed to conceal (ideiinjjr the person or describe the proper-0210 be seizeaD: See Attachment . I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property. YOU ARE COMMANDED to execute this warrant on or before i l??iei to exceed 74 days) ?r in the daytime 6:00 am. to 10 pm. at any time in the day 01 night as I find reaSonable cause has been established . 1 - Unless delayed notice is authorized below, you must give a copy of the wanant and a- recelut for the I110perty taken to the pelson f1 0111 whom, 01 fiom whose p1 emises, the propelty was taken, (11 leave the cop and TELUIDL at the place whele the 111 operty was taken. 3? a, - i The officel executing this wan ant, 01 an of?cel present din mg the execution of. the wa1rant, must prepa1e an inventory as 1equi1 ed by law and p1 when this wan ant and inventory to the Clark cf the (loan Upon its leturn, this wauant and inventory should be ?led undel seal by the Clerl-c oftne Court USil? Initials El I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C. 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose property, will be' 7 searched 01' seized (check the appropriate 110:1) ljfor days 6101' to es need 30). the facts justifying, the latei speci?c date of ?iiz?ii'iig, Mr ., Date and time issued: ?if 1? ,3 rife-um?? fetal: 32mm; 4; Judge ssrg?qizile i 3 . City and state: New York. NY Hon Henrv Pitman Maeisirate Judas Pr im?ea? name 11111171?:A0 93 (Rev. 01109) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: Certi?cation I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the Court. Date: Executing o??icer ?s signature Printed name and title ATTACHMENT I. Premises to be SearchedH?Subject Premises?3 The premises to be searched (?Subject Premises?3?) are described as follows, and include all locked and closed containers found therein: A safe deposit box located inside the TD Bank branch location at 500 Park Avenue, New York, New Y01lr; 10019, marked as box -The safe deposit box IS in the name of Michael Cohen and Laura Cohen. 11. Items to Be Seized A. The items to be seized from Subject Premises-3 are evidence, fruits, and instrumentalities of Violations of 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?), described as follows: 1. Evidence 1elating to Michael Cohen net Worth, available cash and cash equivalents, assets, and annual income, and income sot11ces,fiom Januaryl, 2013 to the piesent. 2. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. 3. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. 4. Evidence of communications between Michael Cohen and American Media, Inc, David Peclcer, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougal. 5. Evidence relating to Cohen?s iole 1n the Trump Campaign, and coo1dination 01 consultation with the Trump Campaign. 6, Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. 7. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 10 2017.03.02 8. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 9. Any portable electronic storage device. B. Search of Seized Electronic Devices Probable cause exists to search any seized electronic storage device for the items set forth in Section above. C. Re?ew of ESI Fol-lo wing seizrn?eofany include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: a surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); 9 opening or cursorily reading the ?rst few ?pages? of such ?les in order to determine their precise contents; a scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden ?les; . a performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and reviewing metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. Law enforcement personnel will make reasonable efforts to search only for ?les, documents, or other electronically stored information within the categories identi?ed in Sections 11A and 11.13 of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the E81 frOm seized devices if necessary to evaluate its contents and to locate all data responsive to the walnut. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect 1 1' 2017.03.02 any attorneywclient or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 12 2017.03.02 A0 93 (SDNY Rev. 05/ 10) search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of New York In the Matter of the Search of (Brie?y describe the property to be searched or tdenti?e the person by name and address) Case No, Safe Deposit Box r-_ocated at the TD Bank Branch at 500 Park Avenue, New York, New York 10019, and any closed containers/items contained therein, See Att. SEARCH AND SEIZURE WARRANT Tom I Any authorized law enforcement of?cer An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or property located in the Southern District of New York (identify the person or be the property to be searched and give its location): Safe Deposit Box; Located at the TD Bank Branch at 500 Park Avenue, New York, New York 10019, and any closed containers/items contained therein, See Attachment The person or property to be searched, described above, is believed to conceal (identify the person or describe the property to be seized): - See Attachment I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property. YOU ARE COMMANDED to execute this warrant on or before . (not to exceed 14 days) if inthe daytime 6:00 am. to 10 pm. at any time in the day or night as I ?nd reasonable cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or ?om whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to the Clerk of the Court. Upon its return, this warrant and inventory should be ?led under seal by the Clerk of the Court. USMJInttz?als El I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C. 2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose property, will be? searched 01? seized (check the appropriate box) days (not to exceed 30). Cluntil, the facts justifying, the later speci?c date of Dateandtimeissued: 734 6 afl?vn Judge? signature City and state: New York. NY Hon. Henry B. Pitman, U.S, Maoistrate Judee Printed name and title A0 93 (Rev. 01/09) Search and Seimre Warrant (Page 2) Return Case No.: Date and time warrant executed; Copy of warrant and inventory left with: Inventory made in the presienoe of Inventory of the property taken and name of any person(s) seized: Certi?cation I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the Court. Date: Executing o?icer?s Signature Printed name and title ATTACHMENT I. Premises to be Searched?Subject Premises?3 The premises to be searched (?Subject Premises-3?) are described as follows, and include all locked and closed containers found therein: A safe deposit box located inside the TD Bank branch location at 500 Park Avenue, New York, New York 10019, marked as box -Fhe safe deposit box is in the name of Michael Cohen and Laura Cohen. II. Items to Be Seized -- -- - of theSubject Offenses The items to be seized from Subject Premises?3 are evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?), described as follows: 1. Evidence relating to Michael Cohen?s net worth, available cash and cash equivalents, assets, and annual income, and income sources, from January 1, 2013 to the present. 2. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. 3. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. 4. Evidence of communications between Michael Cohen and American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/ or Karen McDougal. 5. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 6. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. 7. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 10 2017.03.02 8. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 9. Any portable electronic storage device. B. Search of Seized Electronic Devices Probable cause exists to search any seized electronic storage device for the items set forth in Section above. C. Review of ESI ,Following seizure of any electronic storage device. law enforcement personnel (which may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: - surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); - 0 opening or cursorily reading the ?rst few ?pages? of such ?les in order to determine their precise contents; 0 scanning storage areas to discover and possibly recover recently deleted .?les or deliberately hidden ?les; 0 performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and reviewing metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. Law enforcement personnel will make reasonable efforts to search only for ?les, documents, or other electronically stored information within the categories identi?ed in Sections ILA and 11B of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the E81 from seized devices if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect 11 2017.08.02 any attorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 12 2017.08.02 A0 93 (SDNY Rev. 05/10) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of New York In the Matter of the Search of (Brie?y describe the property to be searched or ideniyjr the person by name and address) Loews Regency Hotel, 540 Park Avenue, Room 1728, New York, New York 10065, and any closed containers/items contained therein, See Attachment SEARCH AND SEIZURE WARRANT To: 1 Any authorized law enfm cement office1 An application by a federal law enforcement officer or an attorney for the government requests the search of the following person or property located in the Southern District of New York (identh?l the person or describe the property to be searched and give its location): Loews Regency Hotel, 540 Park Avenue, Room 1728, New York, New York 10065, and any closed containers/items contained therein, See Attachment The person or propelty to be searched, described above, is believed to conceal (identi?! the person or describe the property to be seized): See Attachment I ?nd that the or any 1e001ded testimony, establish probable cause to search and 3?}?13 the pe1so11 01 property . YOU ARE COMMANDED to execute this Warrant on or before ii) (not to exceed .14 dayojW Ql in the daytime 6:any time in the day 01 night as' tind reasonable cause 'has been establishedUnless delayed notice is autho1ized below, you must give a copy of the wan ant and a leceipt for the property taken to the pe1 son f101n whom, or ?orn whose premises, the p1operty was taken, or leave the copy and-1ece1pt at the place where the p1 operty was taken. . . . . .. The of?cer executing this warrant, or an officer present during the execution of the wan?aiif iriuSt prepare an inventory as required by law and return this warrant and inventmy to the Clerk of the Court. Upon its return, this warrant and inventory should be ?led under seal by the Clerk of the Court. USMJ Initials Cl I ?nd that immediate noti?cation may have an adve1se 1esult listed in 18 U. S. C. 2705 (except fol delay of t11a1), and authorize the of?cer executing this warrant to delay notice to the p61 son who, 01 whose propeIty, will be 86810th 01 seized (clreckl?lre appropriate box) ?fel days (norm exceed 30) 1 3 . Eluntil, the facts justifying, the later Speci?c date of . . . ,7 .3: 2.. Date and time issuedgen?? I. duet. Wm; .r/W Jadgeir signature )il' - . if?? 3 - City and state: New York. NY Hon. HenryB. Pitrrien Maoistrate Jodoe Printednqme and title . .1 a . A093 (Rev. 01/09) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy of Warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: Certi?cation I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the Court. . Date: Executing a?cer ?5 Signature Printed name and title I. Premises to be Searched?Subject Premises-4 The premises to be searched (?Subject Premises-4?) are described as follows, and include electronic devices, and all locked and closed containers found therein: Room 1728 located inside the Loews Regency Hotel at 540 Park Avenue, New York, New York 10065. The building is a luxury hotel located on Park Avenue and 6lst Street. Subject Premises?4 is located on the 17th ?oor of the hotel. 11. Items to Be Seized 7 EVide?cesiFl?llits, and Instrumentalities of the Subject Offenses i I The items to be seized from Subject Premises?4 are evidence, fruits, and instrumentalities of Violations of 18 U.S.C. 371 (conspiracy, as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a financial institution), 1343 (Wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(l)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?), described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer anv interest in taxi medallions, and any associated debts or liabilities, to others, including to and/or entities associated with him. 0. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of "any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or. from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen 82; Associates. f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, from January 1, 2013 to the present. g. Evidence relating to agreements, loans, and/or ?nancial transactions between Cohen and ?and/or entities controlled by 13 2017.08.02 and any payments by - Cohen, from January h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. 1, 2.01;; to me present; i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc., Clifford, and/ or Karen McDougal. lc. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation With the Trump Campaign. 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negatiVe publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 11. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January 1, 2013 to the present. p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of ?mds flowing into an account; or the purpose or nature of any financial transactions involving that financial instimtion, from January 1, 2013 to the present. (1. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. B. Search and Seizure of Electronically Stored Information The items to be seized from Subject Premises-4 also include any computer devices and storage media that may contain any electronically stored information falling within the categories set forth in Section ILA of this Attachment above, including, but not limited to, a Machok Pro, any other desktop and laptop computers, any Apple iPhone or other cellphone er smartphone l4 2017.08.02 Jim. belonging to Michael Cohen or in his possession, an Apple iPad Mini, portable hard drives, disk drives, thumb drives, and personal digital assistants. In lieu of seizing any such computer devices or storage media, this warrant also authorizes the copying of such devices or media for later review. The items to be seized from Subject Premises?4 also include: 1. Any items or records needed to access the data stored on any seized or copied computer devices or storage media, including but not limited to any physical keys, devices, or records of lo gin credentials, passwords, private keys, or similar information. 2. Any items or records that may facilitate a forensic examination of the computer devices or storage media, including any hardware or software manuals or other information 3. computer devices or storage media. Any evidence concerning the identities or locations of those persons with access to, control over, or ownership of the seized or copied computer devices or storage media. C. Review of ESI Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (which may include, in addition to law enforcement officers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to IOCate information responsive to the warrant, including, for example: 2017.03.02 surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outside of a file cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); opening or cursorily reading the first few ?pages? of such files in order to detennine their precise contents; scanning storage areas to discover and possibly recover recently deleted files or deliberately hidden ?les performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related tothe subject matter of the investigation; and reviewing metadata, system information, cop?guration files, registry data, and any other information reflecting how, when, and by whom the computer was used. 15 lift! Law enforcement personnel will make reasonable efforts to search only for files, documents, or other electronically stored information within the categories identi?ed in Sections ILA and 11B of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the ESI from seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. l6 2017.08.02 A0 93 (SDNY Rev. 05/10) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of New York In the Matter of the Search of (Brie?y describe the property to be searched or identi?) the person by name and address) Case No. Loews Regency Hotel, 540 Park Avenue, Room 1728, New York, New York 10065, and any closed containers/items contained therein, See Attachment SEARCH AND SEIZURE WARRANT 7 Any authorized law enforcement of?cer An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or property located in the Southern District Of . New York (identi?J the person or describe the property to be searched and giVe its location): Loews Regency Hotel, 540 Park Avenue, Room 1728, New York, New York 10065, and any closed containers/items contained therein, See Attachment The person or property to be searched, described above, is believed to conceal (identz?: the person or describe the property to be seizeaD: See Attachment I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property. YOU ARE COMMANDED to execute this warrant on or before Li [3 (not to exceed 1 4 days) if in the daytime 6:00 am. to 10 pm. at any time in the day or night as I ?nd reasonable cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The of?cer executing this warrant, or an of?cer present during the execution of the Warrant, must prepare an inventory as required by law and return this warrant and inventory to the Clerk of the Court. Upon its return, this warrant and inventory should be ?led under seal by the Clerk of the Court. USMJIniriaIs I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C. 2705 (except for delay of trial), and authorize the of?cer executing this warrant to [delay notice to the person who, or whose property, Will be searched 01? seized (check the appropriate box) ijOI' days (not to exceed 30). Eluntil, the facts justifying, the later speci?c date of Date and time issued: Hfg?ig 7351i are. AHA-LR Judge? signature City and state: New York. NY Hon Henry Pitman U. S. Maelstrate Judge Printed name and title A0 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: Certi?cation I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the Court. Date: Executing o??icer ?3 Signature Printed name and title ATTACHMENT I. Premises to be Searched??Subject Premises?4 The premises to be searched (?Subject Premises-4?) are described as follows, and include electronic devices, and all locked and closed containers found therein: Room 1728 located inside the Loews Regency Hotel at 540 Park Avenue, New York, New York 10065. The building is a luxury hotel located on Park Avenue and 6lst Street. Subject Premises?4 is located on the 17th ?oor of the hotel. II. Items to Be Seized A. Evidence, Fr?uifs, The items to be seized from Subject Premises-4 are evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy, as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(l)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?), described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/0r entities associated with him to transfer anv interest in taxi medallions, and any associated debts er liabilities, to others, including to and/or entities associated with him. c. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. 6. Evidence of income to Michael D. Cohen 82; Associates, including any documents that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen 85 Associates. - f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, from January 1, 2013 to the present. g. Evidence relating to agreements, loans, and/or financial transactions between and/or entities controlled by 13 Cohen and 2017.08.02 and any payments by -to Cohen, from January h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. 1, 2012 to the present. i. Evidence of communications involving Michael Cohen, Donald Trump and/or I agents or associates of the Trump Campaign about Stephanie Clifford or Karen McD?ougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc., Clifford, and/or Karen McDougal. k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. n. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or fmances, from January 1, 2013 to the present. p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution, from January 1, 2013 to the present. q. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. B. Search and Seizure of Electronically Stored Information The items to be seized from Subject Premises?4 also include any computer devices and storage media that may contain any electronically stored information falling within the categories set forth in Section ILA of this Attachment above, including, but not limited to, a MacBook Pro, any other desktop and laptop computers, any Apple iPhone or other cellphone 0r smartphone 14 2017.03.02 belong'ing?to Michael Cohen or in his possession, an Apple iPad Mini, portable hard drives, disk drives, thumb drives, and personal digital assistants. In lieu of seizing any such computer devices or storage media, this warrant also authorizes the copying of such devices or media for later review. The items to be seized from Subject Premises?4 also include: 1. Any items or records needed to access the data stored on any seized or copied computer devices or storage media, including but not limited to any physical keys, devices, or records of login credentials, passwords, private keys, or similar information. 2. Any items or records that may facilitate a forensic examination of the computer devices or storage media, including any hardware or software manuals or other information concerning the con?guration of the seized or copied computer devices orstorage media. 3. Any evidence concerning the identities or locations of those persons with access to, control over, or ownership of the seized or copied computer devices or storage media. C. Review of ESI Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (which may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: - surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); 0 opening or cursorily reading the ?rst few ?pages? of such ?les in order to determine their precise contents; - scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden ?les; a performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and 0 reviewing metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. 15 2017.08.02 Law enforcement personnel will make reasonable efforts to search only for ?les, documents, or other electronically stored information within the categories identi?ed in Sections HA and KB of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the E81 from seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 16 2017.08.02 ?Wm A0 93 (SDNY Rev. 05/10) Search and Seizure Warrant UNITED STATES DISTRICT COUR for the Southern District of New York In the Matter of the Search of (Brie?y describe the property to be searched or the person by name and address) . An Apple iPhone with Phone Number_ 3 Case See Attachment SEARCH AND SEIZURE WARRANT 1?0: Any antherized law enforcement officer An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or property located in the Southern District of New York (identi?l the person or describe the property to be searched nive its location): 2 An Apple iPhone with Phone Number! See Attachment i? The person or property to be searched, described above, is believed to conceal properly to be seized): See Attachment I find that the or any recorded testimony, establish probable cause to search and seize the person or propeltythan; YOU ARE COMMANDED to execute this warrant on or before inthe daytime 6:any time in the day oranigl't 35?1st ?nd reasonablecansi} has been established. '6 - - Unless delayed notice is authorized below, you must give a copy ofth? warrantfandgareceipt for theyproperty taken to the person from whom, or from whose premises, the property was taken, :o'r?leave? the copy. and treceipt at the place where the property was takenThe officer executing this warrant, or an officer present during the execittioh prepare an inventory as required by law and return this warrant and inventory to the Clarke]? the?ourti Upon its return, this warrant and inventory should be ?led under sea] by the Clerk urine Court. El 1 ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C. 2705 (encept for delay of trial), and authorize the of?cer exeCuting this warrant to delay notice to the person who, or whose property, will be searched 01' seized (check the appropriate box) Ufor days (not to exceed 30). . a 4 1 . Diurtil, the facts justifying, thener-Tspe?ihe?gleregorf .4, - ?wr {firm Lewis? I. If?? I), Date and tune lssued: 1?71 5 5 pbq?enww w??eeg??aah? ,ff g? Judge ., A 7? 4 42/ We City and state: New York. NY . Hon. Hem/,5: :frintedirarhe 937;? A0 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) Return Case No: Date and time warrant executed: Copy of Warrant and inventory left with: Inventory made in the presence of Imentory of the property taken and name of any person(s) seized: Certification to the Cou?. Date: I declare under penalty of perjury that this inventory is correct and was returned along with the original wan'ant Executing o?icer ?s sigmfure Printed name and title mutm ATTACHMENT I. Device Suhj ect to Search and Seizure - Subject Device?1 The device that is the subject of this search and seizure warrant (?Subject Device-1?) is . described as follows: An Apple iPhone serviced by with the telephone number Du1ing the execution of this search warrant, law enforcement personnel are authorized to depress the fingerprints and/or of Michael Cohen onto the Touch 1D sensor of Subject Device-=1, or hold Subject Devicenl in front of Cohen?s face to activate the Face ID sensor, in order to gain access to the contents of any such device as authorized by this Warrant. II. Review 01? E31 on the Subject Device Law enforcement personnel (including, in addition to law enforcement officers and agents, and depending on the nature of the E81 and the status of the investigation and related proceedings, attorneys for the government, attorney supp01t staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained on Subject Device-d for evidence, fruits, and insuumentalities of violations of 18 U.S.C. 371 (conspiracy as it peltains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a financial institution), 1343 (Wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?) described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from anualy 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer anv interest in taxi medallions, and any associated debts or liabilities, to others, including to and/or entities associated with him; 0. Evidence relating to a plan, proposal, or agreement to modi?/ loans that Cohen has with Sterling and/or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents or communications that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents or that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. 17 2017.03.02 f. Evidence relating to Cohen?s net w01th, available cash and cash equivalents, and annual income, income sources, and other assets, Whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, from January 1, 2013 to the present. g. Evidence relating to agreements, loans, and/or ?nancial transactions between and/or entities controlled by . and any payments by_ to Cohen, from January Cohen and l, aura to me present. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougal. k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 11. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January 1, 2013 to the present. p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution, from January 1, 2013 to the present. 18 2017.08.02 If the Government determines that Subject Deviceul is no longer necessary to retrieve and preserve the data on the device, and that Subject Deviceul is not subject to seizure pursuant to Federal Rule of Criminal Procedure 41(0), the Government will return Subject Device-1, upon request. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney~client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 19 2017.08.02 A0 93 (SDNY Rev. 05/ 10) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of New York In the Matter of the Search of (Brie?y describe the property to be searched or identi?! the person by name and address) An AppEe iPhone with Phone Number See Attachment Case No. SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement of?cer I An application by a federal law enforcement officer or an attorney for the government requests the search of the following person or property located in the Southern District of New York (identi?l the person or describe the property to "ive its location)! An Apple iPhone with Phone Number See Attachment The person or property to be searched, described above, is believed to conceal (identz? the person or describe the property to be seizeaD: See Attachment I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property. YOU ARE COMMANDED to execute this warrant on or before 1" IE (not to exceed 14 days) it in the daytime 6:00 am. to 10 pm. at any time in the day or night as I ?nd reasonable cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to the Clerk of the Court. Upon its return, this warrant and inventory should be ?led under seal by the Clerk of the Court. USMJ Initials El I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C. 2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose property, will be searched 01? seized (check the appropriate box) days (not to exceed 30). Duntil, the facts justifying, the later speci?c date of Date andtirne issued: 7ig-qp-W- pl, 6 (Pi-?i?V?e?A Judge signature City and state: New York. NY Hon. Henrv B. Pitman. U.S. Mauistrate Judqe Printed name and title A0 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: Certi?cation I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the Court. Date: Executing of?cer ?5 signature Printed name and title ATTACHMENT I. Device Subject to Search and Seizure Subject Device-1 The device that is the subject of this search and seizure warrant (?Subject Device-1?) is described as follows: An Apple iPhone serviced by with the telephone number During the execution of this search warrant, law enforcement personnel are authorized to depress the ?ngerprints and/ or of Michael Cohen onto the Touch ID sensor of Subject Device-1, or hold Subject Device?1 in front of Cohen?s face to activate the Face ID sensor, in order to gain access to the contents of any such device as authorized by this warrant. II. Review of ESI on the SubjectDevice Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the ESI and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the ESI contained on Subject Device?1 for evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a financial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?) described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to ?1nd/or entities associated with him. 0. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. 0 d. Evidence relating to Essential Consultants, LLC, including any documents or communications that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents or communications that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. 17 2017.08.02 1r 1: Film.- f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, from January 1, 2013 to the present. g. Evidence relating to agreements, loans, and/or ?nancial transactions between md/ or entities controlled by and any payments by to Cohen, from January Cohen and l, 2012 to the present. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougal. k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford 'or others in connection with the election. 10. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January 1, 2013 to the present. p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution, ?om January 1, 2013 to the present. 18 2017.08.02 .il??w If the Government determines that Subject Device?l is no longer necessary to retrieve and preserve the data on the device, and that Subject Device?1 is not subject to seizure pursuant to Federal Rule of Criminal Procedure 41(c), the Government will return Subject Device?1, upon request. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. . 19 2017.08.02 A0 93 (SDNY Rev. 05/10) Search and Seizure Wanant UNITED STATES DISTRICT COURT for the Southern District of New York La 2 9 6 9 SEARCH AND SEIZURE WAREANT EX 1 In the Matter of the Search of (Brie?y describe the property to be searched or identi?l the person by name and address) An Apple phone with phone Number_ 3 See Attachment To: Any authorized law enfm cement of?ce1 An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or property located in the Southern District of New York (fdenh? the person 01' describe the property to he Mmm?mr? ""ve its Iocatiory: An Appie iPhone with Phone Number See Attachment The person or property to be searched, described above, is believed to conceal (idenh?) the person or describe the property 1'0 be seizeaD! See Attachment I ?nd that the or any recorded testimony, establish probable cause to seaich and; 313120 tae person 01 property 47: 1 . . :3 5,11?, 3/ K1. YOU ARE to execute this warrant?on or before a? .. 1 - {not to exam-114114311,? El in the daytime 6:any time in the day or night as I ?nd re sonable cause 1121s been established . . 4 .1 . Unless delayed notice is auth01 ized below you must give a copy of the warrant and a receipt for the pionelty taken to the pe1son f1 om whom 01 from whose premises, the p1 operty was taken, 01 leave the copy and leceio at the place where the property was taken. . - The of?cer executing this warrant, 01' an of?cel present duiing the execution of the walrant, must prepare an inventory as requiied by law and p1 leturn this wanant and inventory to the Clerk of the Court. Upon its retuln, this wanant and inventory should be ?led unde1 seal by the Clelk of the Court. USA/[anftiais I ?nd that immediate noti?cation may have an adve1se result listed in 18 U. S. 2705 (except f01 delay of tiial), and auth01ize the of?cel executing this wairant to delay notice to the pelson who, or whose propeity, will be sealched 01? seized (check the appi?apiiate box) ifm days (not to exceed 30) 1 Cluntil, the facts justifying, the latei speci?c date of It?i, . . 3x 3; 4: Date and time lssued: 7 if MW Aweigh ?i 41/191194? 1" /?ldgr? SSlgi'i?f?IB City and state: New York. NY Hon. HenrvB Pitmali uis. Judqe Printed name and Mia ATTACHMENT I. Device Subject to Search and Seizure Subject Device?2 The device that is the subject of this search and seizure warrant (?Subject Device-2? is described as follows: An Apple iPhone serviced by with the telephone number During the execution of this search warrant, law enforcement personnel are authorized to depress the ?ngerprints and/01? thumbprints of Michael Cohen onto the Touch ID sensor of Subject Device?2, or hold Subject Device-2 in front of Cohen?s face to activate the Face ID sensor, in order to gain access to the contents of any such device as authorized by this warrant. II. Review of ESI on the Subject Device Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the E31 and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained on Subject Device-2 for evidence, fruits, and instrumentalities of Violations of 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S..C. 30116(a)(l)(A) and 30109(d)(l)(A)(l) (illegal campaign contributions) (the ?subj ect Offenses?) described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/01? taxi medallions, from January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to ?md/or entities associated with him c. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents or communications that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants, e. Evidence of income to Michael D. Cohen Associates, including any documents or communications that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. 20 2017.03.02 f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, from January 1, 2013 to the present. g. Evidence 1elating to agreements, loans, and/or ?nancial transactions between Cohen and?and/or entities cont1olled by and any payments by_to Cohen, from January 1, 2012 to the p1esent. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/ or Karen McDougal. k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 11. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, ?'om January 1, 2013 to the present. p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended puipose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that fmancial institution, from January 1, 2013 to the present. 21 2017.08.02 If the Government determines that Subject Device-2 is no longer necessary to retrieve and preserve the data on the device, and that Subject Device~2 is not subject to seizure pursuant to Federal Rule of Criminal Procedure 41 the Government will return Subject Device-2, upon request. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed toprotect any attorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address a potential privileges. 22 2017.08.02 A0 93 (SDNY Rev. 05/10) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of New York In the Matter of the Search of {Brie?y describe the property to be searched or identg'j?i the person by name and address) An Apple iPhone with Phone Number- See Attachment SEARCH AND SEIZURE WARRANT Case No. To: Any autho'rlzed'law entorcement?f?c er An application by a federal law enforcement of?cer or an attorney for the gOVernment requests the search of the following person or property located in the Southern District of New York (identz'jjz the person or describe the property to be searched m'1'e its location): An Apple iPhone with Phone Number See Attachment The person or property to be searched, described above, is believed to conceal (identl'jj) the person or describe the property to be seized): See Attachment I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property. YOU ARE COMMANDED to execute this warrant on or before i (not to exceed 14 days) if in the daytime 6:00 am. to 10 pm. at any time in the day or night as I ?nd reasonable cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to the Clerk of the Court. Upon its return, this warrant and inventory should be ?led under seal by the Clerk of the Court. USMJ Initials I ?nd that immediate noti?cation may have an adverse result listed in 18 U. S. 2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose property, will be searched or seized (check the appropriate box) Elfo?r days (not to exceed 30). Eluntil, the facts justifying, the later speci?c date of Date and time issued: 7; NEW /4 8 ?l W?w I?Judge signature City and state: New York. NY Hon. Henry B. Pitman. U.S.?Maqistrate JudQe Printed name and title A0 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: Certi?cation I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the Court. Date: Executing o?icer Signature Printed name and title ATTACHMENT I. Device Subject to Search and Seizure 4- Subject Device-2 The device that is the subject of this search and seizure warrant (?Subject Device?2?) is described as follows: An Apple iPhone serviced by with the telephone number During the execution of this search warrant, law enforcement personnel are authorized to depress the ?ngerprints and/ or thumbprints of Michael Cohen onto the Touch ID sensor of Subject Device?2, or hold Subject Device?2 in front of Cohen?s face to activate the Face ID sensor, in order to gain access to the contents of any such device as authorized by this warrant. II. Review of ESI on the Subject Device Law enforcement personnel (including, in addition to law enforcement officers and agents, and depending on the nature of the ESI and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the ESI contained on Subject Device-2 for evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a financial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?) described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the present. b. Evidence relating to a plan, proposal, 'or agreement for Michael Cohen and/ or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to? and/or entities associated with him. c. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/ or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents or communications that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents or communications that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. 20 2017.08.02 f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, persona-l ?nancial statements, and bank records, from January 1, 2013 to the present. g. Evidence relating to agreements, loans, and/or ?nancial transactions between and/ or entities controlled by and any payments by '?to Cohen, from January Cohen and l, 110 the present. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougal. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. In. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. n. Evidence relating to Cohen? knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January 1, 2013 to the present. p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds flowing into an account, or the purpose or nature of any ?nancial transactions involving that ?nancial institution, from January 1, 2013 to the present. 21 2017.08.02 If the Government determines that Subject Device?2 is no longer necessary to retrieve and preserve the data on the deviCe, and that Subject Device-2 is not subject to seizure pursuant to Federal Rule of Criminal Procedure 41(0), the Government Will return Subject Device-2, upon request. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designedto collect evidence in a manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 22 2017.08.02 '1 R0 106 (SDNY Re 01/17 . i ation for a?Search Warrantt?ngiOf?UJ. UNITED STATES DISTRICT COURT for the Southern District of New York In the Matter of the Search of 1 . . (Brie?y describe the property to be searched . or identify he person by name and address) Case No. Loews Regency Hotel, 540 Park Avenue, Room 1628 APPLICATION FOR A SEARCH AND SEIZURE WARRANT I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property (identify the person or describe the property to be searched and give its location): Loews Regency Hotel, 540 Park Avenue, Room 1628, a Suite that Encompasses Rooms 1628, 1629, and 1630 New York, New York 10065 locate'd?in?the?ASel?Jthern- Districtof New York there is nowconcealed (identify the person or describe the property to be seized): See Attached Affidavit and its Attachment A The basis for the search under Fed. R. Crim. P. 41 is (check one or more): IE/e'Vidence of a crime; El/?onhaband, fruits of crime, or other items illegally possessed; Q?ijroperty designed for use, intended for use, or used in committing a crime; El a person to be arrested or a person who is unlawfully restrained. The search is related to a Violation of: Code Section(s) O?ense Description(s) 18 USC 371.1005, 1014. 1343. Conspiracy, false bank entries, false statements to a financial 1344' 52 USC 30116 and 30109 institution, wire fraud, bank fraud, and illegal campaign contributions The application is based on these facts: See Attached Affidavit and its Attachment A if Continued on the attached sheet. El Delayed notice of 30 days (give exact ending date if more than 30 days: is requested under 18 U.S.C. 3103 a, the basis of which is set forth on the attached sheet. Sworn to before me and signed in my presenceDate: AFN 1' 7? Judge?ssignaifure ,nombt? Printe name?and title: ?v City and state: New York, NY Case Document 48-2 Filed 07/18/19 Page-2 of 201 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of the Application of the United TO BE FILED UNDER SEAL States of America for a Search and Seizure Warrant for the Premises Known and Described Agent Af?davit in Support of as Loews Regency Hotel, 540 Park Avenue, Application for Search and Seizure Room 1628, a Suite that Encompasses Rooms Warrant 1628, 1629, and 1630 New York, New York 10065, and Any Closed Containers/Items Contained Therein Reference No. 2018R00127 SOUTHERN DISTRICT OF NEW YORK) 83.: - Special AgentrFederal Bureau of Investigation, beingduly sworn, deposes and says: I. Introduction A. Affiant 1. I am a SpecialAgent with the Federal Bureau of Investigation I have been a Special Agent with the FBI since 2009. In the course of my experience and training in these positions, I have participated in criminal investigations into federal offenses involving a wide array of ?nancial crimes, including frauds on ?nancial institutions, as well as into offenses involving public corruption. I also have training and experience executing search warrants, including those involving electronic evidence. 2.. On or about April 8, 2018, the Honorable Henry B. Pitman, United States Magistrate Judge, issued a search and seizure warrant for the premises known and described as Loews Regency Hotel, 540 Park Avenue, Room 1728, New York, New York 10065, and Any . Closed Containers/Items Contained Therein. The warrant and my supporting af?davit (the ?Af?davit?) are appended hereto. The Af?davit is incorporated herein by reference in its entirety as Exhibit A. 2017.08.02 Case Document 48-2 Filed 07/18/19 Page about April 9, 2018, based upon a conversation with another law enforcement agent who spoke to an employee of Loews Regency Hotel, I learned that Michael Cohen is in fact staying in Room 1628 (in a suite encompassing rooms 1628, 1629, and 1630) (collectively, ?Room 1628?), not Room 1728. Accordingly, I respectfully submit the attached amended warrant pursuant to Rule 41 of the Federal Rules of Criminal Procedure for the following Subject Premises: Loews Regency Hotel, 540 Park Avenue, Room 1628, New York, New York 10065, and Any Closed Containers/Items Contained Therein (?Subject For the reasons detailed in the Af?davit and herein, I believe that there is probable cause to believe that Subject Premises-4 entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank ??aud) (collectively, the ?Bank Fraud Offenses?), 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Campaign Finance Offenses?), and 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses) (collectively, the ?Subject Offenses?). 4. Based on the foregoing, I respectfully request the court to issue a warrant to seize the items and information speci?ed in Attachment A to this af?davit and to the Search and Seizure Warrant. 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 4 of 201 5. In light of the con?dential nature of the continuing investigation, I respectfully request that this af?davit and all papers submitted herewith be maintained under seal until the Court orders otherwise. Special Agent FBI Sworn to before me on 15?? 9th day of April, 2018 ,7A1m?fgr HON. HENTW B. PITMAN UNITED STATES MAGISTRATE JUDGE 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 5 of 201 ATTACHMENT A I. Premises to be Searched?Subject Premises-4 The premises to be searched (?Subject Premises-4?) are described as follows, and include electronic devices, and all locked and closed containers found therein: Room 1628 (a suite encompassing rooms 1628, 1629, and 1630) (collectively, ?Room 1628?), located inside the Loews Regency Hotel at 540 Park Avenue, New York, New York 10065. The building is a luxury hotel located on Park Avenue and 61st Street. Subject Premises? 4 is located on the 16th ?oor of the hotel. II. Items to Be Seized Evidence, Fruits, and Instrumentalities of the Subject Offenses . The items to be seized, ?om Subject Premises-4 are evidence, ?uits, andinstrumentalities of violations of 18 U.S.C. 371 (conspiracy, as it'pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank ?aud), and 52 U. S. C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?), described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, ?om January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to _md/or entities associated with him. 0. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and] or Melrose. (1. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or 00111 Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual' moome, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, ??om January 1, 2013 to the present. g. Evidence relating to agreements, loans, and/or financial transactions between Cohen and?and/or entities controlled by 2 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 6 of 201 and any paments lay-to Cohen, ?om January 1, 2012 to the present. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougal. 1c. Evidence relating to Cohen? sI Irole in the Trump Campaign, and coordinationII or consultation with theTmmp Campaign 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship 1n the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 11. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or finances, from January 1, 2013 to the present. p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution, the nature of any business or entity associated with an account at a ?nancial institution; the source of ?inds ?owing into an account, or the purpose or nature of any ?nancial transactions involving that ?nancial institution, ?om January 1, 2013 to the present. q. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. B. Search and Seizure of Electronically Stored Information The items to be seized ?om Subject Premises- 4 also include any computer devices and storage media that may contain any electronically stored information falling within the categories set forth 1n Section ll A of this Attachment above, including, but not limited to, a MacBook Pro, any other desktop and laptop computers, any Apple iPhone or other cellphone or smartphone 3 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 7 of 201 belonging to Michael Cohen or in his possession, an Apple iPad Mini, portable hard drives, disk drives, thumb drives, and personal digital assistants. In lieu of seizing any such computer devices or storage media, this Warrant also authorizes the copying of such devices or media for later review. The items to be seized from Subject Premises-4 also include: 1. Any items or records needed to access the data stored on any seized or copied computer devices or storage media, including but not limited to any physical keys, devices, or records of login credentials, passwords, private keys, or similar information. 2. Any items or records that may facilitate a forensic examination of the computer devices or storage media, including any hardware or software manuals or other information concerning the con?guration of the seized or copied computer devices or storage media. 3. Any evidence concerning the identities or locations of tho se persons with access to, control over, or ownership of the seized or copied computer devices or storage media. e. Review of ESI Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (which may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the ESI contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: a surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); 6 opening or cursorily reading the ?rst few ?pages? of such ?les in order to determine their precise contents; a scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden ?les; 9 performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and a reviewing metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 8 of 201 Law enforcement personnel will make reasonable efforts to search only for ?les, documents, or other electronically stored information within the categories identified in Sections HA and of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the E81 from seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 90f 201 WW ere-? Case Document 48-2 Filed 07/18/19 Page 10 of 201 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of the Application of the United TO BE FILED UNDER SEAL States of America for a Search and Seizure Warrant for the Premises Known and Described 5 Agent Af?davit in Support of as (1) 502 Park Avenue, ?New Application for Search and Seizure York, New York 10022, (2) Michael Cohen?s 5 Warrant Of?ce at 30 Rockefeller Plaza, 23rd Floor, New York, New York 10112, (3) Safe Deposit Box .Located at the TD Bank Branch at 500 Park 3 Avenue, New York, New York 10019, and (4) Loews Regency Hotel, 540 Park Avenue, Room 1728, New York, New York 10065, and Any 3 Closed Containers/Items Contained Therein, and the Electronic Devices Known and Described as 1nd (2) an Apple iPhone with Phone Number: 3 Reference No. 2018R00127 SOUTHERN DISTRICT OF NEW YORK) ss.: Special Agent, Federal Bureau of Investigation, being duly sworn, deposes and says: I. Introduction A. Af?a?nt 1. I am a Special Agent with the Federal Bureau of Investigation I have been a Special Agent with the FBI since 2009. In the course of my experience and training in these positions, I have participated in criminal investigations into federal offenses involving a wide array of ?nancial crimes, including frauds on financial institutions, as well as into offenses involving public corruption. I also have training and experience executing search warrants, including those involving electronic evidence. A 2. I make this Af?davit in support of an application pursuant to Rule 41 of the Federal Rules of Criminal Procedure for a warrant to search the premises speci?ed below (the ?Subject . 2 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 11 of 201 Premises?) and the electronic devices speci?ed below (the ?Subject Devices?) for, and to seize, the items and information described in Attachments A, B, C, D, and F. This affidavit is based upon my personal knowledge; my review of documents and other evidence; my conversations with . other law enforcement personnel; and my training, experience and advice received concerning the use of electronic devices in criminal activity and the forensic analysis of electronically stored information Because this af?davit is being submitted for the limited purpose of establishing probable cause, it does not include all the facts that I have leamed during the course of my investigation. Where the contents of documents and the actions, statements, and *c?onversati'Onssof?others arerep titted-herein; they arevreporte d-in-sub art: except?where otherwise indicated. B. The Subject Premises and Subject Devices 3. Subject Premises-l, Subject Premises?2, Subject Premises?3 and Subject Premises? 4 (collectively, the ?Subject Premises?) are particularly described as: a. Subject Premises-l is Apartment .located inside the building at 502 Park Avenue, New York, New York 10022. The building located at 502 Park Avenue is a 32? ?oor brick residential building. Subject Premises-l is located on the -loor of the building. Based on my review of New York City property records, I have learned that Michael Cohen and Laura Cohen own Subject Premises-l.1 Additionally, as described below, Subject Premises-1 is Cohen?s full?time residence. b. Subject Premises-2 is an of?ce located on the 23rd ?oor of the building at 30 Rockefeller Plaza, New York, New York 10112. The building located at 30 Rockefeller Plaza 1 As noted in?a, have learned that on or about October 28, 2015, Cohen transferred Subject Premises-1 into a trust. 3 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 12 of 201 is a 66~?oor of?ce building that spans the entire block between Sixth Avenue and Rockefeller Plaza. Subject Premises?2 is located on the 23rd ?oor of the building inside of the of?ces of the law ?rm Squire Patton Boggs. The of?ce is assigned to Michael Cohen. As described below, Michael Cohen Works and conducts meetings at Subject Premises-2. 0. Subject Premises-3 is a safety deposit box located inside the TD Bank branch location at 5 00 Park Avenue, New York, New York 10019. Based on my review of records maintained by TD Bank, I have learnedthat the safety deposit box is approximately ?ve inches by ten inches in size, and is?marked as box-The safety deposit box is in the name of Michael (1. Subject Premises-4 is Room 1728 located inside the Loews Regency Hotel at 540 Park Avenue, New York, New York 10065. The building is a luxury hotel located on Park Avenue and 6lst Street. Subject Premises-4 is located on the 17th ?oor of the hotel. Based on my review of emails obtained pursuant to search warrants described below, I have learned that on or about January 5, 2018, Cohen received an email from an employee of Loews Regency, which included a price quote for a long-term stay suite based on a three-month stay from January 8 to April 8, 2018.2 On or about January 29, 2018, Cohen sent an email to a Loews Regency employee, stating, in pertinent part: just spoke to my wife and she has scheduled the move for Thursday. Please mark down that we will be taking possession on Thursday, February lst.? Based on my review of cell phone location data, I have learned that, over the past 24 hours, two cellular phones used by Cohen have been located in the Vicinity of Subject Premises?4. In particular, on or about 2 Although the quoted price contemplated a three-month stay from January 8 to April 8, it appears that Cohen did not move in until February 1, and as of today, April 8, cellphone location information demonstrates that Cohen?s cellular phones are in still in the vicinity of Subject Premises-4. 4 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 13 of 201 April 8, 2018, law enforcement agents using a ?triggerfish? device identi?ed Room 1728 as the room within the hotel in which the Subject Devices are most likely present.3 e. Therefore, I believe that Cohen is temporarily residing in Subject Premises-4. 4. Subject Device-1 and Subject Device-2 (collectively, the ?Subject Devices?) are particularly described as: a. Subject Device-1 is an Apple iPhone serviced by with the telephone number - Based on my review of records maintained by I have learned that Subject ?DeviCe-i is maintained I have learned that Subject Device~1 is presently located in the Southern District of New York. b. Subject Device-2 is an Apple iPhone serviced by with the telephone number - Based on my review of records maintained by I have learned that Subject Device-2 is subscribed to Michael Cohen. Based on my review of cellphone location information maintained by I have learned that Subject Device?2 is presently located in the Southern District Of New York. c. Based on my training, experience, and research, and from consulting the manufacturer?s and service providers? advertisements and product technical speci?cations available online, I know that the Subject Devices have capabilities that allow them to, among other things: make and receive telephone calls; save and store contact information; send and receive 3 Based on my conversations with these agents, I understand that it is also possible that the Subject Devices are one ?oor below, in Room 1628. However, as noted, Iunderstand that Cohen received a price quote for a long-term stay suite and is residing there with his family. Based on my conversations with FBI agents conducting sulveillance, I understand that Room 1728 appears to be a suite, whereas Room 1628 appears to be a standard room. 5 2017.03.02 case Document 48-2 Filed 07/18/19 Page 14 of 201 emails and text messages; download and run mobile telephone applications, including call and messaging application such as WhatsApp, Signal, and Dust; take, send, and receive pictures and videos; save and store notes and passwords; and store documents. C. The Subject Offenses 5 . For the reasons detailed below, I believe that there is probable cause to believe that the Subject Premises and Subject Devices contain evidence, fruits, and instrumentalities of violations of 18 U.S.C. 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud) (collectively, the ?Bank Fraud Offenses?), C?g- 6 (A)iand~3 07170 9 (A) (illegalw camp aignw contributions)? (the ?Campaign Finance Offenses?), and 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses) (collectively, the ?Subject Offenses?). D. Prior Applications 6. The FBI and the United States Attorney?s Of?ce for the Southern District of New York have been investigating several courses of criminal conduct by Michael Cohen. Cohen is an attorney who currently holds himself out as the personal attorney for President Donald Trump, and who previously served for over a decade as an executive in the Trump Organization, an international conglomerate with real estate and other holdings. 7. In connection with an investigation then being conducted by the Of?ce of the Special Counsel the FBI sought and obtained from the Honorable Belyl A. Howell, Chief United States District Judge for the District of Columbia, three search warrants for emails and other content information associated with two email accounts used by Cohen, and one search warrant for stored content associated with an iCloud account used by Cohen. Speci?cally: 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 15 of 201 a. On or about July 18, 2017, the FBI sought and obtained a search warrant for emails in the account-@gmailcom (the ?Cohen Gmail Account?) sent or received between January 1, 2016 and July 18, 2017 (the ?First Cohen Gmail Warran b. On or about August 8, 2017, the FBI sought and obtained a search warrant for content stored in the iCloud account associated with Apple ID -@gmail.com (the ?Cohen iCloud Account? and the ?Cohen iCloud Warran I c. On or about November 13', 2017, the FBI sought and obtained a search warrant for emails in the Cohen Gmail Account sent or received between June 1, 2015 and d. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the account _(the ?Cohen Account?) sent or received between the opening of the Cohen IVIDCPC Account4 and November 13, 2017 (the ?First Cohen Warrant?). 8. The SCO has since referred celtain aspects of its investigation into Cohen to the USAO, which is working with the New York Field Of?ce. As part of that referral, on or about February 8, 2018, the SCO provided the USAO with all non?privileged emails and other A content information obtained pursuant to the First Cohen Gmail Warrant, Second Cohen Gmail Warrant, and Cohen Warrant. On or about March 7, 2018, the SCO provided the USAO 4 Based on my review of this warrant and the affidavit in support of it, I know that the warrant did not specify a time period, but the af?davit indicated that, pursuant to court order, the service provider had provided non-content information for the Cohen Account that indicated that the account contained emails from the approximate period of March 2017 through the date of the warrant. 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 16 of 201 with all non?privileged content obtained pursuant to the Cohen iCloud Ill/Tarrant.5 A ?lter team working with the SCO had previously reviewed the content produced pursuant to these warrants for privilege. 9. On or about February 28, 2018, the USAO sought and obtained search warrants for emails in the Cohen Gmail Account and the Cohen Account, among other accounts, sent or received between November 14, 2017 and Februaly 28, 2018 (the ?Third Cohen Gmail Warrant? and the ?Second Cohen Warrant?). The content produced pursuant to these warrants is ?subj ect to an ongoing review for privilege by an SDNY ?lter team.6 1- 0 ed~ab0veaareerefe?ede to ?Cohen Email Warrants.? 11. On or about April 7, 2018, the USAO and FBI sought and obtained a warrant for prospective and historical cellphone location information for Subject Device?l and Subject Device-2. On or about April 8, 2018, the USAO and FBI sought and obtained authority to employ an electronic technique, commonly known as a to determine the location of Subject Device?1 and Subject Device-2. II. Probable Cause A. Overview 12. The United States Attorney?s Of?ce for the Southern District of New York and FBI are investigating, among other things, schemes by Target Subject Michael Cohen to defraud multiple banks from in or about 2016 up to and including the present, and to make an illegal 5 The SCO had a subset of this non-privileged content on or about February 2, 2018. 5 On or about February 28, 2018 and April 7, 2018, the USAO and FBI sought and obtained Rule 41 search warrants authorizing the search of emails and content obtained pursuant to previously issued warrants for additional subject offenses. 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 17 of 201 campaign contribution in October 2016 to then-presidential candidate Donald Trump. As noted, Cohen is an attorney who currently holds himself out as the personal attorney for President Donald - Trump, and who previously served for over a decade as an executive in the Trump Organization, an international conglomerate with real estate and other holdings. 13. The investigation has revealed that Cohen has made affirmative misrepresentations in and omitted material information from ?nancial statements and other disclosures that Cohen provided to multiple banks in connection with a transaction intended to relieve Cohen of approximately $22 million in debt he owed on taxi medallion loans from the banks. As set forth irr?detailvbelow?nthe?s i - banks, Cohen appears to have intentionally misrepresented his ability to pay cash by failing to disclose cash he began receiving in 2017 from new consulting work; (ii) signi?cantly understated his total holdings of cash and cash equivalents; failed to disclose tens of thousands of dollars he received in interest income, and (iv) failed to inform the banks from which he was seeking debt relief that he had agreed to make a $3.8 million cash payment to a third party,- -in connection?with - debt. By making these misrepresentations and material omissions, Cohen avoided making acquisition of the taxi medallions securing Cohen?s payments on his loans, and attempted to fraudulently induce the banks to relieve him of certain repayment obligations and personal guarantees that Cohen and his wife had signed. 14. Additionally, the investigation has revealed that shortly before the 2016 presidential election, Cohen made a payment of $130,000 from a limited liability eclporation to Stephanie Clifford, an individual who is alleged to have had an extramarital affair with then-candidate Trump. This payment was made to Clifford in exchange for an agreement not to make any public disclosures about her alleged affair with Trump. As set forth below, there is 2017.08.02 rec eiveedocumentsand/ or conduct?"meetin gs?rel?atin to- hisefmanees?and?as setsysomeaofwhichras Case Document 48-2 Filed 07/18/19 Page 18 of 201 probable cause to believe that Cohen made this payment to Clifford for the purpose of in?uencing the presidential election, and therefore that the payment was an excessive in?kind contribution to the Trump campaign. 15. Based on my review of emails obtained from the Cohen Email Warrants, information obtained pursuant to the iCloud Warrant, and documents produced pursuant to subpoenas, as well as my review of public sources, I have learned that Cohen has used the Subject Premises to receive documents related to the transaction intended to relieve Cohen of his taxi medallion debt, receive documents and/or conduct meetings related to his consulting work, noted above and as detailed further herein, he has concealed ?'om the banks in connection with the re?nancing of his taxi medallion debt, receive and send documents relating to his payment to Clifford, and house and operate electronic devices that were utilized in connection with, among other things, the taxi medallion transaction, Cohen? consulting work, and his payment to Clifford. Speci?cally, as describedbelow, Subject Premises-l likely contains evidence concerning Cohen?s taxi medallion loans, his negotiations with banks, his personal finances, his consulting work, his tax returns, and his payment to Clifford, as well as electronic devices containing such evidence, all of which constitute or contain evidence of the Subject Offenses. Additionally, as described below, Subject Premises-2 likely contains evidence relating to Cohen?s consulting work, his ?nances, and his payment to Clifford, as well as electronic devices containing such evidence. Subject Premises-3, as described below, likely contains evidence relating to Cohen?s assets and finances, including assets that may not have been disclosed to banks in connection with the re?nancing of Cohen?s taxi medallion debt or documents relating to such assets, and documents or evidence related to Cohen?s payment to Clifford. Subject Premises-4 likely contains electronic 10 2017.08.02 Case Document 48-2 Filed 07/18/19, Page 19 of 201 devices, including Subject Device-1 and Subject Device-2, which themselves contain evidence of the Subject Offenses, including concerning Cohen?s taxi medallion loans, his negotiations with banks, his personal ?nances, his consulting work, his tax returns, and his payment to Clifford. Accordingly, and as set forth in more detail below, there is probable cause to believe that the Subject Premises and Subject Devices will include evidence of the Subject Offenses. B. Probable Cause Regarding Subjects? Commission of the Subject Offenses7 The Bank Fraud Scheme Cohen Statements to Sterling National Bank - 1.6-. LLCs controlled by him and . . his wife, Laura Cohen, entered into a series of loans from Sterling National Bank (?Sterling?) and the Melrose Credit Union (?Melrose?), secured by taxi medallions, for approximately $20 million. Though entered into by LLCs, the loans were also secured by personal guarantees in the names of both Cohen and his wife. Over time, as the taxi industry weakened and the medallions lost value, Cohen sought to renegotiate the terms of those loans and/or relieve himself from their obligations, including the personal guarantees. As part of that effort, Cohen made a series of representations to Sterling and Melrose about his net worth, assets, available cash and income, among other things. Speci?cally, based on my review of records maintained by Sterling and Melrose, and public sources concerning the taxi industry and the value of taxi medallions, as well as my participation in interviews with a Sterling executive vice-president (the ?Sterling Employee-1?) and two other 7 In the following recitation of probable cause, I frequently refer to phone calls or text messages involving Cohen. The text messages described herein as sent or received by Cohen were all sent or received ?om the telephone numbers associated with Subject Device-l or Subject Device-2. The vast majority of the phone calls described herein made or received by Cohen were made or received by the telephone numbers associated with Subject Device-1 or Subject Device-2, although in celtain limited instances Cohen used a landline or other phone. 11 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 20 of 201 Sterling employees (?Sterling Employee?2? and ?Sterling I have learned, among other things, the following: a. Taxi medallions are small metal plaques affixed to taxis. Without a medallion, it is-illegal to operate a taxi in cities with medallion systems, such as New York City. Cohen and his wife own multiple LLCs that collectively own 32 taxi medallions (each LLC owns two medallions).g Cohen?s purchase of these New York taxi medallions was originally fmanced by loans from Capital One bank, for which the medallions served as collateral. Cohen was not a taxi operator, and leased his medallions to a third party. That third pa1ty made payments to Cohen, who in One. b. In early 2014, Cohen became a customer of Sterling when he sought to re?nance a mortgage on a rental property that he owned. In or around April 2014, Cohen raised with Sterling the prospect of refmancing his taxi medallion loans, which were then at Capital One. By in or about September 2014, Cohen began negotiating a lending transaction with Sterling that would allow Cohen to pay off his loans at Capital One and borrow more money from the then?increase in value of the medallions. According to Sterling Employee-1, in 2014, prior to the recent upheaval in the taxi industry?as a result of the emergence of ride-sharing services, such as Ubermtaxi medallion- loans were viewed by banks and investors as safe, short term credits, as the market value of taxi medallions was consistently rising. Consequently, taxi medallion loans?like the loans held by Cohen?were frequently re?nanced at increasing amounts as the value of the medallions rose. According to Sterling Employee?1, borrowers typically cashed out the increase in the loan amount 8 One of these companies, Mad Dog Cab Corp., was jointly owned by Sondra Cohen, who I believe is Cohen?s mother. 12 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 21 of 201 and used the additional ?Jnds for other purposes. Cohen appears to have followed this approach in 2014, when he agreed to re?nance his medallion loans for approximately $22 million, which?- according to letters from Capital One in Sterling?s ?les?was greater than his previous debt at Capital One Bank ($21 million, of which $14.6 million was a line of credit to Cohen). This allowed Cohen to cash out the proceeds from the transaction. 0. Based on my review of records maintained by Sterling, I have learned that on or about December 8, 2014, each of Cohen? sixteen taxi medallion LLCs entered into loan agreements and promissory notes with Sterling for the principal sum of $1,375,000, with repayment due on sole shareholder of the LLC. The address listed for each of the LLCs was the address for Subject Premises-1. The loans were also each secured by a security agreement, dated the same day,imaking the medallions collateral for the notes. To give Sterling additional security, Michael and Laura Cohen signed personal guarantees and confessions of judgment, giving Sterling the right to pursue collection against the Cohens? personal assets were their corporations to default under the loan agreements. The personal guaranty agreements stated that the LLCs had of?ces at the address for Subject Premises-1, and contained a notice provision that stated that any notices required by the agreements should be mailed to Subject Premises~ 1. In total, Sterling agreed to lend approximately $22 million to the Cohens? companies. d. Pursuant to participation agreements, Sterling transferred 45 percent of Cohen?s taxi medallion debt to Melrose.9 9 Melrose, which had a business principally focused on taxi medallion loans, is now in conservatorship by the National Credit Union Administration 13 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 22 of 201 e. In evaluating Cohen?s requested re?nancing of the taxi medallions, Sterling (and Melrose, consistent with its participation in the deal) conducted due diligence. At Sterling?s request, Cohen provided Sterling with a statement of ?nancial condition, dated August 1, 2014 (the ?August 2014 Financial Statement?), which indicated that Cohen had $100,740,000 in total assets, $23,550,000 in total liabilities, and a net worth of $77,190,000.10 From my review of a Sterling credit memorandum, dated September 29, 2014, I know that Sterling viewed the transaction favorably because, accounting for loan payments, cash flows from the medallions were projected to be positive, the value of the collateral (as estimated by Sterling) exceeded $42 million, and?'the?net?worthwofv Coh en?ewho?was?thee. dir eetv obligoriund erwth e?guarantee agreem over $77 million. An internal Sterling credit and risk rating analysis report, dated October 20, 2014, recommended approval of the loans for substantially the same reasons. f. Based on my review of records maintained by Sterling and public sources, Ihave learned that over time, the collateral backing Cohen?s loans (taxi medallions) lessened in value due to the rise in ride?sharing companies. Additionally, Cohen began falling behind on loan payments to Sterling and Melrose. Iknow from records maintained by Sterling and an interview with Sterling Employee?2 that, beginning in or around September 2015, Cohen told Sterling, in sum and substance, that the individual leasing Cohen?s medallions had fallen behind in making payments to Cohen, and that as a result, the cash ?ow from his taxi medallions had been reduced, leaving him with a shortfall of approximately $16,000 each month. For instance, I have reviewed an email ?om Sterling Employee-2, dated September 9, 2015, summarizing a call with Cohen? which according to the email and toll records for Cohen?s cellphone occurred on September 8, 10 Cohen subsequently provided Sterling with a revised statement of financial condition, also dated August 1, 2014, which reported assets of $99,420,000, total liabilities of $23,550,000, and a net worth of $75,870,000. 14 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 23 of 201 2015?during which Cohen told Sterling Employee-2, in sum and substance, about his cash ?ow problems and a shortfall of approximately $16,000. In that same email, Sterling Employee-2 commented that despite Cohen?s statements, his personal financial information ?indicate[d] a strong ability to make up the difference in payments.? Cohen, however, according to Sterling Employee?2, pushed the bank for a reduction in Cohen?s payments. g. From my review of records maintained by Sterling and my participation in an interview with Sterling Employee-2, I have learned that Cohen and Sterling Employee-2 spoke again on September 28, 2015, and that during the call Cohen stated, in sum and substance, that the Cohen 1 know from my review of records maintained by Sterling that between in or about September 2015 and November 2015, Sterling raised the possibility?both internally and with Cohen?of Cohen posting his real estate holdings, personal residence, or some other collateral as additional security for the banks.11 According to these records, however, Cohen resisted these requests. From my review of loan documents and records maintained by Sterling, I know that in or about November 2015, as a result of Cohen?s representation that he was not earning suf?cient returns on his medallions to cover interest payments, Sterling and Melrose agreed to amend their loans with Cohen by, among other things, reducing the interest rate Cohen paid to Meh?ose and extending the loan maturity date to December 8, 2017. h. Iknow from interviews with Sterling Employee?1 and Sterling Employee-2, as well as emails I have reviewed, that in or about October 2016, Cohen told Sterling Employee?1 that Cohen had a potential buyer of his taxi medallions, named_ who would agree to 11 Based on my review of propeity records, I know that on or about October 28, 2015, around the time period when Sterling raised the possibility of Cohen posting his personal residence?? Subject Premises-1H?as collateral, Cohen transferred Subject Premises-1 into a trust. 15 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 24 of 201 assume Cohen?s debt with Sterling and Melrose. Based on my review of records maintained by Sterling, as well as the interviews with Sterling Employee?1 and Sterling Employee-2 referenced above, Iknow that by or before October 2016, Cohen had entered into negotiations to sell his sixteen corporate taxi medallion entities to for the balance of the loans, which at the time was $21,376,000. I know from my review of records maintained by Sterling, and my participation in an interview with Sterling Employee-2, that as a condition of the transfer of the medallion loans?and because Sterling was unfamiliar with - --Ster1ing requested that Cohen make a substantial principal payment on the loan, of on or about January 3 l, 2017, Cohen told Sterling Employee-1, in sum and substance, that he would make a one million dollar principal reduction payment in order to move forward with the medallion transfer, deal with- Indeed, in an email sent by Cohen to Sterling Employee-2 on or about February 22, 2017, Cohen confirmed that he ?agreed to pay down 1 million from the loan amount.? i. Pursuant to the participation agreements between Sterling and Melrose, Sterling was required to secure Melrose?s agreement to participate in the transfer of the taxi medallion debt from Cohen to_ On or about April 17, 2017, Sterling sent a memorandum to Melrose summarizing the terms of the proposed transaction, and noting the requirement that Melrose agree to the terms. On or about May 2, 2017, Sterling Employee-1 told? that Melrose had agreed to the deal in principle, and that Sterling would be sending the parties a term sheet shortly. j. In order for the banks to conduct diligence and evaluate the proposed transaction fully, they requested financial information from the parties. On or about June 7, 2017, Sterling 16 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 25 of 201 Employee-1 emailed Cohen to request an ?updated personal ?nancial statement,? completed jointly with Cohen?s wife, and Cohen?s most recent federal income tax return. On or about June 8, 2017, Cohen emailed Sterling Employee-1 a Sterling personal ?nancial statement form that had been ?lled out by hand, which referenced a statement of ?nancial condition, dated May 1, 2017 (the ?May 2017 Financial Statement?) that was also attached. The May 2017 Financial Statement included a cover letter ??orn Cohen?s accountant, Jeffrey Getzel, stating, in sum and substance, that the information in the statement came from Cohen and that Getzel had not con?rmed its accuracy or completeness. The May 2017 Financial Statement stated that Cohen had total assets of 00 0ftotal?liabilities?of?$3 9,713 0007777The?May?z 017 Financial Statement indicated that Cohen?s assets were comprised of $1,250,000 in cash, $26,155,000 in closely held companies (such as the taxi medallion entities and his real estate holdings), $3,200,000 in real estate investments, and his $11,000,000 personal residence.12 Based on my review of reports of law enforcement interviews of Sterling Employee-1, I have learned that Sterling Employee-1 reviewed the May 2017 Financial Statement with Cohen to, among other things, verify its accuracy, and Sterling Employee-1 asked Cohen about speci?c line items on the ?nancial statement, including the cash amount, value of medallions, and total liabilities. Cohen stated to Sterling Employee-1, in sum and substance, that the May 2017 Financial Statement was accurate. 1. On or about-August 16, 2017, Sterling Employee?l emailed Cohen and- _ttaching a non-binding. term sheet memorializing the potential transaction between 12 Based on my review of Cohen?s ?nancial statements, I know that the precipitous decline in assets ??om his 2014 ?nancial statement to his 2017 ?nancial statements can be explained primarily by reported depreciation in the value of Cohen?s real estate assets and medallion investments. 17 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 26 of 201 Sterling, Meh-ose, Cohen, an_ The term sheet included a cover letter addressed to Cohen at Subject Premises-1. The parties negotiated the provisions of the term sheet and, on or about September 5, 2017, Sterling Employee?1 sent-and Cohen a copy of the executed term sheet. According to the term sheet,_would borrow $20,000,000 from Sterling and Meh?ose, to be secured by the medallions that-was to acquire from Cohen. in. As part of the agreement, according to the term sheet, $1,265,913 in principal (which is what would remain after the $20,000,000 payment on the outstanding loan balance) would be remaining half of the balance. Based on my review of an internal, Sterling credit memorandum, dated October 4, 2017, the parties reached apreliminary agreement that Cohen would pay $632,956 of the remaining $1,265,912 principal loan balance, and Sterling and Melrose would absorb $357,167 and $275,789, respectively, in the form of charge?offs. According to Sterling Employee- 1, Sterling was willing to divide the repayment of the outstanding principal balance?despite its prior insistence that Cohen make a principal pay-down of at least one million dollars?because Cohen represented on a telephone call with Sterling Employee-1, in sum and substance, that he had insuf?cient liquidity to pay the full outstanding principal balance. As part of the agreement, Sterling and Melrose also agreed to relieve Cohen and his wife of the personal guarantees that they made on behalf of the LLCs. Thus, after completing the -transaction, Cohen would no longer have had any outstanding obligations to Sterling or Melrose. 11. Based on my review of emails sent by Sterling employees, I have learned that because the transaction between the parties was subject to full credit underwriting by Sterling and Melrose (as well as Meh'ose?s regulators at NCUA), in August and September 2017, Sterling - 18 2017.08.02 grinsum andsub stance ,ithat - Case Document 48-2 Filed 07/18/19 Page 27 of 201 required and requested additional ?nancial statements and tax returns for Cohen and - for its credit underwriting process. In response to Sterling?s requests, on or about September 25, 2017, Cohen emailed Sterling Employee-2 a copy of his 2016 tax return. The tax return listed Cohen?s mailing address as Subject Premises?l. Additionally, on or about October 5, 2017, Cohen re?sent Sterling Employee?2 a copy of his May 2017 Financial Statement. A day later, on October 6, 2017, Cohen emailed Sterling Employee-2 a statement of ?nancial condition, dated September 30, 2017 (the ?September 2017 Financial Statement?). 0. Like the May 2017 Financial Statement, the September 2017 Financial Statement the information in the statement came ?om Cohen, and that Getzel had not con?rmed its accuracy or completeness. The September 2017 Financial Statement stated that Cohen had total assets of $33,430,000, total liabilities of $45,630,000, and a negative net worth of $12,200,000.? Notably, unlike Cohen?s May 2017 Financial Statement, the September 2017 Financial Statement represented to Sterling that Cohen had a negative net worth. The September 2017 Financial Statement indicated that Cohen?s assets were comprised of $1,250,000 in cash, $17,630,000 in closely held companies (including the taxi medallion entities and his real estate holdings), 14 $3,200,000 in real estate investments, and his $11,000,000 personal residence (which, for the ?rst 13 Based on my review of Cohen?s ?nancial statements, I know that this ?rrther decline in assets can be explained primarily by reported depreciation in the value of Cohen?s real estate assets and medallion investments. 14 Notably, the September 2017 Financial Statement valued each of Cohen?s thirty-two New York taxi medallions at approximately $180,187.50, which was considerably less than the $650,000 valuation ascribed to each medallion in the Cohen-term sheet. 19 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 28 of 201 time, he indicated was held by The September 2017 Financial Statement included assets and liabilities not held in Cohen?s name, such as various entities associated with his taxi medallions and some of his real estate investment entities. p. From my participation in an interview with Sterling Employee?2, and my review of records maintained by Sterling, I have also learned that around the time Cohen provided Sterling with these ?nancial statements?mic, in or around September 2017-?Cohen stopped paying loan payments on his taxi medallion loans altogether. According to Sterling Employee? 2, Cohen informed Sterling, in sum and substance, that he had insuf?cient funds to pay the or- Sterlingw??A??giwa . and Melrose had not been paid approximately $276,937.92 in principal and interest payments on the medallion loans. Based on Cohen?s ?nancial condition as conveyed in the September 2017 Financial Statement, and his delinquency in making payments to Sterling, among other things, the bank?s credit underwriting committee determined (and memorialized in a December 2017 memorandum) that the Coher-ransaction was favorable for the bank that is, that -Would be a better borrower than Cohen. 1 q. On or about December 26, 2017, Sterling sent Cohen a demand letter requesting the immediate receipt of past?due loan payments. The demand letter was addressed to Cohen at Subject Premises-1. On December 29, 2017, Sterling sent Cohen a letter stating that he was in default under the loans between Sterling and Cohen?s medallion corporations. The notice of default was addressed to Cohen at Subject Premises-1. Cohen did not make an immediate payment on the loans, but instead sent an e-mail to Sterling Employee?l on or about January 24, 2018, 15 Based on my review of property records maintained by the City of New York, and my participation in an interview with Getzel, I know that in 2015, Cohen transferred his residence to a trust. He did not disclose that transaction to Getzel or Sterling until in or about September 2017. i 20 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 29 of 201 stating that during the closing of the Cohen--ransaction, Cohen would ?bring all payments up to date as well as deposit the payoff differential.? Cohen also requested by email on January 24, 2018, that at the closing of the Cohen--. transaction, Sterling provide a letter stating that all of Cohen?s debts have been satis?ed and that Cohen?s personal guarantees of the medallion loans had been terminated. r. The Cohen-transaction, however, did not close. On or about January 29, 2018, the- attorney emailed attorneys for Sterling and stated that ?at this time there is no deal with Michael Cohen. Some of the numbers have changed and we are not prepared ~to- go?forward.? 5. Based on my participation in the interview with Sterling Employee?2 and my review of records maintained by Sterling, I know that after the Cohen-deal fell apart, Sterling assigned Cohen?s loans to Sterling Employee-3, who specializes in collecting on defaulting loans. From my participation in an interview with Sterling Employee?3, my review of telephone call notes taken by Sterling Employee-3, and my review of telephone records, I know that Sterling Employee-'3 spoke several times to Cohen on or about January 30, 2018 about paying down and/or restructuring Cohen?s outstanding taxi medallion loans. On the calls, which in total lasted more than an hour, Cohen stated in sum and substance that he did not have more than $1,250,000 to pay toward the medallion loans. On the call, in the course of reviewing the failed Cohen-- transaction, Sterling Employee?3 questioned Cohen about the price - was to have paid for each medallion, and whether there was a side agreement between Cohen and Cohen denied that there was any side agreement with? t. On or about January 31, 2018, Cohen emailed Sterling Employee-3 and proposed paying $500,000 to bring the loans current and $750,000 to bring the principal balance to 21 2017.03.02 Case Document 48-2 Filed 07/18/19. Page 30 of 201 $20,500,000. Cohen also suggested revised interest payment amounts. The signature block on the email indicated that Cohen?s address was the address for Subject Premises?2. On or about January 31, 2018, Sterling Employee-3 responded to Cohen and stated, in sum and substance, that Cohen would need to pay the entirety of the overdue payments and pay down the principal balance of the loan to $20,000,000 (in total, a payment of approximately $1,750,000), and would need to make larger interest payments. 1 11. On or about February 1, 2018, Cohen emailed Sterling Employee?3 and proposed - ?[p]ayment of $1.250m which ALL can be used to pay down principal, if [Sterling] will waive ast? due-amountsjibutestate d??EI?doeNOTrhaveemore? than?the?SS-lTZ-S 011173; (Emphasis?in Cohen also stated, in sum and substance, that he had insuf?cient ?nancial resources to post additional collateral or pre?fund payments. The signature block on the email indicated that Cohen?s address was the address for Subject Premises-2. Based on my participation in an interview with Sterling Employee-3, I have learned that since January 30, 2018, Sterling has continued to renegotiate the medallion loans with Cohen based on. Cohen?s representations about his current ?nancial position. In particular, according to Sterling Employee-3, Cohen and Sterling have an agreement in principal to restructure Cohen?s loans based in part of Cohen?s. agreement to make a principal payment of approximately $750,000, to make a payment of $500,000 to become cu1rent on interest payments, and to post $192,000 in cash collateral for his future payments on the loan. Cohen also agreed to pledge an interest he had in a property. Sterling Employee-3 has stated that had Cohen indicated he had more than $1,250,000 available to him, Sterling would have, among other things, negotiated for a larger reduction to the principal amount of the loan. 22 20170802 Case Document 48-2 Filed 07/18/19 Page 31 of 201 (ii) Cohen Made Material Misrepresen rations About His Finances to Banks Cohen Concealed from Sterling and Melrose Cash Derived from Consulting Work 17. As set forth in detail below, despite multiple written and oral representations by Cohen to Sterling (and, by extension, Melrose?) that hehad insuf?cient ?mds to pay down the principal balance of the medallion loans, make interest payments, or pay past?due amounts, it appears that between 2016 and the present, Cohen opened and maintained bank accounts at First Republic Bank (?First Republic?), and then received millions of dollars in consulting payments in these accounts, which he did not disclose to Sterling. Cohen set up these period in which he made disclosures to Sterling about his personal ?nances (including his assets and liabilities) and his ability to make payments on the medallion loans. In these disclosures to Sterling~and despite being asked about these bank accounts by his accountant?Cohen misled the bank by claiming he had insuf?cient liquidity to satisfy his obligations or meet the bank?s demands, while withholding information about these ongoing revenue streams and liquid ?nancial assets at First Republic. 18. Speci?cally, based on my review of documents and bank records produced pursuant to a subpoena by First Republic, and my participation in and review of reports of interviews with a First Republic sales manager (?First Republic Employee-1?) and a First Republic senior managing director (?First Republic I have learned, among other things, the following: 15 Based on my review of a report of an interview conducted with an employee of Melrose, I have learned that, pursuant to the paitiCipation agreement between Sterling and Meh?ose, Cohen?s ?nancial statements and other records in Sterling?s possession were forwarded to Melrose so that Melrose could make a determination as to whether to approve of the Cohen-J transaction. Based on my review of reports of interviews with Melrose employees, 1 also know that Cohen called employees at Melrose regarding the Cohen-ransaction. 23 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 32 of 201 a. Cohen and his wife have been customers of First Republic since approximately June 2011. Cohen controls several checking and loan accounts at First Republic, some in his own name and others in the names of corporate entities. According to First Republic?s know-your? customer records on Cohen,17 his primary physical address is the address for Subject Premises?1. b. On or about October 26, 2016, in Manhattan, New York, Cohen opened a new checking account at First Republic in the name of Essential Consultants LLC (the ?Essential Consultants Accoun Cohen was the only authorized signatmy on the account. According to account opening documents, the primary address for Essential Consultants LLC was the address op enedethee'Essenti-alm ConsultantsAAcco untyFiltsteRepublic- - Employee-1 conducted an in?person interview of Cohen. In response to a series of know-your? customer questions about the purpose of the account?the answers to which First Republic Employee-1 entered into a formig?Cohen stated, in sum and substance, that he was opening Essential Consultants as a real estate consulting company to collect fees for investment consulting work, and all of his consulting clients would be domestic individuals based in the United States. Cohen also stated, in sum and substance, that his purpose in setting up the account was to keep the revenue from his consulting businessvewhich he said was not his main source of income?separate from his personal ?nances. As set fo1th below, there is probable cause to believe that Cohen?s statements about the intended purpose of the account and source of funds for the account were false. Speci?cally, as described below, the account was not intended to receive?and does not 17 Certain ?nancial institutions are required to conduct such procedures pursuant to the Bank Secrecy Act and its implementing regulations. See 31 U.S.C. 5318; 31 C.F.R. 1020.220. 13 First Republic Employee-1 ?rst ?lled out the form on the day he interviewed Cohen, October 26, 2016. On or about December 19, 2016, at the request of bank compliance personnel, First Republic Employee-1 updated the form to add more detail about Cohen?s statements. 24 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 33 of 201 appear to have received??money in connection with real estate consulting work; in addition, the account has received substantial payments ?'om foreign sources. c. I know from my review of First Republic bank records that were scheduled by an FBI forensic accountant that after Cohen opened the Essential Consultants Account, Cohen received payments into that account ?'om foreign businesses and entities that do not re?ect the stated client pro?le for the residential and commercial real?estate consulting services. Speci?cally, from my review of the Essential. Consultants Account schedule and public sources, I know the following: irr?B payments of $83,3 33 into the Essential Consultants Account from an entity called Columbus Nova LLC. According to public sources, Columbus Nova is an investment management ?rm controlled by Renova Group, an industrial holding company based in Zurich, Switzerland that is controlled by Russian national Viktor Vekselberg. From January 2017 to August 2017, the Essential Consultants Account received seven payments totaling $583,332.98 from Columbus Nova LLC. ii. Beginning on or about April 5, 2017, the Essential Consultants Account began receiving payments ??om Novartis Investments, SARL, which I believe to be the in?house ?nancial subsidiary of the Swiss pharmaceutical company Novartis International AG (?Novartis?). Between April 2017 and Februaty 2018, the Essential Consultants Account received eleven Wire payments from a Swiss bank account held in the name of Novartis, each in the amount of $99,980, for ?a total of $1,099,780. Beginning in or about April 2017, the Essential Consultants Account started receiving wire payments from a bank account associated with the telecommunications company Inc. Speci?cally, on or about April 14, 2017, sent $100,000 to the 25 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 34 ?of 201 Essential Consultants Account and, from in or about June 2017 to in or about January 2018, the Essential Consultants Account received ten $50,000 payments from In total, sent $600,000 to the Essential Consultants Account. iv. On or about May 10, 2017, June 9, 2017, July 10, 2017, and November 27, 2017, the Essential Consultants Account received four deposits in the amount $150,000 (totaling $600,000) from a bank account in South Korea. The account holder ?rom which the money was sent is Korea Aerospace Industries?Ltd. KAI is a South Korea?based company that. produces and sells fixed-Wing aircraft, helicopter aircraft, and satellites to the United States V. On or about May 22, 2017, the Essential Consultants Account received a $150,000 deposit from an account at Kazkomlnertsbank, a Kazakhstani bank. The listed account holder at Kazkommeltsbank was a second Kazakhstani bank named BIA Bank, A0. A message accompanying the Wire payment indicated that the payment was a consulting fee as per Inv ETA-101 DD May 10, 2017 consulting agreement DD 08 05 2017 CNTR 08/05/2017.? Vi. In total, from on or about January 31,2017 to on or about February 1, 2018, the Essential Consultants Account received approximately $3,033,112.98 in transfers and checks from the aforementioned entities. As of on or about January 10, 2018, the balance in the Essential Consultants Account was $1,369,474.23. Cohen?s Withdrawals from the Essential Consultants account reveal that it was used for largely personal purposes, including to pay, among other things, American Express bills and fees ?om ?the Core Club,? a private social club in New York. d. On or about April 4, 2017, Cohen opened another new checking account at First Republic, this one in the name of Michael D. Cohen Associates, PC. (the Account?). 26 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 35 of 201 Cohen was the only authorized signatory on the account. According to account opening documents, the primary address for Account was the address for Subject Premises-l. Among other things, the Account received ten wire transfers and one check from an account in the name of Squire Patton Boggs, a law ?rm. As noted above, Subject Premises?2 is located inside the New York of?ce of Squire Patton Boggs. In total, from on or about April 5, 2017, to on or about January 2, 2018, the Account received $426,097.70 in deposits, and the balance in the account as of January 2, 2018, was $344,541.35. As discussed below, Cohen never disclosed any of the balance in the Essential Consultants or MDCELA accounts to Sterling re?nancing negotiations, including in his May 2017 Financial Statement and September 2017 Financial Statement. 19. Based on my review of emails that were seized pursuant to the Cohen Email Warrants, and my review of reports of interviews with employees of and Novartis, it appears that the aforementioned payments to the Essential Consultants Account and Account were for political consulting work, including consulting for international clients on issues pending before the Trump administration. Speci?cally, from my review of emails ?om the Cohen Gmail Account, the Cohen Account, and public sources, I have learned the following: a. On or about April 28, 2017, Cohen sent an email to an individual whom I believe is af?liated with KAI. In the email, Cohen attached a ?COnsulting Agreement? between KAI and Essential Consultants dated as of about May 1, 2017. The agreement indicates that Essential Consultants had the address of Subject Premises?2. The document indicates that Essential Consultants would render ?consulting and advisory services, as requested? by KAI, and that KAI would pay Essential Consultants ?a consulting fee of One Million Two Hundred Thousand 27 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 36 of 201 US Dollars,? disbursed through eight $150,000 installments between May 2017 and December 2017. I have also reviewed invoices in amounts of $150,000 that Cohen emailed to an individual whom I believe is af?liated with KAI. At the top of the invoices the address listed for Essential Consultants is the address for Subject Premises-2. I b. On or about May 8, 2017, Cohen sent an email to an individual whom I believe is af?liated with BTA Bank. The signature block on Cohen?s email listed ?Essential Consultants and ?Michael D. Cohen Associates, and provided the address for Subject Premises- 2. In the email, Cohen attached a document purporting to be a ?Consulting Agreement? between Essential Consultants had the address of Subject Premises-2. The document indicates that Essential Consultants would render ?consulting and advisory services? to BTA Bank, and that BTA Bank would pay Essential Consultants ?a consulting fee of One Million Eight Hundred Thousand US Dollars,? disbursed through payments of $150,000. On or about May 10, 2017, Cohen sent an email to an employee of BTA Bank, and attached to the email an invoice to BTA Bank in the name of Essential Consultants, with the address of Subject Premises? 2. The invoice contemplated a $150,000 payment to Essential Consultants for a consulting fee.? 0. On or about January 23, 2017, Cohen appears to have entered into a consulting agreement with which contemplates that Essential Consultants ?shall render consulting and advisory services to and that would ?advise [Essential Consultants] of those issues and matters with respect to which Services desires [Essential Consultants]?s assistance and advice.? The agreement indicates that Essential Consultants had the address of Subject Premises- 1. The contract calls for ?to pay the Consultant for his services . . . a consulting fee of Fifty 28 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 37 of 201 Thousand ($50,000) Dollars . . . per month.? Based on my review of reports of interviews with employees, I have learned that retained Cohen to consult on political issues, including net neutrality, the merger between and Time Warner, and tax reform. d. On or about March 1, 2017, Cohen appears to have entered into a contract between Novartis and Essential Consultants, which provides that Essential Consultants will ?provide consulting and advisory services to Novartis on matters that relate to the repeal and replacement of the Affordable Care Act in the US and any other issues mutually agreeable to [Essential Consultants] and Novaltis.? The contract provides for a ?consulting fee of One Million Two in equal installments over the course of a year. Based on my review of reports of interviews with Novartis employees, I have learned that Novaitis retained Cohen to provide political consulting services and to gain access to relevant policymakers in the Trump Administration. e. In or about February 2017, Cohen began negotiating the terms of a ?strategic alliance? with Squire Patton Boggs. On or about March 4, 2017, Squire Patton Boggs emailed Cohen a ?strategic alliance agreement.? Under the terms of the agreement, Cohen agreed to generate business for the law firm, and Squire Patton Boggs agreed to pay to Cohen ?an annual strategic alliance fee of $500,000, payable in twelve (12) equal installments.? Squire Patton Boggs also agreed to provide Cohen with ?dedicated and segregated of?ce space in [Squire Patton Boggs?s] New York and Washington DC. of?ces, whichoffice space shall be physically separate ?om [Squire Patton Boggs?s] offices and have locked doors and its own locked file cabinets.? On or about April 3, 2017, Squire Patton Boggs announced on' its website that is had formed a ?strategic alliance? with Michael D. Cohen 85 Associates and would ?jointly represent clients.? 29 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 38 of 201 20. Despite the signi?cant amount of money that Cohen received into the Essential Consultants Account and the Account, and the cash balance in both accounts, Cohen did not disclose that information to Sterling or Melrose. Speci?cally, based on my review of documents provided by Getzel (as noted above, Cohen?s accountant at the time), my participation in an interview with Getzel, and my review of notes and z? I have learned the following: a. In or about May 2017, Getzel met with Cohen at Subject Premises-2. At the meeting, Cohen told Getzel, in sum and substance, that he had set up a law practice called Michael WeiawmerCohen? and, a, Cohen told Getzel, in sum and substance, that he expected to earn $75,000 per month in connection with his law practice, and that he expected gross revenues for the consulting business to be between ?ve and six million dollars annually. b. In or about October 2017, if not earlier, Getzel was preparing a personal ?nancial statement for Cohen. On or about October 6, 2017, Getzel sent an email to Cohen in which Getzel wrote that ?[a]ttached is a draft of the new PF as of September 30, 2017? and attached a draft of the September 2017 Financial Statement. The draft statement re?ected that as of September 30, 2017, Cohen had only $1,250,000 in cash, total assets of approximately $33,430,000 (comprised of taxi medallion interests, real estate interests, and his personal residence and property), and liabilities of approximately $45,630,000, leaving him purportedly over $12 million in debt. in the same email, Getzel questioned Cohen, in sum and substance, about the fact that the ?nancial statement did not list any value associated with either the Essential Consultants Account or the Account: did not add any value for you[r] two operating entities Michael D. Cohen Associates 30 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 39 of 201 POC [Sic] and Essential Consultants LLC. Please advise whether or not these should be disclosed and what value.? c. On Or about October 6, 2017, Cohen called Getzel by telephone?which is re?ected on toll records for Cohen?s cellphone?and told Getzel, in sum and substance, not to include Essential Consultants or in the September 2017 Financial Statement because they had no value. On or about October 6, 2017, following the call with Getzel, Cohen, using the Cohen Account, responded to Getzel?s email with the answer ?[l]ooks good to me.? Cohen never directed Getzel to make any changes to his cash position as listed in the September 2017 Financial Statement?lngaglettergdate d? Octob 0177,, addressedto?Getzeer ohen- state a . the attached statement of ?nancial condition and ?nd it to be correct and consistent with the representations that I made to your ?rm. The attached is an accurate re?ection of my assets, liabilities and net w01th (de?cit) as of September 30, 2017.? Attached to that letter was the September 2017 Financial Statement, which, as noted above, was then transmitted to Sterling in connection with the proposed taxi medallion transaction between Sterling, Cohen, and- 21. Based on my review of a rep01t of an interview with Sterling Employee-1, I have learned that Cohen did not disclose his income stream from Essential Consultants to Sterling Employee-1 or, to his knowledge, anyone else at Sterling. According to Sterling Employee?1, knowledge of such an income stream would have affected Sterling?s demands during the negotiations, particularly with respect to the amount of a principal paydown of Cohen?s debt. Cohen Understated His Available Cash 22. In addition to withholding the existence of his Essential Consultants income from Sterling and Melrose, it appears that Cohen also substantially understated his available cash and cash equivalents in his ?nancial disclosures. Speci?cally, Iknow from my review of the September 31 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 40 of 201 2017 Financial Statement that Cohen provided to Sterling that Cohen represented that he had $1,250,000 in cash as of September 30, 2017. I also know that on or about January 30, 2018, in a telephone call with Sterling Employee-3, and on February 1, 2018, in an email to Sterling Employee-3, Cohen represented that he did not have more than $1,250,000 in cash. But, from my review of a summary of bank records that were scheduled by forensic accountants, I have learned that Cohen had approximately $5,000,000 in cash and cash equivalents as of September 30, 2017. Additionally, as of February 1, 2018, Cohen had approximately $6,000,000 in cash and cash equivalents. Speci?cally, from my review of the account schedule and bank records, I have learned a. Cohen has three checking and/or savings accounts at Capital One Bank, one of which is in his wife?s name. As of September 30, 2017, Cohen had $1,105,680.35 in his savings account, and $1,262,982.29 in total in the three accounts at Capital One Bank. As of February 1, 2018, Cohen had a total of $1,389,245.78 in these accounts. b. Cohen has three accounts at Morgan Stanley in his name. As of September 30, 2017, the combined total in cash and cash equivalents in those three accounts was $1,270,600.41. As of February 1, 2018, Cohen had $1,284.996.13 in these accounts. 1 c. As of September 30, 2017, Cohen had $260,689.18 in an account at Signature Bank. As of February 1., 2018, Cohen had $261,517.55 in'this account. d. In addition to the Essential Consultants Account and Account at First Republic, Cohen also had two joint checking accounts with Laura Cohen at First Republic. In total, as of September 30, 2017, Cohen had at least $1,876,209.27 in total in his four accounts at First Republic. As of February 1, 2018, Cohen had $3,332,992.95 in these accounts. 32 2017.03.02 Case Document '48-2 Filed 07/18/19 Page 41 of 201 e. Cohen has an account at Bethpage Credit Union with $25,931.39 in it as of September 30, 2017. f. As of September 30, 2017, Cohen had $17,542.54 in accounts at Sterling. g. Cohen has two accounts at TD Bank?one in his name and one held jointly with his wife. Cohen also has a safety deposit box at TD BankmSubject Premises-3. The safety deposit box was opened on December 13, 2017 in the names of Michael and Laura Cohen. h. In total, as of September 3 0, 2017, Cohen had at least $4,713,935 .08 in his accounts at Capital One Bank, City National Bank, Signature Bank, Sterling Bank, Bethpage Credit Union, accounts at Capital One Bank, City National Bank, Signature Bank, First Republic, and Morgan Stanley.19 23. Accordingly, based on the foregoing, it appears that Cohen?s written and oral representations to Sterling and Melrose that he did not have more than $1,250,000 were false, and that Cohen withheld infonnation regarding approximately $5 million in funds from Sterling and Melrose in order to secure favorable terms in his renegotiation of his medallion loan. Based on my participation in an interview with Sterling Employee?2, and my review of reports of interviews with Sterling Employee?1 and two Melrose employees, it is my understanding that that Sterling and Melrose would View Cohen?s understating of his assets asmaterial to its decision whether to renegotiate Cohen?s medallion loans and on What terms, or to its decision whether approve of the transfer of those loans to - 19 Based on my review of the account schedules described above, I know that, as of the date of this af?davit, the account balances for TD Bank have not yet been included in the schedule for either date and the account balances for Sterling National Bank and Bethpage Credit Union have not yet been included in the schedule for February 1, 2018. Thus, to the extent that these accounts have positive balances, Cohen?s total balances in fact were even higher on these dates. '33 2017.08.02 Case Document 48-2 Filed 07/18/19 Page?42 of 201 Cohen Has Unreported Interest Income 24. It appears that Cohen also hid from Sterling interest income that he was receiving in connection with a six million dollar loan he made to another individual. Speci?cally, I know ??om my review of the May 2017 Financial Statement and September 2017 Financial Statement that Cohen provided to Sterling that Cohen did not disclose that he had made a note receivable in the amount of approximately $6 million, or that he was earning approximately $60,000 per month in interest income in connection with that loan. But, from my review of a surnmaly of bank records that were reviewed by another law enforcement agent, my review of property records and andmyap articipation, in inn,? with Getzel, I have learned the following: a. Based on my review of property records, Ihave learned that on or about March 12, 2012, Cohen agreed to lend approximately $2,000,000.20 It appears that the promissory note was unsecured by any real property. On or about April 28, 2014, Cohen and- amended the promissory note, and restructured the loan to increase the principal amount to approximately $5,000,000. Under the terms of the amended promissory note, the loan was secured bj- apartment in Sunny Isles Beach, Florida. On or ab out April 8, 2015, Cohen aI-restated the promissory note to increase the principal amount to $6,000,000.21 b. Based on my review of a copy of the restated note, which was obtained pursuant to the Cohen Email Warrants, I have learned that under the terms of the amended and restated learned ??om Getzel thau? 21 The note states that the loan is to? husband and wife, jointly and severally. For ease of reference, I refer simply to ?-herein. 34 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 43 of 201 promissory note, Cohen?s loan to-is an mterest-only loan, and that the principal balance of the loan bears interest at an annual rate of 12.25 percent. 1 also know that the amended and restated promissory note includes a schedule of payments that require-to pay Cohen approximately $61,250 per month beginning in April 2015 and ending in April 2019. The note also requires tha-repay the principal balance of $6,000,000 on April 28, 2019. c. Based on my review of bank records, I have learned that, consistent with the terms of the amended and restated promissory note, -has made payments of approximately $61,250 since April 2015. Speci?cally, based on my review of records maintained 71% ,m a ank,,Lhave,1earnedthat from an entity called ?totaling $61,250 per month, which he deposited into his personal bank account at Capital One Bank.22 It appears ?'om my review of bank From my review of records maintained by Capital One Bank, 1 have also learned that since October 2015, Cohen has received checks from an entity called totaling $61,250 per month, which he deposited into his personal bank account at Capital One Bank. It appears ?'om my review of bank records and public sources that - is also the owner of. . In total, it appears that Cohen receives approximately $735,000 per year in interest payments ?om- d. Based on my review of Cohen?s May 2017 and September 2017 Financial Statements, my review or his 2015 and 2016 tax returns obtained via subpoena and ?'om the Cohen Email Warrants, and my participation in an interview with Getzel, I have learned that Cohen did 22 In April 2015, Cohen received a pro-rated payment. For all months thereafter, the total payment equaled $61,250, but-aften made the payment in multiple checks. 35 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 44 of 201 not disclose this interest income he was receiving from -to Sterling or Melrose, or list it on his tax returns. I have also learned that while this interest income is taxable, Cohen did not tell Getzel?his accountant?about the income, and Getzel only learned about the income because he began doing -taxes in 2017.23 25. . Accordingly, based on the foregoing, it appears that Cohen?s representations to Sterling and Melrose that he did not have more than $1,250,000 were false, and that Cohen withheld information relating to the interest income he is receiving from -in order to secure favorable terms in his renegotiation of his medallion loan. 26. As set forth in detail below, during the course of Cohen?s negotiations to sell his interest in taxi medallions and the associated debt to Cohen not only misrepresented his ?nancial position to Sterling, but also failed to disclose a side agreement he had negotiated with-: it appears that-1greed to pay an above-market price for Cohen?s taxi cab medallions, and in exchange, Cohen agreed to pay -approximately $3 .8 million in cash. Speci?cally, ?om my review of documents produced pursuant to a subpoena by Sterling, and my participation in interviews with Sterling Employee-1, Sterling Employee-2, and Sterling Employee-3, I have learned, among other things, the following: a. On or about September 5, 2017, an executed term sheet was circulated by Sterling Employee-1 to Cohen and-The term sheet listed Cohen?s address as the address for Subject Premises-1. According to the term sheet, 1?would borrow $20,000,000 ?orn Sterling and Melrose, to be secured by the medallions that -vas to acquire ??Orn 23 Accordingly, this interest income?which should have been reported as such on Cohen?s tax returns?is included herein in calculations of Cohen?s true cash position. 36 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 45 of 201 Cohen. At a price of $20 million for thirty~two taxi medallions, the proposed transaction valued each medallion as worth $625,000. The term sheet also contemplated a $1,265,913 pay?down of the principal balance of the loan. The term sheet made no mention of a $3.8 million payment ??om Cohen to -or any other form of payment or ?nancial transaction between the parties. b. Additionally, an internal Sterling credit memorandum, dated October 4, 2017, describing the terms of the Cohen?l-transaction and the new loan to 1?.id not mention any payments from Cohen to _inc1uding a $3.8 million payment. The memorandum also noted that the ?loan amount of indicates a purchase price per according to an internal Sterling memorandum dated February 5, 2018, in the month of January 2018, taxi medallions sold for amounts ranging from $120,000 to $3 72,000. According to Sterling Employee-1 and Sterling Employee?2, they were never told that - agreed to a purchase price of $625,000 in exchange for a lump sum payment from Cohen, or that Cohen would make c. On or about January 30, 2018, Sterling Employee-3 asked Cohen whether Cohen had a side agreement witl-to pay sum of money for entering into the medallion transaction. Sterling Employee-3 asked Cohen about such an arrangement because, according to Sterling Employee-3, the price that?ras paying for each medallion appeared to be well above the market price. Cohen stated, in sum and substance, that he had no side agreement?and never had a side agreementmwith - 27. While Cohen anc_ did not disclose any payment from Cohen to -n communications with Sterling, it appears that such a payment was contemplated. Indeed, based on my review of records maintained by Getzel, and my participation in an interview 37 20170302 Case Document 48-2 Filed 07/18/19 Page 46 of 201 with Getzel, I have learned the following, in substance and in part, regarding the proposed side payment from Cohen to - - a. On or about September 19, 20,17, Getzel prepared a memorandum for Cohen entitled, ?Sale of NYC Medallion Entities and Debt Assumption? (the ?Getzel Memorandum?). The Getzel Memorandum summarized the proposed transaction between Cohen and in part, as follows: ?Michael and Laura Cohen will transfer ownership of their 13 NYC medallion entities to a Buyer who will assume their bank indebtedness, upon the [Cohens?] paying down the debt portfolio of the 13 entities by $500,000 and a cash payment to the Buyer of b; ,oitheideal, ?including . the payment of $3,800,000 to - but Getzel did not know where Cohen was going to obtain $3,800,000 to As noted above, Cohen had more than $5,000,000 in cash and cash equivalents as of September 2017, but had only disclosed in his September 2017 Financial Statement that he had $1.25 million in cash. 28. Based on my review of records maintained by Sterling (as well as Melrose, the bank with the participating interest in the loans) and reports of interviews of representatives of Sterling (and Melrose), I have seen no evidence that Sterling, Melrose, or any other financial institution involved in the potential deal With Cohen and '-2vas aware of the planned $3.8 million side payment from Cohen to - The Illegal Campaign Contribution Scheme 29. The USAO and FBI are also investigating a criminal violation of campaign ?nance laws by Michael Cohen. As set forth below, there is probable cause to believe that Cohen made 24 The reference to thirteen medallions appears to be an error by Getzel. Cohen and his Wife together owned sixteen corporations, which in turn owned 32 taxi medallions. 38 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 47 of 201 an excessive in?kind contribution to the presidential election campaign of then-candidate Donald Trump in the form of a $130,000 payment to Stephanie Clifford, an individual who was rumored to have had an extramarital affair with Trump, in exchange for her agreement not to disclose that alleged affair. As set forth below, there is probable cause to believe that this payment was intended to keep Clifford from making public statements about the rumored affair on the eve of the 2016 presidential election, and thus constitutes a campaign contribution in excess of the applicable limit. 30. From my review of public sources, I have learned the following: a. In or around October 2011, there were rumors published on the gossip websites screen name is Stormy Daniels, in or around July 2006. In or about October 2011, Life Style Magazine, a tabloid sold in supermarkets, also published an article, based on the report in TheDirtyeom, alleging an affair had occurred between Trump and Clifford. Both Trump and Clifford, through their representatives, issued denials in response to the articles. 0 b. Speci?cally, on or about October 11, 2011, Keith Davidson, who identi?ed himself as Clifford?s attorney, sent a cease and desist letter to heDirty.eom, demanding that the article regarding Trump and Clifford be removed from the website. Additionally, on or about October 12, 2011, Cohen, who was then Executive Vice-President and Special Counsel to the Trump Organization, stated to News that ?[t]he totally untrue and ridiculous story . . . emanated from a sleazy and disgusting website. . . . The Trump Organization and Donald J. Trump will be bringing a lawsuit . . . [and] Mr. Trump and the Trump Organization would like to thank and commend Stormy Daniels and her attorneys for their honesty and swift actions.? 31. On or about June 16, 2015, Trump formally launched his 2016 presidential campaign. On or about May 4,2016, Trump became the presumptive Republican Party nominee 39 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 48 of 201 for president, and on July 19, 2016, Trump officially became the nominee. Based on my review of public sources, I have learned that while it does not appear that Cohen had an of?cial title as part of the Trump campaign, on multiple occasions Cohen made public statements on behalf of Trump or his campaign. For instance, on or about August 18, 2016, Cohen appeared on CNN to defend Trump?s polling numbers. 32. On or about October 7, 2016, he Washington Post published online a video and accompanying audio in which Trump referred to women in what the article described as ?vulgar terms? in a 2005 conversation with Billy Bush, who'was then the host of Access Hollywood. The things, ?I?ve said and done things Iregret and words released today on this more than a decade old video are one of them. Anyone who knows me knows these words don?t reflect who I am. I said it. I was wrong and I apologize.? Based on my review of public sources, I also know that representatives of the Trump Campaign stated, in sum and substance, that the Access Hollywood comment was an old and isolated incident. 33. Based on my review of public sources, including an article published in Slate magazine by a reporter who interviewed Clifford, I have learned that around this same time, in or about October 2016, Clifford was in discussions with Good Morning America show and Slate magazine, among other media sources, to provide these media outlets with her statement about her alleged relationship with Trump. According to the article in Slate, which the author based on conversations with Clifford over the telephone and by text message, Clifford wanted to be paid for her story or be paid by Trump not to disclose her accusation. As Cohen summarized in a 2018 email obtained pursuant to the Cohen Email Warrants: ?In October 2016, I was contacted 40 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 49 of 201 by counsel for Ms. Clifford stating that news outlets, including ABC News, were pursuing the 201 1 story of an alleged affair between Mr. Trump and Ms. Clifford.? A 34. From my review of telephone toll records25 and information produced pursuant to the iCloud Warrant and Cohen Email Warrants, I have learned that in the days following the Access Hollywood video, Cohen exchanged a series of calls, text messages, and emails with Keith Davidson, who was then Clifford?sattorney, David Pecker and Dylan Howard of American Media, Inc. the publisher of the National Enquirer,26 Trump, and Hope Hicks, who was then press secretary for Trump?s presidential campaign. Based on the timing of these calls, and the content- ofithe textmessages- least- some.of1thes_e_mcommunicati ons concerned the need to prevent Clifford ?'om going public, particularly in the wake of the Access Hollywood story. In particular, I have learned the following: a. On October 8, 2016, at approximately 7:20 pm, Cohen received a call ?'om Hicks. Sixteen seconds into the call, Trump joined the call, and the call continued for over four minutes.27 Based on the toll records that the USAO has obtained to date, I believe that this was the first call 7?5 My attribution of certain telephone numbers to certain individuals as described in this affidavit is based on my review of the vCard (virtual contact ?le) and text messages obtained from Cohen?s telephone pursuant to the iCloud Warrant. 26 Pecker is President of AMI and, according to his own statements in public reports, a personal ?iend of Trump. Howard is the chief content officer of AMI, who according to public records reports directly to Pecker. 271 believe that Trump joined the call between Cohen and Hicks based on my review of toll records. Speci?cally, I know that a call was initiated between Cohen?s telephone number and Trump? 5 telephone number at the same time the records indicate that Cohen was talking to Hicks. After the Cohen-Trump call was initiated, it lasted the same period of time as the Cohen?Hicks call. Additionally, the toll records indicate a and then Trump?s telephone number, which, based on my training and experience, means that the call was either transferred to Trump, or that Trump was added to the call as a conference or three-way call participant. In addition, based on my conversations with an FBI agent who has interviewed Hicks, I have learned that Hicks stated, in substance, that to the best of her recollection, she did not learn about the allegations made by Clifford until early November 2016. Hicks was not specifically asked about this three?way call. 41 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 50 of 201 Cohen had received or made to Hicks in at least multiple weeks, and that Cohen and Trump spoke about once a month prior to this date speci?cally, prior to this call on October 8, 2016, Cohen and Trump had spoken once in May, once in June, once in July, zero times in August, and twice in September. b. Approximately ten minutes after the call ended, Hicks and Cohen spoke again for about two minutes. c. At 7:39 pm, immediately after the second call with Hicks ended, Cohen called David Pecker (as noted above, the President of American Media Inc., or AMI) and they connected for more than a minute. Three minutes after ending his call with Pecker, Cohen received a call ?'om Dylan Howard (as noted above, the Chief Content Of?cer of AMI), and they spoke for approximately a minute. According to toll records, it does not appear that Cohen and Howard spoke regularly prior to October 8, 2016, as it had been over a month since they had called each other. d. At 7:56 pm, approximately eight minutes after his call with Howard ended, Cohen called Hicks and they connected for two minutes. At approximately the same time this call ended, Cohen received a call ?'om Pecker, and they spoke for about two minutes. At 8:03 about three minutes after ending his call with Pecker, Cohen called Trump, and they spoke for nearly eight minutes. I e. At 8:39 pm. and 8:57 Cohen received calls from Howard and spoke to him for about four and six minutes, respectively. At 9:13 about ten minutes after Cohen and Howard hung up from the second of these calls, Howard sent Cohen a text message that said: ?Keith will do it. Let?s reconvene tomorrow.? Based on my involvement in this investigation, I 42 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 51 of 201 believe that when Howard wrote ?Keith,? he was referring to Keith Davidson, the attorney for Stephanie Clifford. At 3:31 now on October 9, 2016, Cohen sent Howard a text message in response that said: ?Thank you.? Eight minutes later, Cohen sent Howard a text message that said: ?Resolution Consultants LLC. is the name of the entity 1 formed a week ago. Whenever you wake, please call my cell.? f. The following day, on October 10, 2016, at 10:58 am, Howard sent a text message to Cohen and Davidson, which stated: ?Keith/Michael: connecting you both in regards to that business opportunity. Spoke to the client this AM and they?re confnmed to proceed with the that stated: ?Michael-? if we are ever going to close this deal In my opinion, it needs to be today. Keit Davidson and Cohen then spoke by phone for about three minutes. Based on my 57 participation in this investigation, I believe that when Howard wrote that the ?clien was ?con?rmed to proceed with the opportunity,? he was referring to Clifford?s agreement in principle to accept money from Cohen in exchange for her agreement not to discuss any prior affair with then-candidate Trump.28 g. Based on my review of records obtained pursuant to the Cohen Email Warrants, I know that on or about October 10, 2016, Clifford and Davidson appear to have signed a ?side letter agreemen that stated it was an exhibit to a ?confidential settlement agreement and mutual release? between ?Peggy Peterson? and ?David Dennison.? The purpose of the document, 28 As set forth below, AMI was also involved in a payment to model Karen McDougal. However, because these communications were in close temporal proximity to the events involving the negotiation of a payment to Clifford, the execution of the agreement with Clifford, and the payment of money to Clifford, I believe that these communications were related to Clifford. Additionally, based on my review of public statements by McDougal, I have learned that she negotiated an agreement with AMI several months prior to these communications between Cohen and Pecker, Howard, and Davidson; 4.3 2017.08.02 3? - Case Document?48-2 Filed 07/18/19 Page 52 of 201 according to the agreement, was to de?ne the ?true name and identity? of persons named by pseudonym in ?con?dential settlement agreement and mutual release.? The side letter agreement speci?es the identity of ?Peggy Peterson? to be Clifford, but the space for ?Dennison?s? identity is blank. The agreement also includes a signature page for ?Peterson,? ?Dennison,? and their attorneys. The signature page is signed by ?Peterson? and his attorney, Davidson, but the document is unsigned by ?Dennison? and his attorney. Based on my involvement in this investigation, I believe that Davidson sent Cohen this partially~signed ?side letter agreemen in order to facilitate the closing of a deal between Davidson?s client and Cohen or his client on mveiiec'toberwl0720?16. 35. It appears that on October 13, 2016, and the days that followed, Cohen took steps to complete a transaction with Davidson, including attempting to open an account ?om which Cohen could transfer funds to Davidson. Speci?cally, from my review of toll records, information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, records maintained by First Republic, as well as my participation in interviews with First Republic employees, I have learned the following: a. 011 the?morning of October 13, 2016, at 8:54 Cohen sent Pecker atext message that stated: need to talk to you.? At 9:06 Pecker sent a text message to Cohen that stated, called please call me back.? The tolls between Cohen and Pecker do not Show a telephone call between 8:54 a.m. and 9:06 am. However, based on my review of text messages, I have learned that Cohen and Pecker communicate with each other over Signal, which is an communications cellphone application that allows users to send text messages and make calls. 44 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 53 of 201 b. At 9:23 am, Cohen sent an email that stated ?call me? to First Republic Employee? 2. The email attached documents from the Secretary of State of Delaware indicating that Cohen had formed a limited liability company called ?Resolution Consultants on September 30, 2016. As noted above, ?Resolution Consultants? is the name of the entity that Cohen had told Howard he had formed recently after Howard said Davidson would ?do it.? At 10:44 am, Cohen called First Republic Employee?2 and told him, in sum and substance, that he needed an account in the name of ?Resolution Consultants? opened immediately, and that he did not want an address on the checks written out of the account. Later that day, another employee at First Republic opening documents partially completed, but failed to provide a copy of his driver?s license or passp01t, and did not respond to the employee?s question of how he wanted to ?nd the account. As a result, the . account was never opened. 0. On October 17, 2016, Cohen incorporated Essential Consultants LLC in Delaware. That same day, he ?led paperwork to dissolve Resolution Consultants LLC. 36. Despite these steps taken by Cohen, it appears that the negotiation between Cohen and Davidson was not prOgressing suf?ciently fast enough for Davidson or his client, Clifford, and they threatened to go public with Clifford?s allegations just days before the presidential election. Speci?cally, based on my review of toll records, information obtained pursuant to the iCloud Warrant, and public sources, I know the following: a. According to an article in he Washington Post, which quoted emails sent from Cohen?s em ail account hosted by the Trump Organization, on October 17, 2016, Davidson emailed Cohen and threatened to cancel the aforementioned ?settlement agreement2017.08.02 Case Document 48-2 Filed 07/18/19 Page 54 of 201 if Cohen did not complete the transaction.? According to the article, Davidson sent Cohen a second email later in the day that stated in part, ?Please be advised that my client deems her settlement agreement canceled and void.? At 4:00 pm. that day, Cohen called Davidson and they spoke for over ?ve minutes. b. Cohen?s 4:00 pm. call with Davidson and/or Davidson?s threats to cancel the ?settlement agreement? appear to have touched off a ?urry of communications about the settlement agreement and whether Clifford would go public. Speci?cally: i. At 4:43 Howard sent Cohen a text message that stated: ?I?m told Based on my involvement in this investigation, I understand Howard?s text to mean that he heard that Clifford was going to take her story of an extramarital affair with Trump to the Daily Mail, a tabloid newspaper. ii. At 4:45 Howard called Cohen and they spoke for over two minutes. Moments later, Davidson and Cohen spoke for about two minutes. At 5:03 pm, Cohen attempted to call Trump, but the call only lasted eight seconds. This was Cohen?s ?rst call after he spoke with Davidson. iv. At 5:25 Cohen texted Howard, stating: V. At 6:44 Howard responded to Cohen?s text, stating: ?Not taking my calls.? Cohen responded one minute later: ?You?re kidding. Who are you ?ying to reach?? Howard responded one minute later: ?The ?agent.?? Based on my involvement in this 29 Due to the partially covert nature of the investigation to this date, the USAO has not requested documents ?om the Trump Organization or Davidson, and thus does not possess the email referenced in this article. 46 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 55 of 201 investigation, I understand Howard?s text messages to mean that he attempted to contact Davidson about the matter involving Clifford, but that Davidson was not taking Howard?s calls. vi. At 6:49 Cohen called Howard and they spoke for nearly four minutes. 0. The following day, on October 18, 2016, heSmokingGun. com, a website that publishes legal documents and mugshots, published an article called: ?Donald Trump and the Porn Superstar,? which alleged that Trump had an extramarital affair with Clifford. However, the article noted that Clifford had declined to comment. 37. On or about October 25, 2016, the communications between Cohen, Davidson, edger?picked?upragai'n?r app ar entlye concerningeaetrans-aeti oneinvolving+ Clifford. Speci?cally, based on my review of toll records, information obtained pursuant to the Cohen Email Warrants and iCloud Warrant, as well as my review of public sources, I have learned the following: a. On October 25, 2016, at 6:09 Howard sent Cohen a text message stating: ?Keith calling you urgently. We have to coordinate something on the matter he?s calling you about or its [sic] could look awfully bad for everyone.? One minute later, Davidson sent Cohen a text message stating ?Call me.? Cohen and Davidson called each other several times over the next half hour but appear not to have connected. At 6:42 Cohen and Davidson spoke for about eight minutes. At 7:11 they spoke for another two minutes. b. The next morning, on or about October 26, 2016, at 8:26 am, Cohen called Trump and'spoke to him for approximately three minutes. At 8:34 am, Cohen called Trump again and connected for a minute and a half. 0. At approximately 9:04 than thirty minutes after speaking with Trump? Cohen sent two emails to the person who had incorporated Resolution Consultants and Essential Consultants for him, and stated ?can you send me asap the ?ling receip and then, in the second . 47 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 56 of 201 email, ?for Essential Consultants That person responded with the ?ling receipt two minutes later at 9:06 am. and with the certi?cation of formation 23 minutes later, at 9:27 am. d. Shortly after that, Cohen contacted First Republic Employee?2 and told him, in sum and substance, that he decided not to open an account in the name of ?Resolution Consulting? and instead would be opening a real estate consulting company in the name of ?Essential Consultants.? Cohen told First Republic Employee?2 that he was at Trump Tower, and wanted to go to a First Republic branch across the street to open the account, so First Republic Employee-2 called First Republic Employee?1, a preferred banker at that branch, assist Cohen. At 11:00 First Republic Employee-1, that around the time of the call he went to Cohen?s of?ce in Trump Tower? on the same ?oor as the Trump Organization?4am went through account opening questions, including know your customer questions, with Cohen. In response to a series of know-your? customer questions about the purpose of the account?the answers to which First Republic Employee-1 entered into a form?Cohen stated, in sum and substance, that he was opening Essential Consultants as a real estate consulting company to collect fees for investment consulting work, and all of his consulting clients would be domestic individuals based in the United States. Based on my review of records obtained from First Republic, it appears that this account (the ?Essential Consultants Accoun was created at a time between 11:00 am. and 1:00 pm. e. At 1:47 pm, Cohen called Davidson and they spoke for approximately two minutes. At approximately 1:49 pm, Davidson emailed Cohen wiring instructions for an attorney client trust account at City National Bank. f. After the Essential Consultants Account was opened on October 26, 2016, Cohen transferred $131,000 from a home equity line of credit that Cohen had at First Republic to the 48 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 57 of 201 Essential Consultants Account. Following the transfer, at approximately 4: 15 pm. on October 26, 2016, First Republic Employee?2?s assistant emailed Cohen at his Trump Organization email address to tell him that the funds had been deposited into the Essential Consultants Account. Cohen forwarded that email to the Cohen Gmail Account and then forwarded it to Davidson. g. At 6:37 Cohen asked Pecker by text message, ?Can we speak? Important.? Cohen called Pecker at 6:49 pm. and connected for thirty seconds. At 6:57 pm, Cohen sent Howard a text message, stating: ?Please call me. Important.? Cohen called Howard at 7:00 pm. and connected for about thirty seconds. At 7:06 called Pecker again and they spoke -. for'nearlyethir?te altext?messageeto VG ohen-thateu?iHe?s seem?? 7 he?d call me back in 20 minutes. I told him what you are asking for his [sic] reasonable. I?ll get it sorted.? Approximately an hour later, at 3:23 pm, Howard told Cohen by text message to ?check your Gmail for email from my private account.? In an email sent at 8:23 pm. by Howard to Cohen and Davidson, with the subject line ?Con?rmation,? Howard stated, ?Thank you both for chatting with me earlier. Con?rming agreement on: - Executed agreement, hand-signed by Keith?s client and returned via overnight or same-day FedEx to Michael, - Change of agreement to re?ect the correct LLC, - Transfer of funds on Thursday AM to be held in escrow until receipt of agreemen After receiving that email, at approximately 8:27 pm, Cohen asked Howard by text message, ?Can you and David [Pecker] give me a call.? Howard responded: ?David is not around I think. I?ll call.? At 8:28 pm, Howard called Cohen and they spoke for three minutes. A 38. On October 27, 2016, Cohen made a payment to Davidson of $130,000?with the funds intended for Clifford?for the purpose of securing her ongoing silence with respect to the. allegations that she had an extramarital affair with Trump. Speci?cally, based on my review of 49 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 58 of 201 toll records, bank records, and information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, I have learned the following: a. At 9:47 am, Cohen sent Davidson an email, stating: ?Keith, kindly con?rm that the wire received today, October 27, 2016 shall be held by you in your attorney?s trust account until such time as directed for release by me, in writing. Additionally, please ensure that all paperwork contains the correct name of Essential Consultants LLC. I thank you in advance for your assistance and look forward to hearing from you later.? b. At? approirimately 10:01 according to records provided by First Republic wire- $13 0; 0 0 0 +Mi~i?uwwm which had been funded a day prior from Cohen? 5 home equity line of credit?to the attorney client trust account at City National Bank that Davidson had speci?ed in the wiring instructions he sent to Cohen. ?The wire transfer was made shortly thereafter. c. At 10:02 am, Davidson responded to Cohen?s email ??om 9:47 am, stating: con?rm that Iwill work in good faith that no funds shall be disbursed unless until the plaintiff personally signs all necessary settlement paperwork, (the form of which will match the prior agreement). The settlement docs will name the correct corporation, (Essential Consultants LLC). Plaintiff signature will be notarized and returned to you via FedEx. Only after you receive FedEx will I disburse. Fair?? d. At 10:50 First Republic Employee?1 sent Cohen an'email con?rming that the payment had been sent and providing him with the wire number. 39. On October 28, 2016, and the days that followed, Cohen ?nalized the transaction with Davidson. Speci?cally, based on my review of toll records, information obtained pursuant to the iCloud Warrant, public sources, and bank records, I know the following: 50 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 59 of 201 a. On October 28, 2016, at 11:48 am, Cohen spoke to Trump for approximately ?ve minutes. Beginning at 1:21 Cohen attempted a series of phone calls to Davidson, Pecker, and Howard throughout the day, although it appears he may only have connected with Howard. b. Later that day, at approximately 7:01 Davidson stated to Cohen by text message that ?all is AOK. I should have signed, notarized docs? on Monday. You'should have them on Tuesday.? Cohen thanked him and said hope we are good.? Davidson responded, assure you. We are vely good.? Howard also texted Cohen at 7:08 pm, ?Keith [Davidson] says we are good.? Cohen then responded to Howard and ?Excellent? to Davidson. At c. On October 31, 2016, Cohen called Howard at 8:22 pm. and they spoke for over three minutes. At 8:32 pm, Cohen received text messages from both Howard and Davidson. Howard said: ?You?ll have paperwork tomorrow says Davidson said: ?We are AOK. You will be receiving a package tomorrow.? Cohen responded ?Thank you? to Howard and ?Thanks Keith. Will call you then? to Davidson. From my involvement in this investigation, I believe Davidson was referring to a signed nondisclosure agreement when he told Cohen that he would receive a package. d. Based on my review of court ?lings that became public in 201 8, Ihave learned that on or about October 28, 2016, LLC and/or David Dennison? entered into a ?con?dential I settlement agreement and mutual release? with ?Peggy Peterson,? pursuant to which ?Peterson? agreed not to disclose certain ?con?dential information pertaining to [Dennison]? in exchange for $130,000. The agreement provided that would wire the funds to ?Peterson?s? attorney, who would then transfer funds to ?Peterson.? Cohen signed the agreement on behalf of 51 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 60 of 201 The agreement stated that the address for which was later referred to in the agreement as ?Essential Consultants, was Cohen?s residence. e. Consistent with the ?con?dential settlement agreement and mutual release,? on or about November 1, 2016, Davidson transferred $96,645 from his attOrney client trust account at City National Bank to a bank account in Clifford?s name. The wire had the annotation ?net settlement.? On the same day, at approximately 9:48 am. Davidson sent Cohen a text message with a picture of a FedEx delivery con?rmation, stating that at approximately 9:09 am. a package shipped by Davidson the previous day had arrived for Cohen at his Trump Organization address. On?the an audio file attached and said ?Give this a lesson [sic] and then call me.? The audio attachment was titled and was a five-minute recording of Davidson interViewing Clifford about recent public allegations made by an adult ?lm star named Jessica Drake regarding her alleged past affair with Trump; in the recording, Clifford explained the reasons she believed that Drake was not credible. Less than an hour later, at approximately 7:05 pm, Cohen called Trump, but it appears that they did not connect. Cohen then called a telephone number belonging to Kellyanne Conway, who at the time was Trump?s campaign manager. They did not connect. At approximately 7:44 pm, however, Cohen received a return call from Conway, which lasted for approximately six minutes. 40. On November 4, 2016, just three days after the Clifford transaction was completed and just four days before the presidential election, the Wall Street Journal published an article alleging that the National Enquirer had ?Shielded Donald Trump? from allegations by Playboy model Karen McDougal that she and Trump had an affair. The article alleged that AMI had agreed to pay McDougal to bury her story. McDougal, like Clifford, had been represented by Davidson. 52 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 61 of 201 Based on my review of toll records, information obtained pursuant to the Cohen Email Warrants and iCloud Warrant, and public sources, it appears that Cohen spoke frequently to Davidson, Howard, Pecker, and Hicks around the time of this article?s publication?just days before Election Day?about the importance of preventing the McDougal and Clifford stories from gaining national traction. Speci?cally, I have learned the following: a. Between 4:30 and 8:00 pm. on November 4, Cohen communicated several times with Howard, Pecker and Davidson. For instance, at approximately 4:49 Cohen sent Howard a text message with a screenshot of an email forwarded to him by another Trump Organization andt- asked?for?GOmme?trawrr ?'om Trump and/or the campaign on the story. Cohen also spoke with Hicks several times, including shortly before and/or after calls with Pecker, Howard and Davidson. Indeed, at approximately 7:33 using two different cellphones subscribed to him, Cohen appears to have been talking to Davidson and Hicks at the same time. b. At approximately 8:51 Cohen sent Howard a message, stating: ?She?s being really difficult with giving Keith a statement. Basically went into hiding and unreachable.? One minute later, Howard responded: ?I?ll ask him again. We just need her to disappear.? Cohen responded, ?She definitely disappeared but refuses to give a statement and Keith cannot push her.? At approximately 8 :55 Howard responded to Cohen?s text: ?Let?s let the dust settle. We don?t want to push her over the edge. She?s on side at present and we have a solid position and a plausible position that she is right?illy employed as a columnis Based on my involvement in this investigation, I believe Cohen and Howard were referring to Karen McDougal when they were discussing ?she? and ?her.? Additionally, I believe Howard?s statement that ?We have . . . a 53 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 62 of 201 plausible position that she is rightfully employed as a columnist? was a reference to the fact that AMI had given McDougal payments for her role as a purported columnist for the company. c. At approximately 8:58 pm. on November 4, 2016, Howard attempted to reassure Cohen about the effect of the Wall Street Journal article, texting, think it?ll be ok pal. I think it?ll fade into the distance.? Cohen responded, ?He?s pissed.? Howard wrote back, ?I?m pissed! You?re pissed. Pecker is pissed. Keith is pissed. Not much we can do.? Based on my involvement in this investigation, I believe Cohen was referring to Trump when he stated ?he?s pissed.? Cohen asked Howard at approximately 9:00 pm. how the Wall Street Journal could - AMI. It looks suspicious at best.? A (1. At approximately 9:03 pm, Hicks called Cohen and they spoke for two minutes. At approximately 9:11 pm, Cohen called Howard and spoke to him for ?ve minutes. At approximately 9:15 pm, Hicks called Cohen and they spoke for nearly seven minutes. Again, Cohen used different phones for these two calls, such that he appears to have been on both calls for about a minute of overlap. At approximately 9:32 pm, Cohen texted Peeker, ?The boss just tried calling you. Are you free?? A minute later, Cohen texted Howard, ?Is there a way to ?nd David quickly?? 6. At approximately 9:50 the Wall Street Journal article was published online. Howard and Hicks both sent web links for the article to Cohen. Over the next half hour, Cohen and Howard exchanged several text messages commenting on how the story came across. The next morning on November 5, 2016, at approximately 7:35 am, Cohen texted Hicks, ?so far I see only 6 stories. Getting little to no traction.? Hicks responded, ?Same. Keep prayingl! It?s working!? Cohen wrote back, ?Even CNN not talking about it. No one believes it and if necessary, I have a 54 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 63 of 201 statement by Storm denying everything and contradicting the other porn stars statement. I wouldn?t use it now or even discuss with him as no one is talking about this or cares!? Based on my involvement in this investigation, I believe Cohen was referring to the above-referenced recorded audio statement by Clifford that he obtained from Davidson, and was stating that such a statement could be used to in?uence potential negative media relating to Trump, but was unnecessary at that time. Based on a text message from Hicks to Cohen, I believe that later that morning, Pecker spoke to Trump. 41. On or about November 8, 2016, Trump won the election for President of the United States. 7 7 42. On or about January 12, 2018, the Wall Street Journal first reported that Cohen arranged a payment to Clifford. On or about January 22, 2018, Common Cause, a government watchdog group, filed a complaint with the Federal Election Commission, alleging that Cohen had violated campaign ?nance laws by making the payment to Clifford. Based on my review public sources following that report, as well as emails obtained pursuant to the Cohen Email Warrants, I have learned the following: a. On or aboutJanuary 23, 2018, the day after Common Cause ?led its complaint, Cohen began emailing himself drafts of statements describing his payment to Clifford. Additionally, on January 23, 2018, Cohen emailed the following draft of that statement to an individual who appears to be writing a book on Cohen?s behalf: In October 2016, I was contacted by counsel for Ms. Clifford stating that news outlets, including ABC news, were pursuing the 2011 story of an alleged affair between Mr. Trump and Ms. Clifford. Despite the fact that both parties had already denied the allegation, as Mr. Trump?s longtime special counsel and protector, I took it upon myself to match the offer and keep the story ?om breaking. I knew the allegation to be false, but I am also a realist who understands that just because something is false doesn ?t mean that it doesn?t create harm and damage. I could not allow this to 55 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 64 of 201 occur. I negotiated a non?disclosure agreement with Ms. Clifford?s counsel and tendered the funds. I did this through my Delaware LLC and transferred personal ?mds to cover the agreement. I was not reimbursed any monies ?'om Mr. Trump, the Trump Organization, any third party or the Presidential campaign. At no point did I ever advise Mr. Trump of my communications or actions regarding this agreement. As outlandish and unusual as this may appear, the Trumps have been like family to me for over a decade. It?s what you do for family. GEmphasis added.) Based on my involvement in this investigation, I believe that the above email is an acknowledgement that the allegation of the affair had existed for some time 20]] story. . but that Cohen was motivated to ?keep the story from breaking? again in October 2016. b. On or about February 13,2018, Cohen said in a statement to The New York Times that ?Neither the Trump Organization nor the Trump campaign was a party to the transaction with Ms. Clifford. The payment to Ms. Clifford was lawful, and was not a campaign contribution or a campaign expenditure by anyone.? Cohen declined to answer follow-up questions including whether Trump had been aware of the payment, why Cohen made the payment, or whether similar payments had been made to other people. 0. On or about February 14, 2018, Cohen was asked by The New York Times whether Trump had reimbursed him, whether he and Trump had made any arrangement at the time of the payment, or whether he had made payments to other women. Cohen stated in response, can?t get into any of tha On or about February 14, 2018, Cohen also stated to The Washington Post that: ?In a private transaction in 2016, I used my own personal ?inds to facilitate a payment of $130,000 to Ms. Stephanie Clifford. Neither the Trump Organization nor the campaign was a party to the transaction with Ms. Clifford, and neither reimbursed me for the payment, either directly or indirectly.? 43. On or about March 9, 2018, Cohen stated to ABC News that ?the funds were taken from my home equity line and transferred internally to my LLC account in the same bank.? 56 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 65 of 201 44. Accordingly, for the foregoing reasons, there is probable cause to believe that Cohen committed violations of the Campaign FinanCe Offenses by making an in?kind contribution to Trump or the Trump campaign in the form of a $130,000 payment to Clifford on the eve of the election. Indeed, while he denies having given an unlawful contribution, in his own statements Cohen has admitted that he-paid $130,000 of his ?personal ?mds? to Clifford and that the payment occurred less than two weeks before the election, as Trump was facing negative media allegations about his behavior toward women, even though allegations of an affair between Trump and Clifford existed since 2011. In addition, the communication records set forth above make evident Clifford?s attorney and the need to preclude Clifford from making a statement that would have re?ected negatively on the candidate in advance of the forthcoming election. C. Probable Cause Justifying Search of the Subject Premises and Subject Devices 45. Based on the foregoing, my review of records produced pursuant to subpoenas and the Cohen Email Warrants, and the iCloud Warrant, and my training and experience, there is probable cause to believe that the Subject Premises and Subject Devices have been used in furtherance of the Subject Offenses and are likely to contain instrumentalities, evidence, and fruits of the Subject Offenses. Speci?cally, there is probable cause to believe that Cohen permanently resides at Subject Premises?1 and, at least in part, works at both Subject Premises?1 and Subject Premises?2, and that those locations contain evidence relating to the Sterling taxi medallion transaction, Cohen?s assets, Cohen?s consulting work for Essential Consultants LLC, and his payment to Clifford. Additionally, there is probable cause to believe that Subject Premises?3 contains evidence of Cohen?s assets and his payment to Clifford. Finally, there is probable cause to believe that Subject Premises-4, in which Cohen is temporarily residing, contains electronic 57 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 66 of 201 devices, including Subject Device-1 and Subject Device-2, which, in turn, contain evidence. of the Subject Offenses, such as evidence relating to the Sterling taxi medallion transaction, Cohen?s assets, Cohen?s consulting work for Essential Consultants LLC, and his payment to Clifford. 46. First, there is probable cause to believe that Cohen lives and operates his businesses, at least in part, at Subject Premises-1. Speci?cally, from my review of property records, I know that Michael Cohen and Laura Cohen own (in trust) Subject Premises?1. From my review of Cohen?s tax returns, I know he lists his primary residence as Subject Premises-1. Additionally, from my review of emails produced pursuant to the Cohen Email Warrants, I know that Cohen routinely refers to Subject Premlses?1"?h1s home. For example,on and October 6, 2017, Cohen emailed individuals that his home address is the address for Subject Premises-1. I also know from my review of emails that Cohen receives package delivery notifications that list Cohen?s address as the address for Subject Premises-1. Cohen has also provided the address?of Subject Premises-1 as the address for Essential Consultants and Michael D. Cohen Associates, PC. For example, the certi?cates of incorporation and account opening documents at First Republic for both entities list their addresses as the address for Subject Premises-l. See supra 18(b), 18(d). The consulting agreement between Essential Consultants and also indicated the address for Essential Consultants is the address for Subject Premises- 1. See supra?jl 47. There is also probable cause to believe that subject Premises-1 is likely to contain instrumentalities, evidence, and ?'uits of the Subject Offenses. Speci?cally, from my review of emails produced pursuant to subpoena and the Cohen Email Warrants and iCloud Warrant, as well as my training and experience, I know the following: 58 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 67 of 201 a. According to records maintained by Sterling, the address for all of Cohen?s taxi medallion is the address for Subject Premises?1. See supra 1i 16(0). Additionally, the medallion loan documents indicate that any mailings related to the loans should be sent to Subject Premises-1. See id. Based on my training and experience, as well as my review of public sources, I know that individuals keep records of properties and assets in which they have ownership interests. Accordingly, I submit that Subject Premises?1 likely contains evidence of Cohen?s ownership of the taxi medallion LLCs, the revenue that those medallions generate, and the . transaction with Sterling in 2014 to re-fmance the medallion loans that were then with Capital One .. Bank. b. From my review of records maintained by Sterling, I also know that Sterling addressed documents relating to the-transaction and Cohen?s attempts to modify the terms of the medallion loans to Subj ect. Premises-l. For instance, Sterling addressed the transaction term sheet, see supra?ii 16(1), and its demand letter and notice of default, s?e supra ii 16(21), to Subject Premises-1. Accordingly, Subject Premises?1 likely contains evidence concerning the - transaction and Cohen?s negotiations with Sterling. Some of those records?such as records relating to a payment from Cohen to --were concealed from Sterling and cannot be obtained via subpoena to Sterling. Additionally, even where documents were sent to Cohen by Sterling (and therefore are available from Sterling via subpoena), the fact that they may be found in Subject Premises?1 will be relevant to Cohen?spossession or knowledge of the documents. 0. From my review of records maintained by First Republic, I know that Cohen provided the address for Subject Premises-1 as the mailing addresses for the Essential Consultants Account and Account. See supra 1803), 18(e). Accordingly, it is likely that Subject 59 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 68 of 201 Premises-1 contains records relating to the Essential Consultants Account and Account, including, among other things, account opening documents, bank statements, documents provided as part of the know-your?customer process, any notes made by Cohen when he was opening the accounts, wire transfer records, and canceled checks. Even where these records can be obtained from First Republic, the fact that they may be found in Subject Premises-1 will be relevant to, among other things, Cohen?s ownership of the accounts, or his knowledge of transactions or the existence of ?mds in accounts. d. Based on my review of records maintained by Capital One Bank, TD Bank, Morgan Stanley, provided the address for Subject Premises-1 as the mailing for his accounts at each of these ?nancial institutions. Accordingly, it is likely that Subject Premises-1 contains records relating to these accounts, including, among other things, bank statements that list account balances. The existence of these records in Subject Premises-1 will be relevant to, among other things, Cohen?s ownership of the accounts and his knowledge of the balances in these accounts. e. Additionally, Cohen may have records of other bank accounts or assets that were not disclosed to Sterling and are not presently known by law enforcement. For example, as described above, Cohen has received interest income since 2015 that he' has not disclosed to Sterling or paid taxes on. Also, on Cohen?s August 2014 Financial Statement, see supra ll 16(e), he disclosed $10,000,000 in ?investments in overseas entities.?30 The value of these investments was omitted from subsequent ?nancial statements. However, for the reasons outlined above, there is probable cause to believe that Cohen omitted the value of those investments from his 2017 30 Based on my participationin an interview with Sterling Employee-3, I have learned that Cohen told Sterling Employee-3 that the reference to ?investments in overseas entities? on his 2014 Financial Statement was to serve merely as a ?placeholder? for potential ?lture investments. 60 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 69 of 201 financial Statements in order to understate his assets. As Subject Premises-1 is Cohen?s primary residence and he uses Subject Premises-1 as the mailing address for bank records, there is probable cause to believe that account statements for unknown bank accounts or assets concealed from Sterling are likely to be found in Subject Premises?l. f. Based on my review of records maintained by and produced pursuant to the Cohen Email Warrants, Iknow that the address Cohen provided to for Essential Consultants is the address for Subject Premises-1. See supra 11 19(0). Therefore, there is probable cause to believe that Subject Premises-1 will contain evidence concerning the operation of Essential Consultants or money that Cohen T. Additionally, because Cohen used the address for Subject Premises-1 for at least one consulting arrangement involving Essential Consultants, there is probable cause to believe that Subject Premises-1 may contain records of other consulting arrangements that Cohen, through Essential Consultants, has with other individuals or entities. g. Based on my review of records maintained by Getzel?s accounting ?rm, and emails produced pursuant to the Cohen Email Warrants, I have learned that Getzel? accounting firm sent documents to Subject Premises-1 and used the address for Subject Premises?1 as the address listed on Cohen?s personal and corporate tax returns. See supra ?11 16(n). For instance, on or about October 6, 2017, an employee at Getzel?s accounting firm emailed Cohen that she had sent Cohen?s September 2017 Financial Statement by FedEx to Cohen?s attention. Accordingly, Cohen?s tax records are likely to, be found in Subject Premises-1. h. Based on my review of bank records and publicly?available documents, Iknow that Cohen used $130,000 from a home equity line of credit on Subject Premises-1 to pay Clifford. I also know that on the settlement and nondisclosure agreement between ?Peggy Peterson? and 61 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 70 of 201 the address for Essential Consultants is Subject Premises?l. Accordingly, Subject Premises?l is likely to contain evidence of the Campaign Finance Offenses, including settlement and nondisclosure agreements, payment records, written and email correspondence, and records pertaining to the home equity line of credit. i. Based on my review of emails produced pursuant to the Cohen Email Warrants and iCloud Warrant, I know that Cohen used at least one Apple iPhone, an Apple iPad Mini, and a MacBook Pro to access his iCloud account. Based on my review of location records provided by Apple pursuant to the iCloud Warrant, I know that electronic devices linked to Cohen?s iCloud account were used at SubjecfPremises-l to, among ?les to Cohen?s iCloud account. Accordingly, there is probable cause to believe that Subject Premises?1 contains electronic devices, including certain Apple products, that for reasons discussed below are likely to contain evidence of the Subject Offenses. j. Based on my review of emails produced pursuant to the Cohen Email Warrants, I understand that Subject Premises-1 recently sustained water damage to certain parts of the premises, and that Cohen has engaged contractors to perform certain remediation work on the premises. In addition, as set forth above, I believe that Cohen and his family are temporarily residing at Subject Premises-4 in the Loew?s Regency Hotel, which is approximately two blocks from Subject Premises?1. However, based on my review of a work order sent to Cohen?s email by a contractor, I understand that the first phase of the work order called for the contractor to ?Pack Remove all items furnishings in Living Room, Kitchen, Sons Room Dining Room? and store them off-site. In addition, based on my review of drawings sentlto Cohen by the contractor, it appears that the work is primarily being done in these rooms. Thus, I believe that the construction - to the extent it is still ongoing would not necessarily have caused Cohen to move 62 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 71 of 201 all documents or evidence responsive to the warrant out of Subject Premises-1, because it does not appear that work is being done to the p01tion of Subject Premises-1, such as a home of?ce or Cohen?s own room, where such documents or evidence would most likely be found.31 48. Second, there is probable cause to believe that Cohen uses Subject Premises-2 as of?ce space, and also that Subject Premises?2 contains certain electronic devices. Speci?cally, from my review of the ?strategic alliance agreemen between Squire Patton Boggs and Cohen, 0 and my review of the press release on Squire Patton Boggs?s? website, I know that Cohen has an of?ce at Subject Premises-2. See supra 18(d), 19(e). Indeed, Ihave learned that pursuant to Cohen?s agreement Patton Boggs?s of?ces on the 23rd ?oor of 30 Rockefeller Plaza, and that the space is ?physically separate? from the ?rm?s of?ces and has ?locked doors and its own locked ?le cabinets.? See supra '1l 19(e). Additionally, I know that under the terms of the agreement, Cohen agreed to ?arrange for [his] own computer server system that is not connected to [Squire Patton Boggs?s] computer network system.? I know from my participation in an interview with Getzel, who met Cohen at Subject Premises?2 in 2017, that Subject Premises-2 is an of?ce with a door, it appears to be used only by Cohen, and it contains, among other things, a computer and paper ?les. AcCording to Getzel, when Getzel saw Cohen at Subject Premises-2, he had two cellular telephones in Subject Premises-2. I also know from my review of emails produced pursuant to the Cohen Email Warrants that Cohen uses the address for Subject Premises-2 in the signature block 3?1 As noted below, based on my training and experience, I believe that individuals who travel or stay in hotels for short-term periods commonly bring some items with them, such as portable electronic devices or sensitive items, meaning that Cohen has likely taken some evidence from Subject Premises?1 to Subject Premises-4. Neveltheless, given the temporary nature of Cohen?s stay at Subject Premises-4 and the scope of the work being done at Subject Premises-1, I believe it is unlikely that Cohen has taken all evidence that would be subject to seizure out of Subject Premises-1. 63 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 72 of 201 on his emails. Based on my review of notes of a call between Cohen and First Republic Employee- 2 (which notes were taken by another First Republic employee, who was participating in the call and taking notes), I know that, on or about November 15, 2017, Cohen told First Republic Employee?2 that he had a new of?ce at 30 Rock. Moreover, Iknow from an article in Vanity Fair published on or about February 14, 2018, that Cohen was interviewed by the magazine in Subject Premises?2 in or about February 2018. 49. There is also probable cause to believe that Subject Premises?2 is likely to contain instrumentalities, evidence, and fruits of the Subject Offenses. Speci?cally, from my review of emails-pro duced pursuant to subpoena and mac as my training and experience, I know the following: a. According to records maintained by Sterling, when Cohen was emailing with Sterling Employee?3 in 2018 about a modification to his existing loan from Sterling, Cohen listed his address in his email as the address for Subject Premises-2. See supra 1] 16(t), 16(u). Accordingly, Subject Premises?2 likely contains evidence concerning Cohen?s loanlmodification negotiations with Sterling. b. Based on my review of records obtained pursuant to the Cohen Email Warrants, I know that the address Cohen provided to KAI and BTA for Essential Consultants is the address for Subject Premises-2. See supra 19(a), 19(b). Therefore, there is probable cause to believe . that Subject Premises-2 will contain evidence concerning the operation of Essential Consultants or money that Cohen received, through Essential Consultants, from KAI and BTA, among other entities with Which Cohen had a consulting arrangement. Additionally, based on my review of emails sent in 2018 that were obtained pursuant to the Cohen Email Warrants, I know that Cohen continues to enter into consulting arrangements through Essential Consultants, and agreements 64 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 73 of 201 relating to those arrangements indicate that Essential Consultants is located at Subject Premises? 2. Additionally, because Cohen used the address for Subject Premises?2 for multiple consulting arrangements involving Essential Consultants, there is probable cause to believe that Subject Premises?2 may contain records of other unknownconsulting arrangements that Cohen has with other individuals or entities. c. Based on my review of records maintained by Getzel?s accounting ?rm, and emails produced pursuant to the Cohen Email Warrants, as well as my participation in an interview with Getzel, I have learned that Getzel visited Subject Premises-2 to meet with Cohen about his taxes. See Essential Consultants on his personal ?nancial statement to banks. According, there is probable . cause to believe that Subject Premises?2 will contain evidence relating to Cohen?s taxes, or notes of his conversation with Getzel. Moreover, the fact that Cohen used Subject Premises-2 for a meeting regarding his personal fmancial matters provides probable cause to believe that documents and information regarding his ?nances will be found in Subject Premises-2. d. Based on my participation in an interview with Getzel, I know that Cohen maintains a computer in Subject Premises?2. From my review of IP data produced pursuant to a subpoena and pen register to Google, it appears that Cohen is logging into his Gmail account from Subject Premises?2. Accordingly, there is probable cause to believe that Subject Premises-2 contains electronic devices, that for reasons discussed below are likely to contain evidence of the Subject Offenses. e. Based upon my training and experience, I have learned that individuals who maintain businesses typically keep records relating to the business?such as contracts with clients and records of payments?at the business? identi?ed location. I am not aware of any addresses 65 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 74 of 201 associated with Essential Consultants other than Subject Premises?l and Subject Premises?2. Accordingly, there is probable cause to believe that Subject Premises-l and Subject Premises-2 will contain business records for Essential Consultants. 50. Third, there is probable cause to believe that Subject Premises~3 is likely to contain instlurnentalities, evidence, and fruits of the Subject Offenses. In particular: a. As noted above, Cohen has two bank accounts at TD Bank. In or about November 2017, as Cohen was receiving substantial income ?om consulting work?thich he did not disclose to Sterling?Cohen opened the safety deposit box at TD Bank, which is Subject Premises-3. In light of the aforementionedEVi'dence that Cohen there is prob able cause to believe that Subject Premises-3 contains ?nancial assets, objects of value and/or documents relating to such assets or?obj ects of value that Cohen likely did not disclose to Sterling. Indeed, based on my training and experience, I am aware that people often conceal valuable items in safety deposit boxes. Accordingly, there is probable cause to believe that Subject Premises-3 will contain evidence of the Bank Fraud Offenses. b. In addition, based on my review of records produced by TD Bank, I know that Cohen has accessed the vault in which Subject Premises?3 is stored on two occasions. The first i such occasion was on November 10, 2017. Cohen signed into the vault at approximately 5:35 and out of vault at approximately 5:39 on that date.32 Based on my review of toll records, I know that Cohen?s first call after he signed out of the safety deposit box - approximately 45 minutes later was to Keith Davidson. Specifically, at 6:25 pm. Cohen called Davidson and they spoke for less than a minute; three minutes later, Davidson called Cohen back and they spoke for approximately 32 The entry in the bank?s log book does not specify whether this is AM. or RM. However, I infer that it is P.M., because it is unlikely that the bank would have been open at 5:35 and 5:39 am. 66 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 75 of 201 22 minutes. The second such occasion was on February 2, 2018, which is during the time period numerous media reports about Cohen?s payment to Clifford were being published, and is one day after it appears that Cohen? 5 family moved into Subject Premises-4, as set forth above. The timing of Cohen? two visits to the vault? one shortly before a call to Keith Davidson and the other around the time that Cohen came under media scrutiny in connection with the payment to Davidson?s client gives rise to probable cause to believe that Subject Premises-3 will contain evidence of the Campaign Finance Offenses, such as documents relevant to the Cohen?s dealing with Keith Davidson and the payment to Clifford, including documents or evidence that Cohen did not want to leave in his apartment Where Workers would?be present:3q 51. Based on my review of emails obtained pursuant to the Cohen Email Warrants and cell phone location information, I believe that Cohen is temporarily residing in Subject Premises? 4. See supra 1H There is also probable cause to believe that Subject Premises-4 contains instlumentalities and evidence of the Subject Offenses, including, the following: a. As described above, it appears that Cohen moved to Subject Premises?4 on or ab out February 2018, at which time numerous media reports about Cohen?s involvement in the payment to Clifford were being published. See supra During this time same period, Cohen was frequently corresponding with the media and sent himself and others statements about his involvement in the payment to Clifford. See supra 1W Thus, there is probable cause that Cohen took at least some documents and evidence relating to the Clifford payment with him to Subject Premises?4, in order to reference and consult them in connection with these statements. 33 As noted above, Subject Premises?3 is approximately five inches by ten inches. Accordingly, I do not believe that it would fit a large volume of hard copy documents; however, a small number of hard-copy documents, or a large volume of documents contained on a ?ash drive or other portable storage device, would fit in Subject Premises-3. 67 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 76 of 201 b. As described above, at the time Cohen moved to Subject Premises?4, he was also A in the midst of ongoing negotiations with Sterling regarding the re?nancin of his medallion debts. For example, on January 30, 2018, Cohen had a phone call with Sterling Employee-3 about his ?nances and the proposed restructuring, and on February 1, 2018, Cohen sent an email to Sterling Employee?3 claiming that he did not have more than $1.25 million in cash. See supra 111] 16(u). Thus, there is probable cause that Cohen took at least some documents and evidence relating to his ongoing negotiations with Sterling with him to Subject Premises?4, in order to reference and consult them in connection with these negotiations. c. As describ?d above, Cohen used??t?leai?t one Apple iPhonejanvAppleriPad?Mini, and a MacBook Pro to access his iCloud account, and these electronic devices linked to Cohen?s iCloud account were used at Subject Premises-1 Cohens? permanent residence to place telephone calls and backup ?les to Cohen?s iCloud account. See supra 111i 47(i). Although Cohen?s stay at Subject Premises?4 is temporary, based on my training and experience I know that individuals who travel or stay in hotels for short-term periods commonly bring p01table electronic devices with them, such as cellular phones, tablets, or laptops. Accordingly, there is probable cause to believe that Subject Premises-4, where Cohen currently appears to be residing, contains electronic devices, including Subject Device-l,Subject Device?2, and/or celtain Apple products, that for the reasons discussed helein ale likely to contain evidence of the Subject Offenses. Moreover, as set f01th above, based on cellphone location information I know that Subject Device-1 and Subject Device-2 were in the vicinity of Subject Premises?4 as recently as this morning (April 8, 2018). As set forth above, there is probable cause to believe that Cohen used the Subj ect Devices in furtherance of the Subject Offenses, including to communicate with Sterling employees regarding the medallion transaction, with First Republic employees regarding 68 2017.08.02 Case . Document 48-2 Filed 07/18/19 Page 77 of 201 the Essential Consultants Account, with his accountant regarding his ?nances, and with individuals, such as Davidson, Howard and Pecker, involved in the 130,000 payment to Clifford. 52. Although Cohen appears to be residing currently in Subject Premises?4, it is unknown whether Cohen will be physically present within Subject Premises?4 at the moment the warrant sought herein are executed. If Cohen is within Subject Premises?4 at that moment, Subject Device?l and Subject Device?2 -Ihis cellphones will likely also be within Subject Premises-4. If Cohen is not within Subject Premises~4 at that moment, the devices will likely be on his person, wherever he is located (which, based on location data for Subject Device-l and Subject Device?2 as recently as today, IS seeks separate authority to seize Subject Device?l and Subject Device-2, in the event that those devices are not located within Subject Premises?4 (or another Subject Premises) at the moment the warrants sought herein are executed. D. Probable Cause Justifying Search of ESI 53. Based on the foregoing, there is probable cause to believe that Subject Premises-l, Subject Premises-2 and Subject Premises?4 contain electronic devices that are likely to contain evidence, fruits, and instrumentalities of the Subject Offenses (and, as set forth above, that Subject Device?l and Subject Device?2 are themselves electronic devices that are likely to contain evidence of the Subject Offenses). Specifically, based on my review of information produced pursuant to the Cohen Email Warrants, the iCloud Warrant, and subpoenas, as well as pen register data, I submit that there is probable cause that Subject Premises-1 contains an Apple iPad Mini, a MacBook Pro, and has, at various times, contained Apple cellphones; similarly, there is probable cause that Subject Premises-2 contains a computer and has, at various times, contained Apple 69 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 78 of 201 cellphones. These devices are likely to include evidence, fruits, and instrumentalities of the Subject Offenses for the following reasons: a. As described throughout this af?davit, Cohen used email to send and receive communications related to the Subject Offenses. In particular, Cohen used email to Send and receive communications with Sterling, First Republic, Getzel, the entities to which he is providing consulting services, Davidson, and Howard, among others. While some of these emails have already been obtained via subpoenas and search warrants, I know from my training and experience that individuals can and do delete emails from their Internet?based inboxes but retain copies of those emails On some of which may not be known to law enforcement, and as a result electronic devices can be a unique repository of all emails relevant to certain Subject Offenses. Indeed, from my involvement in this investigation, I know that Cohen had an email account with the Trump Organization, but the USAO and FBI have not been able to obtain the contents of that account to date. Thus, emails relevant to the Subject Offenses are likely stored on electronic devices in Subject Premises-1, Subject Premises?2 and/or Subject Premises-4. b. Additionally, Subject Premises?1, Subject Premise?2 and Subject Premises?4 likely contain electronic copies of documents relevant to the Subject Offenses. Indeed, I know from my training and experience that individuals often retain copies of important documents on their computers or other electronic devices capable of storing information, including cellphones (such as the Subject Devices) and tablets. Here, there are a number of documents that Cohen has likely retained that will be relevant to the Subject Offenses. For example, electronic devices may include documentation of Cohen?s true net worth, a listing of his assets, an accounting of his available 70 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 79 of 201 cash, consulting agreements with third parties, and documentation of his payment to Clifford, among other evidence of the Subject Offenses. 0. Third, I know ??orn my review of emails obtained pursuant to the Cohen Email Warrants that Cohen sent up online banking with First Republic. Based on my training and experience, I know that individuals who set up online banking often receive electronic notices concerning ?nancial transactions and, on occasion, save records of their ?nancial transactions to their devices. Accordingly, there is probable cause to believe that Cohen?s electronic devices contain evidence of banking activity, including the existence of bank accounts or assets that Cohen did not to Sterling or M'?lfO?s?e?. d. Fourth, ?om my review of records produced by Apple, I know that Cohen communicates using text'message as well as communications applications. These applications that Cohen has downloaded onto a phone include, but are not limited to, INhatsApp, Signal, and Dust. I know from my review of toll records and text messages that, in particular, Cohen communicated with Pecker using these applications. Accordingly, there is probable cause to believe that Cohen?s cellphones - the Subject Devices Will contain messages that are not otherwise accessible relating to the Subject Offenses. 54. Based on my training and experience, I know. that individuals who engage in ?nancial crimes commonly use computers to communicate with co-conspirators, keep ?nancial ledgers, and retain ??audulent documents. As a result, they often store data on their computers related to their illegal activity, which can include logs of online or cellphone?based ?chats? with co-conspirators; email correspondence; contact information of co-conspirators, including telephone numbers, email addresses, and identi?ers for instant messaging and social medial accounts; bank account numbers; and/or records of uses cf ?nds. 71 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 80?of 201 55. Based on my training andexperience, I also know that, where computers are used in furtherance of criminal activity, evidence of the criminal activity can often be found months or even years after it occurred. This is typically true because: a Electronic ?les can be stored on a hard drive for years at little or no cost and users thus have little incentive to delete data that may be useful to consult in the future. 0 Even when a user does choose to delete data, the data can often be recovered months or years later with the appropriate forensic tools. When a ?le is ?deleted? on a home computer, the data contained in the ?le does not actually disappear, but instead remains on the hard drive, in ?slack space,? until it is overwritten by new data that cannot be stored elsewhere on the computer. Similarly, ?les that have been viewed on the Internet are generally downloaded into a temporary Internet directory or ?cache,? which is only . overwritten as the ?cache? ?lls up and isreplaced with more recently viewed Internet pages. Thus, the ability to retrieve from a hard drive or other electronic storage depends less on when the ?le was created or viewed than on a particular user?s operating system, storage capacity, and computer habits. In the event that a user changes computers, the user will typically transfer ?les from the old computer to the new computer, so as not to lose data. In addition, users often keep backups of their data on electronic storage media such as thumb drives, ?ash memory cards, or portable hard drives. 56. Based on the foregoing, I respect?Jlly submit there is prob able cause to believe that Cohen engaged in the Subj ect Offenses, and that evidence of this criminal activity is likely to be found in the Subject Premises, on computers and electronic media found in the Subject Premises, and on the Subject Devices. In particular, there is probable cause toibelieve that the Subject Premises and Subject Devices will contain evidence, ?uits, and instrumentalities of violations of the Subject Offenses, as more fully described in Section II of Attachments A, B, C, D, and to the proposed warrants, including the following: a. Evidence necessary to establish the occupancy or ownership of the Subject Premises, including without limitation, utility and telephone bills, mail envelopes, addressed correspondence, bank statements, identi?cation documents, and keys. b. Evidence relating to Sterling, Melrose, and/or taxi medallions. 72 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 81-of 201 0. Evidence relating to a plan, proposal, or agreement for Cohen and/or entities associated With him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including tc_and/or entities associated with him. d. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. e. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. f. Evidence of income to IMlchae-l DTCohEITcS?ciAssoEia? including??any?documents that indicate the nature and purpose of payments made to or ??om Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. g. Evidence. relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records. h. EVidence relating to agreements, loans, and/or ?nancial transactions between Cohen and?1nd any payments by Cohen. i. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. j. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. 73 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 82 of 201 k. Evidence of communications involving Michael Cohen, American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Campaign, Stephanie Clifford, and/or Karen McDougal. 1. Evidence relating to Cohen?s role in the Trump Campaign, and cecrdination or consultation with the Trump Campaign. m. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. n. Evidence relating payment to Clifford or others in connection with the election. 0. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. p. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances; q. Communications, records, documents, and other ?les re?ecting false representations to a financial institution related to the intended purpose of an account or loan at i that financial institution; the nature of any business or entity associated with an account at a financial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; r. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. Procedures for Searching ESI A. Execution of Warrant for ESI 57. Federal Rule of Criminal Procedure provides that a warrant to search for and seize property ?may authorize the seizure of electronic storage media or the seizure or 74 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 83 of 201 copying of electronically stored information . . for later review.? Consistent with Rule 41, this application requests authorization to seize any computer devices and storage media and transpo?: them to an appropriate law enforcement facility for review. This is typically necessary for a numb er of reasons: a First, the volume of data on computer devices and storage media is often impractical for law enforcement personnel to review in its entirety at the Search location. a Second, because computer data is particularly vulnerable to inadvertent or intentional modi?cation or destruction, computer devices are ideally examined in a controlled environment, such as a law enforcement laboratory, where trained personnel, using specialized software, can make a forensic copy of the storage media that can be subsequently reviewed in a manner that does not change the underlying data. 0 Third, there are so many types of computer hardware and software in use today that it can be impossible to bring to the search site all of the necessary technical manuals and specialized personnel and equipment potentially required to safely access the underlying computer data. a Fourth, many factors can complicate and prolong recovery of data irom a computer device, including the increasingly common use of passwords, or other features or configurations designed to protect or conceal data on the computer, which often take considerable time and resources for forensic personnel to detect and resolve. 58. As discussed herein, Squire Patton Boggs is a ?lnctioning law ?rm that conducts legitimate business unrelated to Cohen?s commission of the Subject Offenses. Subject Premises-. 2 is an of?ce located inside of Squire Patton Boggs?s New York office. In order to execute the warrant in the most reasonable fashion, law enforcement personnel will attempt to investigate on the scene of what computers or storage media, if any, must be seized or copied, and what computers or storage media need not be seized or copied. Law enforcement personnel will speak with Squire Patton Boggs personnel on the scene as may be appropriate to determine which ?les and electronic devices within Subject Premises-2 belong to or were used by Cohen. While, based on the foregoing, it does not appear that Cohen shared electronic devices or a server with Squire Patton Boggs, where appropriate, law enforcement personnel will copy data, rather than physically seize 75 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 84 of 201 computers, to reduce the extent of any disruption of Squire Patton Boggs?s operations. If, after inspecting the seized computers off?site, it is determined that some or all of this equipment is no longer necessary to retrieve and preserve the evidence, the Government will return it. 59. Additionally, because Cohen is an attorney, and claims to serve as a personal attorney for Trump, the review of evidence seized from the Subject Premises and Subject Devices will be conducted pursuant to established screening procedures to ensure that the law enforcement personnel involved in the investigation, including attorneys for the Government, collect evidence in a manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures will include use the investigative team, in order to review potentially privileged communications and determine which communications to release to the investigation and prosecution team. B. Accessing ESI on the Subject Devices 60. As described above, the Subject Devices are both Apple brand devices. 61. I know from my training and experience, as well as from information found in publicly available materials including those published by Apple, that some models of Apple devices such as iPhones and iPads offer their users the ability to unlock the device via the use of a ?ngerprint or thumbprint (collectively, ?fmgerprint?) in lieu of a numeric or alphanumeric passcode or password. This feature is called Touch ID. I also know that the Apple iPhone offers its users the ability to unlock the device via the use of facial recognition (through infrared and visible light scans) in lieu of a numeric or alphanumeric passcode or password. This feature is called Face ID. 62. If a user enables Touch ID on a given Apple device, he or she can register up to 5 ?ngerprints that can be used to unlock that device. The user can then use any of the registered 76 2017.03.02 Case Document 48-2 Filed 07/18/19 Page.85 of 201 ?ngerprints to unlock the device by pressing the relevant fmger(s) to the device?s Touch ID sensor, which is found in the round button (often referred to as the ?home? button) found at the bottom center of the front of the device. If a userenables Face ID on a given Apple device, he or she can unlock the device by raising the iPhone to his or her face, or tapping the screen. In my training and experience, users of Apple devices that offer Touch ID or Face ID often enable it because it is considered to be a more convenient way to unlock the device than by entering a numeric or alphanumeric passcode or password, as well as a more secure way to protect the device?s contents. 63. In some circumstances, Touch ID or Face ID cannot be used to unlock a device that has either securlty feature enabled, and a passcode circumstances include: (1) when the device has just been turned on or restarted; (2) when more than 48 hours has passed since the lasttim?e the device was unlocked; (3) when the passcode or password has not been entered in the last 6 days, and the device has not been unlocked Via'Touch ID in the last 8 hours or the device has not been unlocked via Face ID in the last 4 hours; (4) the device has received a remote lock Command; or (5) ?ve unsuccess?il attempts to unlock the device via Touch ID or Face ID are made. 64. The passcodes or passwords that would unlock the Subject Devices are not known to law enforcement. Thus, it will likely be necessaly to press the fmgers of the user of the Subject Devices to the devices? Touch ID sensor, or hold the Subject Devices in front of the user?s face to activate the Face ID sensor, in an attempt to unlock the devices for the purpose of executing the search authorized by this warrant. Attempting to unlock the relevant Apple devices via Touch ID with the use of the ?ngerprints of the user, or via Face ID by holding the device in front of the user?s face, is necessaly because the government may not otherwise be able to access the data contained on those devices for the purpose of executing the search authorized by this warrant. 77 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 86 of 201 65. Based on these facts and my training and experience, it is likely that Cohen is the user of the Subject Devices, and thus that his ?ngerprints are among those that are able to unlock the Subject Devices via Touch ID or his face is able to unlock the Subject Devices via Face ID. 66. Although I do not know which of a given user?s 10 ?ngerprints is capable of unlocking a particular device, based on my training and experience I know that it is common for a user to unlock a Touch ID?enabled Apple device via the ?ngerprints on thumbs or index ?ngers. In the event that law enforcement is unable to unlock the Subject Devices as described above within the ?ve attempts permitted by Touch ID, this will simply result in the device requiring the entry of a password or passcode bef?ir'?wit can be unlocked. 67. I also know from my training and experience, and my review of publicly available materials published by Apple that Apple brand devices, such as the Subject Devices, have a feature that allows a user to erase the contents of the device remotely. By logging into the Internet, the user or any other individual who possesses the user?s account information can take steps to completely wipe the contents of the device, thereby destroying evidence of criminal conduct, along with any other information on the device. The only means to prevent this action is to disable the device?s ability to connect to the Internet immediately upon seizure, which requires either access to the device itself to alter the settings, or the use of specialized equipment that is not consistently available to law enforcement agents at every arrest. 68. Due to the foregoing, I request that the Court authorize law enforcement to press the ?ngers (including thumbs) of Cohen to the Touch ID sensors the Subject Devices, or hold the Subject Devices in front of Cohen?s face, for the purpose of attempting to unlock the Subject Devices via Touch 1D or Face ID in order to search the contents as authoriZed by this warrant. 78 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 87 of 201 C. Review of E81 69. Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the E81 and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the govelnment in this investigation, and outside technical experts under government Control) will review the E81 contained therein for information responsive to the warrant. 70. In conducting this review, law enforcement personnel may use various techniques to?HEterrnine eete techniques may include, for example: a surveying directories or folders and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); a conducting a ?le-by-?le review by ?opening? or reading the ?rst few ?pages? of such ?les in order to determine their precise contents (analogous to performing a cursory examination of each document in a ?le cabinet to determine its relevance); 7 a ?scanning? storage areas to discover and possibly recover recently deleted data or deliberately hidden ?les; and a performing electronic keyword searches through 7 all electronic storage areas to determine the existence and location of data potentially related to the subject matter of the investigation-??4; and reviewing metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. 34 Keyword searches alone are typically inadequate to detect all relevant data. For one thing, keyword searches work only for text data, yet many types of ?les, such as images and videos, do not store data as searchable text. Moreover, even as to text data, there may be information properly subject to seizure but that is not captured by a keyword search because the information does not contain the keywords being searched. 79 2017.03.02 thetG'cWernment-will Case Document 48-2 Filed 07/18/19 Page 88 of 201 71. Law enforcement personnel will make reasonable efforts to restrict their search to data falling within the categories of evidence speci?ed in the warrant. Depending on the circumstances, however, law enforcement personnel may need to conduct a complete review of all the E81 from seized devices or storage media to evaluate its contents and to locate all data responsive to the warrant. D. Return of ESI 72. . If the Government determines that the electronic devices are no longer necessary to retrieve and preserve the data, and the devices themselves are not. subject to seizure pursuant to Computer data that is or unreadable will not be returned unless law enforcement personnel have determined that the data is not an instrumentality of the offense, (ii) a fruit of the criminal activity, contraband, (iv) otherwise unlawfully possessed, or evidence of the Subject Offenses. 80 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 89 of 201 A0 93 (SDNY Rev. 05/10) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of New York In the Matter of the Search of (Brie?y describe the property to be searched or identi?l the person by name and address) Case No, Loewe Regency Hotel, 540 Park Avenue, Room 1728, New York, New York 10065, and any ciosed containers/items contained therein, See Attachment SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement of?cer An application by a federal law enforcement of?cer "or an attorney for the government requests the search of the following person or property located in the Southern District Of New York (identij?r the person or describe the property to be searched and give its location): Loews Regency Hotel, 540 Park Avenue, Room 1728, New York, New York 10065, and any closed containers/items contained therein, See Attachment The person or property to be searched, described above, is believed to conceal (identi?l the person or describe the property to be seized): See Attachment I ?nd that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or Pro perty . YOU ARE COWANDED to execute this warrant on or before Li in is (not to exceed 14 days) if in the daytime 6:any time in the day or night as I ?nd reasonable cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The of?cer executing this warrant, or an of?cer present during the execution of the Warrant, must prepare an inventory as required by law and return this warrant and inventory to the Clerk of the Court. Upon its retum, this walrant and inventory should be ?led under seal by the Clerk of the Court. El I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C. 2705 (exoept for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose property, will be searched 01? SBlZed (check the appropriate boss) days (not to exceed 30). Duntil, the facts justifying, the later speci?c date of Jitdge ?s signature Dateandtimeissued: A?g?ig 725% Pea. g! City and state: New York, NY l-lon, Henry B. Pitman. U.S. Magistrate Judge . Printed name and title Case Document 48-2 Filed 07/18/19 Page 90 of 201 A0 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: Certi?cation I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the Court. Date: Executing a?cer ?s signature Printed name and title Case Document 48-2 Filed 07/18/19 Page 91 of 201 ATTACHMENT I. Premises to be Searched?~Subject Premises~4 The premises to be searched (?Subject Premises?4?) are described as follows, and include electronic devices, and all locked and closed containers found therein: Room 1728 located inside the Loews Regency Hotel at 540 Park Avenue, New York, New York 10065. The building is a luxury hotel located on Park Avenue and ?lst Street. Subject Premises-e4 is located on the l7th floor of the hotel. II. Items to Be Seized A. Evidence, Fruits, and Instrumentalities of the Subject Offenses Thesiterns-thLbeseizedfrom Subj and instrumentalities of violations of 18 U.S.C. 371 (conspiracy, as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a-fmancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?), described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, ??om January 1, 2013 to the present. . b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to nd/or entities associated with him. 0. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has. with Sterling and/or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e, Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or from Michael D. Cohen 85 Associates, or evidence of the purpose of accounts opened in the name of Mchael D. Cohen Associates. - f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and armual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal financial statements, and bank records, from January 1, 2013 to the present. a. Evidence relatingr to agreements, loans, and/or financial transactions between Cohen and?ind/or entities controlled by 13 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 92 of 201 and any payments by Cohen, from January h. Evidence relating to payments. to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. 1, 2012 to the present. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. Evidence of communications between Michael Cohen and American Media, Inc., David Packer, and/or Dylan Howard about Donald Trump, the Trump Cat'npaign, Stephanie Clifford, and/or Karen ougal. - k. Evidence relating to Cohen?s role inthe Trump Campaign, and cocrdination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 11, Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and ?camp aign contribution limits. 0. Cominunications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January 1, 2013 to the present. p. CommunicatiOns, records, documents, and other files re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of ?Jnds ?owing into an account; or the purpose or nature of any financial transactions involving that ?nancial institution, from January 1, 2013 to the present. q. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. B. Search and Seizure of Electronically Stored Information The items to be seized from Subject Premises?4 also include any computer devices and storage media that may contain any electronically stored information falling within the categories set forth in Section ILA of this Attachment above, including, but not limited to, a MacBook: Pro, any other desktop and laptop computers, any Apple iPhone or other cellphone 0r smartphone 14 20170302 Case Document 48-2 Filed 07/18/19 Page 93 of 201 belonging to Michael Cohen or in his possession, an Apple iPad Mini, po1table hard drives, disk drives, thumb drives, and personal digital assistants. In lieu of seizing any such computer devices or storage media, this warrant also authorizes the copying of such devices or media for later review. The items to be seized from Subject Premises-4 also include: 1. Any items or records needed to access the data stored on any seized or copied computer devices or storage media, including but not limited to any physical keys, devices, or records of login credentials, passwords, private keys, or similar information. 2. Any items or records that may facilitate a forensic examination of the computer devices or storage media, including any hardware or software manuals or other information concerning the configuration of the seized or copied computer devices or storage media. 3. Any evidence concerning the identities or locations of those persons with access to, C. Review of ESI Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (which may include, in addition to law enforcement officers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: surveying various file ?directories? and the individual files they contain (analogous to looking at the outside of a file cabinet for the markings it contains and opening a drawer believed to contain pertinent files) at opening or cursorily readingthe first few ?pages? of such ?les in order to determine their precise contents; - scanning storage areas to discover and possibly recover recently deleted files or deliberately hidden files; a performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and - reviewing metadata, system information, configuration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. 15 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 94 of 201 Law enforcement personnel will make reasonable efforts to search only for ?les, documents, or other electronically stored information Within the categories identi?ed in Sections ILA and ILB of this Attachment. However, law enforcement personnel. are authorized to conduct a complete review of all the E31 from seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 16 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 95 of 201 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of the Application of the United TO BE FILED UNDER SEAL States of America for a Search and Seizure Warrant for the Premises Known and Described Agent Affidavit in Support of as Loews Regency Hotel, 540 Park Avenue, Application for Search and Seizure Room 1628, a Suite that Encompasses Rooms Warrant 1628, 1629, and 1630 New York, New York 10065, and Any Closed Containers/Items Contained Therein Reference No. 2018R00127 SOUTHERN DISTRICT OF NEW YORK) 55.: sworn. deposes and says: I. Introduction A.. Affiant l. I am a Special Agent with the Federal Bureau of Investigation I have been a Special Agent with the FBI since 2009. In the course of my experience and training in these positions, I have participated in criminal investigations into federal offenses involving a wide array of ?nancial crimes, including frauds on ?nancial institutions, as well as into offenses involving public corruption. I also have training and experience executingsearch warrants, including those involving electronic evidence. 2. On or about April 8, 2018, the Honorable Henry B. Pitman, United States Magistrate Judge, issued a search and seizure warrant for the premises known and described as Loews Regency Hotel, 540 Park Avenue, Room 1728, New York, New York 10065, and Any Closed Containers/Items Contained Therein. The warrant and my .supporting affidavit (the ?Af?davit?) are appended hereto. The Affidavit is incorporated herein by reference in its entirety as Exhibit A. 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 96 of 201 3. On or about April 9, 2018, based upon a conversation with another law enforcement agent who spoke to an employee of Loews Regency Hotel, I learned that Michael Cohen is in fact staying in Room 1628 (in a suite encompassing rooms 1628, 1629, and 163 0) (collectively, ?Room 1628?), not Room 1728. Accordingly, I respectfully submit the attached amended warrant pursuant to Rule 41 of the Federal Rules of Criminal Procedure for the following Subject Premises: Loews Regency Hotel, 540 Park Avenue, Room 1628, New York, New York 10065, and Any Closed Containers/Items Contained Therein (?Subject Premises?4?). For the reasons detailed in the Af?davit and herein, I believe that there is probable cause to believe that Subject Premises-4 contains evidence, fruits, and instrumentalities of Violations of 18 U.S.C. 1005 (false bank I entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud) (collectively, the ?Bank Fraud Offenses?), 52 U.S.C. 30116(a)(l)(A) and 30109(d)(l)(A)(1) (illegal campaign contributions) (the ?Campaign Finance Offenses?), and 18 U.S.C. 371 (conspiracy as it pertains to the other Subject Offenses) (collectively, the ?Subject Offenses?). 4. Based on the foregoing, I respectfully request the court to issue a warrant to seize the items and information speci?ed in Attachment A to this af?davit and to the Search and Seizure Warrant. 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 97 of 201 5. In light of the con?dential nature of the continuing investigation, I respectfully request that this af?davit and all papers submitted herewith be maintained under seal until the Court orders otherwise. Special Agent FBI Sworn to before me on 9th day of April, 2018 Hm 0: mm HON. HENRY B. TITMAN UNITED STATES MAGISTRATE JUDGE 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 98 of 201 ATTACHMENT A I. Premises to be Searched?Subject Premises?4 The premises to be searched (?Subject Premises?4?) are described as follows, and include electronic devices, and all locked and closed containers found therein: . Room 1628 (a suite encompassing rooms 1628, 1629, and 1630) (collectively, ?Room _,1628?) located inside the Loews Regency Hotel at 540 Park Avenue, New York, New York 10065. The building 1s a luxury hotel located on Park Avenue and 6lst Street. Subject Premises- 4 1s located on the 16th ?oor of the hotel 7 II. Items to Be Seized A. Evidence, Fruits, and Instrumentalities of the Subject Offenses The 1tems tombe seized from Siibje?f Premises 4 are evidence, fruits, and instrumentalities of violations of 18 U. S. 371 (conspiracy, as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 S. C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?), described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer anv interest in taxi medallions, and any associated debts or liabilities, to others, including to _1nd/ or entities associated with him. 0. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. (1. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. 6. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. f. Evidence relating to Cohen? net worth, available cash and cash equivalents, and annual 1ncome, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, from January 1, 2013 to the present. g. Evidence relating to agreements, loans, and/or ?nancial transactions between Cohen and ?and/or entities controlled by t? 2 2 2017.08.02 Case Document 48-2? Filed 07/18/19 Page 99 of 201 h? ho_ho cohho hoh hoohoo 1., LU 1L LU Lilla h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougal. theoTrumpiCampaignTando consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/oragents or associates of the - Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. . m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 11. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January 1, 2013 to the present. p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any financial transactions involving that ?nancial institution, from January 1, 2013 to the present. q. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. B. Search and Seizure of Electronically Stored Information The items to be seized from Subject Premises?4 also include any computer devices and storage media that may contain any electronically stored information falling within the categories set forth in Section ILA of this Attachment above, including, but not limited to, a MacBook Pro, any other desktop and laptop computers, any Apple iPhone or other cellphone or smartphone 3 20170302 Case Document 48-2 Filed 07/18/19 Page 100 of 201 belonging to Michael Cohen or in his possession, an Apple? iPad Mini, portable hard drives, disk drives, thumb drives, and personal digital assistants. In? lieu of seizing any such computer devices or storage media, this warrant also authorizes the copying of such devices or media for later review. The items to be seized from Subject Premises?4 also include: 1. Any items or records needed to access the data stored on any seized or copied computer devices or storage media, including but not limited to any physical keys, devices, or records of login credentials, passwords, private keys, or similar information. 2. Any items or records that may facilitate a forensic examination of the computer devices or storage media, including any hardware or software manuals or other information concerning the con?guration of the seized or copied computer devices or storage media. 3., Any evidence concerning theidentities or locations of those with access to, control over, or ownership of the seized or copied computer devices or storage media. C. Review of ESI Following seizure of any computer devices and storage media and/or the creation of forenSic image copies, law enforcement?personnel (which may include, in addition to law enforcement of?oers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the ESI contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: a surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); 9 opening or cursorily reading the ?rst few ?pages? of such ?les in order to determine their precise contents; 0 scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden ?les; a performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intlmately related to the subject matter of the investigation; and 0 reviewng metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 101 of 201 Law enforcement personnel? will make reasonable efforts to search only for ?les, documents, or other electronically stored information within the categories identi?ed in Sections ILA and EB of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the ESI'from seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 102 of 201 .5 {oer/Ar Case Document 48-2 Filed 07/18/19 Page 103 of 201 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of the Application of the United TO BE FILED UNDER SEAL States of America for a Search and Seizure Warrant for the Premises Known and Described 5 Agent Af?davit in Support of as (1) 502 Park Avenue,? New Application for Search and Seizure York, New York 10022, (2) Michael Cohen?s Warrant Of?ce at 30 Rockefeller Plaza, 23rd Floor, New 2 York, New York 10112, (3) Safe Deposit Box Located at the TD Bank Branch at 500 Park 3 Avenue, New York, New York 10019, and (4) Loews Regency Hotel, 540 Park Avenue, Room 1728, New York, New York 10065, and Any 3 Therein, and 3 the Electronic Devices Known and Described as (1) an Apple iPhone with Phone Numbei_ and (2) an Apple iPhone with Phone Number Reference No. 2018R00127 SOUTHERN DISTRICT OF NEW - Special Agent, Federal Bureau of Investigation, being duly sworn, deposes and says: . I. Introduction A. Af?ant l. I am a Special Agent with the Federal Bureau of Investigation I have been a Special Agent with the FBI since 2009. In the course of my experience and training in these positions, Ihave participated in criminal investigations into federal offenses involving a wide array of ?nancial crimes, including frauds on ?nancial institutions, as well as into offenses involving public corruption. I also have training and experience executing search warrants, including those involving electronic evidence. 2. I make this Af?davit in support of an application pursuant to Rule 41 of the Federal Rules of Criminal Procedure for a warrant to search the premises speci?ed below (the ?Subject 2 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 104 of 201 Premises?) and the electronic devices specified below (the ?Subject Devices?) for, and to seize, the items and information described in Attachments A, B, C, D, and F. This af?davit is based upon my personal knowledge; my review of documents and other evidence; my conversations With other law enforcement personnel; and my training, experience and advice received concerning the use of electronic devices in criminal activity and the forensic analysis of electronically stored information Because this af?davit is being submitted for the limited purpose of establishing- probable cause, it does not include all the facts that 1 have learned during the course of documents and the actions, statements, and conversations of others are reported herein, they are reported in substance and in part, except Where otherwise indicated. B. The Subject Premises and Subject Devices 3. Subject Premises?1, Subject Premises?2, Subject Premises?3 and Subject Premises? 4 (collectively, the ?Subject Premise-3?) are particularly described as: a. Subject Premises~1 is Apartment .located inside the building at 502 Park Avenue, New York, New York 10022. The building located at 502 Pa?c Avenue is a 32- ?oor brick residential building. Subject Premises-1 is located on the -Eloor of the building. Based on my review of New York City property records, I have learned that Michael Cohen and Laura Cohen own Subject Premises~l.1 Additionally, as described below, Subject Premises-1 is Cohen?s full?time residence. b. Subject Premises-2 is an office located on the 23rd ?oor of the building at 30 Rockefeller Plaza, New York, New York 10112. The building located at 30 Rockefeller Plaza 1As noted twin, 1 have learned that on or. about October 28, 2015, Cohen transferred Subject Premises-1 into a trust. 3 201103.02. Case Document 48-2 Filed 07/18/19 Page 105 of 201 is a 66??oor of?ce building thatspans the entire block between Sixth Avenue and Rookefeller Plaza. Subject Premises-2 is located on the 23rd ?oor of the building inside of the of?ces of the law firm Squire Patton Boggs. The of?ce is assigned to Michael Cohen. As described below, Michael Cohen works and conducts meetings at Subject Premises~2. c. Subject Premises?3 is a safety deposit box located inside the TD Bank branch location at 500 Park Avenue, New York, New York 10019. Based on my review of records maintained by TD Bank, I have learned that the safety deposit box is approximately ?ve inches by I The safety deposit box is in the name of Michael Cohen and Laura Cohen. d. Subject Premises?4 is Room 1728 located inside the Loews Regency Hotel at 5A0 Park Avenue, New York, New York 10065. The building is a luxuly hotel located on Park Avenue and 61st Street. Subject Premises-4 is located on the 17th ?oor of the hotel. Based on my review of emails obtained pursuant to search warrants described below, I have learned that on or about January 5, 2018, Cohen received an email from an employee of Loews Regency, which included a price quote for a longnterm stay suite based on a three?month stay from January 8 to April 8, 2018.2 On or about January 29, 2018, Cohen sent an email to a Loews Regency employee, stating, in pertinent part: just spoke to my wife and she has scheduled the move for Thursday. Please mark down that we will be taking possession on Thursday, February lst.? Based on my review of cell phone location data, I have learned that, over the past 24 hours, two cellular phones used by Cohen have been located in the vicinity of Subject Premises-4. In particular, on or about 2 Although the quoted price contemplated a three?month stay from January 8 to April 8, it appears that Cohen did not move in until February 1, and as of today, April 8, cellphone location information demonstrates that Cohen?s cellular phones are in still in the vicinity of Subject Premises-4. 4 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 106 of 201 April 8, 2018, law enforcement agents using a ?trigger?sh? device identi?ed Room 1728 as the room Within the hotel in which the Subject Devices are most likely present.3 e. Therefore, I believe that Cohen is temporarily residing in Subject Premises?4. 4. ,Subject Device~1 and Subject Device?2 (collectively, the ?Subject Devices?) are particularly described as: a. Subject Device?1 is an Apple iPhone serviced by with the telephone number w?m-B asedonmymeviewrof records maintained have learned that Subject Device-l is subscribed to Michael Cohen. Based on my review of cellphone location information maintained by I have learned that Subject Device?1 is presently located in the Southern District of New York. b. Subject Device?2 is an Apple iPhone serviced by with the telephone number Based on my review of records maintained by I have learned that Subject Device?2 is subscribed to Michael Cohen. Based on my review of cellphone location information maintained by I have learned that Subject Device?2 is presently located in the Southern District of New York. 0. Based on my training, experience, and research, and from consulting the manufacturer?s and service providers? advertisements and product technical speci?cations available online, I know that the Subject Devices have capabilities that allow them to, among other things: make and receive telephone calls; save and store contact information; send and receive 3 Based on my conversations with these agents, I understand that it is also possible that the Subject Devices are one ?oor below, in Room 1628. However, as noted, Iunderstand that Cohen received a price quote for a long?term stay suite and is residing there with his family. Based on my conversations with FBI agents conducting surveillance, I understand that Room 1728 appears to be a suite, whereas Room 1628 appears to be a standard room. 5 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 107 of 201 emails and text messages; download and run mobile telephone applications, including call and messaging application such as WhatsApp, Signal, and Dust; take, send, and receive pictures and videos save and store notes and passwords; and store documents. C. The Subject Offenses 5. For the reasons detailed below, I believe that there is probable cause to believe that the Subject Premises and Subject Devices contain evidence, fruits, and instrumentalities of violations of 18 U.S.C. 1005 (false bank entries), 1014 (false statements to a ?nancial fraud), and 1344 (bank fraud) (collectively, the ?Bank Fraud Offenses?), 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the i?Campaign Finance Offenses?), and 18 U.S.C. 371 (conspiracy as it pertains to the other- Subject Offenses) (collectively, the ?Subject Offenses?). D. Prior Applications 6. The FBI and the United States Attorney?s Office for the Southern District of New York have been investigating several courses of criminal conduct by Michael Cohen. Cohen is an attorney who currently holds himself out as the personal attorney for President Donald Trump, and who previously served for over a decade as an executive in the Trump Organization, an international conglomerate with real estate and other holdings. 7. In connection with an investigation then being conducted by- the Office of the Special Counsel the FBI sought and obtained from the Honorable Beryl A. Howell, Chief United States Districtlludge for the District of Columbia, three search warrants for emails and other content information associated with two email accounts used by Cohen, and one search warrant for stored content associated with an iCloud account used by Cohen. Speci?cally: 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 108 of 201 a. On or about July 18, 2017, the FBI sought and obtained a search warrant for emails in the account-@gmailcom (the ?Cohen Gmail Accorint?) sent or received . between January 1, 2016 and July 18, 2017 (the i'rst Cohen Gmail Warrant?). b. On or about August8, 2017, the FBI sought and obtained a search warrant for content stored in the iCloud account associated with Apple 113 _@gmail.com (the ?Cohen iCloud Account? and the ?Cohen iCloud Warrant?). c. On or about November 13, 2017, the FBI sought and obtained a search Account sent or received ?between June 1, 2015 and November 13, 2017 (the ?Second Cohen Gmail Warrant?). d. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the account?the ?Cohen 1VIDCPC or received between the opening of the Cohen Account4 and November 13, 2017 (the ?First Cohen Warrant?). 8. The SCO has since referred certain aspects of its investigation into Cohen to the USAO, which is working with the New York Field Of?ce. As part of that referral, on or about February 8, 2018, the SCO provided the USAO with all non?privileged emails and other content information obtained pursuant to the First Cohen Gmail Warrant, Second Cohen Gmail Warrant, and Cohen Warrant. On or about March 7, 2018, the SCO provided the USAO 4 Based on my review of this warrant and the affidavit in support of it, I know that the warrant did not specify a time period, but the af?davit indicated that, pursuant to court order, the service provider had provided non-content information for the Cohen Account that indicated that the account contained emails from the approximate period of March 2017 through the date of the warrant. 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 109 of 201 with all non?privileged content obtained pursuant to the Cohen iCloud Warrant.5 A ?lter team working with the SCO had previously reviewed the content produced pursuant to these warrants for privilege. 9. On or about February 28, 2018, the USAO sought and obtained search warrants for emails in the Cohen Gmail Account and the Cohen Account, among other accounts, sent or received between November 14, 2017 and February 28, 2018 (the ?Third Cohen Gmail Warran and the ?Second Cohen Warrant?). The content produced pursuant to these warrants is #subjectwtowaniongoing. reviewiorprivilegehy an SDNY ?lter team.6 10. The emails search warrants described above are referred to collectively as the ?Cohen Email Warrants.? 11. On or about April 7, 2018, the USAO and FBI sought and obtained a warrant for prospective and historical cellphone locatiOn information for Subject Device-1 and Subject Device-2. On or about April 8, 2018, the USAO and FBI sought and obtained authority to employ an electronic technique, commonly known as a ?trigger?sh,? to determine the location of Subject. Device?1 and Subject Device-2. II. Prob able Cause A. Overview 12. The United States Attorney? Of?ce for the Southern District of New York and FBI are investigating, among other things, schemes by Target Subject Michael Cohen to defraud multiple banks from in or about 2016 up to and including the present, and to make an illegal 5 The 800 had previously provided a subset of this non?privileged content on or about February 2, 201 8. 6 On or about February 28, 2018 and April 7, 2018, the USAO and FBI sought and obtained Rule 41 search warrants authorizing the search of emails and content obtained pursuant to previously issued warrants for additional subject offenses. 8 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 110 of 201 campaign contribution in October 2016 to then?presidential candidate Donald Trump. As noted, Cohen is an attorney who currently holds himself out as the personal attorney for President Donald Trump, and who previously served for over a decade as an executive in the Trump Organization, an international conglomerate with real estate and other holdings. 13. The investigation has revealed that Cohen has made af?rmative misrepresentations in and omitted material information from ?nancial statements and other disclosures that Cohen provided to multiple banks in connection with. a transaction intended to relieve Cohen of he. owed on taxi medallion loans from the banks. As set forth in detail below, in these financial statements, and in his oral and other written statements to these banks, Cohen appears to have intentionally misrepresented his ability to pay cash by failing to disclose cash he began receiving in 2017 from new consulting work; (ii) significantly understated his total holdings of cash and cash equivalents; failed to disclose tens of thousands of dollars he received in interest income, and (iv) failed to inform the banks from which he was seeking debt relief that he had agreed to make a $3.8 million cash payment to a third party,- - in connection wit- acquisition of the taxi medallions securing Cohen?s debt. By making these misrepresentations and material omissions, Cohen avoided making payments on his loans, and attempted to fraudulently induce the banks to relieve him of certain repayment obligations and personal guarantees that Cohen and his wife had signed. 14. Additionally, the investigation has revealed that shortly before the 2016 presidential election, Cohen made a payment of $130,000 from alimited liability corporation to Stephanie Clifford, an individual who is alleged to have had an extramarital affair with then?candidate Trump. This payment was made to Clifford in exchange for an agreement not to make any public disclosures about her alleged affair with Trump. As set forth below, there is 2017.08.02. Case Document 48-2 Filed 07/18/19 Page 111 of 201 probable cause to believe that Cohen made this payment to Clifford for the purpose of in?uencing the presidential election, and therefore that the payment was an excessive in?kind contribution to the Trump campaign. 15. Based on my review of emails obtained from the Cohen Email Warrants, information obtained pursuant to the iCloud Warrant, and documents produced pursuant to subpoenas, as well as my review of public sources, I have learned that Cohen has used the Subject Premises to receive documents related to the transaction intended to relieve Cohen of his taxi documents and/or conduct meetings related to his consulting work, (0) receive documents and/or conduct meetings relating to his ?nances and assets, some of which, as noted above and as detailed further herein, he has concealed ??om the banks in connection with the re?nancing of his taxi medallion debt, receive and send documents relating to his payment to Clifford, and house and operate electronic devices that were utilized in connection with, among other things, the taxi medallion transaction, Cohen?s consulting work, and his payment to Clifford. Speci?cally, as described below, Subject Premises~l likely contains evidence concerning Cohen?s taxi medallion loans, his negotiations with banks, his personal finances, his consulting work, his tax returns, and his payment to Clifford, as well as electronic devices containing such evidence, all of which constitute or contain evidence of the Subject Offenses. Additionally, as described below, Subject Premises?2 likely contains evidence relating to Cohen?s consulting work, his, finances, and his payment to Clifford, as well as electronic devices containing such evidence. I Subject Premises-3, as described below, likely contains evidence relating to Cohen?s assets and ?nances, including assets that may not have been disclosed to banks in connection with the re?nancing ?of Cohen?s taxi medallion debt or documents relating to such assets, and documents or evidence related to Cohen?s payment to Clifford. Subject Premises?4 likely contains electronic 10 2017.03.02 Case Do?ument 48-2 Filed 07/18/19 Page 112 of 201 devices, including Subject Device?l and Subject DeviCe?E, which themselves contain evidence of the Subject Offenses, including concerning Cohen?s taxi medallion loans, his negotiations with banks, his personal ?nances, his consulting work, his tax returns, and his payment to Clifford. Accordingly, and as set forth in more detail below, there is probable cause to believe that the Subject Premises and Subject Devices will include evidence of the Subject Offenses. B. Probable Cause Regarding Subjects? Commission of the Subject Offenses7 The Bank Fraud Scheme Cohen ?s Statements to Sterling National 343119. 16. As set forth in detail below, in 2014, Cohen, through LLCs controlled by him and his wife, Laura Cohen, entered into a series of loans from Sterling National Bank (?Sterling?) and the Melrose Credit Union C?Melrose?), secured by taxi medallions, for approximately $20 million. Though entered into by LLCs, the loans were also secured by personal guarantees in the names of both Cohen and his wife. Over time, as the taxi industry wealtened and the medallions lost value, Cohen sought to renegotiate the terms of those loans and/ or relieve himself from their obligations, including the personal guarantees. As part of that effort, Cohen made a series of representations to Sterling and Melrose about his net worth, assets, available cash and income, among other things. Speci?cally, based on my review of records maintained by Sterling and Melrose, and public sources concerning the taxi industry and the value of taxi medallions, as well as my participation in interviews with a Sterling executive vice?president (the ?Sterling Employee-1?) and two other 7 In the following recitation of probable cause, I frequently refer to phone calls or text messages involving Cohen. The text messages described herein as sent or received by Cohen were all sent or received from the telephone numbers associated with Subject Device-l or Subject Device~2. The vast majority of the phone calls described herein made or received by Cohen were made or received by the telephone numbers associated with Subject Device~1 or Subject Device-2, although in certain limited instances Cohen used a landline or other phone. 1 1 2017.03.02 Case Document 48-2 'Filed 07/18/19 Page 113 of 201 Sterling employees (?Sterling Employee-2? and ?Sterling Employee?3?), I have learned, among. other things, the following: a. Taxi medallions are small metal plaques af?xed to taxis. Without a medallion, it is illegal to operate a taxi in cities with medallion systems, such as New York City. Cohen and his wife own multiple LLCs that collectively. own 32 taxi medallions (each LLC owns two medallions).8 Cohen?s purchase of these New York taxi medallions was originally ?nanced by loans from Capital One bank, for which the medallions served as collateral. Cohen was not a taxi That third patty made, payments to Cohen, who in turn used some of those proceeds to make his loan payments to Capital One. b. In early 2014, Cohen became a customer of Sterling when he sought to. re?nance a mortgage on a rental property?that he owned. In or around April 2014, Cohen raised with Sterling the prospect of re?nancing his taxi medallion loans, which were then at Capital One. By in or about September 2014, Cohen began negotiating a lending transaction with Sterling that would allow Cohen to pay off his loans at Capital One and borrow more money from the then-increase in value of the medallions. According to Sterling Employee~1, in 2014, prior to the recent upheaval in the taxi industrye?as a result of the emergence of ride?sharing services, such as. Uberw?wtaxi medallion loans were Viewed by banks and investors as safe, short term credits, as the market value of taxi medallions was consistently rising. Consequently, taxi medallion loans??1ike the loans held by Cohen??were frequently. re?nanced at increasing amounts as the value of the medallions rose. According to Sterling Employee?1 borrowers typically cashed out the increase in the loan amount 3 One of these companies, Mad Dog Cab Corp., was jointly owned by Sondra Cohen, who I believe is Cohen?s mother. 12 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 114 of 201 and used the additional funds for other purposes. Cohen appears to have followed this approach in (2014, when he agreed to re?nance his medallion loans for approximately $22 million, which? according to letters from Capital One in Sterling?s ?les?was greater than his previous debt at Capital One Bank million, of which $14.6 million was a line of credit to Cohen). This allowed Cohen to cash out the proceeds from the transaction. - c. Based on my review of records maintained by Sterling, 1 have learned that on or about December 8, 2014, each of Cohen? sixteen taxi medallion LLCs entered into loan agreements the principal sum of $1,375,000, with repayment due on December 8, 2016. Each loan was signed by Michael or Laura Cohen, depending on who was the sole shareholder of the LLC. The address listed for each of the LLCS was the address for Subject Premises?l. The loans were also each secured by a security agreement, dated the same day, malcing the medallions collateral for the notes.- To give Sterling additional security, Michael and Laura Cohen signed personal guarantees and confessions of judgment, giving Sterling the right to pursue collection against the Cohens? personal assets were their corporations to default under the loan agreements. The personal guaranty agreements stated that the LLCs had of?ces at the address for Subject Premises-l, and contained a notice provision that stated that any notices required by the agreements should be mailed to Subject Premises-1. In total, Sterling agreed to lend approximately $22 million to the Cohens? companies. d. Pursuant to participation agreements, Sterling transferred 45 percent of Cohen?s taxi medallion debt to Melrose.9 9 Melrose, which had a business principally focused on taxi medallion loans, is now in conservatorship by the National Credit'Union Administration 13 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 115 of 201 e. In evaluating Cohen?s requested re?nancing of the taxi medallions, Sterling (and Melrose, consistent with its participation in the deal) conducted due diligence. .At Sterling?s request, Cohen provided Sterling with a statement of ?nancial condition, dated August 1, 2014 (the ?August 2014 Financial Statement?), which indicated that Cohen had $100,740,000 in total assets, $23,550,000 in total liabilities, and a net worth of $77,190,000.10 From my review of a Sterling credit memorandum, dated September 29, 2014, I know that Sterling viewed the transaction favorably because, accounting for loan payments, cash ?ows from the medallions were collateral (asestimated by Sterling) exceeded $42 million, and the net worth of Cohen?who was the direct obligor under the guarantee agreements-was over $77 million. An internal Sterling credit and risk rating analysis report, dated October 20, 2014, recommended approval of the loans for substantially the same reasons. f. Based on my review of records maintained by Sterling and public sources, I have learned that over time, the collateral backing Cohen?s loans (taxi medallions) lessened in value due to the rise in ride~sharing companies. Additionally, Cohen began falling behind on loan payments to Sterling and Melrose. 1 know from records maintained by Sterling and an interview with Sterling Employee-2 that, beginning in or around September 2015, Cohen told Sterling, in sum and substance, that the individual leasing Cohen?s medallions had fallen behind in making payments to Cohen, and that as a result, the cash ?ow from his taxi medallions had been reduced, leaving him with a shortfall of approximately $16,000 each month. For instance, I have reviewed an email from Sterling Employee?2, dated September 9, 2015, summarizing a call with Cohen?? which according to the email and toll records for Cohen?s cellphone occurred on September 8, 10 Cohen subsequently provided Sterling with a revised statement of ?nancial condition, also dated August 1, 2014, which reported assets of $99,420,000, total liabilities of $23,550,000, and a net worth of $75,870,000. 14 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 116 of 201 2015?during which Cohen told Sterling Employee?2, in sum and substance, about his cash flow problems and a shortfall of approximately $16,000. In that. same email, Sterling Employee?2 commented that despite Cohen?s statements, his personal ?nancial information ?indicate[d] a strong ability to make up the difference in payments.? Cohen, however, according to Sterling Employee?2, pushed the bank for a reduction in Cohen?s payments. . g. From my review of records maintained by Sterling and my participation in an interview with Sterling Employee?2, I have learned that Cohen and Sterling Employee-2 spoke 11, again- that during the call Cohen stated, in sum and substance, that the individual to whom Cohen leases the medallions had again reduced payments to Cohen. 1 know from my review of records maintained by Sterling that between in or about September 2015 and November 2015, Sterling raised the possibility?both internally and with Cohen?of Cohen posting his real estate holdings, personal residence, or some other collateral as additional security for the banks.11 According to these records, however, Cohen resisted these requests. From my review of loan documents and records maintained by Sterling, Iknow that in or about November 2015, as a result of Cohen?s representation that he was not earning suf?cient returns on his medallions to cover interest payments, Sterling and Melrose agreed to amend their loans with Cohen by, among other things, reducing the interest rate Cohen paid to Melrose and extending the loan maturity date to December 8, 2017. h. Iknow from interviews with Sterling Employee-1 and Sterling Employee?2, as well as emails have reviewed, that in or about October 2016, Cohen told Sterling Employee-l that Cohen had a potential buyer of his taxi medallions, named who agree ?50 11 Based on my review of property records, I know that on or about October 28, 2015, around the time period when Sterling raised the possrbility of Cohen posting his personal residence? Subject Premises?l?as collateral, Cohen transferred Subject Premises?1 into a trust; 15 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 117 of 201 assume Cohen?s debt with Sterling and Melrose. Based on my review of records maintained by Sterling, as well as the interviews with Sterling Employee-1 and Sterling Employee?2 referenced above, I know that by or before October 20 l6, Cohen had entered into negotiations tosell his sixteen corporate taxi medallion entities to? for the balance of the loans, which at the time was $21,376,000. I know from my review of records maintained by Sterling, and my participation in an interview with Sterling Employee-2, that as a condition of the transfer of the medallion loans#and because Sterling was unfamiliar with - that Cohen makea substantial principal payment on the loan, of approximately one million dollars, prior to the transfer. Cohen rejected this request initially. But on or about January 3 1, 2017, Cohen told Sterling Employee?1, in sum and substance, that he would make a one million dollar principal reduction payment in order to move forward with the medallion transfer deal with - Indeed, in an email sent by Cohen to Sterling Employee?2 on or about February 22, 2017, Cohen con?rmed that he ?agreed to pay down 1 million from the loan amoun i. Pursuant to the participation agreements between Sterling and Melrose, Sterling was required to secure Melrose?s agreement to participate inthe transfer of the taxi medallion debt from Cohen to_ On or about April 17, 2017, Sterling sent a memorandum to Melrose summarizing the terms of the proposed transaction, and noting the requirement that Melrose agree to the terms. On or about May 2, 2017, Sterling Employee?1 told that Melrose had agreed to the deal in principle, and that Sterling would be sending the parties a term sheet shortly. j. In order for the banks to conduct diligence and evaluate the proposed transaction fully, they requested financial information from the parties. On or about June 7, 2017, Sterling 16 2017.08.02 Case Document 48-2 iFiIed 07/18/19 Page 118 of 201 Employee?1 emailed Cohen to request an ?updated personal ?nancial statement,? completed jointly with Cohen?s wife, and Cohen?s most recent federal income tax return. On or about June 8, 2017, Cohen emailed Sterling Employee?1 a Sterling personal ?nancial statement form that had been ?lled out by hand, which referenced a statement of ?nancial condition, dated May 1, 2017 (the ?May 2017 Financial Statement?) that was also attached. The May 2017 Financial Statement included a cover letter from Cohen? accountant, Jeffrey Getzel, stating, in sum and substance, that the information in the statement came from Cohen and that Getzel had not con?rmed its accuracy wLMW-wee? Statement stated that Cohen had total assets of $41,955,000, total liabilities of $39,130,000, and a net worth of $2,825,000. The May 2017 Financial Statement indicated that Cohen?s assets were comprised of $1,250,000 in cash, $26,155,000 in closely held companies (such, as the taxi medallion entities and his real estate holdings), $3,200,000 in real estate investments, and his $11,000,000 personal residence.12 k. Based on my review of reports of law enforcement interviews of Sterling Employee?1,1 have learned that Sterling Employee?1 reviewed the May 2017 Financial Statement with Cohen to, among other things, verify its accuracy, and Sterling Employee~1 asked Cohen about speci?c line items on the ?nancial statement, including the cash amount, value of medallions, and total liabilities. Cohen stated to Sterling Employee?1, in sum and substance, that the May 2017 Financial Statement was accurate. 1. On or about August 16, 2017, Sterling Employee-1 emailed Cohen 211.1(- -attaching a non?binding term sheet memorializing the potential transaction between 19? Based on my review of Cohen?s ?nancial statements, I know that the precipitous decline in assets from his 2014 ?nancial statement to his 2017 financial statements can be explained primarily by reported depreciation in the value of Cohen?s real estate assets and medallion investments. 17 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 119 of 201 Sterling, Melrose, Cohen, and_ The term sheet included a cover letter addressed to Cohen at Subject Premises-l. The parties negotiated the provisions of the term sheet and, on or . about September 5, 2017, Sterling Employee-1 sent _.1d Cohen a copy of the executed term sheet. According to the term sheet?would borrow $20,000,000 from Sterling and Melrose, to be secured by the medallions that _vas to acquire from Cohen. m. As part of the agreement, according to the term sheet, $1,265,913 in principal (which on the outstanding loan balance) Would be repaid by Cohen and the two banks, with Cohen paying ?fty percent and the banks dividing the remaining half of the balance. Based on my review of an internal Sterling credit memorandum, dated October 4, 2017, the parties reached a preliminary agreement that Cohen would pay $632,956 of the remaining $1,265,912 principal loan balance, and Sterling and Melrose would absorb $357,167 and $275,7 89, respectively, in the form of charge-offs. According to Sterling Employee- 1, Sterling was willing to divide the repayment of the outstanding principal balance?despite its prior insistence that Cohen make a principal pay?down of at least one million dollars?because Cohen represented on a telephone call with Sterling Employee?1, in sum and substance, that he had insuf?cient liquidity to pay the full outstanding principal balance. As part of the agreement, Sterling and Melrose also agreed to relieve Cohen and his wife oflthe personal guarantees that they made on behalf of the LLCs. Thus, after completing the '_ransaction, Cohen would no longer have had any outstanding obligations to Sterling or Melrose. . n. Based on my review of emails sent by Sterling employees, I have learned that because the transaction between the parties was subject to full credit underwriting by Sterling and Melrose (as well as Melrose?s regulators at NCUA), in August and September 2017, Sterling I 18 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 120 of 201 required and requested additional ?nancial statements and tax returns for Cohen an:- for its credit underwriting process. In response to Sterling?s requests, on or about September 25, 2017, Cohen emailed Sterling Employee~2 a copy of his 2016 tax return. The tax return listed Cohen?s mailing address as Subject Premises-1. Additionally, on or about October 5, 2017, Cohen re~sent Sterling Employee-2 a copy of his May 2017 Financial Statement. A day later, on October 6, 2017, Cohen emailed Sterling Employee-2 a statement of ?nancial condition, dated September 30, 2017 (the ?September 2017 Financial Statement?). September 2017 Financial Statement included a cover letter from Jeffrey Getzel, Cohen? accountant, stating, in sum and substance, that the information inthe statement came from Cohen, and that Getzel had not con?rmed its accuracy or completeness. The September 2017 Financial Statement stated that Cohen had total assets of $33,430,000, total liabilities of $45,630,000, and a negative net worth of $12,200,000.13 Notably, unlike Cohen?s May 2017 Financial Statement, the September 2017 Financial Statement represented to Sterling that Cohen had a negative net worth. The September 2017 Financial Statement indicated that Cohen?s assets were comprised of $1,250,000 in cash, $17,630,000 in closely held companies (including the taxi medallion entities and his real estate holdings),14 $3,200,000 in real estate investments, and his $11,000,000 personal residence (which, for the ?rst 13 Based on my review of Cohen?s financial statements, I know that this further decline in assets can be explained primarily by reported depreciation in the value of Cohen?s real estate assets and medallion investments. 14 Notably, the September 2017 Financial Statement valued each of Cohen?s thirty-two New 1 York taxi medallions at approximately $180,187.50, which was considerably less than the $650,000 valuation ascribed to each medallion in the Cohen. ':erm sheet. 19 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 121 of 201 time, he indicated was held by a trust).15 The September 2017 Financial Statement included assets and liabilities not held in Cohen?s name, such as various entities associated with his taxi medallions and some of his real estate investment entities. p. From my participation in an interview with Sterling Employee-2, and my review of records maintained by Sterling, I have also learned that around the time Cohen provided Sterling with these ?nancial statements-Le, in or around September 2017??Cohen stopped paying loan payments on his taxi medallion loans altogether. According to Sterling Employee- wag? Cohen?informed.Sterling, in sumandsubstance. that he had insuf?cient funds to pay the principal and interest payments on his medallion loans. By in or about December 2017, Sterling and Melrose had not been paid approximately $276,937.92 in principal and interest payments on the medallion loans. Based on Cohen?s financial condition as conveyed in the September 2017 Financial Statement, and his delinquency in making payments to Sterling, among other things, the bank?s credit underwriting committee determined (and memorialized in a December 2017 memorandum) that the was favorable for the bank that is, that -.vould be a better borrower than Cohen. (1. On or about December'26, 2017, Sterling sent Cohen a demand letter requesting the immediate receipt of past?due loan payments. The demand letter was addressed to Cohen at SubjectPremises?l. On December 29, 2017, Sterling sent Cohen a letter stating that he was in default under the loans between Sterling and Cohen?s medallion corporations. The notice of default was addressed to Cohen at Subject Premises-1. Cohen did not make an immediate payment on the loans, but instead Sent an e?mail to Sterling Employee-1 on or about January 24, 2018, 15 Based on my review of property records maintained by the City of New York, and my participation in an interview with Getzel, I know that in 2015, Cohen transferred his residence to a trust. He did not disclose that transaction to Getzel or Sterling until in or about September 2017. 20 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 122 of 201 stating that during the closing of the Coher-Iansaction, Cohen would ?bring all payments up to date as well as deposit the payoff differential.? Cohen also requested by email on ransaction, Sterling provide a letter January 24, 2018, that at the closing of the Cohen- stating that all of Cohen?s debts have been satis?ed and that Cohen?s personal guarantees of the medallion loans had been terminated. r. The Cohen~-ransaction, however, did not close. On or about January 29, 2018, the- attorney emailed attorneys for Sterling and stated that ?at this time there is no deal with Michael Cohen. Some of the numbers have changed and we are not prepared - to go forward.? s. Based on my participation in the interview with Sterling Employee-2 and my review of records maintained by' Sterling, I know that after the Cohen~-ieal fell apart, Sterling assigned Cohen?s loans to Sterling Employee?3, who specializes in collecting on defaulting loans. From my participation in an interview with Sterling Employee~3, my review of telephone call notes taken by Sterling Employee?3, and my review of telephone records, I know that Sterling Employee-3 spoke several times to Cohen on or about January 3 0, 2018 about paying down and/or restructuring Cohen?s outstanding taxi medallion loans. On the calls, which in total lasted more than an hour, Cohen stated in sum and substance that he did not have more than $1,250,000 to pay toward the medallion loans. On the call, in the course of reviewing the failed Cohen-- transaction, Sterling Employee-3 questioned Cohen about the price -was to have paid for each medallion, and whether there was a side agreement between Cohen and - Cohen denied that there was any side agreement with- 1 t. On or about January 31, 2018, Cohen emailed Sterling Employee?3 and proposed paying $500,000 to bring the loans current and $750,000 to bring the principal balance to 21 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 123 of 201 $20,500,000. Cohen also suggested revised interest payment amounts. The signature block on the email indicated that Cohen?s address was the address for Subject Premises?2. On or about Janualy 31, 2018, Sterling Employee-3 responded to Cohen and stated, in sum and substance, that Cohen would need to pay the entirety of the overdue payments and pay down the principal balance of the loan to $20,000,000 (in total, a payment of approximately $1,750,000), and would need to make larger interest payments. u. On or about February 1, 2018, Cohen emailed Sterling Employee-3 and proposed 5f[p]ayment of $1.250m which ALL can be used to pay down principal, if [Sterling] will waive past due amounts,? but stated do NOT have more than the $1.250m.? (Emphasis in original.) Cohen also stated, in sum and substance, that he had insufficient financial resources to post additional collateral or pre-fund payments. The signature block on the email indicated that Cohen?s address was the address for Subject Premises?2. Based on my participation in an interview with Sterling Employee?3, I have learned that since January 30, 2018, Sterling has continued to renegotiate the medallion loans with Cohen based on Cohen?s representations about his current financial position. In particular, according to Sterling Employee-3, Cohen and Sterling have an agreement in principal to restructure Cohen?s loans based in part of Cohen?s agreement to make a principal payment of approximately $750,000, to make a payment of $500,000 to become current on interest payments, and to post $192,000 in cash collateral for his future payments on the loan. Cohen also agreed to pledge an interest he had in a property. Sterling Employee?3 has stated that had Cohen indicated he had more than $1,250,000 available to him, Sterling would have, among other things, negotiated for a larger reduction to the principal amount of the loan. . 22 2017.08.02 which he did not disclose to Sterling. up these Case Document 48-2 Filed 07/18/19 Page 124 of 201 (ii) Cohen Made Material Misrepresentations About is Finances to Banks Cohen Concealed from Sterling and Melrose Cash Derived from Consulting Work 17. As set forth in detail below, despite multiple written and oral representations by Cohen to Sterling (and, by extension, Meh'osel?) that he had insuf?cient funds to pay down the principal balance of the medallion loans, make rinterest payments, or pay past-due amounts, it appears that between 2016 and the present, Cohen opened and maintained bank accounts at First Republic Bank (?First Republic?), and then received millions of dollars in accounts and received these funds during the very period in which he made disclosures to Sterling about his personal ?nances (including his assets and liabilities) and his ability to make payments on the medallion loans. Inthese disclosures to Sterlingw?and despite being asked about these bank accounts by his accountant??Cohen misled the bank by claiming he had insuf?cient liquidity to I satisfy his obligations or meet the bank?s demands, while withholding information about these ongoing revenue streams and liquid financial assets at First Republic. 18. ?Speci?cally, based on my review of documents and bank records produced pursuant to a subpoena by First Republic, and my participation in and review of reports of interviews with aFirst Republic sales manager (?FirstRepublic Employee?l?) and a First Republic senior managing director (?First Republic Employee?2?), I have learned, among other things, the following: ?6 Based on my review of a report of an interview conducted with an employee of Melrose, I have learned that, pursuant to the participation agreement between Sterling and Melrose, Cohen?s ?nancial statements and other records in Sterling?s possession were forwarded to Melr?se so that Melrose could make a determination as to whether to approve of the CohenJ transaction. Based on my review of reports of interviews with Melrose employees, I also know that Cohen called employees at Mehose regarding the Cohen :ransaction. 23 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 125 of 201 a. Cohen and his Wife have been. customers of First Republic since approximately June 2011. Cohen controls several checking and loan accounts at First Republic, some in his own name and others in the names of corporate entities. According to First Republic?s know-your? customer records on Cohen? his primary physical address is the address for Subject Premises?1. On or about October 26, 2016, in Manhattan, New York, Cohen opened a new checking account at First Republic in the name of Essential Consultants LLC (the ?Essential Consultants Account?). Cohen was the only authorized signatory on the account. According to account opening documents, the primary address for Essential Consultants LLC was the address for Subject Premises~1. When Cohen opened the Essential Consultants Account, First Republic Employee-1 conducted an in?person interview of. Cohen. In response to a series of know-your? customer questions about the purpose of the account??the answers to which First Republic - Employee-1 entered into a formlS?Cohen stated, in sum and substance, that he was opening Essential Consultants as a real estate consulting company to collect fees for investment consulting work, and all of his consulting clients would be domestic individuals based in the United States. Cohen also stated,'in sum and substance, that his purpose in setting up the account was to keep the revenue from his consulting business?~which he said was not his main source of incomew?separate from his personal finances. As set forth below, there is probable cause to believe that Cohen?s statements about the intended purpose of the account and source of funds for the account were false. Speci?cally, as described below, the account was not intended to receive?and does not 17 Certain ?nancial institutions are required to conduct such procedures pursuant to the Bank Secrecy Act and its implementing regulations. See 31 U.S.C. 5318; 31 C.F.R. 1020.220. 13 First Republic Employee~1 ?rst ?lled out the form on the day he interviewed Cohen, October 26, 2016. On or about December 19, 2016, at the request of bank compliance personnel, First Republic Employee?1 updated the form to add more detail about Cohen?s statements. 24 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 126 of 201 appear to have received?money in connection with real estate consulting work; in addition, the? account has received substantial payments from foreign sources. 0. I know from my review of First Republic bank records that were scheduled by an FBI forensic accountant that after Cohen opened the Essential Consultants Account, Cohen received payments into that account from foreign businesses and entities that do not re?ect the stated client pro?le for the residential and commercial real-estate consulting services. Speci?cally, from my review of the Essential Consultants Account schedule and public sources, I know the foll'OWing. Beginning on or about January 31, 2017, Cohen began receiving payments of $83,333 into the Essential Consultants Account from an entity called Columbus Nova LLC. According to public sources, Columbus Nova is an investment management ?rm controlled by Renova Group, an industrial holding company based in Zurich, Switzerland that is controlled by Russian national Viktor Vekselberg. From January 2017 to August 2017, the Essential Consultants Account received seven payments totaling $583,332.98 from Columbus Nova LLC. ii. Beginning on or about April 5, 2017, the Essential Consultants Account began receiving payments from Novartis Investments, SARL, which I believe to be the in?hcuse ?nancial subsidiary of the Swiss pharmaceutical company Novartis International AG (?N0vartis?). . Between April 2017 and February 2018, the Essential Consultants Account received eleven Wire payments from a Swiss bank account held in the name of Novartis, each in the amount of $09,980, for atotal of $1,099,780. Beginning in or about April 2017, the Essential Consultants Account started receiving wire payments from a bank account associated with the telecommunications company- Inc. Speci?cally, on or about April 14, 2017, sent $100,000 to the 25 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 127 of 201 Essential Consultants Account and, from in or about June 2017 to in or about January 2018, the Essential Consultants Account received ten $50,000 payments from In total, sent $600,000 to the Essential Consultants Account. iv. On or about May 10, 2017, June 9, 2017, July 10, 2017, and November 27, 2017, the Essential Consultants Account received four deposits in the amount $150,000 (totaling $600,000) from a bank account in South?Korea. The account holder from which the money was sent is Korea Aerospace Industries Ltd. KAI is a South Korea?based company that produces and sells ?xed?wing aircraft, helicopter aircraft, and satellites to the United States Department of Defense, among other customers. . v. On or about May 22, 2017, the Essential Consultants Account received a $150,000 deposit from an account at Kazkommeitsbank, a Kazakhstani bank. The listed account holder at Kazkommertsbank was a second Kazakhstani bank named BTA Bank, A0. A message accompanying the wire payment indicated'that the payment was a consulting fee as per Inv DD May 10, 2017 consulting agreement WIN DD 08 05 2017 CNTR 08/05/2017.? vi. Initotal, from on or about January 31, 2017 to on or about February 1, 2018, the Essential Consultants Account received approkimately $3,033,112.98. in transfers and checks from the aforementioned entities. As of on or about January 10, 2018, the balance in the Essential Consultants Account was $1,369,474.23. Cohen?s withdrawals from the Essential Consultants account reveal that it was used for largely personal purposes, including to pay, among other things, American Express bills and fees from ?the Core Club,? a private social club in New York. I d. On or about April 4, 2017, Cohen opened another new checking account at First Republic, this one in the name of Michael D. Cohen &'Associates, PC. (the Account?). 26 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 128 of 201 Cohen was the only authorized signatory on the account. According to account opening documents, the p11ma1y address for Account was the address for Subject Premises?1. Among other things, the Account received ten wire transfe1s and one check fiom an account in the name of Squire Patton Boggs, a law firm. As noted above, Subject Premises?2 is located inside the New Yo1k office of Squire Patton Boggs. In total, from on or about April 5, 2017, to on or about January 2, 2018, the Accountieceived $426, 097.70 in deposits, and the balance in the account as of January 2, 2018, was $344,541.35. As discussed below, Cohen Consultants or accounts ?to Sterling during the negotiations with respect to the-:ansaction or the subsequent loan re?nancing negotiations, including Financial Statement. in his May 2017 Financial Statement and September 2017 19. Based on my review of emails that were seized pursuant to the Cohen Email Warrants, and my review of reports of interviews with employees of and Novartis, it appears that the aforementioned payments to the Essential Consultants Account and Account were for political consulting work, including consulting for international clients on issues pending before the Trump administr ation. pecifically, from my review of emails from the Cohen Gmail Account, the Cohen Account, and public sources, I have learned the following: a. On or about April 28, 2017, Cohen sent an email to an individual whom I believe is af?liated with KAI. In the email, Cohen attached a ?Consulting Agreement? between KAI and Essential Consultants dated as of about May 1, 2017. The agreement indicates that Essential Consultants had the address of Subject Premisesn2. The document indicates that Essential Consultants would render ?consulting and advisory services, as requested? by KAI, and that KAI would pay Essential Consultants ?a consulting fee of One Million Two Hundred Thousand 2017.08.02 27 Case Document 48-2 Filed 07/18/19 Page 129 of 201 US Dollars,? disbursed through eight $150,000 installments between May 2017 and December 2017. 1 have also reviewed invoices in amounts of $150,000 that Cohen emailed to an individual whomI believe is af?liated with KAI. At the top of the invoices the address listed for Essential Consultants is the address for Subject Premises~2. b. On or about May 8, 2017, Cohen sent an email to an individual whom I believe is af?liated with BTA Bank. The signature block on Cohen?s email listed ?Essential Consultants and ?Michael D. Cohen Associates, and provided the address for Subject Premises~ Zilnithete'm'ailj" between BTA Bank and Essential Consultants dated as of about May 8, 2017. The agreement indicates that Essential Consultants had the address of Subject Premises?2. The document indicates that Essential Consultants would render ?consulting and advisory services? to BTA Bank, and that BTA Bank would pay Essential Consultants ?a consulting fee of One Million Eight Hundred Thousand US Dollars,? disbursed through payments of $150,000. On or about May 10, 2017, Cohen sent an email to an employee of BTA Bank, and attached to the email an invoice to BTA Bank in the name of Essential Consultants, with the address of Subject Premises~ 2. The invoice contemplated a $150,000 payment to Essential Consultants for a consulting fee.? 0. On or about January 23, 2017, Cohen appears to have entered into a consulting agreement with which contemplates that Essential Consultants ?shall render consulting and advisory services to and that would ?advise Essential Consultants] of those issues and matters with respect to which Services desires [Essential Consultants]?s assistance and advice.? The agreement indicates that Essential Consultants had the address of Subject Premises~ 1. The contract calls for ?to pay the Consultant for his services . . . a consulting fee of Fifty 28 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 130 of 201 Thousand ($50,000) Dollars . . . per month.? Based on my review of reports of interviews with employees, I have learned that retained Cohen to consult on political issues, including net neutrality, the merger between and Time Warner, and tax reform. d. On or about March 1, 2017, Cohen appears to have entered into a contract between Novartis and Essential Consultants, which provides that Essential Consultants will ?provide consulting and advisory services to Niovartis on matters that relate to the repeal and replacement of the Affordable Care Act in the US and any other issues mutually agreeable to Essential for a ?consulting fee of One Million Two Hundred Thousand ($1,200,000) US dollars,? to be paid to Essential Consultants in equal installments over the course of a year. Based on my review of reports of interviews with Novartis employees, I have learned that Novartis retained Cohen to provide political consulting services and to gain access to relevant policymakers in the Trump Administration. e. In or about February 2017, Cohen began negotiating the terms of a ?strategic alliance.? with Squire Patton Boggs. On or about March 4, 2017, Squire Patton Boggs emailed Cohen a ?strategic alliance agreemen Under the terms of the agreement, Cohen agreed to generate business for the law ?rm, and Squire Patton Boggs agreed to pay to Cohen ?an annual strategic alliance fee of $500,000, payable in twelve (12) equal installments.? Squire Patton Boggs also agreed to provide Cohen with ?dedicated and segregated of?ce space in [Squire Patton Boggs?s] New York and Washington DC. of?ces, which of?ce space shall be physically separate from [Squire Patton Boggs?s] of?ces and have locked doors and its own locked ?le cabinets.? On or about April 3, 2017, Squire Patton Boggs announced on its website that is had tormed a ?strategic alliance? with Michael D. Cohen 85 Associates and would ?jointly represent clients.? 29 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 131 of 201 20. Despite the signi?cant amount of money that Cohen received into the Essential Consultants Account and the Account, and the cash balance in both accounts, Cohen did not disclose that information to Sterling or Melrose. Speci?cally, based on my review of documents provided by Getzel (as noted above, Cohen?s accountant at the time), my participation in an interview with Getzel, and my review of notes and a? I have learned the following: a. In or about May 2017, Getzel. met with Cohen at Subject Premises?2. At the Getzelrin sum..andsubstance,..that he had set up a law practice called Michael D. Cohen Associates P.C., and a consulting company called Essential Consultants LLC. Cohen told Getzel, in sum and substance, that he expected to earn $75,000 per month in connection with his law practice, and that he expected gross revenues for the consulting business to be between ?ve and six million dollars annually. b. In or about October 2017, if not earlier, Getzel was preparing a personal ?nancial statement for Cohen. On or about October 6, 2017, Getzel sent an email to Cohen in which Getzel wrote that ?[a]ttached is a draftSeptember 30, 2017? and attached a draft of the September 2017 Financial Statement. The draft statement re?ected that as of September 30, 2017, Cohen had only $1,250,000 in cash, total assets of approximately $33,430,000 (comprised of taxi medallion interests, real estate interests, and his personal residence and property), and liabilities of approximately $45,630,000, leaving him purportedly over $12 million in debt. Inthe same email, Getzel questioned Cohen, in sum and substance, about the fact that the ?nancial statement did not list any value associated with either the Essential Consultants Account or the MDCELA Account: did not add any value for you[r] two operating entities Michael D. Cohen Associates 30 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 132 of 201 POC [sic] and Essential Consultants LLC. Please advise whether or not these should be disclosed and what value.? c. On or about October 6, 2017, Cohen called Getzel by telephone??which is re?ected on toll records for Cohen?s cellphone?and told Getzel, in sum and substance, not to include Essential Consultants or in the September 2017 Financial Statement because they had no value. On or about October 6, 2017, following the call with Getzel, Cohen, using the Cohen Account, responded to Getzel?s email with the answer ?[l]ooks good to me.? Cohen never directed Getzel to make any September 2017 Statement, In a letter dated October 6, 2017, addressed to Getzel, Cohen stated, have reviewed the attached statement of ?nancial condition and ?nd it to be correct and consistent with the representations that I made to your ?rm. The attached is an accurate re?ection of my assets, liabilities and net weith (de?cit) as of September 30, 2017.? Attached to that letter was the September 2017 Financial Statement, which, as noted above, was then transmitted to Sterling in connection with the proposed taxi medallion transaction between Sterling, Cohen, and- 21. Based on my review of a report of an interview with Sterling Employee?1, I have learned that Cohen did not disclose his income stream from Essential Consultants to Sterling Employee-1 or, to his knowledge, anyone else at Sterling. According to Sterling Employee?1, knowledge of such an income stream would have affected Sterling?s demands during the negotiations, particularly with respect to the amount of a principal paydown of Cohen?s debt. Cohen Understated His Available Cash . 22. In addition to withholding the existence of his Essential Consultants income from Sterling and Melrose, it appears that Cohen also substantially understated his available cash and cash equivalents in his ?nancial disclosures. Speci?cally, I know from my review of the September 3 1 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 133 of 201 2017 Financial Statement that Cohen provided to Sterling that Cohen represented that he had $1,250,000 in cash as of September 30, 2017. I also know that on or about January 30, 2018, in a telephone call with Sterling Employee-3, and on February 1, 2018, in an email to Sterling Employee?3, Cohen represented that he did not have more than $1,250,000 in cash. But, from my review of a summary of bank records that Were scheduled by forensic accountants, I have learned that Cohen had approximately $5,000,000 in cash and cash equivalents as of September 30, 2017. Additionally, as of February 1, 2018, Cohen had approximately $6,000,000 in cash and cash from-my-rev-iew- ofthe and bank records, 1 haye learned the following: a. Cohen has three checking and/0r savings accounts at Capital One Bank, one of which is in his wife?s name. As of September 30, 2017, Cohen had $1,105,680.35 in his savings account, and $1,262,982.29 in total in the three accounts at Capital One Bank. As of February 1, 2018, Cohen had a total of $1,389,245.78 in these accounts. b. Cohen has three accounts at Morgan Stanley in his name. As of September 30, 2017, the combined total in cash and cash equivalents in those three accounts was $1,270,600.41. As of February 1, 2018, Cohen had $1,284.996.13 in these accounts. 0. As of September 30, 2017, Cohen had $260,689.18 in an account at Signature Bank. As of ebruary 1, 2018, Cohen had $261,517.55 in this account. I i d. In addition to the Essential Consultants Account and Account at First Republic, Cohen also had two joint checking accounts with Laura Cohen at First Republic. In total, as of September 30, 2017, Cohen had at least $1,876,209.27 in total in his four accounts at First Republic. As of February 1, 2018, Cohen had $3,332,992.95 in these accounts. 32 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 134 of 201 e. Cohen has an account at Bethpage Credit Union with $25,931.39 in it as of September 30, 2017. f. As of September 30, 2017, Cohen had $17,542.54 in accounts at Sterling. g. Cohen has two accounts at TD Bank?one in his name and one held jointly with his wife. Cohen also has a safety deposit box at TD Banks?Subject Premises-3. The safety deposit box was opened on December 13, 2017 in the names of Michael and Laura Cohen. h. Intotal, as of September 30, 2017, Cohen had at least $4,713,935.08 in his accounts .CitwaationalBanlg?wignature Bank, Sterling BanigBethpage Credit Union, First Republic, and Morgan Stanley. As of February 1, 2018, Cohen had $6,268,732.59 in his accounts at Capital One Bank, City National Bank, Signature Bank, First Republic, and Morgan Stanley.19 23. Accordingly, based on the foregoing, it appears that Cohen?s written and oral representations to Sterling and Melrose that he did not have more than $1,250,000 were false, and that Cohen withheld information regarding approximately $5 million in funds from Sterling and Melrose in order to secure favorable terms in his renegotiation of his medallion loan. Based on my participation in an interview with Sterling Employee?2, and my review of reports of interviews with Sterling Employee?1 and two Melrose employees, it is my understanding that that Sterling and Melrose would View Cohen?s understating of his assets as material to its decision whether to renegotiate Cohen?s medallion loans and on what terms, or to its decision whether approve of the transfer of those loans to- 19 Based on my review of the account schedules described above, I know that, as of the date of this af?davit, the account balances for TD Bank have not yet been included in the schedule for either date and the account balances for Sterling National Bank and Bethpage Credit Union have not yet been included in the schedule for February 1, 2018. Thus, to the extent that these accounts have positive balances, Cohen?s total balances in fact were even higher on these dates. 33 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 135 of 201 Cohen Has Unreported Interest Income 24. It appears that Cohen also hid from Sterling interest income that he was receiving in connection with a six million dollar loan he made to another individual. Speci?cally, I know from my review of the May 2017 Financial Statement and September 2017 Financial Statement that Cohen provided to Sterling that Cohen did not disclose that he had made a note receivable in the amount of approximately $6 million, or that he was earning approximately $60,000 per month in interest income in connection with that loan. But, from my review of a summary of bank records that were reviewed by another law enforcement agent, my review of property records and documents obtained pursuant to the Cohen Email Warrants, and my participation in an interview with Getzel, I have learned the following: a. Based on my review of property records, I have learned that on or about March 12, 2012, Cohen agreed to lenc? approximately $2,000,000.20 It appears that the promissory note was unsecured by any real property. On or about April 28, 2014, Cohen am-amended the promissory note, and restructured the loan to increase the principal amount to approximately $5,000,000. Under the terms of the amended promissory note, the loan was secured by-ipartment in Sunny Isles Beach, Florida. On or about April 8, 2015, Cohen and -'estated the promissory note to increase the principal amount to $6,000,000.21 b. Based on my review of a copy of the restated note, which was obtained pursuant to the Cohen Email Warrants, I have learned that under the terms of the amended and restated 2.0 I learned from Getzel that? 21 The note states that the loan is husband and wife, jointly and severally. For ease of reference, I refer simply to -Lerein. 34 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 136 of 201 promissory note, Cohen?s loan tc-is an interest?only loan, and that the principal balance of the loan bears interest at an annual rate of 12.25 percent. I also know that the amended and restated promissory note includes a schedule of payments that require -) pay Cohen approximately $61,250 per month beginning in April 2015 and ending in April 2019. The note also requires thai-epay the principal balance of $6,000,000 on April 28, 2019. c. Based on my review of bank. records, I have learned that, consistent with the terms of the amended and restated promissory note,-1as made payments of review of records maintained 7 by Capital One Bank, I have learned that from April 2015 to October 2015, Cohen received checks from an entity called ?:otaling $61,250 per month, which he deposited into his personal bank account at Capital One Bank.22 It appears from my review of bank records and public sources that-Ls the owner of From my review of recordsmaintained by Capital One Bank, Ihave also learned that since October 2015, Cohen has received checks from an entity called 1? totaling $61,250 per month, which he deposited into his personal bank account at Capital One Bank. It appears from my review of bank records and public sources that-is also the owner of In total, it appears that Cohen receives approximately $73 5,000 per year in interest payments from- d. Based on my review of Cohen?s May 2017 and September 2017 Financial Statements, my review of his 2015 and 2016 tax returns obtained via subpoena and from the Cohen Email Warrants, and my participation in an interview with Getzel, I have learned that Cohen did 22 In April 2015, Cohen reWe?ve-d a pro?rated payment. For all months thereafter, the total payment equaled $61,250, but often made the payment in multiple checks. 3 5 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 137 of 201 not disclose this interest income he was receiving fror-:o Sterling or Melrose, or list it on his tax. returns. I have also learned that while this interest income is taxable, Cohen did not tell Getzel?his accountant?about the income, and Getzel only learned about the income because he began doing-taxes in 2017.23 25. Accordingly, based on the foregoing, it appears that Cohen?s representations to Sterling and Melrose that he did not have more than $1,250,000 were false, and that Cohen - withheld information relating to the interest income he is receiving from -in order to secure favorable terms in his renegotiation of his medallion loan. Cohen Had a Side Agreement With 26. As set forth in detail below, during the course of Cohen?s negotiations to sell his interest in taxi medallions and the associated debt to Cohen not only misrepresented his ?nancial position to Sterling, but also failed to disclose a side agreement he had negotiated with -t appears tha-Lgreed to pay an above?market price for Cohen?s taxi cab medallions, and in exchange, Cohen agreed to pay - approximately $3 .8 million in cash. Speci?cally, from my review of documents produced pursuant to a subpoena by Sterling, and my participation in interviews with Sterling Employee-1, Sterling Employee?2, and Sterling Employee?3, I have learned, among other things, the following: a. On or about September 5, 2017, an enecuted term sheet was circulated by Sterling Employee~l to Cohen and- The term sheet listed Cohen?s address as the address for Subject Premises?1. According to the term borrow $20,000,000 ??om Sterling and Melrose, to be secured by the medallions tha-was to acquire from 23 Accordingly, this interest income?which should have been reported as such on Cohen?s tax A returns?is included herein in calculations of Cohen?s true cash position. 36 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 138 of 201 Cohen. At'a price of $20 million for thirty-two taxi medallions, the proposed transaction valued each medallion as worth $625,000. The term sheet also contemplated a $1,265,913 pay-down of the principal balance of the loan. The term sheet made no mention of a 8 million payment from Cohen to '-3r any other form of payment or ?nancial transaction between the parties. b. Additionally, an internal Sterling credit memorandum, dated October 4, 2017, describing the terms of the Cohen?_zransaction and the new loan to_did not mention any payments from Cohen to _including a $3.8 million payment. The memorandum also a purchase price per medallion? but ?it is recognized that this is not in line with current market values.? Indeed, according to an internal Sterling memorandum dated February 5, 2018, in the month of January 2018,taxi medallions sol'dfor amounts ranging from $120,000 to $3 72,000. According to Sterling Employee?1 and Sterling Employee-2, they were never told that ?-agreed to a purchase price of $625,000 in exchange for a lump sum payment from Cohen, or that Cohen would make anypaymentto- c. On or about January 30, 2018, Sterling Employee?3 asked Cohen whether Cohen had a side agreement with _3 pay _a sum of money for entering into the medallion transaction. Sterling Employee-3 asked Cohen about such an arrangement because, according to Sterling Employee~3, the price that _was paying for each medallion appeared to be well above the market price. Cohen stated, in sum and substance, that he had no side agreement??and never had a side agreement?wid- 27. While Cohen and _lid not disclose any payment from Cohen to _1 communications with Sterling, it appears that such a payment was contemplated. Indeed, based on my review of records maintained by Getzel, and my participation in an interview 37 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 139 of 201 with Getzel, I have learned the following, in substance and in part, regarding the proposed side payment from Cohen to a. On or about September 19, 2017, Getzel prepared a. memorandum for Cohen entitled, ?Sale of NYC Medallion Entities and Debt Assumption? (the ?Getzel Memorandum?). The Getzel Memorandum summarized the proposed transaction between Cohen and- in part, as ?Michael and Laura Cohen will transfer ownership of their 13 NYC medallion entities to a Buyer who will assume their bank indebtedness, upon the [Cohens?] paying down the debt of b. According to Getzel, Cohen told him the parameters of the deal, including the payment of $3,800,000 to- but Getzel did not know where Cohen was going to obtain $3,800,000 to pay- As noted above, Cohen had more than $5,000,000 in cash and cash equivalents as of September 2017, but had only disclosed in his September 2017 Financial Statement that he had $1.25 million in cash. 28. Based on my review of records maintained by Sterling (as well as Melrose, the bank with the participating interest in the loans) and reports of interviews of representatives of Sterling (and Melrose), I have seen no evidence that Sterling, Melrose, or any other ?nancial institution involved in the potential deal with Cohen and -was aware of the planned $3.8 million side payment from Cohen to- The Illegal Campaign Contribution Scheme 29. The USAO and FBI are also investigating a criminal violation of campaign ?nance laws by Michael Cohen. As set forth below, there is probable cause to believe that Cohen made 9?4 The reference to thirteen medallions appears to be an error by Getzel.? Cohen and his wife together owned sixteen corporations, which in turn owned 32 taxi medallions. 38 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 140 of 201 an excessive in-kind contribution to the presidential election campaign of then-candidate Donald Trump in the form 'of a $130,000 payment to Stephanie Clifford, an individual who was rumored to have had an extramarital affair with Trump, in exchange for her agreement not to disclose that- alleged affair. As set forth below, there is probable cause to believe that this payment was intended to keep Clifford from making public statements about the rumored affair on the eve of the 2016 presidential election, and thus constitutes a campaign contribution in excess of the applicable limit. 30. From my review of public sources, I have learned the following: In or around October 2011, there were rumors published on the gossip websites TheDirzy. com that Trump had had an extramarital affair with Clifford, an adult film actress whose screen name is Stormy Daniels, in or around July 2006. In or about October 2011, Life Style Magazine, a tabloid sold in supermarkets, also published an article, based on the report in TheDz'rty.com, alleging an affair had occurred between Trump and Clifford. Both Trump and Clifford, through their representatives, issued denials in response to the articles. b. Speci?cally, on or about October 11, 201 1, Keith Davidson, who identi?ed himself as Clifford?s attorney, sent a cease and desist letter to TheDirly. com, demanding that the article regarding Trump and Clifford be removed from the website. Additionally, on or about October 12, 2011, Cohen, who was then Executive Vice?President and Special Counsel to the Trump Organization, stated to 11?! News that ?[t]he totally untrue and ridiculous story . . . emanated from a sleazy and disgusting website. . . . The Trump Organization and Donald J. Trump will be bringing a lawsuit . . . [and] Mr. Trump and the Trump Organization would like to thank and commend Stormy Daniels and her attorneys for theirhonesty and swift actions.? 31. On or about June 16, 2015, Trump formally launched his 2016 presidential campaign. On or about May 4, 2016, Trump became the presumptive Republican Party nominee 39 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 141 of 201 for president, and on July 19, 2016, Trump of?cially became the nominee. Based on my review of public sources, I have learned that while it does not appear that Cohen had an official title as part of the Trump campaign, on multiple occasions Cohen made public statements on behalf of Trump or his campaign. For instance, on or about August 18, 2016, Cohen appeared on CNN to defend Trump?s polling numbers. 32. On or about October 7, 2016, The Washington Post published online a video and accompanying audio in which Trump referred to women in what the article described as ?vulgar teims??i?n?? a 200 the host of Acceserollwood. The following day, on October 8, 2016, Trump appeared in a video in which he stated, among other things, ?I?ve said and done things I regret and words released today on this more than a decade old video are one of them. Anyone who knows me knows these words don?t reflect who I am. I said it. I was wrong and I apologize.? Based on my review of public sources, I also know that representatives of the Trump Campaign stated, in sum and substance, that the Access Hollywood commentwas an old and isolated incident. 33. Based on my review of public sources, including an article published in Slate magazine by a reporter who interviewed Clifford, I have learned that around this same time, in or about October 2016, Clifford was in discussions with Good Morning America Show and Slate magazine, among other media sources, to provide these media outlets with her statement about her alleged relationship with Trump. According to the article in Slate, which the author based on conversations with Clifford over the telephone and by text message, Clifford wanted to be paid for her story or be paid by Trump not to disclose her accusation. As Cohen summarized in a 201 8 email obtained pursuant to the Cohen Email Warrants: ?In October 2016, I was contacted 40 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 142 of 201 by counsel for Ms. Clifford stating that news outlets, including ABC News, were pursuing the 201 1 story of an alleged affair between Mr. Trump and Ms. Clifford.? 34. From my review of telephone toll records25 and information produced pursuant to the iCloud Warrant and Cohen Email Warrants, I have learned that in the days following the Access Hollywood video, Cohen exchanged a series of calls, text messages, and emails with Keith Davidson, who was then Clifford? attorney, David Pecker and Dylan Howard of American Media, Inc. the publisher of the National Enquirer,26 Trump, and Hope Hicks, who was then press secretary for Trump?s presidential campaign. Based on the timing of these calls, and the content- of the text messages and emails, I believe that at least some of these communications concerned the need to prevent Clifford from going public, particularly in the wake of the Access Hollywood story. In particular, I have learned the following: a. On October 8, 2016, at approximately 7:20 pm, Cohen received a call from Hicks. Sixteen seconds into the call, Trump joined the call, and the call continued for over four minutes.27 Based on the toll records that the USAO has obtained to date, I believe that this was the ?rst call 25 My attribution of certain telephone numbers to certain individuals as described in this af?davit is based on my review of the vCard (virtual contact file) and text messages obtained from Cohen?s telephone pursuant to the iCloud Warrant. 26 Pecker is President of AMI and, according to his own statements in public reports, a personal friend of Trump.- Howard is the chief content of?cer of AMI, who according to public records reports directly to Pecker. 27 I believe that Trump joined the call between Cohen and Hicks based on my review of toll records. Speci?cally, I know that a call was initiated between Cohen?s telephone number and Trump?s telephone number at the same time the records indicate that Cohen was talking to Hicks. After the Cohen?Trump call was initiated, it lasted the same period of time as the Cohen-Hicks call. Additionally, the toll records indicate a and then Trump?s telephone number, which, based on my training and experience, means that the call was either transferred to Trump, or that Trump was added to the call as a conference or three?way call participant. In addition, based on my conversations with an FBI agent who has interviewed Hicks, I have learned that Hicks stated, in substance, that to the best of her recollection, she did not learn about the allegations made by Clifford until early November 2016. Hicks was not specifically asked about this three?way call. 41 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 143 of 201 Cohen had received or made to Hicks in at least multiple weeks, and that Cohen and Trump spoke about once a month prior to this date speci?cally, prior to this call on October 8, 2016, Cohen and Trump had spoken once in May, once in June, once in July, zero times in August, and twice in September. b. Approximately ten minutes after the call ended, Hicks and Cohen spoke again for about two minutes. c. At 7:39 pm, immediately after the second call with Hicks ended, Cohen called or AMDand they connected for thirty seconds. Approximately four minutes later, Cohen called Pecker again and they spoke for more than a minute. .Three minutes after ending his call with Pecker, Cohen received a call from Dylan Howard (as noted above, the Chief Content Of?cer of AMI), and they spoke for approximately a minute. According to toll records, it does not appear that Cohen and Howard spoke regularly prior to October 8, 2016, as it had been over a month since they had called each other. d. At 7:56 pm, approximately eight minutes after his call with Howard ended, Cohen called Hicks and they connected for two minutes. At approximately the same time this call ended, Cohen received a call from Pecker, and they spoke for about two minutes. At 8:03 about three minutes after ending his call with Pecker, Cohen called Trump, and they spoke for nearly eight minutes. 6, At 8:39 pm. and 8:57 pm, Cohen received calls from Howard and spoke to him for about four and six minutes, respectively. At 9:13 pm, about ten minutes after Cohen and Howard hung up from the second of these calls, HOWard sent Cohen a text message that said: ?Keith will do it. Let?s reconvene tomorrow.? Based on my involvement in this investigation, I 42 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 144 of 201 believe that when Howard wrote ?Keith,? he was referring to Keith Davidson, the attorney for Stephanie Clifford. At 3 :31 now on October 9, 2016, Cohen sent Howard a text message in response that said: ?Thank you.? Eight minutes later, Cohen sent Howard a text message that said: ?Resolution Consultants LLC. is the name of the entity 1 formed a week ago. Whenever you wake, please call my cell.? f. The following day, on October 10, 2016, at 10:58 Howard sent atext message to Cohen and Davidson, which stated: ?Keith/Michael: connecting you both in regards to that business opportunity. With the opportunity. Thanks. Dylan. Over to you two.? At 12:25 pm, Davidson sent Cohen a text message that stated: ?Michael if we are ever going to close this deal In my opinion, it needs to be today. Keith.? Davidson and Cohen then spoke by phone for about three minutes. Based on my participation in this investigation, I believe that when Howard wrote that the ?clien was ?con?rmed to proceed with the oppottunity,? he was referring to Clifford?s agreement in principle to accept money from Cohen in exchange for her agreement not to discuss any prior affair with then?candidate Trump.28 g. Based on my review of records obtained pursuant to the Cohen Email Warrants, I know that on or about October 10, 2016, Clifford and Davidson appear to have signed a ?side letter agreement? that stated it was an exhibit to a ?confidential settlement agreement and mutual release? between ?Peggy Peterson? and ?David Dennison.? The' purpose of the document, 23 As set forth below, AM was also involved in a paymentto model Karen McDougal. However, because these communications were in close temporal proximity to the events involving the negotiation of a payment to Clifford, the execution of the agreement with Clifford, and the payment of money to Clifford, I believe that these communications were related to Clifford. Additionally, based on my review of public statements by McDougal, I have learned that she negotiated an agreement with AMI several months prior to these communications between Cohen and Pecker, Howard, and Davidson. 43 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 145 of 201 according to the agreement, was to de?ne the ?true name and identity? of persons named by pseudonym in ?con?dential settlement agreement and mutual release.? The side letter agreement specifies the identity of ?Peggy Peterson? to be Clifford, but the space for ?Dennison?s? identity is blank. The agreement also includes a signature page for ?Peterson,? ?Dennison,? and their attorneys. The signature page is signed by ?Peterson? and his attorney, Davidson, but the document is? unsigned by ?Dennison? and his attorney. Based on my involvement in this investigation, I believe that Davidson sent Cohen this partially~signed ?side letter agreemen in .. order to facilitate the closing of a deal between Davidson?s client and Cohen or his client on, October 10, 2016. 35. It appears that on October 13, 2016, and the days that followed, Cohen took steps to complete a transaction with Davidson, including attempting to open an account from which Cohen could transfer ?tnds to Davidson. Specifically, from my review of toll records, information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, records maintained by First Republic, as well as my participation in interviews with First Republic employees, I have learned the following: a. On the morning of October 13, 2016, at 8:54 am, Cohen sent Peclcer a text message that stated:' need to talk to you.? At 9:06 am, Pecker sent a text message to Cohen that stated, called please call me back.? The tolls between Cohen and Peclcer do not show a telephone call between 8:54 am. and 9:06 am. However, based on my review of text messages, I have learned that Cohen and Pecker communicate with each other over Signal, which is an communications cellphone application that allows users to send text messages and make calls. 44 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 146 of 201 b. At 9:23 Cohen sent an email that stated ?call me? to First Republic Employee- 2. The email attached documents from the Secretary of State of Delaware indicating that Cohen had formed a limited liability company called ?Resolution Consultants on September 30, 2016. As noted above, ?Resolution Consultants? is the name of the entity that Cohen had told Howard he had formed recently after Howard said Davidson would ?do it.? At 10:44 Cohen called First Republic Employee?2 and told him, in sum and substance, that he needed an account in the name of ?Resolution Consultants? opened immediately, and that he did not want an address on the checks employee at First Republic emailed Cohen account opening paperwork to complete. Cohen returned the account opening documents partially completed, but failed to provide a copy of his driver?s license or passport, and did not respond to the employee?s question of how he wanted to fund the account. As a result, the account was never opened. 0. On October 17, 2016, Cohen incorporated Essential Consultants LLC in Delaware. That same day, he ?led paperwork to dissolve Resolution Consultants LLC. 36. Despite these steps taken by Cohen, it appears that the negotiation between Cohen and Davidson was not progressing suf?ciently fast enough for Davidson or his client, Clifford, and they threatened to go public with Clifford?s allegations just days before the presidential election. Specifically, based on my review of toll records, information obtained pursuant to the iCloud Warrant, and public sources, I know the following: i a. According to an article in The Washington Post, which quoted emails sent from Cohen?s email account hosted by the Trump Organization, on October 17, 2016, Davidson emailed Cohen and threatened to cancel the aforementioned ?settlement agreement2017.08.02 Case Document 48-2 Filed 07/18/19 Page 147 of 201 if Cohen did not complete the transaction.29 According to the article, Davidson sent Cohen a second email later in the day that stated in part, ?Please be advised that my client deems her settlement agreement canceled and void.? At 4:00 pm. that day, Cohen called Davidson and they spolce for over ?ve minutes. b. Cohen?s 4:00 pm. call with Davidson and/or Davidson?s threats to cancel the ?settlement agreement? appear to have touched off a ?urry of communications about the settlement agreement and whether Clifford would go public. Speci?cally: i. message that statedt ?I?m told they?re going with DailyMail. Are you aware?? One minute later, Cohen responded: ?Call me.? Based on my involvement in this investigation, I understand Howard?s text to mean that he heard that Clifford was going to take her story of an extramarital affair with Trump to the Daily Mail, a tabloid newspaper. ii. At 4:45 pm, Howard called Cohen and they spoke for over two minutes. Moments later, Davidson and Cohen spoke for about two minutes. 'At 5:03 pm, Cohen attempted to call Trump, but the call only lasted eight seconds. This was Cohen?s first call after he spoke with Davidson. iv. At 5:25 pm, Cohen texted Howard, stating: v. At 6:44 pm, Howard responded to Cohen?s text, stating: ?Not taking my calls.? Cohen responded one minute later: ?You?re kidding. Who are you trying to reach?? Howard responded one minute later: ?The ?agent.?? Based on my involvement in this 29 Due to the partially covert nature of the investigation to this date, the USAO has not requested documents from the Trump Organization or Davidson, and thus does not possess the email referenced in this article. 46 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 148 of 201 investigation, I understand Howard?s text messages to mean that he attempted to contact Davidson about the matter involving Clifford, but that Davidson was not taking Howard?s calls. vi. . At 6:49 pm, Cohen called Howard and they spoke for nearly four minutes. c. The following day, on October 18, 2016, TheSmokingGuncom, a website that publishes legal documents and mugshots, published an article called: ?Donald Trump and the Porn Superstar,? which alleged that Trump had an extramarital affair with Clifford. However, the article noted that Clifford had declined to comment. 37.- between Cohen,,Davidson, Howard and Pecker picked up again, apparently concerning a transaction involving Clifford. Speci?cally, based on my review of toll records, information obtained pursuant to the Cohen Email Warrants and iCloud Warrant, as well as my review of public sources, I have learned the following: a. On October 25, 2016, at 6:09 pm, Howard sent Cohen a text message stating: ?Keith calling you urgently. We have to coordinate something on the matter he? calling you about or its [sic] could look awfully bad for everyone.? One minute later, Davidson sent Cohen a text message stating ?Call me.? Cohen and Davidson called each other several times over the next half hour but appear not to have connected. At 6 :42 pm, Cohen and Davidson spoke for about eight minutes. At 7:11 pm, they spoke for another two minutes. b. The next morning, on or about October 26, 2016, at 8:26 am, Cohen called Trump and spoke to him for approximately three minutes. At 8:34 am, Cohen called Trump again and connected for a minute and a half. c. At approximately 9:04 a.m.?less than thirty minutes after speaking with Trump?e Cohen sent emails to the person who had incorporated Resolution Consultants and Essential Consultants for him, and stated ?can you send me asap the ?ling receipt? and then, in the second 47 2017.03.02 Case Document48-2 Filed?O7/18/19 Page 149 of 201 email, ?for Essential Consultants That person responded with the ?ling receipt two minutes later at 9:06 am. and with the certi?cation of formation 23 minutes later, at 9:27 am. 01. Shortly after that, Cohen contacted First Republic Employee?2 and told him, in sum and substance, that he decided not to open an account in the name of ?Resolution Consulting? and instead would be opening a real estate consulting company in the name of ?Essential Consultants.? Cohen told First Republic Employee-2 that he was at Trump Tower, and wanted to go to a First Republic branch across the street to open the account, so First Republic Employee-2 called First branch, assist Cohen. At 11:00 am, First Republic Employee?l called Cohen. 1 know from my participation in an interview with First Republic Employee~l, that around the time of the call he went to Cohen?s of?ce in Trump Towers? on the same ?oor as the Trump Organization?wand went through account opening questions, including know your customer questions, with Cohen. In response to a series of know-your? customer questions about the purpose of the account??the answers to which First Republic Employeenl entered into a form??Cohen stated, in sum and substance, that he was opening Essential Consultants as a real estate consulting company to collect fees for investment consulting work, 'and all of his consulting clients would be domestic individuals based in the United States. Based. on my review of records obtained from First Republic, it appears that this account (the ?Essential Consultants Account?) was created at a time between 11:00 am. and 1:00 pm. e. At 1:47 pm, Cohen called Davidson and they spoke for approximately two minutes. At approximately 1:49 pm, Davidson emailed Cohen wiring instructions for an attorney client trust account at City National Bank. f. After the Essential Consultants Account was opened on October 26, 2016, Cohen transferred $131,000 from a home equity line of credit that Cohen had at First Republic to the 48 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 150 of 201 Essential Consultants Account. Following the transfer, at approximately 4:15 pm. on October 26, 2016, First Republic Employee-2?s assistant emailed Cohen at his Trump Organization email address to tell him that the funds had been deposited into the Essential Consultants Accdunt. Cohen forwarded that email to the Cohen Gmail Account and then forwarded it to Davidson. g. At 6:37 pm, Cohen asked Pecker by text message, ?Can we speak? Important.? Cohen called Pecker at 6:49 pm. and connected for thirty seconds. At 6:57 pm, Cohen Sent Howard a text message, stating: ?Please call me. Important.? Cohen called Howard at 7:00 pm. and connected again andthey spoke for nearly-thirteen minutes. 1 At 7:24 pm, Howard sent a text message to Cohen that: ?He said he?d call me back in 20 minutes. I told him what you are asking for his [sic] reasonable. I?ll get it sorted.? Approximately an hour later, at 8:23 pm, Howard told Cohen by text message to ?check your Gmail for email from my private accoun 3? In an email sent at 8:23 pm. by Howard to Cohen and Davidson, with the subject line ?Con?rmation,? Howard stated, ?Thank you both for chatting with me earlier. Con?rming agreement on: Executed agreement, hand-signed by Keith?s client and returned via overnight or same-day FedEx to Michael, Change of agreement to reflect the correct LLC, Transfer of funds on Thursday AM to be held in escrow until receipt of agreement.? After receiving that email, at approximately 8:27 pm, Cohen asked Howard by text message, ?Can you and David [Pecker] give me a call.? Howard responded: ?David is not around I think. I?ll call.? At 8:28 pm, Howard called Cohen and they spoke for three minutes. 38. On October 27, 2016, Cohen made a payment to Davidson of $130,000Jwith the funds intended for Clifford?for the purpose of securing her ongoing silence with respect to the allegations that she had an extramarital affair with Trump. Specifically, based on my review of 49 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 151 of 201 toll records, bank records, and information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, I have learned the following: a. At 9:47 am, Cohen sent Davidson an email, stating: ?Keith, kindly con?rm that the wire received today, October 27, 2016 shall be held by you in your attorney?s trust account until such time as directed for release by me, in writing. Additionally, please ensure that all paperwork contains the correct-name of Essential Consultants LLC. I thank you in advance for your assistance and look forward to hearing from you later.? b:??At?approxi1natelywi to records provided by First Republic Bank, Cohen completed paperwork to wire $130,000 from the Essential Consultants Account?? which had been funded a day prior from Cohen?s home equity line of credit?etc the attorney client trust account at City National Bank that Davidson had speci?ed in the wiring instructions he sent to Cohen. The wire transfer was made shortly thereafter. 0. At 10:02 am, Davidson responded to Cohen?s email from 9:47 stating: confirm that I will work in good faith that no funds shall be disbursed unless 85 until the plaintiff personally signs all necessary settlement paperwork, (the form of which will match the prior agreement). The settlement docs will name the correct corporation, (Essential Consultants LLC). Plaintiff? signature will be notarized and returned to you via FedEx. Only after you receive FedEx will I disburse. Fair?? (1. At 10:5 0. am, First Republic Employee-1 sent Cohen an email con?rming that the payment had been sent and providing him with the wire number. 39. On October 28, 2016, and the days that followed, Cohen ?nalized the transaction with Davidson. Speci?cally, based on my review of toll records, information obtained pursuant to the iCloud Warrant, public sources, and bank records, I know the following: 50 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 152 of 201 a. On October 28,2016, at 11:48 am, Cohen spoke to Trump for approximately five minutes. Beginning at 1:21 pm, Cohen attempted a series of phone calls to Davidson, Pecker, and Howard throughout the day, although it appears he may only have connected with Howard. b. Later that day, at approximately 7:01 pm, Davidson stated to Cohen by text message that ?all is AOK. 1 should have signed, notarized does on Monday. You should have them on Tuesday.? Cohen thanked him and said ?1 hope we are good.? Davidson responded, assure you. We are very good.? Howard also texted Cohen at 7:08 pm, ?Keith [Davidson] says we are to Davidson. At approximately 10:30 pm, Cohen spoke to Hicks for three minutes. 0. On October 31, 2016, Cohen called Howard at 8:22 pm. and they spoke for over three minutes. At 8:32 pm, Cohen received text messages from both Howard and Davidson. Howard said: ?You?ll have paperwork tomorrow says Davidson said: ?We are AOK. You will be receiving a package tomorrow.? Cohen responded ?Thank you? to Howard and ?Thanks Keith. Will call you then? to Davidson. From my involvement in this investigation, I believe Davidson was referring to a signed nondisclosure agreement when he told Cohen that he would receive a package. d. Based on my review of court ?lings that became public in 2018, 1 have learned that on or about October 28, 2016, LLC and/or David Dennison? entered into a ?con?dential settlement agreement and mutual release? with ?Peggy Peterson,? pursuant to which ?Peterson? agreed not to disclose certain ?con?dential information pertaining to [Dennison in exchange for $130,000. The agreement provided that would wire the funds to ?Peterson?s? attorney, who would then transfer funds to ?Peterson.? Cohen signed the agreement on behalf of 51 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 153 of 201 The agreement stated that the address for which was later referred to in the agreement as ?Essential Consultants, was Cohen?s residence. e. Consistent with the ?con?dential settlement agreement and mutual release,? on or about November 1, 2016, Davidson transferred $96,645 from his attorney client trust account at City National Bank to a bank account in Clifford?s name. The wire had the annotation ?net settlemen On the same day, at approximately 9:48 am. Davidson sent Cohen a text message with a picture of a FedEx delivery con?rmation, stating that at approximately 9:09 am. a package shipped by Davidson the previous day had arrived for Cohen__ at his Trump Organization address. On the same day, at approximately 6:14 pm, Davidson sent Cohen an email with an audio file attached and said ?Give this a lesson [sic] and then call me.? The audio attachment was titled ?Stormy.mp3? and was a five-minute recording of Davidson interviewing Clifford about recent public allegations made by an adult ?lm star named Jessica Drake regarding her alleged past affair with Trump; in the recording, Clifford explained the reasons she believed that Drake Was not credible. Less than an hour later,'at approximately 7:05 pm, Cohen called Trump, but it appears that they did not connect. Cohen then called a telephone number belonging to Kellyanne Conway, who at the time was Trump?s campaign manager. They did not connect. At approximately 7:44 pm, however, Cohen received a return call from Conway, which lasted for approximately six minutes. 40. On November 4, 2016, just three days after the Clifford transaction was completed and just four days before the presidential election, the Wall Street Journal published an article alleging that the National Enquirer had ?Shielded Donald Trump? from allegations by Playboy model Karen McDougal that she and Trump had an affair. The article alleged that AMI had agreed to pay McDougal to bury her story. McDougal, like Clifford, had been represented by Davidson. 52 2017.08.02 Case Document 48-2? Filed 07/18/19 Page'154 of 201 Based on my review of toll records, information obtained pursuant to the Cohen Email Warrants and iCloud Warrant, and public sources, it appears that Cohen spoke frequently to Davidson, Howard, Pecker, and Hicks around the time of this article?s publication?just days before Election Day?#about the importance of preventing the McDougal and Clifford stories from gaining national traction. Speci?cally, I have learned the following: a. Between 4:30 and 8:00 pm. on November 4, Cohen communicated several times with Howard, Pecker and Davidson. For instance, at approximately 4:49 pm, Cohen sent Howard anemaiLfmwarded to him by another Trump Organization lawyer. The forwarded email was from a Wall Street Journal reporter, and asked for comment from Trump and/or the campaign on the story. Cohen also spoke with Hicks several times, including shortly before and/or after calls with Pecker, Howard and Davidson. Indeed, at approximately 7:33 using two different cellphones subscribed to him, Cohen appears to have been talking to Davidson and Hicks at the same time. b. At approximately 8:51 pm, Cohen sent Howard a message, stating: ?She?s being really difficult with giving Keith a statement. Basically went into hiding and unreachable.? One minute later, Howard responded: ?I?ll ask him again. We just need her to disappear.? Cohen responded, ?fShe definitely disappeared but refuses to give a statement and Keith cannot push her.? At approximately 8 :55 pm, Howard responded to Cohen?s text: ?Let?s let the dust settle. We don?t want to push her over the edge. She?s on side at present and we have a solid position and a plausible position that she is rightfully employed as a columnist.? Based on my involvement in this investigation, I believe Cohen and Howard were referring to Karen McDougal when they were discussing ?she? and ?her.? Additionally, I believe Howard?s statement that ?we have . Y. . a 53 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 155 of 201 plausible position that she is rightfully employed as a columnist? was a reference to the fact that AMI had given McDougal payments for her role as a purported columnist for the company. 0. At approximately 8:58 pm. on November 4, 2016, Howard attempted to reassure Cohen about the effect of the forthcoming Wall Street Journal article, texting, think it? ll be ok pal. Ithink it?ll fade into the distance.? Cohen responded, ?He?s pissed.? Howard wrote baCk, ?I?m pissed! You?re pissed. Pecker is pissed. Keith is pissed. Not much we can do.? Based on my involvement in this investigation, I believe Cohen was referring to Trump when he stated ?he "s pissed.? Cohen asked Howard at approximately 9:00 pm. howthe Wall Street Journal could publish its article if ?everyone denies.? Howard responded, ?Because there is the payment from AMI. It looks suspicious at best.? d. At approximately 9:03 pm, Hicks called Cohen and they spoke for two minutes. At approximately 9:11 pm, Cohen called Howard and spoke to him for five minutes. At approximately 9:15 pm, Hicks called Cohen and they spoke for nearly seven minutes. Again, Cohen used different phones for these two calls, such that he appears to have been on both calls for about a minute of overlap. At approximately 9:32 pm, Cohen texted Pecker, ?The boss just tried calling you. Are you free?? A minute later, Cohen texted Howard, ?Is there a way to ?nd David quickly?? e. At approximately 9:50 pm, the Wall Street Journal article was published online. Howard and Hicks both sent web links for the article to Cohen. Over the next half hour, Cohen and Howard exchanged several text messages commenting on how the story came across. The next morning on November 5, 2016, at approximately 7:35 am, Cohen texted Hicks, ?So far I see only 6 stories. Getting little to no traction.? Hicks responded, ?Same. Keep prayingl! It?s working!? Cohen wrote back, ?Even CNN not talking about it. No one believes it and if necessary, I have a 54 2017.08.02 - - - ase 1.18 Document 48-2 Filed 07/18/19 Page 156 of 201 statement by Storm denying everything and contradicting the other porn stars statement. Iwouldn?t use it now or even discuss with him as no one is talking about this or cares!? Based on my involvement in this investigation, I believe Cohen was referring to the above?referenced recorded audio statement by Clifford that he obtained from Davidson, and was stating that such a statement could be used to in?uence potential negative media relating to Trump, but was unnecessary at that time. Based on a text message from Hicks to Cohen, I believe that later that morning, Pecker spoke to Trump. 41. On or about November of the United States . '42. On or about January 12, 2018, the Wall Street Journal ?rst reported that Cohen arranged a payment to Clifford. On or about January 22, 2018, Common Cause, a government watchdog group, ?led a complaint with the Federal Election Commission,'alleging that Cohen had violated campaign ?nance laws by making the payment to Clifford. Based on my review public sources following that report, as well as emails obtained pursuant to the Cohen Email Warrants, I have learned the following: a. On or about January 23, 2018, the day after Common Cause ?led its complaint, Cohen began emailing himself drafts of statements describing his payment to Clifford. Additionally, on January 23, 2018, Cohen emailed the following draft of that statement to an individual who appears to be writing a book on Cohen?s behalf: In October 2016, I was contacted by counsel for Ms. Clifford stating that news outlets, including ABC news, were pursuing the 2011 story of an alleged affair between Mr. Trump and Ms. Clifford. Despite the fact that both parties had already denied the allegation, as MI. Trump?s longtime special counsel and protector, I took it upon myself to match the offer and keep the story ??om breaking. I knew the allegation to be false, but I am also a realist who understands that just because something is false doesn ?t mean that it doesn?t create harm and damage. I could not allow this to 55 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 157 Of 201 occur. Lnegotiated a non-disclosure agreement with Ms. Clifford?s counsel and tendered the funds. I did this through my Delaware LLC and transferred personal funds to cover the agreement. I was not reimbursed any monies from Mr: Trump, the Trump Organization, any third party or the Presidential campaign. At no point did I ever advise Mr. Trump of my communications or actions regarding this agreement. As outlandish and unusual as this may appear, the Trumps have been like family to me for over a decade. It?s what you do for family. (Emphasis added.) Based on my involvement in this investigation, I believe that the above email is an acknowledgement that the allegation of the affair had existed for some time 2011 $0132.. but that Cohen was motivated to ?keep the story from breaking? again in October 2016. b. On or about February 13, 2018, Cohen said in a statement to The New York TIT-nines that ?Neither the Trump Organization nor the Trump campaign was a party to the transaction with Ms. Clifford. The payment to Ms. Clifford was lawful, and was not a campaign contribution or a campaign expenditure by anyone.? Cohen declined to answer follow-up questions including . whether Trump had been aware of the payment, why Cohen made the payment, or whether similar payments had been made to other people. . c. On or about February 14, 2018, Cohen was asked by The New York Times whether Trump had reimbursed him, whether he and Trump had made any arrangement at the time of the payment, or whether he had made payments to other women. Cohen stated in response, can?t get into any of that.? On or about February 14, 2018, Cohen also stated to The Washington Post that: ?In a private transaction in 2016, I used my own personal funds to facilitate a payment of $130,000 to Ms. Stephanie Clifford. Neither the Trump Organization nor the Trump campaign was a party to the transaction with Ms. Clifford, and neither reimbursed me for the payment, either directly or indirectly.? I 43. On or about March 9, 2018, Cohen stated to ABC News that ?the funds were taken from my home equity line and transferred internally to my LLC account in the same bank.? 56 2017.08.02 - Case Document 48-2 Filed 07/18/19 Page 158 of 201 44. Accordingly, for the foregoing reasons, there is probable cause to believe that Cohen committed violations of the Campaign Finance Offenses by making an in-kind contribution to Trump or the Trump campaign in the form of a $130,000 payment to Clifford on the eve of the election. Indeed, while he denies having given an unlawful contribution, in his own statements Cohen has adrhitted that he paid $130,000 of his ?personal funds? to Clifford and that the payment occurred less than two weeks before the election, as Trump was facing negative media allegations about his behavior toward women, even though allegations of an affair between Trump and Cliffordexisted records set forthabove make evident that Cohen communicated with members of the Trump campaign about his negotiation with Clifford?s attorney and the need to preclude Clifford. from making a statement that would have reflected negatively on the candidate in advance of the forthcoming election. C. Probable Cause Justifying Search of the Subject Premises and Subject Devices 45. Based on the foregoing, my review of records produced pursuant to subpoenas and the Cohen Email Warrants, and the iCloud Warrant, and my training and experience, there is probable cause to believe that the Subject Premises and Subject Devices have been used in furtherance of the Subject Offenses and are likely to contain instrumentalities, evidence, and fruits of the Subject Offenses. Speci?cally, there is probable cause to believe that Cohen permanently resides at Subject Premises?l and, at least in part, works at both Subject Premises-1 and Subject Premises-2, and that those locations contain evidence relating to the Sterling taxi medallion transaction, Cohen?s assets, Cohen?s consulting work for Essential Consultants LLC, and his payment to Clifford. Additionally, there is probable cause to believe that Subject Premises?3 contains evidence of Cohen?s assets and his payment to Clifford. Finally, there is probable cause to believe that Subject Premises-4, in which Cohen is temporarily residing, contains electronic 57 2017.03.02 Case Document 48-2 File?d 07/18/19 Page 159 of 201 devices, including Subject Device-1 and Subject Device~2, which, in turn, contain evidence of the Subject Offenses, such as evidence relating to the Sterling taxi medallion transaction, Cohen's assets, Cohen?s consulting work for Essential Consultants LLC, and his payment to Clifford. 46. First, there is probable cause to believe that Cohen lives and operates his businesses, at least in part, at Subject Premises?1. Speci?cally, from my review of property records, I know that Michael Cohen and Laura Cohen own (in trust) Subject Premises?l. From my review of Cohen?s tax returns, I know he lists his primary residence as Subject Premises~1. Additionally, from my review of emails pro that Cohen routinely refers to Subject Premises?l as his home. For example, on or about September 28, 2017 and, October 6, 2017, Cohen emailed individuals that his home address is the address for Subject Premises~l. I also know from my review of emails that Cohen receives package delivery notifications that list Cohen?s address as the address for Subject Premises?1. Cohen has also provided the address of Subject Premises-1 as the address for Essential Consultants and Michael D. Cohen Associates, PC. For example, the certi?cates of incorporation and account opening documents at First Republic for both entities list their addresses as the address for Subject Premises?1. See supra 18(b), 18(d). The consulting agreement between Essential Consultants and also indicated the address for Essential Consultants is the address for Subject Premises? 1. See supra 1i 19(0). 47. There is also probable cause to believe that Subject Premises-1 is likely to contain instrumentalities, evidence, and fruits of the Subject Offenses. Speci?cally, from my review of emails produced pursuant to subpoena and the Cohen Email Warrants and iCloud Warrant, as well as my training and experience, I know the following: 58 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 160 of 201 a. According to records maintained by Sterling, the address for all of Cohen?s taxi medallion LLCs is the address for Subject Premises?1. See supra 16(0). Additionally, the medallion loan documents indicate that any mailings related to the loans should be sent to Subject Premises-1. See id, Based on my training and experience, as well as my review of public sources, I know that individuals keep records of properties and assets in which they have ownership interests. Accordingly, I submit that Subject Premises-1 likely contains evidence of Cohen?s ownership of the taxi medallion .LLCs, the revenue that those medallions generate, and the transaction with Sterling in 2014 to re??nance the medallion loans that were then with Capital One Bank. b. From my review of records maintained by Sterling, I also know that Sterling addressed documents relating to and Cohen?s attempts to modify the terms of the medallion loans to Subject Premises?1. For instance, Sterling addressed the transaction term sheet, see supra jl 16(1), and its demand letter and notice of default, see supra 1i 16(q), to Subject Premises-l. Accordingly, Subject Premises-l likely contains evidence concerning the -transaction and Cohen?s negotiations with Sterling. Some of those records?such as records relating to a payment ?'om Cohen to '-were concealed from Sterling and cannot be obtained via subpoena to Sterling. Additionally, even where documents were sent to Cohen by Sterling (and therefore are available from Sterling via subpoena), the fact that they may be found in Subject Premises?1 will be relevant to Cohen?s possession or knowledge of the documents. 0. From my review of records maintained by 'First Republic, I know that Cohen provided the address for Subject Premises?1 as the mailing addresses for the Essential Consultants Account and Account. See supra 18(b), 18(6). Accordingly, it is likely that Subject 59 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 161 of 201 Premisele contains records relating to the Essential Consultants Account and Account, including, among other things, account opening documents, bank statements, documents provided as part of the know-yourucustomer process, any notes made by Cohen when he was opening the accounts, wire transfer records, and canceled checks. Even where these records can be obtained from First Republic, the fact that they may be found in Subject Premises?l will be relevant to, among other things, Cohen?s ownership of the accounts, or his knowledge of transactions or the existence of funds in accounts. (1. Based on my Bank, TD Bank, Morgan Stanley, City National Bank, Signature Bank, and Bethpage Credit Union, I know that Cohen provided the address for Subject Premises-l as the mailing for his accounts at each of these financial institutions. Accordingly, it is likely that Subject Premises~l contains records relating to these accounts, including, among other things, bank statements that: list account balances. The existence of these records in Subject Premises?1 will be relevant to, among other things, Cohen?s ownership of the accounts and his knowledge of the balances in these accounts. e. Additionally, Cohen may have records of other banlc accounts or assets that were not disclosed to Sterling and are not presently known by law enforcement. For example, as described above, Cohen has received interest income since 2015 that he has not. disclosed to Sterling or paid taxes on. Also, on Cohen?s August 2014 Financial Statement, see supra 16(e), he disclosed $10,000,000 in ?investments in overseas entities.?30 The value of these investments was omitted from subsequent ?nancial statements. However, for the reasons outlined above, there is probable cause to believe that Cohen omitted the value of those investments from his 2017 30 Based on my participation in an interview with Sterling Employee-3, I have learned that Cohen told Sterling Employee-:3 that the. reference to ?investments in overseas entities? on his 2014 Financial Statement was to serve merely as a ?placeholder? for potential future investments. 60 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 162 of 201 ?nancial statements in order to understate his assets. As Subject Premises-1 is Cohen?s primary residence and he uses Subject Premises~l as the mailing address for bank. records, there is probable cause to believe that account statements for unknown bank accounts or assets concealed from Sterling are likely to be found in Subject Premises?l. f. Based on my review of records maintained by and produced pursuant to the Cohen Email Warrants, I know that the address Cohen provided to for Essential Consultants is the address for Subject Premises?l. See supra ?lj 19(0). Therefore, there is probable cause to believe that Subject Premises- operation of Essential Consultants or money that Cohen received, through Essential Consultants, from Additionally, because Cohen used the address for Subject Premises-l for at least one consulting arrangement involving Essential Consultants, there is probable cause to believe that Subject Premises-l may contain records of other consulting arrangements that Cohen, through Essential Consultants, has with other individuals or entities. g. Based on my review of records maintained by Getzel?s accounting ?rm, and emails produced pursuant to the Cohen Email Warrants, I have learnedthat Getzel?s accounting ?rm sent documents to Subject Premises-l and used the address for Subject Premises-l as the address listed on Cohen?s personal and corporate tax returns. See supra ii 16(n). For instance, on or about October 6, 2017, an employee at Getzel?s accounting firm emailed Cohen that she had sent Cohen?s September 2017 Financial Statement by FedEx to Cohen?s attention. Accordingly, Cohen? tax records are likely to be found in Subject Premises?l. h. Based on my review of bank records and'publicly?available documents, Iknow that Cohen used $130,000 ??om a home equity line of credit on Subject Premises~l to pay Clifford. I also know that on the settlement and nondisclosure agreement between ?Peggy Peterson? and 61 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 163 of 201 the address for Essential Consultants is Subject Premises-1. Accordingly, Subject Premises?l is likely to contain evidence of the Campaign Finance Offenses, including settlement and nondisclosure agreements, payment records, written and email correspondence, and records pertaining to the home equity line of credit. i. Based on my review of emails produced pursuant to the Cohen Email Warrants and iCloud Warrant, I know that Cohen used at least one Apple iPhone, an Apple iPad Mini, and a MacBook Pro to access his iCloud account. Based on my review of location records provided by electronic devices linked to Cohen?s iCloud account were used at Subject Premises?1 to, among other things, place telephone calls and backup ?les to Cohen?s iCloud account. Accordingly, there is probable cause to believe that Subject Premises?l contains electronic devices, including certain Apple products, that for reasons discussed below are likely to contain evidence of the Subject?Offenses. j. Based on my review of emails produced pursuant to the Cohen Email Warrants, I understand that Subject Premises-1 recently sustained water damage to certain parts of the premises, and that Cohen has engaged contractors to perform certain remediation work on the premises. In addition, as set forth above, I believe that Cohen and his family are temporarily residing at Subject Premises?4 in the Loew?s Regency Hotel, which is approximatelytwo blocks from Subject Premises-1. However, based on my review of a work order sent to Cohen?s email by a contractor, I understand that the first phase of the work order called for the contractor to ?Pack Remove all items furnishings in Living Room, Kitchen, Sons Room (Si Dining Room? and store them off?site. In addition, based on my review of drawings sent to Cohen by the contractor, it appears that the work is primarily being done in these rooms. Thus, I believe that the construction 1 to the extent it is still ongoing would not necessarily have caused Cohen to move 62 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 164 of 201 all documents or evidence responsive to the warrant out of Subject Premises?l, because it does not appear that work is being done to the portion of Subject Premises-l, such as a home of?ce or Cohen?s own room, where such documents or evidence would most likely be found?1 48. Second, there is probable cause to believe that Cohen uses Subject Premises~2 as of?ce space, and also that Subject Premises-2 contains certain electronic devices. Speci?cally, from my review of the ?strategic alliance agreement? between Squire Patton Boggs and Cohen, and my review of the press release on Squire Patton Boggs?s website, I know that Cohen has an Indeed, I have learned that pursuant to Cohen?s agreement with the law ?rm, he has ?dedicated and segregated of?ce space? in Squire Patton Boggs?s of?ces on the 23rd ?oor of 30 Rockefeller Plaza, and that the space is ?physically separate? from the ?rm?s of?ces and has ?locked doors and its own locked ?le cabinets.? See supra 19(6). Additionally, I know that under the terms of the agreement, Cohen agreed to ?arrange for [his] own computer server system that is not connected to [Squire Patton Boggs?s] computer network system.? I know from my participation in an interview with Getzel, who met Cohen at Subject?Premises?Z in 2017, that Subject Premises?2 is an of?ce with a door, it appears to be used only by Cohen, and it contains, among other things, a computer and paper files. According to Getzel, when Getzel saw Cohen at Subject Premises?2, he had two cellular telephones in Subject Premises?2. I also know from my review of emails produced pursuant to the Cohen Email Warrants that Cohen uses the address for Subject Premises-2 in the, signature block 31 As noted below, based on my training and experience, I believe that individuals who travel or stay in hotels for short?term periods commonly bring some items with them, such as portable electronic devices or sensitive items, meaning that Cohen has likely taken some evidence from Subject Premises?1 to Subject Premises?4. Nevertheless, given the temporary nature of Cohen?s stay at Subject Premises?4 and the scope of the work being done at Subject Premises?1, I believe it is unlikely that Cohen has taken all evidence that would be subject to seizure out of Subject Premises-l. 63 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 165 of 201' on his emails. Based on my review of notes of a call between Cohen and First Republic Employee- 2 (which notes were taken by another First Republic employee, who was participating in the call and taking notes), I know that, on or about November 15, 2017, Cohen told First Republic Employee?2 that he had a new of?ce at 30 Rock. Moreover, Ilmow from an article in Vanity air published on or about February 14, 2018, that Cohen was interviewed by the magazine in Subject Premises?2 in or about February 2018. 49. There is also probable cause to believe that Subject Premises~2 is likely to contain Offenses. Speci?cally, from my review of emails produced pursuant to subpoena and the Cohen Email Warrants and iCloud Warrant, as well as my training and experience, I know the following: a. According to records maintained by Sterling, when Cohen was emailing with Sterling Employee-3 in 2018 about a modi?cation to his. existing. loan from Sterling, Cohen listed his address in his email as the address for Subject Premises-2. See supra 16(t), 16(u). Accordingly, Subject Premises-2 likely contains evidence concerning Cohen?s loan modi?cation negotiations with Sterling. b. Based on my review of records obtained pursuant to the Cohen Email Warrants, I know that the address Cohen provided to KAI and BTA for Essential Consultants is the address for Subject Premises?2. See supra 19(a), 1903). Therefore, there is probable cause to believe that Subject Premises?2 will contain evidence concerning the operation of Essential Consultants or money that Cohen received, through Essential Consultants, from KAI and BTA, among other entities with which Cohen had a Consulting arrangement. Additionally, based on my review of emails sent in 2018 that were obtained pursuant to the Cohen Email Warrants, I know that Cohen continues to enter into consulting arrangements through Essential Consultants, and agreements 64 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 166 of 201 relating to those arrangements indicate that Essential Consultants is located at Subject Premises- 2, Additionally, because Cohen used the address for Subject Premises?2 for multiple consulting arrangements involving Essential Consultants, there is probable cause to believe that Subject Premises~2 may contain records of other unknown consulting arrangements that Cohen has with other individuals or entities. c. Based on my review of records maintained by Getzel?s accounting ?rm, and emails produced pursuant to the Cohen Email Warrants, as well as my participation in an interview with I Getzel, I have about his taxes. See supra 20(a). At that meeting, Getzel discussed with Cohen whether Cohen should disclose Essential Consultants on his personal ?nancial statement to banks. According, there is probable cause to believe that Subject Premises?2 will contain evidence relating to Cohen?s taxes, Or notes of his conversation with Getzel. Moreover, the fact that Cohen used Subject Premises?2 for a meeting regarding his personal ?nancial matters provides probable cause to believe that documents and information regarding his ?nances will be found in Subject Premises?2. d. Based on my participation in an interview with Getzel, I know that Cohen maintains a computer in Subject Premises?2. From my review of data produced pursuant to a subpoena and pen register to Google, it appears that Cohen is logging into his Gmail account from Subject Premises?2. Accordingly, there is probable cause to believe that Subject Premises~2 contains electronic devices, that for reasons discussed below are likely to contain evidence of the Subject Offenses. e. Based upon my training and experience, I have learned that individuals who . maintain businesses typically keep records relating to the business?esuch as contracts with clients and records of payments?at the business? identi?ed location. I am not aware of any addresses 65 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 167 of 201 associated -with Essential Consultants other than Subject Premises-l and Subject Premises-2. Accordingly, there is probable cause to believe that Subject Premises-1 and Subject Premises-2 will contain business records for Essential Consultants. 50. Third, there is probable cause to believe that Subject Premises-3 is likely to contain instrumentalities, evidence, and fruits of the Subject Offenses. In particular: a. As noted above, Cohen has two bank accounts at TD Bank. In or about November 2017, as Cohen was receiving substantial income from consulting workw?which he did not disclose to Sterling;Cohen Premises?3. In light of the aforementioned evidence that Cohen conceals assets, including assets at TD Bank, there is probable cause to believe that Subject Premises-3 contains ?nancial assets, objects of Value and/or documents relating to such assets or objects of value that Cohenlikely did not disclose to Sterling. Indeed, based on my training and experience, I am aware that people often conceal valuable items in safety deposit boxes. Accordingly, there is probable cause to believe that Subject Premises?3 will contain evidence of the Bank Fraud Offenses. I b. In addition, based on my review of records produced by TD Bank, 1 know that Cohen has accessed the vault in which Subject Premises?3 is stored on two occasions. The first such occasion was on November 10, 2017. Cohen signed into the vault at approximately 5:35 and out of vault at approximately 5:39 on that date.32 Based on my review of toll records, I know that, Cohen? ?rst call after he signed out of the safety deposit box approximately 45 minutes later was to Keith Davidson. Specifically, at 6:25 pm. Cohen called Davidson and they spoke for less than a minute; three minutes later, Davidson called Cohen back and they spoke for approximately 32 The entry in the bank?s log book does not specify whether this is AM. or RM. However, I infer - that it is P.M., because it is unlikely that the bank would have been open at 5:35 and 5:39 am. 66 2017.03.02 - - ase 1.18 Document 48-2 Filed 07/18/19 Page 168 of 201 22 minutes. The second such occasion was on February 2, 2018, which is during the time period numerous media reports about Cohen?s payment to Clifford were being published, and is one day after it appears that Cohen?s family moved into Subject Premises?4, as set forth above. The timing of Cohen? 3 two visits to the vault - one shortly before a call to Keith Davidson and the other around . the time that Cohen came under media scrutiny in connection with the payment to Davidson?s client? gives rise to probable cause to believe that Subject Premises-3 will contain evidence of the Campaign Finance Offenses, such as documents relevant to the Cohen?s dealing with Keith Davidson and the evidence that Cohen did not want to leave in his apartment where construction workers would be present.33 51. Based on my review of emails obtained pursuant to the Cohen Email Warrants and cell phone location information, I believe that Cohen is temporarily residing in Subject Premises? 4. See supra ilil There is also probable cause to believe that Subject Premises-4 contains instrumentalities and evidence of the Subject Offenses, including, the following: a. As described above, it appears that Cohen moved to Subject Premises-4 on or about February 1, 2018, at which time numerous media reports about Cohen?s involvement in the. payment to Clifford were being published. See supra During this time same period, Cohen was frequently corresponding with the media and sent himself and others statements about his involvement in the payment to Cli?ord. See supra Thus, there is probable cause that Cohen took at least some documents and evidence relating to the Clifford payment with him to Subject Premises?4, in order to reference and consult them in connection with these statements. MW 33 As noted above, Subject Premises?3 is approximately five inches by ten inches. Accordingly, I do not believe that it would fit a large volume of hard copy documents; however, a small number of hard?copy documents, or a large volume of documents contained on a ?ash drive or other portable storage device, would fit in Subject Premises?3. 67 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 169 of 201 b. As described above, at the time Cohen moved to Subject Premises?4, he was also in the midst of ongoing negotiations with Sterling regarding the refinancing of his medallion debts. For example, on January 30, 2018, Cohen had a phone call with Sterling Employee?3 about his ?nances and the proposed restructuring, and on February 1, 2018, Cohen sent an email to Sterling Employee?3 claiming-that he did not have more than $1.25 million in cash. See swam i6(u). Thus, there is probable cause that Cohen took at least some documents and evidence relating to his ongoing negotiations with Sterling with him to Subject Premises?4, in order to reference and consult them in connection . c. As described above, Cohen used at least one Apple iPhone, an Apple iPad Mini, and a MacBook Pro to access his iCloud account, and these electronic devices linked to Cohen?s iCloud account were used at Subject Premises?1 ?'Cohens? permanent residence to. place telephone calls and backup files to Cohen?s iCloud account. See supra 47 Although Cohen? 3 stay at Subject Premises?4 is temporary, based on my training and experience I know that individuals who travel or stay in hotels for short?term periods commonly bring portable electronic devices with them, such as cellular phones, tablets, or laptops. Accordingly, there is probable cause to believe that Subject Premises-4, where Cohen currently appears to be residing, contains electronic devices, including Subject Device-1, Subject Device-?2, and/or certain Apple products, that for the reasons discussed herein are likely to contain evidence of the Subject Offenses. d. Moreover, as set forth above, based on cellphone location information I know that Subject Device?1 and Subject Device?2. were in the vicinity of Subject Premises?4 as recently as this morning (April 8, 2018). As set forth above, there is probable cause to believe that Cohen used the Subject Devices in furtherance of the Subject Offenses, including to communicate with Sterling employees regarding the medallion transaction, with First Republic employees regarding 68 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 170 of 201 the Essential Consultants Account, with his accountant regarding his ?nances, and with individuals, such as Davidson, Howard and Pecker, involved in the $130,000 payment to Clifford. 52. Although Cohen appears to be residing currently in Subject Premises-4, it is unknown whether Cohen will be physically present within) Subject Premises?4 at the moment the warrant sought herein are executed. If Cohen is within Subject Premises?4 at that moment, Subject Device-l and Subject Device-2 his cellphones 1. will likely also be within Subject Premises?4. If Cohen is not within Subject Premises-4 at that moment, the devices will likely be on his person, Device-l and Subject Device-2 as recently as today, is likely to be in the Southern District of New York). As such, this warrant seeks separate authority to seize Subject Device?l and Subject Device?2, in the event that those devices are not located within Subject Premises?4 (or another Subject Premises) at the moment the warrants sought herein are executed. D. Probable Cause Justifying Search of E81 53. Based on the foregoing, there is probable cause to believe that Subject Premises?l, Subject Premises?53. and Subject Premises?4 contain electronic devices that are likely to contain evidence, fruits, and instrumentalities of the Subject Offenses (and, as set forth above, that Subject Device?l and Subject Device-Q are themselves electronic devices that are likely to contain evidence of the Subject Offenses). Speci?cally, based on my review of information produced pursuant to the Cohen Email Warrants, the iCloud Warrant, and subpoenas, as well as pen register data, I submit that there is probable cause that Subject Premises?1 contains an Apple iPad Mini, a MacBook Pro, and has, at various times, contained Apple cellphones; similarly, there is probable cause that Subject Premises-2 contains a computer and has, at various times, contained Apple 69 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 171 of 201 cellphones, .These devices are likely to include evidence, fruits, and instrumentalities of the Subject Offenses for the following reasons: a. As described throughout this affidavit, Cohen used email to send and receive communications related to the Subject Offenses. In particular, Cohen used email to send and receive communications with Sterling, First Republic, Getzel, the entities to which he is providing consulting services, Davidson, and Howard, among others. While some of these emails have already been obtained via subpoenas and search warrants, I know from my training and experience inboxes but retain, copies of those emails on their hard drives. I also know that individuals often have multiple email accounts, some of which may not be known to law enforcement, and as a result electronic devices can be a unique repository of all emails relevant to certain Subject Offenses. Indeed, from my involvement in this investigation, I know that Cohen had an email account with the Trump Organization, but the USAO and FBI have not been able to obtain the contents of that account to date. Thus, emails relevant to the Subject Offenses are likely stored on electronic devices in Subject Premises?1, Subject Premises?2 and/or Subject Preni?ises~4. b. Additionally, Subject Premises-1, Subject Premise?2 and Subject Premises~4 likely contain electronic copies of documents relevant to the Subject Offenses. Indeed, I know from my training and experience that individuals often retain copies of important documents on their computers or other electronic devices capable of storing information, including cellphones (such as the Subject Devices) and tablets. Here, there are a number of documents that Cohen has likely retained that will be relevant to the Subject Offenses. For example, electronic devices may include documentation of Cohen?s true net w01th, a listing of his assets, an accounting of his available 70 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 172? of mi cash, consulting agreements with third parties, and documentation of his payment to Clifford, among other evidence of the Subject Offenses. c. Third, I know ?om my review of emails obtained pursuant to the Cohen Email Warrants that Cohen sent up online banking with First Republic. Based on my training and experience, I know that individuals who set up online banking often receive electronic notices concerning financial transactions and, on occasion, save records of their financial transactions to their devices. Accordingly, there is probable cause to believe that Cohen?s electronic devices contain evidence of banking ofrbankdaccountsior assets that Cohen did not disclose to Sterling or Melrose. d. Fourth, from my review of records produced by Apple, I know that Cohen communicates using text message as well as communications applications. These applications that Cohen has downloaded onto a phone include, but are not limited to, WhatsApp, Signal, and Dust. I know from my review of toll records and text messages that, in particular, Cohen communicated with Pecker using these applications. Accordingly, there is probable cause to believe that Cohen?s cellphones the Subject Devices will contain . messages that are not otherwise accessible relating to the Subject Offenses. 54. Based on my training and experience, I know that individuals who engage in ?nancial crimes commonly use computers to communicate with co?conspirators, keep financial ledgers, and retain fraudulent documents. As a result,'they often store data on their computers related to their illegal activity, which can include logs of online or cellphone-based ?chats? with co-conspirators; email correspondence; contact information of co-conspirators, including telephone numbers, email addresses, and identi?ers for instant messaging and social medial accounts; bank account numbers; and/or records of uses of funds. 71 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 173 of 201 55. Based on my training and experience, I also know that, where computers are used in furtherance of criminal activity, evidence of the criminal activity can often be found months or even years after it occurred. This is typically true because: .0 Electronic ?les can be stored on a hard drive for years at little or no cost andusers thus have little incentive to delete data that may be useful to consult in the future. 0 Even when a user does choose to delete data, the data can often be recovered months or years later with the appropriate forensic tools. When a ?le is ?deleted? on a home computer, the data contained in the file does not actually disappear, but instead remains on the hard drive, in ?slack space,? until it is overwritten by new data that cannot-be 'stored elsewhereon the computer. Similarly, files that have been viewed on the Internet are generally downlOaded into a temporary . overwritten as the ?cache? fills up and is replaced with more recently viewed Internet pages. Thus, the ability to retrieve from a hard drive or other electronic storage media depends less on when the file was created or viewed than on a particular user?s operating system, storage capacity, and computer habits. 0 In the event that a user changes computers, the user will typically transfer ?les from the old computer to the new computer, so as not to lose data. In addition, users often keep backups of their data on electronic storage media such as thumb drives, ?ash memory cards, CD-ROMS, or portable hard drives. 5 6. Based on the foregoing, I respectfully submit there is probable cause to believe that Cohen engaged in the Subject Offenses, and that evidence of this criminal activity is likely to be found in the Subject Premises, on computers and electronic media found in the Subject Premises, and on the Subject Devices. In particular, there is probable cause to believe that the Subject Premises and Subject Devices will contain evidence,'fruits, and instrumentalities of violations of the Subject Offenses, as more fully described in SectionII of Attachments A, B, C, D, and to the proposed warrants, including the following: a. Evidence necessary to establish the occupancy or ownership of the Subject Premises, including without limitation, utility and telephone bills, mail envelopes, addressed correspondence, bank statements, identification documents, and keys. b. Evidence relating to Sterling, Melrose, and/or taxi medallions. 72 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 174 of 201 0. Evidence relating to a plan, proposal, or agreement for Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including tt_and/or entities associated with him. d. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. e. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any f. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. g. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank; records. h. Evidence relating to agreements, loans, and/or ?nancial transactions between Cohen and _1nd any payments by- Cohen. i. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. - j. Evidence of communications involving Michael Cohen, Donald Trump and/or. agents or. associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen ougal. 73 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 175 of 201 k. Evidence of communications involving Michael Cohen, American Media, Inc, David Pecker, and/or Dylan Howard about Donald Trump, the. Trump Campaign, Stephanie Clifford, and/or Karen McDougal. 1. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. m. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative - publicity involving Trump?s n. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 0. Evidence relating to Cohen?s knowledge of the campaign finance laws, campaign contribution reporting requirements, and campaign contribution limits. p. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or finances; q. Communications, records, documents, and other files re?ecting false representations to a ?nancial institution related to the intended purpose of an account or lo an at that ?nancial institution; the nature of any business or entity associated with an account at a financial institution; the source of funds ?owing into an account; or the pmpose or nature of any ?nancial trans actions involving that financial institution; r. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. Procedures for Searching ESI A. Execution of Warrant for E81 57. Federal Rule of Criminal Procedure provides that a warrant to search for and seize property ?may authorize the seizure of electronic storage media or the seizure or 74 2017.08.02 - - ase 1.18 Document 48-2 Filed 07/18/19 Page 176 of 201 copying of electronically stored information . . . for later review.? Consistent with Rule 41, this application requests authorization to seize any computer devices and storage media and them to an appropriate law enforcement facility for review. This is typically necessary for a number of reasons: . 0 First, the volume of data on computer devices and storage media is often impractical for law enforcement personnel to review in its entirety at the search location.? 0 Second, because computer data is particularly vulnerable to inadvertent or intentional modification or destruction, computer devices are ideally examined in a controlled environment, such as a law enforcement laboratory, where trained personnel, using specialized software, can make a that can be subsequently reviewed in a manner that does not change the underlying data. 0 Third, there are so many types of computer hardware and software in use today that it can be impossible to bring to the search site all of the necessary technical manuals and specialized personnel and equipment potentially required to safely access the underlying computer data. 0 Fourth, many factors can complicate and prolong recovery of data from a computer device, including the increasingly common use of passwords, or other features or con?gurations designed to protect or conceal data on the computer, which often take considerable time and resources for forensic personnel to detect and resolve. 58. As discussed herein, Squire Patton Boggs is a functioning law firm that conducts legitimate business unrelated to Cohen? commission'of the Subject Offenses. Subject Premises- 2 is an of?ce located inside of Squire Patton Boggs?s New York office. In order to execute the warrant in the most reasonable fashion, law enforcement personnel will attempt to investigate on the scene of what computers or storage media,- if any, must be seized or copied, and what computers or storage media need not be seized or copied. Law enforcement personnel will speak with Squire Patton Boggs personnel on the scene as may be appropriate to determine which files and electronic devices within Subject Premises?2 belong to or were used by Cohen. While, based on the foregoing, it does not appear that Cohen shared electronic devices or a server with Squire Patton Boggs, where appropriate, law enforcement personnel will copy data, rather than physically seize . 75 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 177 of 201 computers, to reduce the extent of any disruption of Squire Patton Boggs?s operations. If, after inspecting the seized computers off?site, it is determined that some or all of this equipment is no longer necessary to retrieve and preserve the evidence, the Government will return it. 59. Additionally, because Cohen is an attorney, and claims to serve as a personal attorney for Trump, the review of evidence seized from the Subject Premises and Subject Devices will be conducted pursuant to established screening procedures to ensure that the law enforcement personnel involved in the investigation, including attorneys for the Government, collect evidence in a manner reasonably designed to protect any attorneyfclient-or other- applicableprivilege. When appropriate, the procedures will include use of a designated ??lter team,? separate and apart from the investigative team, in order to review potentially privileged communications and determine which communications to release to the investigation and prosecution team. B. Accessing ESI on the Subject Devices 60. As described above, the Subject Devices are both Apple brand devices. 61. I know from my training and experience, as well as from information found in publicly available materials including those published by Apple, that some models of Apple devices such as iPhones and iPads offer their users the ability to unlock the device via the use of a fingerprint or thumbprint (collectively, ?fingerp1?int?) in lieu of a numeric or alphanumeric passcode or password. This feature is called Toucth. I also know that the Apple iPhone offers its users the ability to unlock the device via the use of facial recognition (through infrared and visible light scans) in lieu of a numeric or alphanumeric passcode or password. This feature is called Face ID. 62. if a user enables Touch ID on a given Apple device, he or she can register up to 5 fmgerprints that can be used to unlock that device. The user can then use any of the registered 76 2017.08.02 - - ase 1.18 Document 48-2 Filed 07/18/19 Page 178 of 201 ?ngerprints to unlockthe device by pressing the relevant finger(s) to the device?s Touch ID sensor, which is found in the?round button (often referred to as the ?home? button) found at the bottom center of the front of the device. If a user enables Face ID on a given Apple device, he or she can unlock the device by raising the iPhone to his or her face, or tapping the screen. In my training and experience, users of Apple devices that offer Touch ID or Face 1D often enable it because it is considered to be a more convenient way to unlock the device than by entering a numeric or alphanumeric passcode or password, as well as a more secure way to protect the device?s contents. 63. In some circumstances, that . has either security feature enabled, and a- passcode or password must be used instead. These circumstances include: (1) when the device has just been turned on or restarted; (2) when more than 48 hours has passed since the last time the device was unlocked; (3) when the passcode or password has not been entered in the last 6 days, and the device has not been unlocked via Touch ID in the last 8 hours or the device has not been unlocked via Face ID in the last 4 hours; (4) the device has received a remote lock command; or (5) five unsuccessful attempts to unlock the device via Touch ID or Face ID are made. 64. The passcodes or passwords that would unlock the Subject Devices are not known to law enforcement. Thus, it will likely be necessary to press the ?ngers of the user of the Subject Devices to the devices? Touch ID sensor, or hold the Subject Devices in front of the user?s face to activate the Face ID sensor, in an attempt to unlock the devices for the, purpose of executing the search authorized by this warrant. Attempting to unlock the relevant Apple devices via Touch ID with the use of the fingerprints of the user, or via Face ID by holdi the device in front of the user?s face, is necessary because the government may not?otherwise be able to access the data contained on those devices for the purpose of executing the search authorized by this warrant. 77 2017.03.02 Ca - - se 1.18 Document 48-2 Filed 07/18/19 Page 179 of 201 65. Based on these facts and my training and experience, it is likely that Cohen is the user of the Subject Devices, and thus that his fmgerprints are among those that are able to unlock the Subject Devices via Touch ID or his face is able to unlock the Subject Devices via Face ID. 66 . Although I do not know which of a given user?s 10 fingerprints is capable of unlocking a particular device, based on my training and experience I know that it is common for a user to unlock a Touch IDuenabled Apple device via the fmgerpr?mts on thumbs or index fingers. In the event that law enforcement is unable to unlock the Subject Devices as described above within the five attempts permitted requiring the entry of a password or passcode before it can be unlocked. 67. I also know from my training and experience, and my review of publicly available materials published by Apple that Apple brand devices, such as the Subject Devices, have a feature that allows a user to erase the contents of the device remotely. By logging into the Internet, the user or any other individual who possesses the user?s account information can take steps to completely wipe the contents of the device, thereby destroying evidence of criminal conduct, along with any other information on the device. The only means to prevent this action is to disable the device?s ability to connect to the Internet immediately upon seizure, which requires either access to the device itself to alter the settings, or the use of specialized equipment that is not consistently available to law enforcement agents at every arrest. - 68. Due to the foregoing, I request that the Court authorize law enforcement to press the ?ngers (including thumbs) of Cohen to the Touch ID sensors the Subject Devices, or hold the Subject Devices in front of Cohen?s face, for the purpose of attempting to unlock the Subject Devices via Touch ID or Face ID in order to search the contents as authorized by this warrant. 78 2017.03,02 Case Document 48-2 Filed 07/18/19 Page 180 of 201 C. Review of E81 69. Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the E81 and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) will review the E81 contained therein for informa 'on responsive to the warrant. ementpersonnel may use various techniques to determine which ?les or other ESI contain evidence or fruits of the Subject Offenses. Such techniques may include, for example: surveying directories or folders and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); It conducting a ?le?byw?le review by ?opening? or reading the ?rst few ?pages? of such ?les in order to determine their precise contents (analogous to performing a cursory examination of each document in a ?le cabinet to determine its relevance); 0 ?scanning? storage areas to discover and possibly recover recently deleted data or deliberately hidden ?les; and - performing electronic keyword searches through all electronic storage areas to determine the existence and location of data potentially related to the subject matter of the investigations?i; and reviewing metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. 34 Keyword searches alone are typically inadequate to detect all relevant data. For one thing, keyword searches work only for text data, yet many types of ?les, such as images and videos, do not store data as searchable text. Moreover, even as to text data, there may be information properly subject to seizure but that is not captured by a keyword search because the information does not contain the keywords being searched. 79 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 181 of 201 71. Law enforcement personnel will make reasonable efforts to restrict their search to data falling within the categories of evidence speci?ed in the warrant. Depending-on the circumstances, however, law enforcement personnel may need to conduct a complete review of all the E81 from seized devices or storage media to evaluate its contents and to locate all data responsive to the warrant. Return of E81 72. If the Government determines that the electronic devices are no longer necessary to retrieve and preserve the data, and the devices themselves are'not-subj ectwtoeseizurepursuantto- Federal Rule of Criminal Procedure 41(c), the Government will return these items, upon request. Computer data that is or unreadable will not be returned unless law enforcement personnel have determined that the data is not an instrumentality of the offense, (ii) a fruit of the criminal activity, contraband, (iv) otherwise unlawfully p0ssessed, or evidence of the Subject Offenses. 80 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 182 of 201 IV. Conclusion and Ancillary Provisions 73. Based on the foregoing, I respectfully request the court to issue a warrant to seize the items and information speci?ed in Attachments A, B, C, D, and to this af?davit and to the Search and Seizure Warrants. 74. In light of the con?dential nature of the continuing investigation, I respectfully request that this af?davit and all papers submitted herewith be maintained under seal until the Court orders otheiwise. Special Agent - A FBI Sworn to before me on 8th day of April, 2018 Htm?v B-Q?tna? EON. HENRY B. PITMAN UNITED STATES MAGISTRATE JUDGE 81 2017.08.02 Case Document 48-2 ?Filed 07/18/19 Page 183 of 201 A0 93 (SDNY Rev. 05/10) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of New York I in the Matter of the Search of (Briefly describe the property to be searched or identi?: the person by name and address) Case No. Loews Regency Hotel, 540 Park Avenue, Room 1728, New York, New York 10065, and any closed containers/items contained therein, See Attachment - SEARGHANDSEIZUREWWARRANL . or To: - Any authorized law enforcement of?cer of the following person or property located in the Southern District of New Yo rk (identi?l the person or describe the property to be searched and give its location): Loews Regency Hotel, 540 Park Avenue, Room 1728, New York, New York 10065, and any closed containers/items contained therein, See Attachment The person or property to be searched, described above, is believed to conceal the person or describe the property to be seized): See Attachment I find that the or any recorded testimony, establish probable cause to search and seize the person or property. - YOU ARE COMZMANDED to execute this warrant on or before Ll i3 mat to 14 days) if in the daytime 6:any time in the day or night as I ?nd reasonable cause has been . established. . Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property . taken to the person ?rom whom, or ?om whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The of?cer executing this warrant, or an o?icer present during the execution of the Warrant, must prepare an inventory as required by law and return this warrant and inventory to the Clerk of the Court. Upon its return, this warrant and inventory should be ?led under sea] by the Clerk of the Court. USMJInitials I find that immediate noti?cation may have an adverse result listed in 18 U.S.C. 2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose property, will be searched 01? seiZed (check the appropriate box) El for days (not to exceed 30). Eluntil, the facts justifying, the later specific date of .. i Date and time issued: Q?gpig 7 rm peer. Huge, Q?s-g g: ngi' ?ask Jiidge ?s signature B. Pitman, U.S. Mauistrate Judoe City and state: New York, NY Hon. Henry - Printed name and ri?e Case Document 48-2 Filed 07/18/19 Page 184 of 201 A0 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any personCs) seized: Certi?cation I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the Cou1t. Date: Erecuting o?icer ?5 Signature Printed name and ri?e Case Document 48-2 Filed 07/18/19 Page 185 of 201 ATTACHMENT I. Premises to be Searched??Subj eet Premises~4 The premises to be searched (?Subject Premises?4?) are described as follows, and include electronic devices, and all locked and closed containers found therein: Room 1728 located inside the L0 ews Regency Hotel at 540 Park Avenue, New York, New York 10065 . The building is a luxury hotel located on Park Avenue and 61st Street. Subject Premises?4 is located on the 17th ?oor of the hotel. 1? e?Seized A. Evidence, Fruits, and Instrum entaiities of the Subject Offenses The items to be seized from Subject Premises?4 are evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy, as it pertains to the other Subject O??enses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(l)(A) and 30109(d)(l)(A)(1) (illegal campaign contributions) (the ?Subject Offenses? described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, andJor taxi medallions, from Janualy 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts hr liabilities, to others, including tc_and/ or entities associated with him. 0. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has . with Sterling and/or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. 6. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or from Michael D. Cohen 82; Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen 6?5 Associates. 1, f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, . and annual income, income scurces, and other assets, whether held personally or through entities, including tax returns, personal financial statements, and bank records, from January 1, 2013 to the present. 0? Evidence relating to agreements, loans, and/or ?nancial transactions between and/or entities controlled by Cohen and 13 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 186 of 201 and any payments by -to Cohen, from January h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. l3 AULL LU 1. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidencreiof ?communicationsvbetwenen Michael Cohen and Aiherican Media?Cine: David Pecker, and/or Dylan Howard about Donald Tlump, the Trump Campaign, Stephanie Clifford, and/ or Karen ougal. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/ or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others in connection with the election. 11. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getael and/or other accountants, . relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, ??om January 1, 2013 to the present. p. CommunicatiOns, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a financial institution; the source of funds ?owing into an account; or the purpose or nature of any A financial transactions involving that ?nancial institution, from January 1, 2013 to the present. q. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. B. Search and Seizure of Electronically Stored Information The items to be seized from Subject Premises-4 also include any computer devices and storage media that may contain any electronically stored information falling within the categories set forth in Section 11A of this Attachment above, including, but not limited to, a MacBoolc Pro, any other desktop and laptop computers, any Apple iPhone or other cellphone er smartphone 14 2017.08.02 Case Document 48-2 Filed 07/18/19? Page 187 of 201 belonging to Michael Cohen or in his possession, an Apple iPad Mini, portable hard drives, disk drives, thumb drives, and personal digital assistants. In lieu of seizing any such computer devices or storage media, this warrant also authorizes the-copying of such devices or media for later review. The items to be seized from Subject Premises?4 also include: 1. Any items or records needed to access the data stored on any seized or copied computer devices or storage media, including but not limited to any physical keys, devices, or records of login credentials, passwords, private keys, or similar information. 2. Any items or records that may facilitate a forensic examination of the computer eleethei'Linfermatien?? concerning the con?gtn?ation of the seized or copied computer devices or storage media. 3. Anyevideneeconcerningathe identitiesorlo cations. ofthosepersonswith.aecessto, control over, or ownership of the seized or copied computer devices or storage media. C. Review of ESI Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (which may include, in addition to law enforcement officers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the ESI contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: - surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les) - opening or cursorily reading the first few ?pages? of such ?les in order to determine their precise contents; a scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden files; a performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and reviewing metadata, system information, configuration files, registry data, and any other information re?ecting how, when, and by whom the computer was used. 15 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 188 of 201 Law enforcement personnel Will make reasonable efforts to search only for files, documents, or other electronically stored information Within the categories identi?ed in Sections ILA and ILB of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the ESI from seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ?filter team,? separate and apart from the investigative team, in order to address?potentialzprivileges; l6 2017.03.02 Case Document 48-2 Filed 07/18/19 Page 189 of 201 IV. Conclusion and Ancillary Provisions I 73. Based on the foregoing, I respectfully request the court to issue a warrant to seize the items and information speci?ed in Attachments A, B, C, D, anth to this af?davit and to the Search and Seizure Warrants. 74. In light of the con?dential nature of the continuing investigation, I respectfully request that this af?davit and all papers submitted herewith be maintained under seal until the Court orders otherwise. Special Agent FBI Sworn to before me on 8th day oprr112013 f/ w: r5; wet/Mn? HOE. HENRYB PITMAJV UNI NIAGISTRATE JUDGE 81 2017.08.02 Case 1: 18- -cr- -00-602 WHP Document 48- 2 Filed 07/18/19 Page 190 of 201 A0 93 (SDNY Rev. 05/10) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of New York 18MAG .2968 Case No In the Matter of the Search of (Brie?y describe the property to be searched or identify the person by name and address) Loews Regency Hotel, 540 Park Avenue, Room 1628, New York, New York 10065, and any closed containers/items contained therein, See Attachment A SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement of?cer An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or preperty located in the Southern District of New York (identify the person or describe the property to be searched and give its location): Loews Regency Hotel, 540 Park Avenue, Room 1628 (a suite encompassing rooms 1628, 1629, and 1630) (collectively, ?Room 1628?), New York, New York 10065, and any ctosed containers/items contained therein, See Attachment A The person or property to be searched, described above, is believed to conceal (tdentr??z the person or describe the property to be seizeaDI See AttachmentA 4 I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property. YOU ARE COMMANDEI) to execute this warrant on or before 1,1 a i (not to exceed-14 days) in the daytime 6:any time in the day or night as I find reasonable cause has been" established. . . Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt fo1 the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to the Clerk of the Court. [3 Upon its return, this warrant and inventory should be ?led under seal by the Clerk of the USMJ In1t1als I ?nd that immediate noti?cation may have an adverse result listed 1n 18 U. S. C. 2705 (except for' delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or Whose property, will be searched 01? seized (check the appropriate box) Elfor days (not to exceed 30). . Duntil, the facts justifying, the later speci?c date of Date and time issued: if We? 5w; i ,9 Judge' Stgnature f? City and state: New York. NY Hon Henry B. Pitman Magistrate Judge Pr1nted name and t1tle Case Document 48-2 Filed 07/18/19 Page 191 of 201 A0 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy of warrant and-inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: Certification I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the Court. Date: Executin cer?s Si nature Primed name and title Case Document 48-2 Filed 07/18/19 Page 192 of 201, ATTACHMENT A I. Premises to be Searched?Subject Premises-4 The premises to be searched (?Subject Premises?4?) are described as follows, and include electronic devices, and all looked and closed containers found therein: Room 1628 (a suite encompassing rooms 1628, 1629, and 1630) (collectively, ?Room 1628?), located inside the Loews Regency Hotel at 540 Park Avenue, New York, New York 10065. The building is a luxury hotel located on Park Avenue and 61st Street. Subject Premises? 4 is located on the 16th ?oor of the hotel. II. Items to Be Seized A. Evidence, Fruits, and Instrumentalities of the Subject Offenses The items to be seized from Subject Premises-4 are evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy, as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?), described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to and/or entities associated with him. c. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/or Melrose. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, from January 1, 2013 to the present. g. Evidence relating to agreements, loans, and/or ?nancial transactions between Cohen and ?and/or entities controlled by 2 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 193 of 201 and any payments by_to Cohen, from January 1, 2012 to the present. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc., Clifford, and/or Karen McDougal. k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/ or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. - m. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others 1n connection with the election. 11. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January 1, 2013 to the present. p. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into 'an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution, from January 1, 2013 to the present. q. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. B. Search and Seizure of Electronically Stored Information The items to be seized from Subject Premises-4 also include any computer devices and storage media that may contain any electronically stored information falling within the categories set forth in Section ILA of this Attachment above, including, but not limited to, a MacBook Pro, any other desktop and laptop computers, any Apple iPhone or other cellphone or smartphone 3 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 194 of 201 belonging to Michael Cohen or in his possession, an Apple iPad Mini, portable hard drives, disk drives, thumb drives, and personal digital assistants. In lieu of seizing any such computer devices or storage media, this warrant also authorizes the copying of such devices or media for later review. The items to be seized from Subject Premises-4 also include: 1. Any items or records needed to access the data stored on any seized or copied? computer devices or storage media, including but not limited to any physical keys, devices, or records of login credentials, passwords, private keys, or similar information. 2. Any items or records that may facilitate a forensic examination of the computer devices or storage media, including any hardware or software manuals or other information concerning the configuration of the seized or copied computer devices or storage media. 3. Any evidence concerning theidentities or locations of those persons with access to, control over, or ownership of the seized or copied computer devices or storage media. C. Review of ESI Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (which may include, in addition to law enforcement of?Cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: 0 surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outsideof a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); 0 opening or cursorily reading the ?rst few ?pages? of such ?les in order to determine their precise contents; 0 scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden ?les; 0 performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and 0 reviewing metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by Whom the computer was used. 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 195 of 201 Law enforcement personnel will make reasonable efforts to search only for files, documents, or other electronically stored information within the categories identified in Sections ILA and ILB of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the ESI from seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures shall include use? of a designated ?filter team,? separate and apart from the investigative team, in order to address potential privileges. 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 196 of 201 A0 93 (SDNY Rev. 05/10) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of New York In the Matter of the Search of (Brie?y describe the property to be searched or identi?) the person by name and address) Case No. Loews Regency Hotel, 540 Park Avenue, Room 1628, New York, New York 10065, and any ciosed containers/items contained therein, See Attachment A SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement of?cer An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or property located in the Southern District of New York (identify the person or describe the property to be searched and give its location): Loews Regency Hotel, 540 Park Avenue, Room 1628 (a suite encompassing rooms 1628, 1629, and 1630) (collectively, ?Room 1628"), New York, New York 10065, and any closed containers/items contained therein, See Attachment A The person or property to be searched, described above, is believed to conceal (identijy the person or describe the property to be seized): - See Attachment A I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property. YOU ARE COMMANDED to execute this warrant on or before Ll? i, Fig 7 (not to exceed 14 days) if in the daytime 6:00 am. to 10 pm. at any time in the day or night as I ?nd reasonable cause hasibeen established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to the Clerk of the Court. El Upon its return, this warrant and inventory should be ?led under seal by the Clerk of the Court. . USMJ Initials El I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C. 2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose property, will be searched 01? seized (check the appropriate box) leor days (not to exceed 30). Cluntil, the facts justifying, the later speci?c date of Judge ?5 signature Date and time issued: wi? 7 i 5: 5,31. ?12 City and state: New York. NY Hon. Henrv B. Pitman, U.S. Magistrate Judge Printed name and title Case Document 48-2 Filed 07/18/19 Page 197 of 201 A0 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) Return Case N0.: Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: Certi?cation I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the Court. Date: Executing o??z?cer ?s signature Printed name and title Case Document 48-2 Filed 07/18/19 Page 198 of 201 ATTACHMENT A I. Premises to be Searched?Subject Premises-4 The premises to be searched (?Subject Premises?4?) are described as follows, and include electronic devices, and all looked and closed containers found therein: Room 1628 (a suite encompassing rooms 1628, 1629, and 1630) (collectively, ?Room 1628?), located inside the Loews Regency Hotel at 540 Park Avenue, New York, New York 10065. The building is a luxury hotel located on Park Avenue and 61st Street. Subject Premises- 4 is located on the 16th floor of the hotel. 11. Items to Be Seized A. Evidence, Fruits, and Instrumentalities of the Subject Offenses The items to be seized from Subject Premises?4 are evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy, as it pertains to the other Subject Offenses), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), and 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offenses?), described as follows: a. Evidence relating to Sterling National Bank, Melrose Credit Union, and/or taxi medallions, from January 1, 2013 to the present. b. Evidence relating to a plan, proposal, or agreement for Michael Cohen and/or entities associated with him to transfer anv interest in taxi medallions, and any associated debts or liabilities, to others, including to_1nd/or entities associated with him. c. Evidence relating to a plan, proposal, or agreement to modify loans that Cohen has with Sterling and/ or Melrose. d. Evidence relating to Essential Consultants, LLC, including any documents that indicate the nature and purpose of payments made to or from Essential Consultants or the nature of any work done by Cohen or any other individuals in connection with Essential Consultants. e. Evidence of income to Michael D. Cohen Associates, including any documents that indicate the nature and purpose of payments made to or from Michael D. Cohen Associates, or evidence of the purpose of accounts opened in the name of Michael D. Cohen Associates. f. Evidence relating to Cohen?s net worth, available cash and cash equivalents, and annual income, income sources, and other assets, whether held personally or through entities, including tax returns, personal ?nancial statements, and bank records, from January 1, 2013 to the present. g. Evidence relating to agreements, loans, and/or ?nancial transactions" between Cohen and ?and/or entities controlled by 2 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 199 of 201 ay-aa 1, 2012 to the present. h. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. i. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. j. Evidence of communications between Michael Cohen and American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougal. k. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. 1. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape and other potential sources of negative publicity involving Trump?s relationship in the run up to the election. . n1. Evidence relating to any reimbursement or other promises made to Cohen for payment to Clifford or others 1n connection with the election. n. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. 0. Communications with others, including Jeffrey Getzel and/or other accountants, relating to Cohen?s bank accounts, taxes, debts, and/or ?nances, from January I, 2013 to the present. p. Communications, recOrds, documents, and other ?les re?ecting false representations to a ?nancial institution related to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution, from January 1, 2013 to the present. q. Evidence of Cohen?s intent as it relates to the Subject Offenses under investigation. B. Search and Seizure of Electronically Stored Information The items to be seized from Subject Premises-4 also include any computer devices and storage media that may contain any electronically stored information falling within the categories set forth in Section ILA of this Attachment above, including, but not limited to, a MacBook Pro, any other desktop and laptop computers, any Apple iPhone or other cellphone or smartphone 3 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 200 of 201 belonging to Michael Cohen or in his possession, an Apple iPad Mini, portable hard drives, disk drives, thumb drives, and personal digital assistants. In lieu of seizing any such computer devices or storage media, this warrant also authorizes the copying of such devices or media for later review. The items to be seized from Subject Premises-4 also incltide: 1. Any items or records needed to access the data stored on any seized or copied computer devices or storage media, including but not limited to any physical keys, devices, or records of login credentials, passwords, private keys, or similar information. 2. Any items or records that may facilitate a forensic examination of the computer devices or storage media, including any hardware or software manuals or other information concerning the con?guration of the seized or copied computer devices or storage media. 3. Any evidence concerning theidentities or locations of those persons with access to, control over, or ownership of the seized or copied computer devices or storage media. C. Review of ESI Following seizure of any computer devices and storage media and/or the creation of forensic image copies, law enforcement personnel (which may include, in addition to law enforcement of?Cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the E81 contained therein for information responsive to the warrant. In conducting this review, law enforcement personnel may use various techniques to locate information responsive to the warrant, including, for example: 0 surveying various ?le ?directories? and the individual ?les they contain (analogous to looking at the outside of a ?le cabinet for the markings it contains and opening a drawer believed to contain pertinent ?les); 0 opening or cursorily reading the ?rst few ?pages? of such ?les in order to determine their precise contents; 0 scanning storage areas to discover and possibly recover recently deleted ?les or deliberately hidden ?les; 0 performing key word searches through all electronic storage areas to determine whether occurrences of language contained in such storage areas exist that are intimately related to the subject matter of the investigation; and reviewing metadata, system information, con?guration ?les, registry data, and any other information re?ecting how, when, and by whom the computer was used. 2017.08.02 Case Document 48-2 Filed 07/18/19 Page 201 of 201 Law enforcement. personnel will make reasonable efforts to search only for ?les, documents, or other electronically stored information within the categories identi?ed in Sections HA and ILB of this Attachment. However, law enforcement personnel are authorized to conduct a complete review of all the E81 from seized devices or storage media if necessary to evaluate its contents and to locate all data responsive to the warrant. Additionally, review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 2017.08.02 Case Document 48-3 Filed 07/18/19 Page 1 of 67 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Information TO BE FILED UNDER SEAL Associated with the Email Accounts rammn mm, AGENT AFFIDAVIT 7 . Maintained at Premises Controlled by Google, Inc., the Email Account . Maintained at Premises Controlled by Oath, Inc., and the Email Account maintained at Premises Controlled by 1 1 Internet, Inc., USAO Reference No. 201 8R00127 Agent Af?davit in Support of Application for a Search Warrant for Stored ElectronicCommunications STATE OF NEW YORK ss. COUNTY OF NEW YORK Special Agent-of the United States Attorney?s Of?ce for the Southern District of New York, being duly sworn, deposes and states: I. Introduction A. Af?ant 1. I am a Special Agent with the United States Attorney?s Of?ce for the Southern District of New York (the I have been a Special Agent with the USAO since August 2016. I previously served as a Special Agent with the United States Department of Labor Inspector General from May 2011 to August 2016. In the course of my experience and training in these positions, Ihave participated in criminal investigations into federal offenses involving a Wide array Case Document 48-3 Filed 07/18/19 Page 2 of 67 of ?nancial crimes, including frauds on ?nancial institutions. I also have training and experience executing search warrants, including those authorizing the search of email accounts. B. The Provider, the Subject Account and the Subject Offenses 2. Imake this af?davit in support of an application for a search warrant pursuant to 18 U.S.C. 2703 for all content and other information associated with the email accounts -@gmail.com (the ?Cohen Account?), (the (the Account?), (the Account?), and -@aol.com (the ?I-Account?) (collectively, the ?Subject Accounts?). The Cohen Account, i?Account, and Account are maintained and controlled by Google, Inc., headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043 (?Google?), the Account is maintained and controlled by 1 1-Internet, Inc., headquartered at 701 Lee Road, Suite 300, Chesterbrook, 19087 and th-Account is maintained and controlled by Oath, Inc., 22000 AOL Way, Dulles, Virginia 20166 (?Oath?) (together, the ?Providers?). The information to be searched is described in the following paragraphs and in Attachments A, B, and to the proposed warrants. 3. As detailed below, there is probable cause to believe that the Subject Accounts contain evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to defraud the United States), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud) (collectively, the ?Subject Offenses?). The Target Subjects of this investigation are MICHAEL COHEN (?Cohen?) and others known and unknown. This af?davit is based upon my personal knowledge, my review of documents produced pursuant to grand jury subpoenas and prior search warrants, my review of interview reports prepared by other law enforcement of?cers, and my conversations with other law enforcement of?cers, as well as it 2 . 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 3 of 67 my training and experience concerning the use of email in criminal activity. Because this affidavit is being submitted for the limited purpose of establishing probable cause, it does not include all the facts Ihave learned during my investigation. Where the contents of documents and the actions, statements, and conversations of others are reported herein, they are reported in substance and in part, except where otherwise indicated. C. Services and Records of the Provider 4. I have learned the following about the Providers: a. The Providers offer email services to the public. In particular, Google permits subscribers to maintain email accounts under the domain name gmail.com. Google also allows a subscriber to maintain email accounts under any domain name under the subscriber?s control. For example, if a subscriber controls the domain name Google enables the subscriber to host any email address under this domain name on servers operated by Google. Oath permits subscribers to maintain email accounts under the domain name aol.com. 1 permits subscribers to maintain email accounts under any domain name under the subscriber?s control. For example, if a subscriber controls the domain name_? 1 1 enables the subscriber to host any email address under this domain name on servers operated by -1 1. A subscriber using the Providers? services can access his or her email account from any computer connected to the Internet. b. The Providers maintain the following records and information with respect to every subscriber account: i. Email contents. In general, any email (which can include attachments such as documents, images, and videos) sent to or ?'om a subscriber?s account, or stored in draft form in the account, is maintained on the Providers? servers unless and until the subscriber deletes the email. If the subscriber does not delete the email, it can remain on the Providers? computers 3 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 4 of 67 inde?nitely. Even if the subscriber deletes the email, it may continue to be available on the Provider?s servers for a certain period of time. ii. Address book. The Providers also allow subscribers to maintain the equivalent of an address book, comprising email addresses and other contact information of other email users. Subscriber and billing information. The Providers collect and maintain (typically unveri?ed) identifying information about each subscriber, including, for example, name, username, address, telephone number, and alternate email addresses. The Providers also maintain records concerning the date on which the account was created, the Internet protocol address of the user at the time of account creation, the current status of the account active or closed), the length of service, and the types of services utilized by the subscriber. Additionally, forpaying subscribers, the Providers maintain records of the subscriber?s means and source of payment, including any credit card or bank account number. iv. Transactional information. The Providers also typically retain certain transactional information about the use of each account on its system. This information can include records of login session) times and durations and the methods used to connect to the account (such as logging into the account through the Providers? website). v. Customer correspondence. The Providers also typically maintain records of any customer service contacts with or about the subscriber, including any inquiries or complaints concerning the subscriber?s account. A vi. Search history. Google and Oath also typically maintain records of any search history or web history associated with the subscriber?s account. 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 5 of 67 vii. Associated content. Google also typically maintains content and records relating to the following applications that are associated with its e?mail accounts: (A) ?Google Docs,? which provides document?editing software that can be used to create, share, store, and manage documents online; (B) ?Google Drive,? which enables users to store ?les on Google servers, where they can be accessed remotely by the user and others; and (C) ?Gchat? or ?Instant Messenger,? which provides a chat interface through which users can communicate with each other in real time. Oath also typically maintains content and records relating to AOL instant message, which provides a chat interface through which users can communicate with each other in real time. Preserved and backup records. The Providers also maintain preserved copies of the foregoing categories of records with respect to an account, for at least 90 days, upon receiving a preservation request from the Government pursuant to 18 U.S.C. The Providers may also maintain backup copies of the foregoing categories of records pursuant to its own data retention policy. D. Jurisdiction and Authority to Issue Warrant 5. Pursuant to 18 U.S.C. 2703(a), the Government may require a provider of an electronic communications service or a remote computing service, such as the Providers, to disclose all stored content and all non-content records or other information pertaining to a subscriber, by obtaining a warrant issued using the procedures described in the Federal Rules of Criminal Procedure 6. A search warrant under 2703 may be issued by ?any district court of the United States (including a magistrate judge of such a court)? that ?has jurisdiction over the offense being investigated.? 18 U.S.C. 2711(3)(A)(i). 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 6 of 67 7. When the Government obtains records under 2703 pursuant to a search warrant, the Government is not required to notify the subscriber of the existence of the warrant. 18 U.S.C. 2703 (3). Additionally, the Government may obtain an order precluding the Provider from notifying the subscriber or any other person of the warrant, for such period as the Court deems appropriate, where there is reason to believe that such noti?cation will seriously jeopardize an investigation. 18 U.S.C. 2705(b). E. Prior Applications 8. On or about July 18, 2017, in connection with an investigation being conducted by the Of?ce of the Special Counsel the Federal Bureau of Investigationi(?FBI?) sought and obtained from the Honorable Beryl A. Howell, Chief United States District Judge for the District of Columbia, a search warrant for emails in the Cohen Account sent or received between January 1, 2016 and July 18, 2017. On or about November 13, 2017, the FBI sought and obtained from Judge Howell search warrants for emails in the Cohen Account sent or received between June 1, 2015 and November 13, 2017, and emails in the Account sent or received between the opening of the account and November .13, 2017. The SCO has since referred certain aspects of their investigation into Cohen to the USAO, which is working with the New York Field Office. As part of that?referral, the SCO provided the USAO with emails and other content information obtained pursuant to the search warrants executed by the SCO, which had already been reviewed for privilege.1 As discussed below, this af?davit is based in part on my review of 1 In an abundance of caution, in a separate application the USAO has sought authorization, pursuant to Fed. R. Crim. P. 41, to review the emails obtained pursuant to the Prior Cohen Account Warrants for evidence related to certain additional conduct that was not the focus of the Prior Cohen Account Warrants. The emails obtained ?om the Prior Cohen Account Warrants that relate to that additional conduct do not form a basis for the instant application. 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 7 of 67 responsive materials produced pursuant to the July 18 and November 13, 2017 warrants (the ?Prior Cohen Account Warrants?). 9. On or about November 7, 2017, and January 4, 2018, as well as certain prior dates, the SCO sought and obtained from Judge Howell orders authorizing and extending the installation and use of pen registers and trap and trace devices to record communications sent to or from the Cohen Account. The SCO has provided pen register data obtained pursuant to those orders to the USAO. This af?davit, as discussed below, is based in part on my review of the pen register data obtained pursuant to the November 7, 2017 and January 4, 2018 orders (the ?Pen Register Data?). 10. On or about February 16, 2018, the USAO sought and obtained from the Honorable Debra Freeman, United States Magistrate Judge for the Southern District ofNew York, an order pursuant to 18 U.S.C. 2703(d) for email header information associated with the Account. This af?davit, as discussed below, is based in part on my review of email header information produced by 1 1 in response to that order (the Header Information?). 11. Probable Cause A. Overview 1 1. The United States Attorney?s Office for the Southern District of New York and FBI are investigating, amongother things, a schemeby Target Subject Michael Cohen to defraud multiple banks. Cohen is an attorney who currently holds himself out as the personal attorney for President Donald Trump, and who previously served for over a decade as an executive in the Trump Organization, an international conglomerate with real estate and other holdings. 12. The investigation has revealed that Cohen has made affirmative misrepresentations in and omitted material information from financial statements and other disclosures that Cohen provided .to multiple banks in connection with a transaction intended to relieve Cohen of approximately $22 million in debt he owed on taxi medallion loans from the banks. As set forth 7 02.28.2018 Case 1:18-cmr-00602-WHP Document 48-3 Filed 07/18/19 Page 8 of 67 in detail below, in these ?nancial statements, and in his oral and other written statements to these banks, Cohen appears to have intentionally omitted cash assets that he began receiving in 2017 from new consulting work; (ii) signi?cantly understated his total holdings of cash and cash equivalents; and failed to inform the banks from which he was seeking debt relief that he had agreed to make a $3.8 million cash payment to a third party, - in connection with - acquisition of the taxi medallions securing Cohen?s debt. By making these misrepresentations and material omissions, Cohen avoided making payments on his loans, and attempted to and had secured proposed agreements from the banks to relieve him of certain repayment obligations worth millions of dollars. 13. Based on my review of emails obtained from the Prior Cohen Account Warrants, Header Information, and documents produced pursuant to subpoenas, I have learned that Cohen has used the Cohen Account and/or Account to, among other things, communicate with and their attorney,? about the proposed transfer of Cohen?s medallions and associated debts; (ii) negotiate a pay-down of the principal amount of the taxi medallion loans; communicate with his accountant about the contents of the false financial statements at issue; and (iv) send those false ?nancial statements to banks. Additionally, i?Jsed the Account, ._Account and-Account, respectively, to communicate with Cohen about the status of the taxi medallion transaction, and to send relevant ?nancial statements to 7 banks. Accordingly, and as set forth in more detail below, there is probable cause to believe that the Subject Accounts will include evidence of the Subject Offenses. B. Cohen?s Statements to Sterling National Bank 14. As set forth in detail below, in 2014, Cohen, through limited liability corporations controlled by him and his wife, Laura Cohen, entered into a series of loans from Sterling 8 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 9 of 67 National Bank (?Sterling?) and the Melrose Credit Union (?Melrose?), secured by taxi medallions, for approximately $20 million. Though entered into by LLCs, the loans were also secured by personal guarantees in the names of both Cohen and his wife. Over time, as the taxi industry weakened and the medallions were devalued, Cohen sought to renegotiate the terms of those loans and/or relieve himself from their obligations, including the personal guarantees. As part of that effort, Cohen made a series of representations to Sterling and Melrose about his. net worth, assets, available cash, and ?nancial outlook. Speci?cally, based on my review of records maintained by Sterling and Melrose, and public sources concerning the taxi industry and the value of taxi medallions, as well as my review of reports prepared by law enforcement of?cers of interviews with a Sterling executive vice-president (the ?Sterling Employee-1?) and my participation in an interview with a Sterling employee (the ?Sterling Employee?2?), I have learned, among other things, the following: a. Taxi medallions are small metal plaques af?xed to taxis. Without a medallion, it is illegal to operate a taxi in cities with medallion systems, such as New York City. Cohen and his wife own multiple LLCs that collectively own 32 taxi medallions (each LLC owns two medallions).2 Cohen?s purchase of these New York taxi medallions was originally ?nanced by loans from Capital One Bank, for which the medallions served as collateral. Cohen was not a taxi operator, and leased his medallions to a third party. That third party made payments to Cohen, who in turn used some of those proceeds to pay his loan payments. b. In early 2014, Cohen became a customer of Sterling when he sought to re?nance a mortgage on a rental property that he owned. In or around April 2014, Cohen raised with Sterling 2 One of these companies, Mad Dog Cab Corp., was jointly owned by Sondra Cohen, who I believe is Cohen?s mother. 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 10sof 67 the prospect of re?nancing his taxi medallion loans, which were then at Capital One Bank. By in or about September 2014, Cohen began negotiating a lending transaction with Sterling that would allow Cohen to pay off his loans at Capital One and borrow more money ?om the then?increase in value of the medallions. According to Sterling Employee-1, in 2014, prior to the recent upheaval in the taxi industry?as a result of the emergence of ride?sharing services, such as Uber?taxi medallion loans were viewed by banks and investors as safe, short term credits, as the market value of taxi medallions was consistently rising. Consequently, taxi medallion loans?like the loans held by Cohen?were frequently re?nanced at increasing amounts as the value of the medallions rose. According to Sterling Employee-l, borrowers typically cashed out the increase in the loan amount and used the additional funds for other purposes. Cohen appears to have followed this approach in 2014, when he agreed to re?nance his medallion loans for approximately $22 million, which~ according to letters from Capital One Bank in Sterling?s ?les?was greater than his previous debt at Capital One Bank ($21 million, of which $14.6 million was. a line of credit to Cohen). This allowed Cohen to cash out the proceeds from the transaction. 0. Based on my review of records maintained by Sterling, have learned that on or about December 8, 2014, each of Cohen?s sixteen taxi medallion corporations entered into loan agreements and promissory notes with Sterling for the principal sum of $1,375,000, with repayment due on December 8, 2016. Each loan was signed by Michael or Laura Cohen, depending on who wasthe sole shareholder of the corporation. The loans were also each secured by a security agreement, datedthe same day, making the medallions collateral for the notes. To give Sterling additional security, Michael and Laura Cohen. signed personal guarantees and confessions of judgment, giving Sterling the right to pursue collection against the Cohens? personal assets were their corporations to default under the loan agreements. In total, Sterling agreed to lend 10 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 11 of 67 approximately $22 million to the Cohens? companies. Pursuant to participation agreements, Sterling transferred 45 percent of that debt to Melrose.3 Under the terms of Sterling?s participation agreements with Melrose, Sterling was precluded from amending or modifying the loans without the consent of Melrose. d. In evaluating Cohen?s requested re?nancing of the taximedallions, Sterling (and Melrose, consistent with its participation in the deal) conducted due diligence. At Sterling?s request, Cohen provided Sterling with a statement of ?nancial condition, dated August 1, 2014 (the ?August 2014 Financial Statement?), which indicated that Cohen had $100,740,000 in total assets, $23,550,000 in total liabilities, and a net worth of $77,190,000.4 From my review of Va Sterling credit memorandum, dated September 29, 2014, I know that Sterling viewed the transaction favorably because, accounting for loan payments, cash ?ows from the medallions were projected to be positive, the value of the collateral (as estimated by Sterling) exceeded $42 million, and the net worth of Cohenmwho was the direct obligor under the guarantee agreements?was over $77 million. An internal Sterling credit and risk rating analysis report, dated October 20, 2014, recommended approval of the loans for substantially the same reasons. e. Based on my review of records maintained by Sterling and public sources, I have learned that over time, the collateral backing Cohen?s loans (taxi medallions) lessened in value due to the rise in ride-sharing companies and signi?cant devaluation of taxi medallions. Additionally, Cohen began falling behind on loan payments to Sterling and Melrose. ?1 know from records maintained by Sterling and an interview with Sterling Employee?2 that, beginning in or around 3 Melrose, which had a business principally focused on taxi medallion loans, is now in conservatorship by the National Credit Union Administration 4 Cohen subsequently provided Sterling with a revised statement of ?nancial condition, also dated August 1, 2014, which reported assets of $99,420,000, total liabilities of $23,5 50,000, and a net worth of $75,870,000. 11 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 12 of 67 September 2015, Cohen told Sterling, in sum and substance, that the individual leasing Cohen?s medallions had fallen behind in making payments to Cohen, and that as a result, the cash ?ow from his taxi medallions had been reduced, leaving him with a shortfall of approximately $16,000 each month. For instance, I have reviewed an email frOmiSterling Employee?2, dated September 9, 2015, summarizing a call with Cohen?which'according to the email and toll records for Cohen?s cellphone occurred on September 8, 2015?during which Cohen told Sterling Employee-2, in sum and substance, about his cash ?ow problems and a shortfall of approximately $16,000. hithat same email, Sterling Employee?2 commented that despite Cohen?s statements, his personal financial information ?indicate a strong ability to make up the difference in payments.? Cohen, however, according to Sterling Employee-2, pushed the bank for a reduction in Cohen?s payments. i f. From my review of records maintained by Sterling and my participation in an interview with Sterling Employee-2, I have learned that Cohen and Sterling Employee-2 spoke again on September 28, 2015, and that during the call Cohen stated, in sum and substance, that the individual to whom Cohen leases the medallions had again reduced payments to Cohen. 1 know from my review of records maintained by Sterling that between in or about September 2015 and November 2015, Sterling raised the possibility?mboth internally and with Cohen?of Cohen posting his real estate holdings, personal residence, or some other collateral as additional security for the banks. According to these records, however, Cohen resisted these requests. From my review of loan documents and records maintained by Sterling, I know that in or about November 2015, as a result of Cohen?s representation that he was not earning suf?cient returns on his medallions to cover interest payments, Sterling and Melrose agreed to amend their loans with Cohen by, 12 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 13 of 67 among other things, reducing the interest rate Cohen paid to Melrose and extending the loan maturity date to DeCember 8, 2017. g. I know from interviews with Sterling Employee-1 and Sterling Employee-2, as well as emails I have reviewed, that in or about October 2016, Cohen told Sterling Employee?1 that Cohen had a potential buyer of his taxi medallions, named -who would agree to assume Cohen?s debt with Sterling and Melrose. Based on my review of records maintained by Sterling, as well as the interviews with Sterling Employee?1 and Sterling Employee?2 referenced . above, Iknow that by or before October 2016, Cohen had entered into negotiations to sell his sixteen corporate taxi medallions to who is a medallion owner and taxi operator, for the balance of the loans, which at the time was $21,376,000. I know from my review of records maintained by Sterling, and my participation in an interview with Sterling Employee-2, that as a condition of the transfer of the medallion loans?and because Sterling was unfamiliar with- ??Ster1ing requested that Cohen make a substantial principal payment on the loan, ,of approximately one million dollars, prior to the transfer. Cohen rejected this request initially. But on or about January 31, 2017, Cohen told Sterling Employee-1, in sum and substance, that he would make a one million dollar principal reduction payment in order to move forward with the medallion transfer deal with - Indeed, in an email sent from the Cohen Account to Sterling Employee-2 on or about February 22, 2017, Cohen confirmed that he ?agreed to pay down 1 million from the loan amount.? h. Pursuant to the participation agreements between Sterling and Melrose, Sterling was required to secure Melrose?s agreement-to participate in the transfer of the taxi medallion debt from Cohen to On or about April 17, 2017, Sterling sent a memorandum to . Melrose summarizing the terms of the proposed transaction, and noting the requirement that 13 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 14 of 67 Melrose agree to the terms. On or about May 2, 2017, emailed Sterling Employee?1 from the ._Account to inquire about the status of the transaction. Sterling Employee-1 responded to at the _Account that Melrose had agreed to the deal, and that Sterling would be sending a term sheet shortly. A i. In order for the banks to evaluate the proposed transaction fully, they requested ?nancial information from the parties. On or about October 26, 2016, a Sterling employee emailed the .-Account about the ?Cohen Medallion Purchase,? and stated order to proceed with the assumption of Michael?s loans,? Sterling needed certain ?nancial information _1t the _Account, that he would send a ?nancial statement and tax returns shortly. Additionally, on or about June 7, 2017, Sterling Employee-1 emailed Cohen to request an ?updated personal ?nancial statemen completed jointly with Cohen?s Wife, and Cohen?s most recent federal income tax retum. On or about June 8, 2017, Cohen emailed Sterling Employee?1 from the Cohen Account, attaching a Sterling personal ?nancial statement form that had been ?lled out by hand, which referenced a statement of ?nancial condition, dated May 1, 2017 (the ?May 2017 Financial Statement?), that was also attached. The May 2017 Financial Statement included a cover letter from Cohen?s accountant, Jeffrey Getzel, stating, in sum and substance, that the information in the statement came ?om Cohen and that Getzel had not con?rmed its accuracy or completeness. The May 2017 Financial Statement stated that Cohen had total assets of $41,955,000, total liabilities of $39,130,000, and a net worth of $2,825,000. The May 2017 Financial Statement indicated that Cohen?s assets were comprised of $1,250,000 in 14 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 15 of 67 cash, $26,155,000 in closely held companies (such as the taxi medallion entities and his real estate holdings), $3,200,000 in real estate investments, and his $11,000,000 personal residence. j. Based on my review of reports of law enforcement interviews of Sterling Employee?1, I have learned-that Sterling Employee?1 reviewed each line of the May 2017 Financial Statement with Cohen to, among other things, verify its accuracy, and Sterling Employee?l asked Cohen about the cash amount listed on the May 2017 Financial Statement. Cohen stated to Sterling Employee?1, in sum and substance, that the May 2017 Financial Statement Was accurate. k. On or about August 16, 2017, Sterling Employee?1 emailed Cohen at the Cohen Account and at the _Account, attaching a non-binding term sheet memorializing the potential transaction between Sterling, Melrose, Cohen, and - - On or about August 29, 2017, .emailed Sterling Employee?1 from the- Account, requesting that he be included on ?all future e?mails to and/or - - concerning this matter,? and providing propo?sededits to the term sheet. On or about August 30, 2017, Sterling Employee?l emailed _at the I 1 Account, Cohen at the Cohen Account, and i- at the _Account, and provided them with a revised term sheet. On or about September 5, 2017, Sterling Employee?1 sent? at the ._Account, Cohen at the Cohen Account, and-1t the .Account a copy of the executed term sheet. According to the term sheet, would borrow $20,000,000 from Sterling and Melrose, to be secured by the medallions that _was to acquire from Cohen. 1 1. As part of the agreement, according to the term sheet, $1,265,913 in principal (which is what would remain after the $20,000,000 payment on the outstanding loan balance) would be repaid by-Cohen and the two banks, with Cohen paying ?fty percent and the banks dividing the 15 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 16 of 67 remaining half of the balance. Based on my review of an internal Sterling credit memorandum, dated October 4, 2617, the parties reached a preliminary agreement that Cohen would pay $632,956 of the remaining $1,265,912 principal loan balance, and Sterling and Melrose would absorb $357,167 and $275,789 respectively in the form of charge?offs. According to Sterling Employee- . 1, Sterling was willing to divide the repayment of the outstanding principal balance?despite its prior insistence that Cohen make a principal pay-down of at least one million dollars?because . Cohen represented on a telephone call with Sterling Employee-l, in sum and substance, that he had insuf?cient liquidity to pay the full outstanding principal balance. As part of the agreement, Sterling and Melrose also agreed to relieve Cohen and his wife of the personal guarantees that they made on behalf of the LLCs. Thus, after completing the -transaction, Cohen would no longer I have had any outstanding obligations to Sterling or Melrose. m. Based on my review of emails sent by Sterling employees, I have learned that because the transaction between the parties was subject to full credit underwriting by Sterling and Melrose (as well as Melrose?s regulators at NCUA), in August and September 2017, Sterling required and requested-additional financial statements for Cohen and - for its credit underwriting process. In response to Sterling?s requests, on or about October 5, 2017, 2- - sent from the Account to a Sterling employee a copy of i- - personal ?nancial statement. The ?nancial statement lists the? Account as the email contact for?. Additionally, on or about October 5, 2017, Cohen, using the Cohen Account, re-sent Sterling Employee?2 a copy of his May 2017 Financial Statement. A day later, on October 6, 2017, Cohen, using the Cohen Account, emailed Sterling Employee?2 a statement of ?nancial condition, dated September 30, 2017 (the ?September 2017 Financial Statement?). 16 02.28.2018 . Case Document 48-3 Filed 07/18/19 Page 17 of 67 11. Like the May 2017 Financial Statement, the September 2017 Financial Statement included a cover letter from Jeffrey Getzel, Cohen? accountant, stating, in sum and substance, that the information in the statement came from Cohen, and that Getzel had not con?rmed its accuracy or completeness. The September 2017 Financial Statement stated that Cohen had total assets of $33,430,000, total liabilities of $45,630,000, and a negative net worth of $12,200,000. Notably, unlike Cohen?s May 2017 Financial Statement, the September 2017 Financial Statement represented to Sterling that Cohen had a negative net worth. The September 2017 Financial Statement indicated that Cohen?s assets were comprised of $1,250,000 in cash, $17,630,000 in closely held companies (such as the taxi medallion entities and his real estate holdings), 5 $3,200,000 in real estate investments, and his $11,000,000 personal residence (which, for the first time, he indicated was held in trust). The September 2017 Financial Statement included assets and liabilities not held in Cohen?s name, such as various entities associated with his taxi medallions and some? of his real estate investment entities. 0. From my participation in an interview with Sterling Employee-2, and my review of records maintained by Sterling, I have also learned that at or around the time Cohen provided Sterling with these ?nancial statements?in or around September 2017?Cohen stopped paying loan payments on his taxi medallion loans altogether. According to Sterling Employee- 2, Cohen informed Sterling, in sum and substance, that he had insufficient funds to pay the principal and interest payments on his medallion loans. By in or about December 2017, Sterling and Melrose had not been paid approximately $276,937.92 in principal and interest payments on the medallion loans. Based on Cohen?s ?nancial condition as conveyed in the 5 Notably, the September 2017 Financial Statement valued each of Cohen?s thirty?two New York taxi medallions at approximately $180,187.50, which was considerably less than the $650,000 valuation ascribed to each medallion in the . 17 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 18 of 67 September 2017 Financial Statement, and his delinquency in making payments to Sterling, among other things, the bank?s credit underwriting committee determined (and memorialized in a December 2017' memorandum) that the Cohen~?- transaction was favorable for the bank that is, that -would be a better borrower than Cohen. p. On or about December 26, 2017, Sterling sent Cohen a demand letter requesting the immediate receipt of past~due loan payments. On December 29, 2017, Sterling sent Cohen a letter stating that he was in default under the loans between Sterling and Cohen?s medallion corporations. Cohen did not make an immediate payment on the loans, but instead sent an e~rnail to Sterling Employee-1 on or about January 24, 2018, from the Cohen Account, stating that during the closing of the Cohen?'- transaction, Cohen would ?bring all payments up to date as, well as deposit the payoff differential.? Cohen also requested by email sent from the Cohen Account on January 24, 2018, that at the closing of the Cohen?- transaction, Sterling provide a letter stating that all of Cohen?s debts have been satis?ed and that Cohen?s personal guarantees of the medallion loans had been terminated. q. The Cohen-?- transaction, however, did not close. On or about January 29, 2018, i-the -attorney, emailed attorneys for Sterling ?om the-xccount and stated that ?at this time there is no deal with Michael Cohen. Some of the numbers have changed and we are not prepared to go forward.? r. Based on my participation in the interview with Sterling Employee-2 and my review of records maintained by Sterling, I know that after the Cohen~- deal fell apart, - Sterling assigned Cohen?s loans to an employee at Sterling who specializes in collecting on defaulting loans (?Sterling From my review of telephone call notes, I know that Sterling Employee?3 spoke to Cohen on or abOut January 30, 2018 about paying down and/or 18 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 19 of 67 restructuring Cohen?s outstanding taxi medallion loans. Based on my review of an email between Sterling Employee-3 and Cohen, 1 know that on the January 30, 2018 call, Cohen stated that he would send a ?corrected current? version of his personal ?nancial statement. Following that call, on or about January 31, 2018, Cohen emailed Sterling Employee?3 from the Cohen Account a copy of the September 2017 Financial Statement. Later that day, Cohen again emailed Sterling Employee~3 from the Cohen Account and proposed paying $500,000 to bring the loans current and $750,000 to bring the principal balance to $20,500,000. Cohen also suggested revised interest payment amounts. On or about January 31, 2018, Sterling Employee-3 responded to A Cohen at the Cohen Account and stated, in sum and substance, that Cohen would need to pay the entirety of the overdue payments and pay down the principal balance of the loan to $20,000,000 (in total, a payment of approximately $1,750,000), and would need to make larger interest payments. I 5. On or about February 1, 2018, Cohen emailed Sterling Employee-3 from the Cohen Account and proposed ?[p]ayment of $1.250m which ALL can be used to pay down principal, if [Sterling] will waive past due amounts,? but stated do NOT have more than the $1.250m.? (Emphasis in original.) Cohen also stated, in sum and substance, that he had insuf?cient ?nancial resources to post additional collateral or pre~fund payments. Based on my participation in an interview with Sterling Employee?2, I have learned that Sterling continues to renegotiate the I medallion loans with Cohen based on Cohen?s representations about his current ?nancial position. 19 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 20 of 67 C. Cohen Made Material Misrepresentations About His FinanCes to Banks Cohen Concealed from Sterling and Melrose Cash Derived from Consulting Work 15. As set forth in detail below, despite multiple representations by Cohen to Sterling (and, by extension, Melrose6) that he had insuf?cient funds to pay down the principal balance of the medallion loans, make interest payments, or pay past-due amounts, it appears that between 2016 and the present, Cohen opened and maintained bank accounts at First Republic Bank (?First Republic?), and then received millions of dollars in purported consulting payments in these accounts, which he did not disclose to Sterling. Cohen set up these accounts and received these funds during the very period in which he made disclosures to Sterling about his personal ?nances (including his assets and liabilities) and his ability to make payments on the medallion loans. In these disclosures to Sterling?and despite being asked about these bank accounts by his accountant?Cohen withheld information about liquid financial assets at First Republic. 16. Speci?cally, based on my review of documents and bank records produced pursuant to a subpoena by First Republic, and my participation in and review of reports of interviews with two First Republic employees, I have learned, among other things, the following: a. Cohen and his wife have been customers of First Republic since approximately June 2011. Cohen controls several checking and loan accounts, some in his own name and others in the names of corporate entities. 6 Based on my review of a report of an interview conducted with an employee of Melrose, 1 have learned that, pursuant to the participation agreement between Sterling and Melrose, Cohen?s ?nancial statements and other records in Sterling?s possession were forwarded to Melrose so that Melrose could make a determination as to whether to approve of the Cohen? transaction. Based on my review of reports of interviews wier Melrose employees, 1 also know that Cohen called employees at Melrose regarding the Cohen- transaction. 20 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 21 of 67 b. On or about October 26, 2016, in Manhattan, New York, Cohen opened a new checking account at First Republic in the name of Essential Consultants LLC (the ?Essential Consultants Account?). Cohen was the only authorized signatory on the account. When Cohen opened the Essential Consultants Account, a First Republic employee (?First Republic Employee? conducted an in?person interview of Cohen. In response to a series of know?your?customer questions7 about the purpose of the account?the answers to which First Republic Employee-1 entered into a forms?mCohen stated, in sum and substance, that he was opening Essential Consultants as a real estate consulting company to collect fees for investment consulting work, and all of his consulting clients would be domestic individuals based in the United States. Cohen also stated, in sum and substance, that his purpose in setting up the account was to keep the revenue from his consulting business?which he said was not his main source of income?separate from his personal ?nances. As set forth below, there is probable cause to believe that Cohen?s statements about the intended purpose of the account and source of funds for the account were false. Speci?cally, the account was not intended to receive?and does not appear to have received?money in connection with?real estate consulting work; in addition, the account has received substantial payments from foreign sources. I 0. First, on or about October 27, day after he opened the Essential Consultants Account, Cohen used the account to wire $130,000 to an account held in the name of attorney Keith Davidson?s law ?rm. Based on my review of emails between Cohen and Davidson, 7 Certain fmancial institutions are required to conduct such procedures pursuant to the Bank Secrecy Act and its implementing regulations. See 31 U. S. C. 5318; 31 CPR. 1020.220. 8 First Republic Employee? ?1 ?rst ?lled out the form on the day he interviewed Co,hen October 26, 2016. On or about December 19, 2016, at the request of bank compliance personnel, First Republic Employee~ 1 updated the form to add more detail about Cohen?s statements. 21 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 22 of 67 obtained pursuant to the Prior Cohen Account Warrants, I believe that this payment did not relate to any real estate consulting work, but rather was a ?settlement? payment made to Davidson?s client. 9 Based on my review of public sources, I have learned that Davidson?s client is alleged to have had an extramarital affair with Donald Trump. On or about February 13, 2018, Cohen made a public statement that a private transaction in 2016, I used my own personal funds to facilitate a payment of $130,000 to [Davidson?s client].? d. Second, lknow from my review of First Republic bank records that were scheduled by an FBI forensic accountant that after Cohen opened the Essential Consultants Account, Cohen received payments into that account from foreign'businesses and entities that do not re?ect the stated client pro?le for the residential and commercial real?estate consulting services. "Speci?cally, from my review of the Essential Consultants Account schedule and public sources, I know the following: i. Beginning on or about January 31, 2017, Cohen began receiving payments of $83,333 from an entity called ColumbusNova LLC, which were deposited into the Essential Consultants Account. According to public sources, Columbus Nova is an investment management firm controlled by Renova Group, an industrial holding company based in Zurich, Switzerland that is controlled by Russian national Viktor Vekselberg. From January 2017 to August 2017, the Essential Consultants Account received seven payments totaling $583,332.98 from Columbus Nova LLC. 9 Specifically, have learned from my review of bank records that on or about October 26, 2016, Cohen transferred $131,000 from a home equity line of credit account at First Republic to the Essential Consultants Account; on or about October 27, 2016, Cohen transferred $130,000 from the Essential Consultant Account to an account held in the name of Davidson?s law ?rm at a bank based in Los Angeles; and on or about November 1, 2016, a wire transfer in the amount of approximately $96,645 was made from Davidson?s account to a bank account in the name of Davidson?s client. 22 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 23 of 67 ii. Beginning on or about April 5, 2017, Cohen began receiving payments from Novartis Investments, SARL, which I believe to be the in-house ?nancial subsidiary of the Swiss pharmaceutical company Novartis International AG (?Novartis?). Between April 2017 and January 12018, the Essential Consultants Account received ten wire payments from a Swiss bank account held in the name of Novartis, each in the amount of $99,980, for a total of $999,800. Beginning in or about April 2017, the Essential Consultants Account started receiving wire payments from a bank account associated with the telecommunications company Inc. Speci?cally, on or about April 14, 2017, wired $100,000 to the Essential ConsultantsAccount and, ?om in or about June 2017 to in or about January 2018, the Essential Consultants Account received nine $50,000 payments from In total, wired $550,000 to the Essential Consultants Account. iv. On or about May 10, 2017, June 9, 2017, July 10, 2017, and November 27, 2017, the Essential Consultants Account received four deposits in the amount $150,000 (totaling $600,000) from a bank account in South Korea. The account holder from which the money was sent is Korea Aerospace Industries Ltd. KAI is a South Korea-based company that produces and sells ?xed?wing aircraft, helicopter aircraft, and satellites to the United States Department of Defense, among other customers. v. On or about May 22, 2017, the Essential Consultants Account received a $150,000 deposit from an account at Kazkommertsbank, a Kazakhstani bank. The listed account holder at Kazkommertsbank was a second Kazakhstani bank named?BTA Bank, A0. A message accompanying the wire payment indicated that the payment was a consulting fee as per Inv DD May 10, 2017 consulting agreement DD 08 05 2017 CNTR 08/05/2017.? 23 02.28.2018 Case Document 48-3? Filed 07/18/19 Page 24 of 67 vi. In total, from on or about January 31, 2017 to on or about January 10, 2018, the Essential Consultants Account received approximately $2,883,132.98 in transfers and checks from the aforementioned entities. As of on or about January 10, 2018, the balance in the Essential Consultants Account'was $1,369,474.23. e. On'or about April 4, 2017, Cohen opened another newchecking account at First Republic, this one in the name of Michael D. Cohen Associates, PC. (the Account?). Cohen was the only authorized signatory on the account. Among other things, the Account received ten wire transfers and one check ?om an account in the name of Squire Patton Boggs, a law ?rm. In total, from on or about April 5,2017, to on or about January 2, 2018, the Account received $426,097.70 in deposits, and the balance in the account as of January 2, 2018, was $344,541.35. As discussed below, Cohen never disclosed any of the balance in the Essential Consultants or accounts to Sterling during the negotiations with respect to the - transaction, including in his May 2017 Financial Statement and September 2017 Financial Statement. 17. Based on my review of emails from the Cohen Account that were seized pursuant to the Prior Cohen Account Warrants, and my review of reports of interviews with employees of and Novartis, it appears that the aforementioned payments to the Essential Consultants Account and Account ostensibly were for political consulting work, including consulting for international clients on issues pending before the Trump administration.10 Specifically, from my review of emails from the Cohen Account and public sources, I have learned the following: 10 Based on my review of public sources, I have learned that Cohen is not registered as a lobbyist or as a person acting as an agent of foreign principals, as may have been required by the Foreign Agents Registration Act. 24 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 25 of 67 a. On or about April 28, 2017, Cohen sent an email from the Cohen Account to an individual whom I believe is af?liated with KAI. In the email, Cohen attached a document purporting to be a ?Consulting Agreement? between KAI and Essential Consultants dated as of about May 1, 20.17. The document indicates that Essential Consultants would render ?consulting and advisory services, as requested? by KAI, and that KAI would pay Essential Consultants ?a consulting fee of One Million Two Hundred Thousand US Dollars,? disbursed through eight $150,000 installments between Mayl2017 and December 2017. b. On or about May 10, 2017, Cohen sent an email ?om an alternate email address, copying the Cohen Account, to an employee of BTA Bank. To the email, Cohen attached an invoice to BTA Bank in the name of Essential Consultants. The invoice contemplated a $150,000 payment to Essential Consultants for a consulting fee.? c. On or about February 13, 2017, Cohen emailed an employee from the Cohen Account what appears to be a consulting agreement, which contemplates that Essential Consultants ?shall render consulting and advisory services to and that would ?advise [Essential Consultants] of those issues and matters with respect to which Services desires [Essential Consultants]?s assistance and advice.? The contract calls for ?to pay the Consultant for his services . . . a consulting fee of Fifty Thousand ($50,000) Dollars . . . per month.? Based on my review of reports of interviews with employees, I have learned that retained Cohen to consult on political issues, including net neutrality, the merger between and Time Warner, and tax reform. d. Onor? about January 17, 2017, Cohen emailed to a representative of Novartis from . the Cohen Account a contract; between Novartis and Essential Consultants, which provides that Essential Consultants will ?provide consulting and advisory services to Novartis on matters that 25 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 26 of 67 relate to the repeal and replacement of the Affordable Care Act in the US and any other issues mutually agreeable to [Essential Consultants] and Novartis.? The contract provides for a ?consulting fee of One Million Two Hundred Thousand ($1,200,000) US dollars,? to be paid to Essential Consultants in even installments over the course of a year. Based on my review of reports of interviews with Novartis employees, I have learned that Novartis retained Cohen to provide political consulting services and to gain access to relevant policymakers in the Trump Administration. e. On or about April 3, 2017, Squire Patton Boggs, a law ?rm, announced on its website that is had formed a ?strategic alliance? with Michael D. Cohen Associates and would ?jointly represent clients.? 18. Despite the signi?cant amount of money that Cohen received into the Essential Consultants Account and the Account, and the cash balance in both accounts, Cohen did not disclose that information to Sterling or Melrose. Speci?cally, based on my review of documents provided by Getzel, and my review of notes and a? I have leamed the following: a. In or about May 2017, Getzel met with Cohen at a law ?rm in Manhattan, New York. At the meeting, Cohen told Getzel, in sum and substance, that he had set up a law practice called Michael D. Cohen Associates PC, and a consulting company called Essential Consultants LLC. Cohen told Getzel, in sum and substance, that he expected to earn $75,000 per month in connection with his law practice, and that he expected gross revenues for the consulting business to be between ?ve and six million dollars annually. b. In or about October 2017, if not earlier, Getzel was preparing a personal ?nancial statement for Cohen. On or about October 6, 2017, Getzel sent an email to Cohen at the Cohen 26 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 27 of 67 Account in which Getzel wrote that ?[a]ttached is a draft of the new PFS as of September 30, 2017? and attached a draft of the September 2017 Financial Statement. The draft statement re?ected that as of September 30, 2017, Cohen had only $1,250,000 in cash, total assets of approximately . $33,430,000 (comprised of taxi medallion interests, real estate interests, and his personal residence and property), and liabilities of approximately $45,630,000, leaving him purportedly over $12 million in debt. In the same email, Getzel questioned Cohen, in sum and substance, about the fact that the ?nancial statement did not list any assets associated with either the Essential Consultants Account or the Account: did not add any value for you[r] two operating entities Michael D. Cohen Associates POC [Sic] and Essential Consultants LLC. Please advise whether or not these should be disclosed and what value.? c. On or about October 6, 2017, Cohen called Getzel by telephone??which is re?ected on toll records for Cohen?s cellphone?and told Getzel, in sum and substance, not to include Essential Consultants or in the September 2017 Financial Statement because they had no value. d. On or about October 6, 2017, following? the call with Getzel, Cohen, using the Cohen Account, responded to Getzel?s email with the answer ?[l]ooks good?to me.? Cohen never directed Getzel to make any changes to his cash position as listed in the September 2017 Financial Statement. Neither Essential Consultants nor was listed on the September 2017 Financial Statement that was provided to Sterling. 19. Based on the foregoing, and from my review of bank records and emails sent by Cohen to Sterling, I know that the September 2017 Financial Statement made no mention whatsoever of assets that Cohen held in the Essential Consultants Account or the Account. As of September 30, 2017?the date of the September 2017 Financial Statement?Cohen had 27 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 28 of 67 approximately $673,729.95 in the Essential Consultants Account and $248,619.28 in the Account. As of October 6, 2017, the date when Getzel asked Cohen about the two accounts, Cohen had approximately $823,709.95 in the Essential Consultants Account and $248,619.28 in the Account. Cohen Understated His Available Cash 20. In addition to withholding the existence of the Essential Consultants Account and the Account from Sterling and Melrose, it appears that Cohen also substantially understated his available cash and cash equivalents in his ?nancial disclosures. Speci?cally, I know from my review of the September 2017 Financial Statement that Cohen provided to Sterling that Cohen represented that he had $1,250,000 in cash as of September 30, 2017. But, from my review of a summary of bank records that were scheduled by an FBI forensic accountant, I have learned that Cohen had over $5,000,000 in cash and cash equivalents as of September 30, 2017. Speci?cally, from my review of the account schedule and bank records, I have learned the following: 21. Cohen has three Checking and/or savings accounts at Capital One Bank, one of which is in his wife?s name. As of September 30, 2017, Cohen had $1,105,680.35 in his savings account, and $1,262,982.29 in total in the three accounts at Capital One Bank. b. Cohen has three accounts at Morgan Stanley in his name. As of September 30, 2017, the combined total in cash and cash equivalents in those three accounts was $1,270,600.41. c. As of September 30, 2017, Cohen had $260,689.18 in an account at Signature Bank. d. In addition to the Essential Consultants Account and Account at First . Republic, Cohen also had two joint checking accounts with Laura Cohen at First Republic. In total, as of September 30, 2017, Cohen had at least $1,876,209.27 in total in his four accounts at First Republic. 28 02.28.2018 Case - Document 48-3 Filed 07/18/19 Page 29 of 67 e. Cohen has an account at Bethpage Credit Union with $25,931.39 in it as of September 30, 2017. f. As of September 30, 2017, Cohen had $17,542.54 in accounts at Sterling. g. Cohen has two accounts at TD Bank?one in his name and one held jointly with his wife?and the total balance across the two accounts as of September 30, 2017 was $300,096.72. h. In total, as of September 30, 2017, Cohen had at least $5,014,051.30 in his accounts at Capital One Bank, Signature Bank, TD Bank, Bethpage Credit Union, First Republic, and Morgan Stanley. 21. Accordingly, based on the foregoing, it appears that Cohen?s representations to Sterling and Melrose that he did not have more than $1,250,000 were false, and that Cohen withheld information regarding approximately $5 million in funds from Sterling and Melrose, in order to secure favorable terms in his renegotiation of his medallion loan. Based on my participation in an interview with Sterling Employee-2, and my review of reports of interviews with Sterling Employee-1 and two Melrose employees, it is my understanding that that Sterling and Melrose would view Cohen?s understating of his assets as material to its decision whether to renegotiate Cohen?s medallion loans and on what terms, or approveof the transfer of these loans to Cohen Had a Side Agreement With - 22. As set forth in detail below, it appears that during the course of Cohen?s negotiations to sell his interest in taxi medallions and the associated debt to Cohen not only misrepresented his financial position to Sterling, but also failed to disclose a side deal he had negotiated with it a ears that agreed to a an above?market rice for PP Cohen?s taxi cab medalliOns, and in exchange, Cohen agreed to pay -approximately 29 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 30 of 67 $3.8 million in cash. Speci?cally, from my review of documents produced pursuant to a subpoena by Sterling, and reports prepared by law enforcement of?cers of interviews with Sterling Employee-1, as well as my participation in an interview with Sterling Employee?2, I have learned, among other things, the following: a. On or about September 5, 2017, an executed term sheet was circulated by Sterling Employee?1 to Cohen and? See supra 14(k). According to the term sheet, - - would borrow $20,000,000 from Sterling and Melrose, to be secured by the medallions that -was to acquire from Cohen. At a price of $20 million for thirty?two taxi medallions, the proposed transaction valued each medallion as worth $625,000. The term sheet also contemplated a $1,265,913 pay-down of the principal balance of the loan. The term sheet made no mention of a $3.8 million payment from Cohen to - or any other form of payment or fmancial transaction between the parties. b. Additionally, an internal Sterling credit memorandum, dated October 4, 2017, describing the terms of the Cohen-transaction and the new loan tc_did not mention any payments from Cohen to - including a $3.8 million payment. The memorandum also noted that the ?loan amount of indicates a purchase price per medallion? but ?it is recognized that this is not in line with current market values.? Indeed, according to an internal Sterling memorandum dated February 5, 2018, in the month of January 2018, taxi medallions sold for amounts ranging from $120,000 to $3 72,000. According to Sterling Employee-1 and Sterling Employee-2, they were never told that - agreed to a purchase price of $625,000 in exchange for a lump sum payment from Cohen, or that Cohen would make any payment to - 30 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 31 of 67 23. While Cohen and_ did not disclose any payment from Cohen to -in communications with Sterling, it appears that such a payment was contemplated. Indeed, based on my review of records maintained by Getzel, and a report prepared by law enforcement agents of an interview with Getzel, have learned the following, in substance and in part, regarding the proposed side-payment from Cohen to? a. On or about September 19, 2017, Getzel prepared a memorandum for Cohen entitled, ?Sale of NYC Medallion Entities and Debt Assumption? (the ?Getzel Memorandum?). The Getzel Memorandum summarized the proposed transaction between Cohen and - in part, as follows: ?Michael and Laura Cohen will transfer ownership of their 13 NYC medallion entities to a Buyer who will assume their bank indebtedness, upon the [Cohens?] paying down the debt portfolio of the 13 entities by $500,000 and a cash payment to the Buyer of b. According to Getzel, Cohen told him the parameters of the deal, including the payment of $3,800,000 to - but Getzel did not know where Cohen was going to obtain $3,800,000 to pay - As noted above, Cohen had more than $5,000,000 in cash and cash equivalents as of September 2017, but had only disclosed in his September 2017 Financial Statement that he had $1.25 million in cash. 24. Based on my review of records maintained by Sterling (as well as Melrose, the bank With the participating interest in the loans) and reports of interviews of representatives of Sterling (and Melrose), I have seen no evidence that Sterling, Melrose, or any other financial institution -was aware of the planned $3.8 million involved in the potential deal with Cohen and side payment from Cohen to - I 11 The reference to thirteen medallions appears to be an error by Getzel. Cohen and his wife together owned sixteen corporations, which in turn owned 32 taxi medallions. 31 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 32 of 67 D. Probable Cause Regarding the Subject Accounts 25. As set forth above, since at least September 2015, if not earlier, Cohen has told Sterling that he has dif?culty making payments on his medallion loans and, since at least October 2016, Cohen has been actively engaged in an attempt to sell his taxi medallions and the associated debts to_ In the course of doing so, Cohen has used the Cohen Account and/or Account to engage in email communications regarding the terms of the transactions and the at the Account, _at the 1- Account, and i- at the-Account. Speci?cally, as described above, there is probable cause to believe that the Subject Accounts have been used undisclosed side-payment with regarding the proposed Cohen?-. transaction with Sterling: a. Cohen has used the Cohen Account to, among other things, negotiate a pay-down of the principal amount of the loan, see supra 1i 14(g), to send term sheets to Sterling, see supra 11 140), to communicate with his accountant about the contents of ?nancial statements, see supra 11 16, to send ?nancial statements to Sterling, see supra 11 14(i), (1), to check on the status of the transaction as of January 24, 2018, see supra 1i 14(n), to negotiate a reduction of his debt with Sterling on or around January 31, 2018, see supra 1i 14(0), to tell Sterling on February 1, 2018, he does not have the ability to pay more than $1,250,000, see supra 11 14(p), and to communicate with individuals responsible for sources of payments to the Essential Consultants Account, see supra 1i 15. In other words, from the communications described above, it appears likely that the Cohen Account will contain recent evidence of the Subject Offenses, including communications and potential misrepresentations to Sterling, and evidence indicating that statements made to Sterling are false or misleading. b. _has used the _Account, to communicate about the proposed taxi medallion transaction with Cohen, which appears to have been discussed as early 32 02.28.2018 Document 48-3 Filed 07/18/19 Page 33 of 67 as October 2016. See supra Speci?cally, as described above, as early as May 2, 2017, I _used the - Account to inquire about the status of the transaction, see supra ll 14(h). He used the ?Account to exchange drafts of the proposed term sheet with Cohen, - and Sterling, see supra 11 140). The ._Account was also used by i-to send a personal ?nancial statement for_ to Sterling, see supra 11 14(1). The Z_Account was copied on emails ?orn the 1? Account about the transaction, see supra 11 14(i), and was listed on _?nancial statement as the contact email for_. see supra fl 14(m). Additionally, based on my review of Header Information, I know that on or about September 1, 2017?Hat or around the time the -and Cohen were negotiating a term the _Account to send and receive eight emails from Cohen at the Account. c. -has used the .chount to communicate with Sterling employees, Cohen, and ._about the proposed taxi medallion transaction since at least December 2016. See-supra 14(g), 24(0). Speci?cally, on or about August 29, 2017, -told Sterling that he should be included on ?all future e?mails? involving the proposed transaction, see supra 1] 140). Additionally, -was involved in making revisions to the parties? term sheets, and he told Sterling on January 29, 2018 that-would not go forward with the planned transaction, see supra 140), Accordingly, there is probable cause to believe that the -Account will contain evidence of the negotiations between Sterling and the parties, evidence of a payment from Cohen to -and the reasons for the collapse of the Cohen-?- transaction. 12 For instance, from records provided by Sterling, I know that on or about December 2, 2016,?sent an email to a Sterling employee using the? Account. The email forwarded correspondence between-who was using the? Account, and an employee of Capital One regarding extending i? loan with Capital One. 33 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 34 of 67 26. Additionally, it appears that Cohen set up the Account to receive emails he was previously receiving at the Cohen Account. Speci?cally, based on my review of records maintained by I have learned that on or about May 5, 2017, Cohen sent an email from the Account to a blind copy list of recipients stating that ?[d]ue to the overwhelming volume of phone calls and emails coming into my previous cellular number and e-mail address, I have elected to create for Clients Only the following. Kindly use this new information for all future contact and communications.? The signature line on the email listed ?Essential Consultants and ?Michael D. Cohen Associates, as well as the Account as the email address. 13 27. In addition, A based on my review of emails from the Account produced pursuant to the Prior Cohen Account Warrants and the Header Information, I have learned that Cohen has used the Account to send and receive emails from the Cohen Account, to communicate with the-Account, and to send and receive emails from other email accounts about his political consulting business. Additionally, from my review of the IVIDCPC Header Information, it appears that since the November 13, 2017 search warrant on the Account, Cohen has continued to send and receive emails at the Account that appear likely to be relevant to the commission of the Subject Offenses. For example, emails obtained pursuant to the Prior Cohen Account Warrants, as well as the Header Information have revealed the following: a. On approximately eight occasions in August and September 2017, while Cohen, were communicating about a term sheet for the CohenJ-taxi 13 Based on my review of emails from the Account obtained pursuant to subpoena, I have learned that Cohen has used the account to communicate with numerous individuals with whom he does not enjoy an attomey~client privilege, including some of the individuals described below. See in?a 27. 34 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 35 of 67 medallion transaction, see supra 1i 14(k), Cohen used the Account to send or receive emails from -it the-chount. For instance, on or about August 22, 2017, -used the -Account to send an email to Sterling Employee?1 and copied Cohen on the email at the Account. On the same day, Sterling Employee?1 responded to-at the-chount and Cohen at the Account. On or about August 22, 2017, Cohen also used the Account to send an email to Sterling Employee?1. b. As noted above, on or about September 1, 2017, Cohen used the Account to send or receive eight emails with the-Account. . 0. Cohen used the Account to send and receive emails from individuals who work at companies with whom it appears Cohen has a political consulting agreement. For example, beginning in April 2017?the same month when Cohen began receiving payments from see supra 1N 16(d), used the Account to send and receive emails from employees. These emails contain, among other things, invoices from Cohen to for consulting work by Cohen. Similarly, beginning in April 2017??which is also the month Cohen began receiving payments from Novartis for consulting work, see supra 16(d), Cohen used the Account to send and receive emails from employees of Novartis. These emails concern, among other things, invoices from Cohen and requests for Novartis for Cohen?s assistance on an initiative relating to drug pricing. d. From my review of the Header Information, I have learned that Cohen-has continued to use the Account to send and receive emails from individuals who work at companies with whom it appears Cohen had a political consulting agreement, such as Novartis and For instance, on approximately six occasions between November 28, 2017 and January 30, 2018, the Account was used to send and receive emails from accounts belonging to 305 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 36 of 67 individuals using @att.com email addresses. Similarly, on approximately seventeen occasions between December 1, 2017 and February 20, 2018, the Account was used to send and receive emails from accounts belonging to individuals using @novartis.com email addresses. Since November 15, 2017, the NIDCPC Account has also sent and received emails with individuals using the email domains @bta.kz, which I believe is the email domain used by employees of BTA Bank, see supra 111] 16(d), 17(b), and @squirepb.oom, which I believe is the email domain used by employees of the law firm Squire Patton Boggs?both of which Cohen appears to have a consulting relationship with, see supra 1W 16(e), 17(e). Accordingly, it appears that Cohen continues to use the Account to send and receive emails that will be relevant to whether he is maintaining a consulting business, what type of consulting work he is doing, and whether he is receiving money for that consulting work. 28. In addition to the foregoing, based on my review of the Pen Register Data, see supra 11 9, it appears that since the date of the last search warrant on the Cohen Account (129., November 13, 2017), Cohen has continued to use the Cohen Account to communicate with the - _Account, the -Account, and other email accounts that appear likely to be relevant to the commission of the Subject Offenses described above. For example, the Pen Register Data has revealed the following: a. Emails sent by the Cohen Account to the-chount on or about December 18, 2017 at 8:26 December 21, 2017 at 9:35 December 22, 2017 at 4:32 January 3, 2018 at 8:01 January 3, 2018' at 2:56 and January 4, 2018 at 3:31 pm. b. An email sent by the Cohen Account to the ._Account on or about January 25,2018 at 8:55 pm. 36 02.28.2018 . Case .. Document 48-3 Filed 07/18/19 Page 37 of 67 c. Emails from the Cohen Account to the email account on or about December 1, 2017 at 2:14 December 29, 2017 at 10:20 January 2, 2018 at 3:52 January 2, 2018 at 5:44 and January 8, 2018 at 6:38 pm. Based upon my review of emails contained in the Cohen Account, I have learned that the_ email account belongs to ef?ey Getzel, Cohen?s accountant, through whom Cohen made misrepresentations to ?nancial institutions, as discussed above. d. Emails from the Cohen Account to email accounts belonging to Sterling employees, including Sterling Employee?1, on or about January 25, 2018 at 10:23pm, January 26, 2018 at 12:55 January 29, 2018 at 5:30 January 29, 2018 at 8:29 January 30, 2018 at 6:44 pm. An email sent from the Cohen Account to A the email account on or about January 25, 2018 at 5:29 pm. As stated above, First Republic is the bank at which the Essential Consultants Account is held. f. Numerous emails sent from the Cohen Account to the email account including emails on or about December 4, 2017, at 2: 17 pm. and January 29, 2018 at 5:43 pm. Based upon the email address and domain name, as well as my review of reports of interviews and documents re?ecting that Cohen?s taxi medallions were leased. and operated by I believe that the ?-email address belongs to 29. Based on my review of records maintained by Sterling, I know that Cohen used the Cohen Account to send and receive documents related to the Cohen--transaction. Based on my training and experience, I know that Google allows users of e?mail accounts to easily save documents to ?le sharing and retention platforms such as Goo gle Docs and Google Drive. I 37 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 38 of 67 also know, from my training and experience, that users of e?mail accounts often use instant messaging interfaces linked to their email accounts. Further, I have learned that the Providers maintain records of search and web histories associated with email accounts and, based on my training and experience, users of e-mail accounts use associated web search browsers associated with a subscriber?s account to research topics they are e-mailing about. Accordingly, there is probable cause to believe that content information associated with the Subject Accounts will also contain evidence related to the Subject Offenses. 30. Thus, Irespeotfully submit that there is probable cause to believe that emails and other content information from the Subject Accounts will contain evidence of Cohen?s efforts to sell his taxi medallions and the associated debt, and his misrepresentations and omissions to Sterling and Melrose in connection with these negotiations. Although Cohen appears to have communicated with and 1- primarily through the Cohen Account and . Account, I know, based on my involVement in the investigation, that Cohen also used at least one other email account associated with his position at the Trump organization. Thus, I respectfully submit that there is probable cause to believe that emails and other content information from the Z_Account, - Account and i-Account since on or about October 1, 2016?the approximate date of when Cohen?s efforts to sell his taxi medallions and the associated debt began?will re?ect communications with the Cohen Account, Account, and possibly one or more additional accounts used by Cohen, and probable cause to believe that such emails will constitute evidence of Cohen?s commission of the Subject Offenses, including the extent to which Cohen did or did not inform other individuals involved in the conduct described above?such as?~of his misstatements and omissions to financial institutions. 3 8 02.28.2018 Case Document 48-3 Filed 07/18/19 I Page 39 of 67 31. Temporal Limitation. This application seeks all emails and other requested content information speci?ed in Attachments?A, B, C, and for the following periods: a. For the Cohen Account, this application seeks all emails sent, created, or received between November 14, 2017, and the date of the proposed warrant, inclusive. As described above, . pursuant to the Prior Cohen Account Warrants, the SCO obtained and provided to the USAO emails from the Cohen Account that were sent, created, or received before November 14, 2017. This application also seeks other information speci?ed above associated with the Cohen Account that was created between December 1, 2014 (the month when Cohen entered into the medallion loans with Sterling), and the date of the proposed warrant, inclusive. b. For the Account, this application seeks all emails sent, created, or received between November 14, 2017, and the date of the proposed warrant, inclusive. As described above, pursuant to a prior warrant, the SCO obtained and provided to the USAO emails from the Account that were sent, created, or received before November 14, 2017. I c. For the?Account and ._Account, this application seeks emails and all other content information speci?ed above sent, created, or received between October 1, 2016, and the date of the proposed warrant, inclusive. As described above, October 2016 is the month in which Cohen began negotiating the taxi medallion sale with the? d. For the - Account, this application seeks emails and all other content information speci?ed above sent, created, or received between December 1, 2016, and the date of the proposed warrant, inclusive. As described above, December 2016 is the month in which- began representing the-n relation to the taxi medallion transaction. E. Evidence, Fruits and Instrumentalities 32. Based upon the foregoing, I respectfully submit there is probable cause to believe that information stored on Google?s servers associated with the Cohen Account will contain evidence, 39 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 40 of 67 fruits, and instrumentalities of violations of the Subject Offenses, as more fully described in Section II of Attachment A to the proposed warrant for the Cohen Account and Account, including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the Cohen Account or Account. b. Communications, records, documents, and other ?les involving Sterling, Melrose, and/or taxi medallions; c. Communications, records, documents, and other ?les involving a plan, proposal, or agreement for Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to_and/or entities associated with him; i d. Communications, records, documents, and other ?les involving Essential Consultants, LLC or Michael D. Cohen Associates, including those which indicate the nature and purpose of payments made to or from Essential Consultants or Michael D. Cohen Associates; e. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who communicated with the Cohen Account and/or Account about any matters relating to Essential Consultants, LLC, or about any plan or proposal or agreement for Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to_and/ or entities associated with him; f. Communications between the Cohen Account and/ or Account and Jeffrey Getzel relating to Cohen?s bank accounts, taxes, debts, and/or ?nances; 40 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 41 of 67 g. Communications, records, documents, and other ?les reflecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; h. Evidence indicating how and when the Cohen Account and Account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; and i. Evidence indicating the Cohen Account and Account owner?s intent as it relates to the Subject Offenses under investigatidn. 33. Based upon the foregoing, I further submit there is probable cause to believe that information stored on Google 5 servers associated with the?Account and- .-5iccount will contain evidence, fruits, and instrumentalities of violations of the Subject Offenses, including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the_. Account and Account; b. Communications, records, documents, and other ?les involving a plan or proposal or agreement for Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to _and/or entities associated with him; 0. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who 41 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 42 of 67 communicated with the _Account ant?Account about any matters relating to any plan or proposal or agreement for Cohen and/ or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to - -1nd/or entities associated with him; d. Communications between the Account and? Account and others, including employees or representatives of Sterling, Melrose, or other financial regarding Cohen?s ?nances; e. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; f. Evidence indicating how and when the _Account and - -1 Account were accessed or used, to determine the geographic and chronological content of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating the?Account and _Account owners? intent as it relates to the Subject Offenses under investigation. 34. Based upon the foregoing, I further submit there is probable cause to believe that information stored on Oath?s servers associated with the-Account will contain evidence, fruits, and instrumentalities of violations of the Subject Offenses, including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the-Account; 42 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 43 of 67 b. Communications, records, documents, and other ?les involving a plan or proposal or agreement for Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to -and/or entities associated with him; 0. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who communicated with the -\ccount about any matters relating to any plan or proposal or agreement for Cohen and/or entities associated with him to transfer any interestin taxi medallions, and any associated debts or liabilities, to -and/or entities associated with him; d. Communications between the j-chount and others, including employees or representatives of Sterling, Melrose, or other ?nancial institution(s), regarding Cohen?s ?nances; and e. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution. Review of the Information Obtained Pursuant to the Warrant 35. Pursuant to 18 U.S.C. 2703(g), the presence of a law enforcement of?cer is not required for service of a search warrant issued under 2703, or for the collection or production of responsive records. Accordingly, the warrant requested herein will be transmitted to the Providers, which shall be directed to produce a digital copy of any responsive records to law enforcement personnel within 30 days from the date of service. Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the E81 and the 43 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 44 of 67 status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) will retain the records and review them for evidence, fruits, and instrumentalities of the Subject Offenses as speci?ed in Section of Attachments A, and to the proposed warrant. 36. In conducting this review, law enforcement personnel may use various methods to locate evidence, ?uits, and instrumentalities of the Subject Offenses, including but not limited to 7 undertaking a cursory inspection of all emails within the Subject Account. This method is analogous to cursorily inspecting all the ?les in a file cabinet in an office to determine which paper evidence is subject to seizure. Although law enforcement personnel may use other methods as well, particularly including keyword searches, I know that keyword searches and similar methods are typically inadequate to detect all information subject to seizure. As an initial matter, keyword searches work only for text data, yet many types of files commonly associated with emails, including attachments such as scanned documents, pictures, and videos, do not store data as searchable text. Moreover, even as to text data, keyword searches cannot be relied upon to capture all relevant communications in an account, as it is impossible to know in advance all of the unique words or phrases that investigative subjects will use in their communications, and consequently there are often many communications in an account that are relevant to an investigation but that do not contain any keywords that an agent is likely to search for. 37. 'Because Cohen and-re attorneys, the review of the content within the Subject Accounts will be conducted pursuant to established screening procedures to ensure that. the law enforcement personnel involved in the investigation, including attorneys for the Government, collect evidence in a manner reasonably designed to protect any attorney?client or otherapplicable 44 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 45 of 67 privilege. When appropriate, the procedures will include use of a designated ??lter team,? separate and apart from the investigative team, in order to review potentially privileged communications and determine which communications to release to the investigation and prosecution team. IV. Request for Non-Disclosure and Sealing Order? 38. The existence and scope of this ongoing criminal investigation are not publicly known. As a result, premature public disclosure of this af?davit or the requested warrants could alert Cohen that he is under investigation, causing him to destroy evidence, ?ee from prosecution, or otherwise seriously jeopardize the investigation. I In particular, based on my experience investigating white collar cases, including cases featuring documents such as agreements, drafts of agreements, notes of conversations, and other documentary evidence, premature disclosure of an investigation may cause the target of the investigation to attempt to destroy or conceal such evidence. In addition, as also set forth above, Cohen uses computers and electronic communications in furtherance of his activity and thus could easily delete, or otherwise conceal such digital evidence from law enforcement were he to learn of the Government?s investigation. See 18 U.S.C. 2705(b)(3). Cohen also appears to have the ?nancial means that would facilitate his ?ight from prosecution. See 18 U.S.C. 2705(b)(2), (5). 39. Accordingly, there is reason to believe that, were the Providers to notify the subscriber or others of the existence of the warrant, the investigation would be seriously jeopardized. . Pursuant to 18 U.S.C. 2705 Itherefore respectfully request that the Court direct the Providers not to notify any person of the existence of the warrant for a period of 180 days from issuance, subject to extension upon application to the Court, if necessary. 40. For similar reasons, I respectfully request that this af?davit and all papers submitted herewith be maintained under seal until the Court orders otherwise, except that the Government be permitted without further order of this Court to provide copies of the warrant and af?davit as 45 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 46 of 67 need be to personnel assisting it in the investigation and prosecution of this matter, and to disclose those materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. V. Conclusion 41. Based on the foregoing, I respect?rlly request that the Court issue the warrants sought herein pursuant to the applicable provisions of the Stored Communications Act, 18 U.S.C. 27 (for contents) and 2703(c)(1)(A) (for records and other information), and the relevant provisions of Federal Rule of Criminal Procedure 41. United States Attorney?s Office Southern District of New York Sworn to before me this 28th day of February, 2018 iis>izifF5i ?ii 2' rial i, I: i )t LE GABRIEL w. NSTEIN Tl. rited States Magistrate ?ge them Districpsfit?wemic 46 02.28.2018 Case Document 48-3 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Information Associated with the Email Account naintained at Premises Controlled by 1 Internet, Inc., USAO Reference No. 201 8R00127 SEARCH WARRANT AND ON-DISCLOSURE ORDER TO: 1 1 Internet, Inc. (?Provider?) United States Attorney?s Of?ce for the Southern District of New York and the Federal Bureau of Investigation (collectively, the ?Investigative Agencies?) 1. Warrant. Upon an af?davit of Special Agent-of the United States Attorney?s Of?ce for the Southern District of New York, and pursuantto the provisions of the Stored Communications Act, 18 U.S.C. ?7 2703(b)(1)(A) and and the relevant provisions of Federal Rule of Criminal Procedure 41, the Court hereby ?nds there is probable cause to believe the email account-maintamed at premises controlled by 1 1 Internet, Inc, contains evidence, fruits, and instrumentalities of crime, all as speci?ed in Attachment hereto; Accordingly, the Provider is hereby directed to provide to the Investigative Agencies, within 7 days of the date of service of this Warrant and Order, the records speci?ed in Section II of Attachment hereto, for subsequent review by law enforcement personnel as authorized in Sections and IV of Attachment D. The Government is required to serve a copy of this Warrant and Order on the Provider within 14 days of the date of issuance. The Warrant and Order may be served via electronic transmission or any other means through which the Provider is capable of accepting service. Case Document 48-3 Filed 07/18/19 Page 48 of 67 2. Non?Disclosure order. Pursuant to 18 U.S.C. 2705(b), the Court ?nds that there is reason to believe that noti?cation of the existence of this warrant will result in destruction of or tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the existence of this Warrant and Order to the listed subscriber or to any other person for a period of 180 days from the date of this Order, subject to extension upon application to the Court if necessary, except that Provider may disclose this Warrant and Order to an attorney for Provider for the purpose of receiving legal advice. 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which it was issued, be ?led under seal, except that the Government may without further order of this Court serve the Warrant and Order on the Provider; provide copies of the Af?davit or Warrant and Order as need be to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. Dated: New York, New York a, [qurfdm Date Issued Time Issued HO 'ernited'Stlates ate?Ju?dge Southern DistrietofNevVYork 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 49 of 67 Email SearchAAttachment 1. Subject Account and Execution of Warrant This warrant is directed to 1 1 Internet, Inc. (the ?Provider?), headquartered at 701 Lee Road, Suite 300, Chesterbrook, 19087, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email account -_:the ?Subject Account?) for the time period between November 14, 2017 and the date of this warrant, inclusive. A law enforcement of?cer will serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement I of?cer an electronic copy of the information speci?ed in Section 11 below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories speci?ed in Section below. II. Information to be Produced by the Provider To'the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Account: a. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Account, including all message content, attachments, and header information (speci?cally including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email). b. Address book information. All address book, contact list, or similar information associated with the Subject Account. o. Subscriber and payment information. All subscriber ?and payment information regarding the Subject Account, including but not limited to name, username, address, telephone Case Document 48-3 Filed 07/18/19 Page 50 of 67 number, alternate email addresses, registration IP address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Account, including any IP logs or other records of session times and durations. e. Customer correspondence. All correspondence with the subscriber or others associated with the Subject Account, including complaints, inquiries, or other contacts with support services and records of actions taken. f. Preserved or backup records. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a prese1vation request issued pursuant to 18 U.S.C. 2703(f) or otherwise. I Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the records produced by the Provider in order to locate any evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud the United States), 1005 (false bank entries); 1014 (false statements to a financial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the Subject Account; b. Communications, records, documents, and other files involving Sterling National Bank, "Melrose Credit Union, and/ or taxi medallions; 0. Communications, records, documents, and other ?les involving a plan, proposal, or agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 2 . 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 51 of 67 medallions, and any associated debts or liabilities, to others, including to -and/or entities associated with him; d. Communications, records, documents, and other ?les involving Essential Consultants, LLC or Michael D. Cohen Associates, including those which indicate the nature and purpose of payments made to or from Essential Consultants or Michael D. Cohen Associates; e. The identity of any_person(s) including records that reveal the whereabouts of the person(s) who communicated with the Subject Account about any matters relating to Essential Consultants, LLC, or about any plan or proposal or agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to -and/or entities associated with him; f. Communications between the Subject Account and Jeffrey Getzel relating to Michael D. Cohen?s bank accounts, taxes, debts, and/or finances; g. Communications, records, documents, and other ?les re?ecting false representations to a financial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; h. Evidence indicating how and when the Subject Account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; and i. Evidence indicating the Subject Account owner?s intent as it relates to the Subject Offenses under investigation. 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 52 of 67 IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidenCe in a manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 53 of 67 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Information Associated with the Email Accounts @gmail.com, . -@gmail.com, and Maintained at Premises Controlled by Google, Inc., USAO Reference No. 2018R00127 SEARCH WARRANT AND NON-DISCLOSURE ORDER TO: Google, Inc. (?Provider?) United States Attorney?s Of?ce for the Southern District of New York and the Federal Bureau of Investigation (collectively, the ?Investigative Agencies?) 1. Warrant. Upon an af?davit of Special Agent _of the United States Attorney?s Of?ce for the Southern District of New York, and pursuant to the'provisions of the Stored Communications Act, 18 U.S.C. ?2703(b)(1)(A) and and the relevant provisions of Federal Rule of Criminal Procedure 41, the Court hereby ?nds there is probable cause to believe the email accounts -@gmai1.com, -@gmai1.com, and maintained at premises controlled by Google, Inc., contain evidence, fruits, and instrumentalities of crime, all as speci?ed in Attachments A and hereto. Accordingly, the Provider is hereby directed to provide to the Investigative Agencies, within 7 days of the date of service of this Warrant and Order, the records speci?ed in Section II of Attachments A and hereto, for subsequent review by law enforcement personnel as authorized in Sections and IV of Attachments A and B. The Government is required to serve a copy of this Warrant and Order on the Provider within 7 days of the date of issuance. The Warrant and Order may be served via Case Document 48-3 Filed 07/18/19 Page 54 of 67 electronic transmission or any other means [through which the Provider is capable of accepting service. 2. Non-Disclosure Order. Pursuant to 18 U.S.C. 2705(b), the Court ?nds that there is reason to believe that noti?cation of the existence of this warrant will result in destruction of or tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the existence of this Warrant and Order to the listed subscriber or to any other person for a period of 180 days from the date of this Order, subject to extension upon application to the Court if necessary, except that Provider may disclose this Warrant and Order to an attorney for Provider for the purpose of receiving legal advice. 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which it was issued, be ?led under seal, except that the Government may without further order of this Court serve the Warrant and Order on the Provider; provide copies of the Af?davit or Warrant and Order as need be to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. Dated: New Yorlr, New York MEWS l?qu?ih Bate Issued Time Issued I. i NORA LEE CAB 3 W, (K Chief United Qtates Magistrate Judge Southern District of New York 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 55 of 67 Email Search Attachment A I. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the ?Provider?), headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email account -@gmai1.com (the ?Subject Account?) for the time period referenced below. A law enforcement of?cer will serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement of?cer an electronic copy of the information specified in Section 11 below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories speci?ed in Section below. II. Information to be Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Account: a. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Account, including all message content, attachments, and header . information (speci?cally including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email) limited to items sent, received, or created between November 14, 2017 and the date of this warrant, inclusive. b. Address book information. All address book, contact list, or similar information associated with the Subject Account. c. Subscriber and payment information. All subscriber and payment information regarding the Subject Account, including but not limited to name, usemame, address, telephone Case Document 48-3 Filed 07/18/19 Page 56 of 67 number, alternate email addresses, registration address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Account, including any IP logs or other records of session times and durations, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. e. Customer correspondence. All correspondence with the subscriber or others associated with the Subject Account, including complaints, inquiries, or other contacts with support services and records of actions taken, limited to items sent, received, or created-between December 1, 2014 and the date of this warrant, inclusive. f. Search History. All search history and/or web history associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. g. Associated content. All Google Docs, files. maintained on Google Drive,iand instant messages or Gchats associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. h. I Preserved or backup records. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 18 U.S.C. 2703(f) or otherwise. 111. Review of InformatiOn by the Government Law enforcement personnel (who may include, in addition to law enforcement of?cers and - agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the records produced by the Provider in order to locate any evidence, ?uits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud 2 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 57 of 67 the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the Subject Account; 1 b. Communications, records, documents, and other ?les involving Sterling National Bank, Melrose Credit Union, and/or taxi medallions; I c. Communications, records, documents, and other ?les involving a plan, proposal, or agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to -and/or entities associated with him; d. Communications, records, documents, and other ?les involving Essential Consultants, LLC or Michael D. Cohen Associates, including those which indicate the nature and purpose of payments made to?or from Essential Consultants or Michael D. Cohen Associates; e. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who communicated with the Subject Account about any matters relating to Essentia1 Consultants, LLC, . or about any plari or proposal oragreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to_and/or entities associated with him; f. Communications between the Subject Account and Jeffrey Getzel relating to Michael D. Cohen?s bank accounts, taxes, debts, and/or ?nances; g. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 58 of 67 institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; h. Evidence indicating how and when the Subject Account was'accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; and Evidence indicating the Subject Account owner?s intent as it relates to the Subject Offenses under investigation. IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 59 of 67 Email Search Attachment I. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the ?Provider?), headquartered at 1600 - Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email accounts -@gmail.com and?(the ?Subject Accounts?) for the time period between October 1, 2016 and the date of this warrant, inclusive. A law enforcement of?cer will serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement of?cer an electronic copy of the information speci?ed in Section II below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the - categories speci?ed in Section below. II. Information to be Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Accounts: a. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Accounts, including all message content, attachments, and header information (speci?cally including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email). b. Address book information. All address book, contact list, or similar information associated with the Subject Accounts. 0. Subscriber and payment information. All subscriber and payment information regarding the Subject Accounts, including but not limited to name, username, address, telephone Case Document 48-3 Filed 07/18/19 Page 60 of 67 number, alternate email addresses, registration IP address, account creation date, account status, length of service, type-s of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Accounts, including any IP logs or other records of session times and durations. e. A Customer correspondence. All correspondence with the subscriber or others associated with the Subject Accounts, including complaints, inquiries, or other contacts with support services and records of actions taken. f. Search History. All search history and/ or web history associated with the Subject Accounts. g. Associated content. All GOogle Docs, ?les maintained on Google Drive, 'and instant messages or Gchats associated with the Subject, Accounts. h. Preserved or backup records. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 18 U.S.C. 2703(f) or otherwise. Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement officers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical, experts under government control) are authorized to review the records produced by the Provider in order to locate any and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud the United States), 1005 (false bank entries); 1014 (false statements to a financial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the Subject Accounts; 2 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 61 of 67 b. Communications, records, documents, and other ?les involving a plan or proposal or agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to nd/or entities associated with him; 0. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who communicated with the Subject Accounts about any matters relating to any plan or proposal or agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to -nd/or entities associated with him; d. Communications between the Subject Accounts and others, including employees or representatives of Sterling National Bank, Melrose Credit Union, or other ?nancial institution(s), regarding Michael D. Cohen?s ?nances; e. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; f. Evidence indicating how and when the Subject Accounts was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating the Subject Accounts owners? intent as it relates to the Subject Offenses under investigation. 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 62 of 67 IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attomey?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 63 of 67 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Information Associated with the Email Account @aolcom, Maintained at Premises Controlled by Oath, Inc., USAO Reference No. 201 8R00127 SEARCH WARRANT AND NON-DISCLOSURE ORDER TO: Oath, Inc. (?Provider?) United States Attorney 5 Of?ce for the Southern District of New York and the Federal Bureau of Investigation (collectively, the ?Investigative Agencies?) 1. Warrant. Upon an af?davit of Special Agent -of the United States Attorney?s Of?ce for the Southern District of New York, and pursuant to the provisions of the Stored Communications Act, 18 U.S.C. ?2703(b)(1)(A) and and the relevant provisions of Federal Rule of Criminal Procedure 41, the Court hereby ?nds there is probable cause to believe the email account-@aolcom, maintained at premises controlled by Oath, Inc., contains evidence, fruits, and instrumentalities of crime, all as speci?ed in Attachment hereto. Accordingly, the Provider is hereby directed to provide to the Investigative Agencies, ?within 7 days of the date of service of this Warrant and Order, the 1*ecOrds speci?ed in Section II of Attachment hereto, for subsequent review by law enforcement personnel as authorized in? Sections and IV of Attachment C. The Government is required to serve a copy of this Warrant and Order on the Provider within 14 days of the date of issuance. The Warrant and Order may be served via electronic transmission or any other means through which the Provider is capable of accepting service. Case Document 48-3 Filed 07/18/19 Page 64 of 67 2. Non-Disclosure Order. Pursuant to 18 U.S.C. 2705(b), the Court ?nds that there is reason to believe that noti?cation of the existence of this warrant will result in destruction of or tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the existence of this Warrant and Order to the listed subscriber or to any other person for a period of 180 days from the date of this Order, subjectto extension upon application to the Court if necessary, except'that Provider may disclose this Warrant and Order to an attorney for Provider for the purpose of receiving legal advice. 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which it was issued, be ?led under seal, except that the Oovernment may without further order of this Court serve the Warrant and Order on the Provider; provide copies of the Af?davit or Warrant and Order as need be to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. Dated: New York, New York 191/1121? 10 0070? Date Issued Time Issued i ORABLE CABRIMPW hief United States Magistrate Judge Southern District of New York 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 65 of 67 Email Search Attachment I. Subject Account and Execution of Warrant This warrant is directed to Oath, Inc. (the ?Provider?), headquartered at 22000 AOL Way, Dulles, Virginia 20166, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email account-@aolcom (the ?Subject Account?) for the time period between December 1, 2016 and the date of this warrant, inclusive. A law enforcement of?cer will serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement of?cer an electronic copy of the information speci?ed in? Section 11 below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories speci?ed in Section below. II. Information to be Produced by the Provider lo the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Account: a. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Account, including all message content, attachments, and header information (speci?cally including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email). b. Address book information. All address book, contact list, or similar information associated with the Subject Account. c. Subscriber and payment information. All subscriber and payment information regarding the Subject Account, including but not limited to name, username, address, telephone number, alternate email addresses, registration IP address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. Case Document 48-3 Filed 07/18/19 Page 66 of 67 d. Transactional records. All transactional records associated with the Subject Account, including any 1P logs or other records of session times and durations. e. Customer correspondence. All correspondence with the subscriber or others associated with the Subject Account, including complaints, inquiries, or other contacts with support services- and records of actions taken. f. Search History. All search history and/or web history. g. Preserved or backup records. Any preserved or backup copies of any of the foregoing categories. of records, whether created in response to a preservation request issued pursuant to 18 U.S.C. 2703 or otherwise. Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the records produced by the Provider in order to locate any evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the Subject Account; b. Communications, records, documents, and other ?les involving a plan or proposal or agreement for Michael D. Cohen and/ or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, tc-and/or entities associated with him; 02.28.2018 Case Document 48-3 Filed 07/18/19 Page 67 of 67 0. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who communicated with the Subject Account about any matters relating to any plan or proposal or agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to -and/or entities associated with him; - d. Communications between the Subject Account and others, including employees or representatives of Sterling National Bank, Melrose Credit Union, or other ?nancial institution(s), regarding Michael D. Cohen? ?nances; and e. Communications, records, documents, and other ?les-re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution. IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 1 of 105 A0 106 (Rev. 06/09) Application for a Search Warrant UNITED STATES DISTRICT COURT for the Southern District of New York In the Matter of the Search of (Brie?y describe the prOperzjy to be searched or identity the person by name and address) A Device Containing the Results of Three Email Search Warrants, See Attachment A APPLICATION FOR A SEARCH WARRANT I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under penalty of perjury that I have reason to believe that on the following person or property (identz'?i the person or describe the 2" located in the Southern District of New York there is now concealed (identi?z the person or describe the property to be seizeoQ: PLEASE SEE ATTACHED AFFIDAVIT AND RIDER. The basis for the search under Fed. R. Crim. P. 41(c) is (check one or more): Mevidence of a crime; El contraband, fruits of crime, or other items illegally possessed; El property designed for use, intended for use, or used in committing a crime; a person to be arrested or a person who is unlawfully restrained. The search is related to a violation of: Code Section O??ense Description 18 USC 371, 1005, 1014, Conspiracy to defraud the United States; false bank entries; faise statements to a 1343, 1344 financial institution; wire fraud; bank fraud The application is based on these facts: PLEASE SEE ATTACHED AFFIDAVIT AND RIDER. [if Continued on the attached sheet. sf Delayed notice of 30 days (give exact ending date if more than 30 days: is requested under 18 U.S.C. 3103a, the basis of which is set forth on the attached sheet. Printed ndine and title . Sworn to before me and signed in my presence. Date: f?ir I I: I r. Judgz's Sigm-T?Y? City and state: NW TWA, WY Hon. Gabriel W. Gorenstein, lliS?lVlagistrate Judge Printed name and title e: - esu Case Document 48-4 Filed 07/18/19 Page 2 of 105 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of the Application of the United TO BE FILED UNDER SEAL States Of America for a Search Warrant for A Device Containing the Results of Three Email Agent Af?davit in Support of Search Warrants, USAO Reference No 3 Application for a Search Warrant 2018R00127 i SOUTHERN DISTRICT OF NEW YORK) 55.: Special Agent-of the United States Attorney?s Office for the Southern I I. Introduction A. Af?ant 1. I am a Special Agent with the United States Attorney?s Office for the Southern District of New York (the I have been a Special Agent with the USAO since August 2016. Ipreviously served as a Special Agent with the United States Department of Labor Inspector General from May 2011 to August 2016. In the course of my experience and training in these positions, Ihave participated in criminal investigations into federal offenses involving a wide array of financial crimes, including frauds on financial institutions. I also have training and experience executing search warrants, including those authorizing the search of email accounts. 2. I make this Affidavit in support of an application pursuant to Rule 41 of the Federal Rules of Criminal Procedure for a warrant to search the electronic device specified below (the ?Subject Device?) for the items and information described in Attachment A. This affidavit is based upon my personal knowledge; my review of documents and other evidence my conversations with other law enforcement personnel; and my training, experience and advice received concerning the use of computers in criminal activity and the forensic analysis of electronically stored information Because this affidavit is being submitted for the limited purpose of establishing probable 2 Case Document 48-4 Filed 07/18/19 Page 3 of 105 cause, it does not include all the facts that I have learned during the course of my investigation. Where the contents of documents and the actions, statements, and conversations of others are reported herein, they are reported in substance and in part, except where otherwise indicated. B. Prior Warrants and the Subject Device 3. As set forth in detail below, the USAO and the Federal Bureau of Investigation are investigating, among other things, a scheme by Michael Cohen to defraud multiple banks. Cohen is an attorney who currently holds himself out as the personal attorney for President Donald Trump: and who previously-luseui'vedwfor over a decade as. an executive 1n the Trump Organization, an international conglomerate with real estate and other holdings. 4. In connection with an investigation then being conducted by the Of?ce of the Special Counsel the FBI sought and obtained from the Honorable Beryl A. Howell, Chief United States District Judge for the District of Columbia, three search warrants (collectively, the Warrants?) for emails and other content information associated with two email accounts . used by Cohen. Specifically: A a. On or about July 18, 2017, the FBI sought and obtained a search warrant for emails in the account _@gmail.com (the ?Cohen Gmail Account?) sent or received between January 1, 2016 and July 18, 2017. This warrant, which is numbered 17-mj-00503, is attached as Exhibit A (the ?First Cohen Gmail Warrant?). b. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the Cohen Gmail Account sent or received between June 1, 2015 and November 13, 2017. This warrant, which is numbered 17?mj?00'855, is attached as Exhibit (the ?Second Cohen Gmail Warrant?). c. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the account I?the ?Cohen Account?) sent or 3 Case Document 48-4 Filed 07/18/19 Page 4 of 105 received between the opening of the Cohen Account1 and November 13, 2017. This warrant, which is numbered 17?mj?00854, is attached as Exhibit (the ?Cohen Warrant?). 5. The SCO has since referred certain aspects of its investigation into Cohen to the USAO, which is working with the New York Field Of?ce. As part of that referral, on or about February 8, 2018, the SCO provided the USAO with all non-privileged emails and other content information obtained pursuant to the SCO Warrants. A ?lter team working with the SCO -- h-adwpreviously reviewed the e?mails producedpurs?uantmto Warrants for privilege. 6. These emails are contained on the Subject Device, which is particularly described as a black and red USB drive with a white label that says ?Tracking 180208140208.? That is, the Subject Device contains the emails and other content information obtained pursuant to the SCO Warrants, less any emails that were screened. and removed by the privilege team. 7. The Subject Device is presently located in the Southern District of New York. C. The Subject Offenses 8. The af?davits in support of the SCO Warrants describe evidence of several different courses of conduct by Cohen, including, among other things, false statements to ?nancial institutions relating to the purpose of an account he opened in the name of Essential Consultants LLC and the nature of funds ?owing into that account, and activities undertaken by Cohen on behalf of certain foreign persons or foreign entities without having registered as a foreign agent. The SCO Warrants accordingly de?ne the evidence to be seized by reference to subject offenses 1 Based on my review of this warrant and the af?davit in support of it, I know that the warrant did not specify a time period, but the af?davit indicated that, pursuant to court order, the service provider had provided non?content information for the Cohen Account that indicated that the account contained emails from the approximate period of March 2017 through the date of the warrant. Case Document 48-4 Filed 07/18/19 Page 5 of 105 and speci?c categories of information related to these courses of conduct. The subject offenses in the SCO Warrants are summarized as follows: Exhibit Warrant Subiect Offenses in Prior Warrant A First Cohen Gmail 18 U.S.C. 1014 (false statement to ?nancial institution), 195 6 (money Warrant laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 611 et seq. (Foreign Agents Registration Act Second Cohen Gmail 18 U.S.C. 1014 (false statement to ?nancial institution), 1343 (wire Warrant ?aud), 1344 (bank ?aud), 1956 (money laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 611 et seq. (PARA) Cohen Warrant 18 U.S.C. 1014 (false statement to ?nancial institution), 1343 (wire ?aud), 1344 (bank ?aud), 1956 (money laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 6 11 ct seq. (PARA) 9. Based on my participation in this investigation, including my review of documents obtained pursuant to subpoena and court order, my conversations with witnesses and review of reports of conversations with witnesses, and my review of publicly available information, I have learned of additional conduct by Cohen, described below, which was not described in the af?davit seeking the First Cohen Gmail Warrant and was described brie?y in the af?davits seeking the Second Cohen Gmail Warrant and the Cohen Warrant.2 10. I am therefore requesting authority to expand the search of the non-privileged e? mails obtained pursuant to the SCO Warrants, as contained on the Subject Device, for evidence related to this additional conduct. As set forth below, in addition to the categories of evidence already described in the SCO Warrants, there is probable cause to believe that the Subject Device contains evidence of violations of 18 U.S.C. 371 (conspiracy to defraud the United States), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud) (collectively, the ?Subject Offenses?), related to the additional conduct described below.3 2 I do not base this application on my review of emails obtained pursuant to the SCO Warrants. 3 The SCO Warrants cite many of the same statutes as subject offenses and describe categories of information that likely encompass evidence of the additional conduct described herein. 5 Case Document 48-4 Filed 07/18/19 Page 6 of 105 II. Probable Cause Regarding the Subject Offenses 11. Together with this application, I am submitting an application for a search warrant, pursuant to 18 U.S.C. 2703, for all content and other information associated with the Cohen Gmail Account, for the time period November 14, 2017 to the present; the Cohen Account, for the time period November 14, 2017 to the present; and three other email accounts. The af?davit in support of this application is attached as Exhibit (the ?Accompanying Affidavit?), and is incorporated by reference as if fully set forth herein. 12. As set forth in the AccompanyingAf?davit, there i-sprobable cause to believe that Cohen has made af?rmative misrepresentations in and omitted material information from financial statements and other disclosures that Cohen provided to multiple banks in connection with a transaction intended to relieve Cohen of approximately $22 million in debt he owed on taxi medallion loans from the banks. As set forth in detail in the Accompanying Affidavit, in these ?nancial statements, and in his oral and other written statements to these banks, Cohen appears to have intentionally omitted cash assets that he began receiving in 2017 from new consulting work; (ii) signi?cantly understated his total holdings of cash and cash equivalents; and failed to inform the banks from which he was seeking debt relief that he had agreed to make a $3.8 million cash payment to a third party, in connection with acquisition of the taxi medallions securing Cohen?s debt. By making these misrepresentations and material omissions, Cohen avoided making payments on his loans, and attempted to and has secured proposed agreements from the banks to relieve him of certain repayment obligations worth millions of dollars. Nevertheless, in an abundance of caution, I am seeking explicit authorization to search the Subject Device for evidence of this additional conduct. Case Document 48-4 Filed 07/18/19 Page 7 of 105 13. As noted above, the Accompanying Af?davit seeks email content for the Cohen Gmail Account and the Cohen Account for the period fromNovember 14, 2017 to the present, and therefore establishes probable cause that a search of the email content from that time period will reveal evidence, fruits, and instrumentalities of the Subject Offenses. As set forth below, the Accompanying Affidavit also establishes probable cause to believe that a search of the Subject Device (73. e. the non-privileged emails from the earlier time periods covered by the SCO Warrants) will similarly reveal evidence, fruits, and instrumentalities of the Subject Offenses.4 For example, as described in the Accompanying Af?davit: a. In or about December 2014, Sterling National Bank (?Sterling?) agreed to lend approximately $22 million to Cohen?s medallion companies. See Accompanying Affidavit 11 14(0). b. In or about September 2015, Cohen began pushing Sterling for a reduction in his payments. See id 14(e). c. In or about October 2016, Cohen told a Sterling employee (?Sterling Employee-1?) that he had a potential buyer of his taxi medallions, named_, who . would agree to assume Cohen?s debt with Sterling (and Melrose Credit Union, the participating bank). See id. 11 14(g). Negotiations of the potential taxi medallion transaction then folldwed for more than a year. See id. 4 As noted, the Subject Device contains email content for the Cohen Gmail Account from the period of June 1, 2015 to November 13, 2017, and email content for the Cohen Account for the period of March 2017 to November 13, 2017, 2017 F1nanc1a1 Statemen that was also attached. See id 14(1). Case Document 48-4 Filed 07/18/19 Page 8 of 105 d. On or about February 22, 2017, the Cohen Gmail Account5 sent an email to a Sterling employee (?Sterling Employee?2?) stating that he ?agreed to pay down 1 million from the loan amoun See id 1[ 14(g). e. On or about June 8, 2017, Cohen emailed Sterling Employee-1 from the Cohen Gmail Account, attaching a Sterling personal ?nancial statement form that had been ?lled out by hand, which referenced a statement of ?nancial condition, dated May 1, 2017 (the ?May f. On or about October 5, 2017, Cohen, using the Cohen Gmail Account, re- sent Sterling Employee? 2 a copy of his May 2017 Financial Statement. A day later, on October 6, 2017, Cohen, using the Cohen Gmail Account, emailed Sterling Employee?2 a statement of fmancial condition, dated September 30, 2017 (the ?September 2017 Financial Statement?). See id 11 14(m). The September 2017 Financial Statement omitted assets that Cohen held in certain bank accounts and substantially understated his available cash and cash equivalents. See id. 1111 19?20. g. It appears that Cohen set up the Cohen Account to receive emails he was previously receiving at the Cohen Gmail Account. On or about May 5, 2017, Cohen sent an email from the Cohen Account to a blind copy list of recipients, stating that ?[d]ue to the overwhelming volume of phone calls and emails coming into my previous cellular number and e-mail address, I have elected to create for Clients Only the following. Kindly use this new 5 As noted in n.2, supra, I do not base this application on my review of emails obtained pursuant to the SCO Warrants. Where the content of emails sent from or received by the Cohen Gmail Account and/or the Cohen MDPC Account are described herein, my description is based on copies of these emails produced by third parties pursuant to subpoena or otherwise. 8 Case Document 48-4 Filed 07/18/19 Page 9 of 105 information for all future contact and communications.? The signature line on the email listed the Cohen Account as the new email address. See id. 1] 26. h. Based on my review of header information obtained by court order, I have learned that, on approximately eight occasions in August and September 2017, while Cohen, - and and -were communicating about a term sheet for the Coheni- taxi medallion transaction, the Cohen Account sent or received emails from including emails on which Sterling employees were copied. On or about August 22, 2017, Cohen also used the Cohen Account to send an email to Sterling Employee?1. See id. 1] 27(a). i. Based on my review of header information obtained by court order, I have learned that on or about September 1, 20l7?at or around the time the '-and Cohen were negotiating a term sheet?the Cohen Account sent or received eight emails to or from_. See id. 112503). 14. Therefore, there is probable cause to believe that a search of the Subject Device will reveal evidence, fruit and instrumentalities of the Subject Offenses, including the following: a. Communications, records, documents, and other ?les involving Sterling, Melrose, and/or taxi medallions; b. Communications, records, documents, and other ?les involving a plan, proposal, or agreement for Cohen and/ or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to and/or t? entities associated with him; 0. Communications, records, documents, and other files necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) Case Document 48-4 Filed 07/18/19 Page 10 of 105 who communicated with the Cohen Gmail Account and/ or the Cohen Account about any plan or proposal or agreement for Cohen and] or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to and/ or entities associated with him; d. Communications between the Cohen Gmail Account and] or the Cohen Account and Jeffrey Getzel relating to Cohen?s bank accounts, taxes, debts, and] or finances; e. Evidence indicating the Cohen Gmail Account and the Cohen Account owner?s intent as it relates to the Subject Offenses under investigation. Procedures for Searching ESI A. Review of E81 15. Law enforcement personnel (including, in addition to law enforcement officers and agents, and depending on the nature of the E81 and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, interpreters, and outside vendors or technical experts under government control) will review the E81 contained on the Subject Device for information responsive to the warrant. 16. In conducting this review, law enforcement personnel may use various methods to locate evidence, fruits, and instrumentalities of the Subject Offenses, including but not limited to undertaking a cursory inspection of all emails contained on the Subject Device. This method is analogous to cursorily inspecting all the files in a file cabinet in an office to determine which paper evidence is subject to seizure. Although law enforcement personnel may use other methods as well, particularly including keyword searches, I know that keyword searches and similar methods are typically inadequate to detect all information subject to seizure. As an initial matter, keyword 10 Case Document 48-4 Filed 07/18/19 Page 11 of 105 searches work only for text data, yet many types of files commonly associated with emails, including attachments such as scanned documents, pictures, and videos, do not store data as searchable text. Moreover, even as to text data, keyword searches cannot be relied upon to capture all relevant communications in an account, as it is impossible to know in advance all of the unique words or phrases that investigative subjects will use in their communications, and consequently there are often many communications in an account that are relevant to an investigation but that do not contain any keywords that an agent is likely to search for. IV. Conclusion and Ancillary Provisions 17. Based on the foregoing, I respectfully request the court to issue a warrant to seize the items and information specified in Attachment A to this affidavit and to the Search and Seizure Warrant. 18. In light of the confidential nature of the continuing investigation, and for the reasons more fully set forth in the Accompanying Af?davit, I respectfully request that this affidavit and all papers submitted herewith be maintained under seal until the Court orders otherwise. Special Agent, USAO Sworn to before.- me on A day of February, 20l 8 N. w- ITED MM i ll Case Document 48-4 Filed 07/18/19 Page 12 of 105 Attachment A 1. Device to be Searched The device to be searched (the ?Subject Device?) is described as a black and red USB drive with a white label that says ?Tracking 180208140208?, which contains emails and other content information obtained pursuant to the three search warrants, numbered 17?mj?00503, 17-mj-00855 and 17-mj?00854, obtained by the Special Counsel?s Of?ce less the emails that were screened and removed by the privilege team. 11. Review of ESI on the Subject Devices Law enforcement personnel (including, in addition to law enforcement officers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, interpreters, and outside vendors or technical experts under government control) are authorized to review the E81 contained on the Subject Device for evidence, fruits, and instrumentalities of one or more violations of 18 U.S.C. 371 (conspiracy to defraud the United States), 1005 (false bank entries), 1014 (false statements to a financial institution), 1343 (wire fraud), and 1344 (bank fraud) (collectively, the ?Subject Offenses?), as listed below: a. Communications, records, documents, and other files involving Sterling National Bank, Melrose Credit Union, and/or taxi medallions; b. Communications, records, documents, and other files involving a plan, proposal, or agreement for Michael'D. Cohen and] or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to i_ and/or entities associated with him; I c. The identity of any person(s) including records that reveal the whereabouts of the person(s) who communicated with _@gmail.com and/or - (the ?Subject Accounts?) about any plan or proposal or agreement for Michael D. Cohen and/ or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to _and/or entities associated with him; d. Communications between the Subject Accounts and Jeffrey Getzel relating to Michael D. Cohen?s bank accounts, taxes, debts, and/or ?nances; Case Document 48-4 Filed 07/18/19 Page 13 of 105 e. Evidence indicating the owner of the Subject Accounts? intent as it relates to the Subject Offenses under investigation. Case Document 48-4 Filed 07/18/19 Page 14 of 105 Case Document 48-4 Filed 07/18/19 Page 15 of 105 A0 93 (Rev. 11/13) Search and Seizure Warrant i1 .II- In a as UNITED STATES DISTRICT COURT gum 91mm I it for the @5531! ates Courts District of Columbia In the Matter of the Search of 03 (Brie?y describe the property to be searched 3356:1117 mj 005 ll Beryl A or identify the person by name and address) A3-3[gned INFORMATION WITH THE EMAIL Date {/18 Seizure Warrant ACCOUNT Description: Seemh a? SEARCH AND SEIZURE WARRANT Any authorized law enforcement "Of?cer An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or property located in the Northern District of California (identz'jjl the person or describe the prepare! to be searched amt/give its location): See Attachment A. I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property described above, and that such search will reveal (identify the person or describe the property [0 be seized): See Attachment B. YOU ARE COMMANDED to execute this warrant On or before August 1, 2017 (not to exceed 14 days) in the daytime 6:00 am. to 10:00 pm. Cl at any time in the clay or night because good cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to Hon, Beryl A. Howell United States Magistrate Judge) Cl Pursuant to 18 U.S.C. 3103 I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C. 2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose property, will be searched or seized (check the appropriate box) for days (not to exceed 30) El until, the facts justifying, the later speci?c date of Date and time issued: 7k? 117? . M) Judge 's signature City and state: Washington, DC, Hon. Howell Chier. 8. District Judge Printed name and title Case Document 48-4 Filed 07/18/19 Page 16 of 105 A0 93 (Rev lfl3) Search and Seizure Warrant (Page 2) Return Case No.: Date and ti! wart ant exeetited; 7 Copy of warrant and itWentoty? left With 9' l7 was *09?5?593 7/ 9217/0 ?7 5 15% weak Lag? A - .. Inventory rnade in the presence of . Inventoryrof the property taken and narne ofany person(3) seized: La?tte ll50067 3w A 1.5; 4 Hpro JUL 2017 Clark: s. Bankruptcy Certi?cn tion declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the designatedjudge. Primed name and ri?e Case Document 48-4 Filed 07/18/19 Page 17 of 105 ATTACHMENT A This warrant applies to information associated with the Google Mail Account -@gmail.com that is stored at premises owned, maintained, controlled, or operated by Google, a company headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043. Case Document 48-4 Filed 07/18/19 Page 18 of 105 ATTACHMENT B, I. Information to be disclosed by? Google To the extent that the information described in Attachment A is within the possession, custody, or control of the Google (hereinafter ?the Provider?), regardless of whether such information is stored, held or maintained inside or outside of the United States, and including any emails, records, files, logs, or information that have been deleted but are still available to the Provider, the Provider is required to disclose the following information to the government for each 111.11., m, a. The contents of all emails associated with the account, including stored or preserved copies of emails sent to and from the account, draft emails, the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email; b. All records or other information regarding the identi?cation of the account, to include full name, physical address, telephone numbers and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the IP address used to register the account, log-in IP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log ?les, and means and source of payment (including any credit or bank-account number); c. The types of service utilized; d. All records or other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and files; 6. All records pertaining to communications between the Provider and any person regarding the account, including contacts with support services and records of actions taken; and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the types of service utilized, the IP address used to register the account, log-in IP addresses associated with .session times and dates, account status, alternative e-mail addresses provided Case Document 48-4 Filed 07/18/19 Page 19 of 105 during registration, all other user names associated with the account, all account names associated with the subscriber, methods of connecting; f. All search history'or web history; g. All records indicating the services available to subscribers of the accounts; h. All usernames associated with or sharing a lo gin IP address or browser cookie with the accounts; i. All cookies, including third-party cookies, associated with the user; j. All records that are associated with the machine cookies associated with the user; ?id 1 k. All telephone or instrument numbers associated with the Account (including MAC addresses, Electronic Serial Numbers Mobile Electronic Identity Numbers Mobile Equipment Identi?er Mobile Identi?cation Numbers Subscriber Identity Modules Subscriber Integrated Services Digital Network Number International Mobile Subscriber Identi?ers or International Mobile Equipment Identities II. Information to be Seized by the Government All information described above in Section I that constitutes evidence, contraband, fruits, and/.or instrumentalities of violations of 18 U.S.C. 1014 (false statements to a ?nancial . institution) and 18 U.S.C. 1956 (money laundering), as well as 18 U.S.C. 951 (acting as an unregistered foreign agent) and the Foreign Agents Registration Act 22 U.S.C. 611 et seq, involving Michael Dean Cohen and occurring on or after January 1, 2016, including, for each account or identi?er listed on Attachment A, information pertaining to the following matters: a. Communications, records, documents, and other ?les involving Essential Consultants, b. Communications, records, documents, and other ?les involving Bo and Abe Realty, c. Communications, records, documents, and other ?les that false representations to 'a ?nancial institution with relation to intended the purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an Case Document 48-4 Filed 07/18/19 Page 20 of 105 account a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; Records of any funds or bene?ts received by or offered to Michael Dean Cohen by, or on behalf of, any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; Communications, records, documents, and other ?les that reveal efforts by Michael Dean Cohen to conduct activities on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or u?lu, .. forei'gn?p?rincip?al?s; Evidence indicating how and when the account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; Evidence indicating the account owner?s state of mind as it relates to the crimes under investigation; The identity of the person(s) who created or used the account, including records that help reveal the whereabouts of such person(s); and The identity of any records that help reveal the whereabouts of the communicated with the account about any matters relating to activities conducted by Michael Dean Cohen on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals. Case Document 48-4 Filed 07/18/19 Page 21 of 105 1 Exhibit Case Document 48-4 Filed 07/18/19 Page 22,0f 105 revs. res A0 93 (Rev. 11113,) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the District of Columbia In the Matter of the Search of (Etie?y ([2337 {be the pi ope} ty to he seat cited 3836? 1.17?mj?00855 0" idem?? ?mm-2 3 Assigned To: Chief Judge Howell, Beryl A INFORMATION WITH THE EMAIL Assign Date 1111312017 COM 3 Search and Seizure Warrant SEARCH AND SEIZURE WARRANT "re; WAny authorized law enforcement of?cer An application by a federal law enforcement of?cer or alt-attorney for the government requests the search of the following person or property located in the Northern District of California (identity the person or describe the property to be searched and give its io?catfoa): See Attachment A. I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or preperty described above, and that sueh search will reveal (identi?) the person or describe the property to be seized: See Attachment B. YOU ARE COMMANDED to execute this warrant on or before November 20, 2017 (not to exceed 14 days) in the daytime 6:00 am. to 10:00 p.111. at any time in the day 01* night because good cause has been established. Unless delayed notice is authorized below; you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from WhOse premises, the propelty Was taken, er leave the copy and at the place Where the property Was taken The of? o?er executing this warrant, or an of?cer present during the execution ?of the warrant inust prepare an inventmy as tequit-ed by law and tetum this Warrant and inventory to Hon Beryl A. Howeli (United States Magistrate Judge) Pursuant to 18 U.S.C. 3103 31ij, Itind that immediate notification may have an adverse result listed in 18 USS. 2705 (except for delay of trial), and authorize the of?cer exec?uting this warrant to delay notice to the person who, or WhoSe property, will be searched or Seized (checkthe appropriate box) Cl for days (not to exceed 30) El until, the facts justifying the later speci?c date cf Date and time issued: Qf??f'm?W?W] ??f/fil X?f?w W'J'ztdge signature City, and state: Washington, DC Hon, Beryl ,ArHoweli, Chief 0:8. District Judge Printed name and title Case Document 48-4 Filed 07/18/19 Page 23 of 105 ma A0 93 (Rev. 11/13) Search and seizure Warrant (Page-2) Return Case No.2 Date and time warrant executed: . Copy of warrant and inventory left with: Inventmy made in the presence of Inventory of the property taken and. name of any persen(s) Seized: Certi?cation I declare under penalty of perjury thatthis inventmy iseorreet and was returned along with the eriginal wanant t6 the designated judge. Date: Executing a?cer .s?fgnature Prfr?triedlnm?? and ri?e Case Document 48-4 Filed 07/18/19 Page 24 of 105 ATTACHMENT A This warrant applies to information associated with the Google Mail Account -@gmail.com that is stored at- premises owned, maintained, controlled, or operated by Goo gle, a company headquartered at 1600 Arnphitheatre Parkway, Mountain View, CA 94043. Case Document 48-4 Filled 07/18/19 Page 25 of 105 "We ATTACHMENT I. Information to be disclosed by Google To the extent that the information described in Attachment A is within the posSession, custody, or control of the Google (hereinafter ?the Provider?), regardless of whether such information is stored, held or maintained inside or outside of the United States, and including any emails, records, ?les, logs, or information that have been deleted but are still available to the Provider, the Provider is required to disclose the following information to the government for each account or identi?er listed in Attachment A: a. The contents of all emails associated-with the account, including stored or preserved" copies of emails Sent to and from the account,- draft emails, the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email; b. All records or other information regarding the identi?cation of the account, to include full name, physical address, telephone numbers and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the IP address used to register the account, logwin IP addresses associated with seSsiOn times and dates, account status, alternative email addresses provided during registration, methods of? connecting, log ?les, and means and source of payment (including any credit or bank account number); 0. The types of service utilized; d. All records or other stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and ?les; c. All records pertaining to communications between the Provider and any person regarding the account, including contacts with support services and records of actions taken; and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the types of service utilized, the l? address used to register the account, log-in addresses associated with session times and dates, account status, alternative e-mail addresses provided during registration, all other user names associated with the account, all account names associated with the subscriber, methods of connecting; Case Document 48-4 Filed 07/18/19 Page All search history or web history; All records indicating the services available to subscribers of the accounts; All usernames associated with or sharing a lo gin IP address or broWser cookie with the accounts; All cookies, including third-party cookies, associated with the user; All records that are associated with the machine cookies associated with the user; and All telephone or instrument numbers associated with the Account (including MAC IL Mobile Electronic ta'essty? Numbers Mobile Equipment Identi?er Mobile Identi?cation Numbers subscriber Identity Modules Mobile SubsCriber Integrated Services Digital Network Number International Mobile Subscriber Identi?ers or International Mobile Equipment Identities Information to be Seized by the Government All information described above in Section Ithat constitutes evidence, contraband, fruits, and/or instrumentalities of I violations of 18 U.S.C. 10314 (false statements, to a financial institution), 18 U.S.C. 1343 (Wire fraud), 18 U.S.C. 1344 (bank fraud), and 18 U.S.C. 1956 (money laundering), as well as 18 U.S.C. 951 (acting as an unregistered foreign agent) and the Foreign Agents Registration Act 22 USS. 611 at saga, involving Michael Dean Cohen and occurring on or after line It, 2015, including, for each account or identi?er listed on Attachment A, information pertaining to the following matters: a. Communications, records, documents, and other ?les involving Essential Consultants, Communications, record's, documents, and other files that false representations to a financial institution with relati0n to intended the purpoSe of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account a ?nancial institutibn; the Source of funds flowing into an account; Or the purpose or nature of any ?nancial transactions involving that ?nancial institution; Case Document 48-4 Filed 07/18/19 Page 27 of 105 My, ML- 0. Records of any funds or bene?ts received by or offered to Michael Dean Cohen by, or on behalf of, any foreign government, foreign officials, foreign entities, foreign persons, or foreign principals; d. Communications, records, documents, and other ?les that reveal efforts by Michael Dean Cohen to conduct activities on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or fOreign principals; e. Evidence indicating how and when the account was accessed or used, to determine to the crimes under investigation and to the account owner; f. Evidence indicating the account oWner?s state of mind as it relates to the crimes 'under investigation; g. The identity of the person(s) who created or used the account, including records that help reveal the whereabouts of such personCs); and h. The identity of any records that help reveal the whereabouts of the cbmmunicatecl With the account about any matters relating to activities conducted by Michael Dean Cohen on behalf of; for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals. Review Protocols Review of the items described in Attachment A and Attachment 13' shall be conducted pursuant to established procedures designed to collect evidence in a manner consistent with professional responsibility requirements Concerning the maintenance of attorney?client and other operative privileges. When appropriate, the procedures shall include use of a designated ?filter team,? separate and apart from the investigatiVe team, in order to address potential privileges. ?the, "w Case Document 48-4 Filed 07/18/19 Page 28 of 105 Exhibit Case Document 48-4 Filed 07/18/19 Page (Rev. 111'] 3) Search and Seizure Warrant 11: UNITED STATES DISTRICT COURT ., for the District of Columbia In the Matter of the Search of (Brie?y describe ti1ep1~operty 1?0 benearched C338: or fdenz?DjJ 1113193113011 by name and address) Assigned T0. - Chief Judge Beryl A. INFORMATION ASSOCIATED WITH THE ACCOUNT Assign Date: 1111312017 '3 THE Descripti?en Search and Seizure Warrant PREMISES OF 1&1 INTERNET 1N0 3 SEARCH AND SEIZURE WARRANT To: Any authorized 1aw enforcement office1 An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person 01 property located 1n the Northern District of Caiifornia (identi?l the person 01 1183131156 the pi apart}! to be searched rind?give ifs location): See Attachment A. I 1? 1111 that the af?davitCs-J, or any recorded testimony, establish probable cause to Search and seize the person or property described above, and that such search will reveal ?denryj: 1112133111011 01 desci ib? the proper 1y (0 be 521;: ed): See Attachment B. YOU ARE GOMMANDED to execute this warrant on or before November 20, 2017 (no; toegrceed 14 days) [if in the daytime 6:00am. to 10:00 p.111. 1:1 at. any time in the day orni-ght because good cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the ploper'ty taken to the person from w,h01n 01 from whose premiSes, the property was taken or leave the copy and receipt at the plaice whe1e the propelty was taken. The of?cer executing this warrant, or an officer present during the execution of the walrant, must prepare an inventory as required bylaw and this warrant and inventory to - 1 Hon; .Ber?yl A. HoWell . Waited'Stdteis Magistrate Judge) El Pursuant to 18 -.S C. 3103a(b), 1 ?nd that immediate noti?cation may have an adverse result listed In 18 S. C. 2705 [except for delay of trial), and authotize the of?eel executing this Warrant to delay notice to the person who or whose pLOpelty; W111 be 362110th 01? seized (Check the appiopriate 271311,} fot days (110110 exceed 30) El until the facts jnstiiying, the 12111.31 speci?c date of Date and time iSSLted: ffg/ ,gl/ (f1, [If-1? Judge' 5 signrn?w City and state: Washington, DC 1 Hon. Beryl A. Howe?, enter us- Dietrlot Judge - Printed name (1111:111er Case Documents48-4 Filed?O7/18/19 Page 30 of 105 A0 93 (Rev. 11/13) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy of war-rant and left with: Inventory made in the presence of Inventory of the property taken and narfi?e of any person(s) seized: . Certi?cation I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the designated judge. Date: Executing o?z?cer signature Pr?int?d name and rifle Case Document 48-4 Filed 07/18/19 Page 31 of 105 ATTACHNIEN A This warrant applies to information associated with the email'-_ that is stored 'at premises owned,- maintained, controlled, or operated by 1&1 Internet, Inc. an electronic communication and/or remote computing service provider headquartered in Sunnyvale, California. Case Document 48-4 Filed 07/18/19 Page 32 of 105 ATTACHMENT Information to be disclosed by 1&1 To the extent that the infonnation deseribed in Attachment A is within the possession, . custody, or control of the 1&1 (hereinafter ?the Provider?), regardless of whether such information is stered, held or maintained inside or outside of the United States, and including any emails, records, tiles, logs, or information that have been deleted but are still available to the Provider, the Provider is required to disclose the following information to the government for each account or identi?er listedin Attachment A: 7, vmmw?w? a. The contents of all emails associated with the account, including stored or preserved copies of emails sent to and from the account, draft emails, the source and destination addresses associated with each email, the date and time at which each email wassent, and the size and length of each email; All records or other information regarding the identi?cation of the account, to include full name, physical address, telephone numbers and other identi?ers, records of?session times and durations, the date on which the account was created, the length of service, the IP address used to registerthe account, logic IP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of cennecting, log; ?les, and means and source of payment (including any creditor bank account number); The types of service utilized; All records or other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and files; All records pertaining to communications between the Provider and any person regarding the account, including contacts with support services and records of- actions -taken; and other identi?ers, records of session times and duraticns, the date on which the account was created, the length ofservice,.the types of service utilized, the IP address used to register the account, logwin IP addresses associated with Session times and dates, account status, alternative .e-mail addresses provided during registration, all other user names associated with the account, all account names associated with the subscriber, methods of connecting; Case Document 48-4 Filed 07/18/19 Page 33 of 105 (my. All search history or web history; All records indicating the sewices available to subscribers of the accounts; All usernames associated with or sharing a login IP address or browser cookie With the accounts; I All cookies, including third?party ecokies, associated with the user; All records that are associated with the machine cookies associated with the user; and All telephone or instrument numbers associated with the Account (including MAC II. addresses, metastases "names Merits Electronicml'?derititym Numbers Mobile Equipment identi?er Mobile Identi?cation Numbers Subscriber Identity Modules Mobile subscriber integrated Services Digital Network Number International Mobile SubScriber Identi?ers or International Mobile Equipment Identities Information to be Seized by the Government All information described above in Section I that constitutes evidence, contraband, fruits, and/or instrumentalities of violations of 18 U.S.C. 1014 (false statements to a ?nancial U.S.C. 1343 (wire fraud), 18 USC. 1344 (bank fraud), and 18 U.S.C. 1956 (money laundering), as well as 18 11.3.0. 951 (acting as an unregistered foreign agent) and the FOreign Agents Registration Act 22 U.S.C.. 611 et seq, involving Michael Dean Cohen, including, for each account or identi?er listed on Attachment A, information pertaining to the fellowing matters: .a'I Communications, records, documents, and other ?les involving Essential Consultants, Communications, records, documents, and other ?les that false representations to a financial institution with relation to intended the purpose of an or loan at that ?nancial institution; the nature of any business or entity assOciated with and account a financial institution; the source of funds ?owing into an aCcount; or the put?p?ose or nature of any ?nancial transactions involving that financial institution; Case Document 48-4 Filed 07/18/19 Page 34 of 105 Records of any funds or bene?ts received by or offered to Michael Dean Cohen by, or on behalf of, any foreign government, foreign official-s, foreign entities, foreign per-sons, or foreign principals; Communications, records, documents, and other files that reveal efforts by Michael Dean Cohen to conduct activities on behalf of, for the bene?t of, or at the direction "of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; Evidence indicating how and when the account was accessed or used, to determine context (Sf?account access, use, and events relating to the crimes under investigation and to the account owner; Evidence indicating the account owner?s state of mind as it relates to the crimes under investigation; The identity of the person(s) who created or used the account, including records that help reveal the whereabouts of such person(s); and The identity of any records that help reveal the whereabouts of the communiCated with the account about any matters relating to activities conducted by Michael Dean Cohen on behalf of, for the benefit of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals, Review Protocols Review of the items described in Attachment A and Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner consistent with professiOnal responsibility requirements concerning the maintenance of attorney-client and other Operative privileges. When appropriate, the procedures shall include use. of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. Case Document 48-4 Filed 07/18/19 Page 35 of 105 Exhibit Case Document 48-4 Filed 07/18/19 Page 36 of 105 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Information TO BE FILED UNDER SEAL A ?minted With the Email Accounts @gmailcom, AGENT AFFIDAVIT Maintained at Premises Controlled by Google, Inc., the Email Account Maintained at Premises Controlled by ., ,Ir mum ., - maintained at Premises Controlled by 1 Internet, Inc., USAO Reference No. 2018R00 127 Agent Affidavit in Support of Application for a Search Warrant for Stored Electronic Communications STATE OF NEW YORK COUNTY OF NEW YORK i SS. Special Agent _of the United States Attorney?s Of?ce for the Southern District of New York, being duly sworn, deposes and states: I. Introduction A. Affiant l. I am a Special Agent with the United States Attorney?s Office for the Southern District of New York (the I have been a Special Agent with the USAO 'since August 2016. I previously served as a Special Agent with the United States Department of Labor Inspector General from May 2011 to August 2016. In the course of my experience and training in these positions, I have participated in criminal investigations into federal offenses involving a Wide array Case Document 48-4 Filed 07/18/19 Page 37 of 105 of ?nancial crimes, including frauds on ?nancial institutions. I also have training and experience executing search warrants, including those authorizing the search of email accounts. B. The Provider, the Subject Account and the Subject Offenses 2. I make this af?davit in support of an application for a search warrant pursuant to 18 U.S.C. 2703 for all content and other information associated with the email accounts _@gmail.com (the ?Cohen Account?), (the Account?), and -@aol.com (the -Accoun?) (collectively, the ?Subject Accounts?). The Cohen Account, ?Account, and? Account are maintained and controlled by Google, Inc, headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043 (?Google?), the Account is maintained and controlled by 1 1 Internet, Inc., headquartered at 701 Lee Road, Suite 300, Chesterbrook, 19087 and the-chount is maintained and controlled by Oath, Inc., 22000 AOL Way, Dulles, Virginia 20166 (?Oath?) (together, the ?Providers?). The information to be searched is described in the following paragraphs and in Attachments A, B, and to the proposed warrants. I 3. As detailed below, there is probable cause to believe that the Subject Accounts contain evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to defraud the United States), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud) (collectively, the ?Subject Offenses?). The Target Subjects of this investigation are MICHAEL COHEN (?Cohen?) and others known and unknown. This af?davit is based upon my personal knowledge, my review of documents produced pursuant to grand jury subpoenas and prior search warrants, my review of interview reports prepared by other law enforcement of?cers, and my conversations with other law enforcement of?cers, as well as 2 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 38 of 105 my training and experience concerning the use of email in criminal activity. Because this af?davit is being submitted for the limited purpose of establishing probable cause, it does not include all the facts Ihave learned during my investigation. Where the contents of documents and the actions, statements, and conversations of others are reported herein, they are reported in substance and in part, except where otherwise indicated. C. Services and Records of the Provider 4. I have learned the followingmabout the Providers: a. The Providers offer email services to the public. In particular, Google permits subscribers to maintain email accounts under the domain name gmail.com. Google also allows a subscriber to maintain email accounts under any domain name under the subscriber?s control. For example, if a subscriber controls the domain name Google enables the subscriber to host any email address under this domain name on servers operated by Google. Oath permits subscribers to maintain email accounts under the domain name aol.com. 1 1 permits subscribers to maintain email accounts under any domain name under the subscriber?s control. For example, if a subscriber controls the domain name 1 1 enables the subscriber to host any email address under this domain name on servers operated by l. A subscriber using the Providers? services can access his or her email account from any computer connected to the Internet. b. The Providers maintain the following records and information with respect to every subscriber account: i. Email contents. In general, any email (which can include attachments such as documents, images, and videos) sent to or from a subscriber?s account, or stored in draft form in the account, is maintained on the Providers? servers unless and until the subscriber deletes the email. If the subscriber does not delete the email, it can remain on the Providers? computers 3 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 39 of 105 inde?nitely. Even if the subscriber deletes the email, it may continue to be available on the Provider?s servers for a certain period Of time. ii. Addressbook. The Providers also allow subscribers to maintain the equivalent of an address book, comprising email addresses and other contact information of other email users. Subscriber and billing information. The Providers collect and maintain username, address, telephone number, and alternate email addresses. The Providers also maintain records concerning the date on which the account was created, the Internet protocol address of the user at the time of account creation, the current status of the account (cg, active or closed), the length of service, and the types of services utilized by the subscriber. Additionally, for paying subscribers, the Providers maintain records of the subscriber?s means and source of payment, including any credit card or bank account number. iv. Transactional information. The Providers also typically retain certain transactional information about the use of each account on its system. This information can include records of login session) times and durations and the methods used to connect to the account (such as logging into the account through the Providers? website). i v. Customer correspondence. The Providers also typically maintain records of any customer service contacts with or about the subscriber, including any inquiries or complaints concerning the subscriber?s account. vi. Search history. Google and Oath also typically maintain records of any search history or web history associated with the subscriber?s accOunt. 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 40 of 105 vii. Associated content. Google also typically maintains content and records relating to the following applications that are associated with its e?mail accounts: (A) ?Google Docs,? which provides document~editing software that can be used to create, share, store, and manage documents online; (B) ?Google Drive,? which enables users to store files on Google servers, where they can be accessed remotely by the user and others; and (C) ?Gchat? or ?Instant Messenger,? which provides a chat interface through which users can communicate with each a message, which provides a chat interface through which users can communicate with each other in real time. Preserved and backup records. The Providers also maintain preserved copies of the foregoing categories of records with respect to an account, for at least 90 days, upon receiving a preservation request from the Government pursuant to 18 U.S.C. 2703(f). The Providers may also maintain backup copies of the foregoing categories of records pursuant to its own data retention policy. D. Jurisdiction and Authority to Issue warrant 5. Pursuant to 18 U.S.C. 2703(a), the Government may require a provider of an electronic communications service or a remote. computing service, such as the Providers, to disclose all stored content and all non?content records or other information pertaining to a subscriber, by obtaining a warrant issued using the procedures described in the Federal Rules of Criminal Procedure. 6. A search warrant under 2703 may be issued by ?any district court of the United States (including a magistrate judge of such a court)? that ?has jurisdiction over the offense being investigated.? 18 U.S.C. 2711(3)(A)(i). 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 41 of 105 7. When the Government obtains records under 2703 pursuant to a search warrant, the Government is not required to notify the subscriber of the existence of the warrant. 18 U.S.C. 2703(a), (3). Additionally, the Government may obtain an order precluding the Provider ?om notifying the subscriber or any other person of the warrant, for such period as the Court deems appropriate, where there is reason to believe that such noti?cation will seriously jeopardize an investigation. 18 U.S.C. 2705(b). WW ~~W~mE7xBrioprApplieations 1111, W, 8. On or about July 18, 2017, in connection with an investigation being conducted by the Of?ce of the Special Counsel the Federal Bureau of Investigation sought and obtained from the Honorable Beryl A. Howell, Chief United States District Judge for the District of Columbia, a search warrant for emails in the Cohen Account "sent or received between January 1, 2016 and July 18, 2017. On or about November 13, 2017, the FBI sought and obtained from Judge Howell search warrants for emails in the Cohen Account sent or received between June 1, 2015 and November 13, 2017, and emails in the Account sent or received between the opening of the account and November 13, 2017. The SCO has since referred certain aspects of their investigation into Cohen to the USAO, which is working with the New York Field Of?ce. As part of that referral, the SCO provided the USAO with emails and other content information obtained pursuant to the search warrants executed by the SCO, which had already been reviewed for privilege.1 As discussed below, this af?davit is based in part on my review of 1 In an abundance of caution, in a separate application the USAO has sought authorization, pursuant to Fed. R. Crim. P. 41, to review the emails obtained pursuant to the Prior Cohen Account Warrants for evidence related to certain additional conduct that was not the focus of the Prior Cohen Account Warrants. The emails obtained from the Prior Cohen Account Warrants that relate to that additional conduct do not form a basis for the instant application. 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 42 of 105 responsive materials produced pursuant to the July 18 and November 13, 2017 warrants (the ?Prior Cohen Account Warrants?). 9. On or about November 7, 2017, and January 4, 2018, as well as certain prior dates, the SCO sought and obtained from Judge Howell orders authorizing and extending the installation and use of pen registers and trap and trace devices to record communications sent to or from the Cohen Account. The SCO has provided pen register data obtained pursuant to those orders to the USAO. pursuant to the November 7, 2017 and January 4, 2018 orders (the ?Pen Register Data?). 10. On or about February 16, 2018, the USAO sought and obtained from the Honorable Debra Freeman, United States Magistrate Judge for the Southern District of New York, an order pursuant to 18 U.S.C. 2703(d) for email header information associated with the Account. This af?davit, as discussed below, is based in part on my review of email header information produced by 1 1 in response to that order (the Header Information?). TI. Probable Cause A. Overview 1 1. The United States Attorney?s Office for the Southern District of New York and FBI are investigating, among other things, a scheme by Target Subject Michael Cohen to defraud multiple banks. Cohen is an attorney who currently holds himself out as the personal attorney for President Donald Trump, and who previously served for over a decade as an executive in the Trump Organization, an international conglomerate with real estate and other holdings. 12. The investigation has revealed that Cohen has made affirmative misrepresentations in and omitted material information from financial statements and other disclosures that Cohen provided to multiple banks in connection with a transaction intended to relieve Cohen of approximately $22 million in debt he owed on taxi medallion loans from the banks. As set forth 7 02.28.2018 Case Document 48-4 Filed 07/18/19. Page 43 of 105 in detail below, in these ?nancial statements, and in his oral and other written statements to these banks, Cohen appears to have intentionally omitted cash assets that he began receiving in 2017 from new consulting work; (ii) signi?cantly understated his total holdings of cash and ?cash equivalents; and failed to inform the banks from which he was seeking debt relief that he had agreed to make a $3.8 million cash payment to a third party, _in connection with acquisition of the taxi medallions securing Cohen?s debt. By making these loans, and attempted to and had secured proposed agreements from the banks to relieve him of certain repayment obligations worth millions of dollars. 13. Based on my review of emails obtained from the Prior Cohen Account Warrants, MD CPC Header Information, and documents produced pursuant to subpoenas, I have learned that Cohen has used the Cohen Account and/or Account to, among other things, communicate with?and their attorney,- about the proposed transfer of Cohen?s medallions and associated debts; (ii) negotiate a pay?down of the principal amount of the taxi medallion loans; communicate With his accountant about the contents of the false ?nancial statements at issue; and (iv) send those false ?nancial statements Account?Account and -iccount, respectively, to communicate with Cohen about the status of the taxi medallion transaction, and to send relevant ?nancial statements to banks. Accordingly, and as set forth in more detail below, there is probable cause to believe that the Subject Accounts will include evidence of the Subject Offenses. B. Cohen?s Statements to Sterling National Bank 14. As set forth in detail below, in 2014, Cohen, through limited liability corporations controlled by him and his wife, Laura Cohen, entered into a series of loans from Sterling 8 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 44 of 105 National Bank (?Sterling?) and the Melrose Credit Union (?Melrose?), secured by taxi medallions, for approximately $20 million. Though entered into by LLCs, the loans were also secured by personal guarantees in the names of both Cohen and his wife. Over time, as the taxi industry weakened and the medallions were devalued, Cohen sought to renegotiate the terms of those loans and/or relieve himself from their obligations, including the personal guarantees. As part of that effort, Cohen made a series of representations to Sterling and Melrose about his net worth, assets, Sterling and Melrose, and public sources concerning the taxi industry and the value of taxi medallions, as well as my review of reports prepared by law enforcement of?cers of interviews with a Sterling executive vice-president (the ?Sterling Employee?1?) and my participation in an interview with a Sterling employee (the I have learned, among other things, the following: a. Taxi medallions are small metal plaques af?xed to taxis. Without a medallion, it is illegal to operate a taxi in cities with medallion systems, such as New York City. Cohen and his wife own multiple LLCs that collectively own 32 taxi medallions (each LLC owns two medallions).2 Cohen?s purchase of these New York taxi medallions was originally financed by loans from Capital One Bank, for which the medallions served as collateral. Cohen was not a taxi operator, and leased his medallions to a third party. That third party made payments to Cohen, who in turn used some of those proceeds to pay his loan payments. b. In early 2014, Cohen became a customer of Sterling when he sought to refinance a mortgage on a rental property that he owned. In or around April 2014, Cohen raised with Sterling 2 One of these companies, Mad Dog Cab Corp., was jointly owned by Sondra Cohen, who I believe is Cohen?s mother. 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 45 of 105 the prospect of re?nancing his taxi medallion loans, which were then at Capital One Bank. By in or about September 2014, Cohen began negotiating a lending transaction with Sterling that would allow Cohen to pay off his loans at Capital One and borrow more money from the then?increase in value of the medallions. According to Sterling Employee?l in 2014, prior to the recent upheaval in the taxi industry?as a result of the emergence of ride-sharing services, such as Uber?taxi medallion loans were viewed by banks and investors as safe, short term credits, as the market value by Cohen?were frequently re?nanced at increasing amounts as the value of the medallions rose. According to Sterling Employee-l borrowers typically cashed out the increase in the loan amount and used the additional funds for other purposes. Cohen appears to have followed this approach in 2014, when he agreed to re?nance his medallion loans for approximately $22 million, which? according to letters from Capital One Bank in Sterling?s ?les?was greater than his previous debt at Capital One Bank ($21 million, of which $14.6 million was a line of credit to Cohen). This allowed Cohen to cash out the proceeds from the transaction. 0. Based on my review of records maintained by Sterling, I have learned that on or about December 8, 2014, each of Cohen?s sixteen taxi medallion corporations entered into loan agreements and promissory notes with Sterling for the principal sum of$ 1,375,000, with repayment due on December 8, 2016. Each loan was signed by Michael or Laura Cohen, depending on who was the sole shareholder of the corporation. The loans were also each secured by a security agreement, dated the same day, making the medallions collateral for the notes. To give Sterling additional security, Michael and Laura Cohen signed personal guarantees and confessions of judgment, giving Sterling the right to pursue collection against the Cohens? personal assets were their corporations to default under the loan agreements. In total, Sterling agreed to lend 10 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 46 of 105 approximately $22 million to the Cohens? companies. Pursuant to participation agreements, Sterling transferred 45 percent of that debt to Melrose.3 Under the terms of Sterling?s participation agreements with Melrose, Sterling was precluded from amending or modifying the loans without the consent of Melrose. d. In evaluating Cohen?s requested re?nancing of the taxi medallions, Sterling (and Melrose, consistent with its participation in the deal) conducted due diligence. At Sterling?s (the ?August 2014 Financial Statement?), which indicated that Cohen had $100,740,000 in total assets, $23,550,000 in total liabilities, and a net worth of $77,190,000.4 From my review of a Sterling credit memorandum, dated September 29, 2014, 1 know that Sterling viewed the transaction favorably because, accounting for loan payments, cash ?ows from thelmedallions were projected to be positive, the value of the collateral (as estimated by Sterling) exceeded $42 million, and the net worth of Cohen?who was the direct obligor under the guarantee agreements?was over $77 million. An internal Sterling credit and risk rating analysis report, dated October 20, 2014, recommended approval of the loans for substantially the same reasons. e. Based on my review of records maintained by Sterling and public sources, I have learned that over time, the collateral backing Cohen?s loans (taxi medallions) lessened'in value due to the rise in ride-sharing companies and signi?cant devaluation of taxi medallions. Additionally, Cohen began falling behind on loan payments to Sterling and Melrose. I know from records maintained by Sterling and an interview with Sterling Employee-2 that, beginning in or around 3 Melrose, which had a business principally focused on taxi medallion loans, is now in conservatorship by the National Credit Union Administration 4 Cohen subsequently provided Sterling with a revised statement of ?nancial condition, also dated August 1, 2014, (which reported assets of $99,420,000, total liabilities of $23,550,000, and a net Worth of $75,870,000. 1 1 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 47 of 105 September 2015, Cohen told Sterling, in sum and substance, that the individual leasing Cohen?s medallions had fallen behind in making payments to Cohen, and that as a result, the cash flow from his taxi medallions had been reduced, leaving him with a shortfall of approximately $16,000 each month. For instance, I have reviewed an email from Sterling Employee-2, dated September 9, 2015, summarizing a call with Cohen?which according to the email and toll records for Cohen?s cellphone occurred on September 8, 2015?during which Cohen told Sterling approximately $16,000. In that same email, Sterling Employee?2 commented that despite Cohen?s statements, his personal financial information ?indicate[d] a strong ability to make up the difference in payments.? Cohen, however, according to Sterling Employee-2, pushed the bank for a reduction in Cohen?s payments. f. From my review of records maintained by Sterling and my participation in an interview with Sterling Employee-2, I have learned that Cohen and Sterling Employee-2 spoke again on September 28, 2015, and that during the call Cohen stated, in sum and substance, that the individual to whom Cohen leases the medallions had again reduced payments to Cohen. I know from my review of records maintained by Sterling that bemeen in or about September 2015 and November 2015, Sterling raised the possibility?both internally and with Cohenwf Cohen posting his real estate holdings, personal residence, or some other collateral as additional security for the banks. According to these records, however, Cohen resisted these requests. From my review of loan documents and records maintained by Sterling, I know that in or about November 2015, as a result of Cohen?s representation that he was not earning suf?cient returns on his medallions to cover interest payments, Sterling and Melrose agreed to amend their loans with Cohen by, 12 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 48 of 105 among other things, reducing the interest rate Cohen paid to Melrose and extending the loan maturity date to December 8, 2017. g. Iknow from interviews with Sterling Employee?1 and Sterling Employee?2, as well as emails I have reviewed, that in or about October 2016, Cohen told Sterling Employee?1 that Cohen had a potential buyer of his taxi medallions, named -who would agree to assume Cohen?s debt with Sterling and Melrose. Based on my review of records maintained by -. above, I know that by or before October 2016, Cohen had entered into negotiations to sell his sixteen corporate taxi medallions to - who is a medallion owner and taxi operator, for the balance of the loans, which at the time was $21,376,000. I know from my review of records maintained by Sterling, and my participation in an interview with Sterling Employee?2, that as a condition of the transfer of the medallion loans?and because Sterling was unfamiliar with - -?Sterling requested that Cohen make a substantial principal payment on the loan, of approximately one million dollars, prior to the transfer. Cohen rejected this request initially. But on or about January 3 1, 2017, Cohen told Sterling Employee-1, in sum and substance, that he would make a one million dollar principal reduction payment in order to move forward with the medallion transfer deal with - Indeed, in an email sent from the Cohen Account to Sterling Employee?2 on or about February 22, 2017, Cohen con?rmed that he ?agreed to pay down 1 million from the loan amoun h. Pursuant to the participation agreements between Sterling and Melrose, Sterling was required to secure Melrose?s agreement to participate in the transfer of the taxi medallion debt from Cohen to On or about April 17, 2017, Sterling sent a memorandum to Melrose summarizing the terms of the proposed transaction, and noting the requirement that 13 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 49 of 105 Melrose agree to the terms. On or about May 2, 2017,_emailed Sterling Employee-1 from the?account to inquire about the status of the transaction. Sterling Employee-1 responded t(_1t the _1 Account that Melrose had agreed to the deal, and that Sterling would be sending ?a term sheet shortly. i. In order for the banks to evaluate the proposed transaction fully, they requested the _Account about the ?Cohen Medallion Purchase,? and stated order to proceed with the assumption of Michael?s loans,? Sterling needed certain ?nancial information from?i responded from the _Account, copying _at th<_Account, that he would send a ?nancial statement and tax returns shortly. Additionally, on or about June 7, 2017, Sterling Employee-1 emailed Cohen to 3! request an ?updated personal ?nancial statemen completed jointly with Cohen?s wife, and Cohen?s most recent federal income tax return. On or about June 8, 2017, Cohen emailed Sterling Employee-l from the Cohen Account, attaching a Sterling personal ?nancial statement form that had been ?lled out by hand, which referenced a statement of ?nancial condition, dated May 1, 2017 (the ?May 2017 Financial Statement?), that was also attached. The May 2017 Financial Statement included a cover letter from Cohen?s accountant, Jeffrey Getzel, stating, in sum and substance, that the information in the statement came from Cohen and that Getzel had not con?rmed its accuracy or completeness. The May 2017 Financial Statement stated that Cohen had total assets of $41,955,000, total liabilities of $39,130,000, and a net worth of $2,825,000. The May 2017 Financial Statement indicated that Cohen?s assets were comprised of $1,250,000 in 14 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 50 of 105 cash, $26,155,000 in closely held companies (such as the taxi medallion entities?and his real estate holdings), $3,200,000 in real estate investments, and his $11,000,000 personal residence. j. Based on my review of reports of law enforcement interviews of Sterling Employee-1, I have learned that Sterling Employee?1 reviewed each line of the May 2017 Financial Statement with Cohen to, among other things, verify its accuracy, and Sterling Employee?1 asked Cohen about the cash amount listed on the May 2017 Financial Statement. Cohen stated to Sterling W, W. 7, k. On or about August 16, 2017, Sterling Employee?1 emailed Cohen at the Cohen Account ant?at the?Account, attaching a non?binding term sheet memorializing the potential transaction between Sterling, Melrose, Cohen, and i- On or about August 29, 2017, -emailed Sterling Employee-1 from the - Account, requesting that he be included on ?all future emails to? and/ or - - concerning this matter,? and providing proposed edits to the term sheet. On or about August 30, 2017, Sterling Employee?1 emailed?at the Account, Cohen at the Cohen Account, and - at the-Account, and provided them with a revised term sheet. On or about September 5, 2017, Sterling Employee-1 sent at the _Account, Cohen at the Cohen Account, and -at the -chount a copy of the executed term sheet. According to the term sheet,_would borrow $20,000,000 from Sterling and Melrose, to be secured by the medallions that -was to acquire from Cohen. 1. As part of the agreement, according to the term sheet, $1,265,913 in principal (which is what would remain after the $20,000,000 payment on the outstanding loan balance) would be repaid by Cohen and the two banks, with Cohen paying ?fty percent and the banks dividing the - 15 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 51 of 105 remaining half of the balance. Based on my review of an internal Sterling credit memorandum, dated October 4, 2017, the parties reached a preliminary agreement that Cohen would pay $632,956 of the remaining $1,265,912 principal loan balance, and Sterling and Melrose would absorb $357,167 and $275,789 respectively in the form of charge-offs. According to Sterling Employee? 1, Sterling was willing to divide the repayment of the outstanding principal balance?despite its prior insistence that Cohen make a principal pay?down of at least one million dollars?because insuf?cient liquidity to pay the full outstanding principal balance. As part of the agreement, Sterling and Melrose also agreed to relieve Cohen and his wife of the personal guarantees that they made on behalf 'of the LLCs. Thus, after completing the -:ransaction, Cohen would no longer have had any outstanding obligations to Sterling or Melrose. m. Based on my review of emails sent by Sterling employees, I have learned that because the transaction between the parties was subject to full credit underwriting by Sterling and Melrose (as well as?Melrose?s regulators at NCUA), in August and September 2017, Sterling required and requested additional ?nancial statements for Cohen and its credit underwriting process. In response to Sterling?s requests, on or about October 5, 2017, - -sent from the - Account to a Sterling employee a copy of l- - personal ?nancial statement. The ?nancial statement lists the Account as the email contact for - Additionally, on or about October 5, 2017, Cohen, using the Cohen Account, re-sent Sterling Employee?2 a copy of his May 2017 Financial Statement. A day later, on October 6, 2017, Cohen, using the Cohen Account, emailed Sterling Employee?2 a statement of ?nancial condition, dated September 30, 2017 (the ?September 2017 Financial Statement?). 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 52 of 105 n. Like the May 2017 Financial Statement, the September 2017 Financial Statement included a cover letter from Jeffrey Getzel, Cohen?s accountant, stating, in sum and substance, that the information in the statement came from Cohen, and that Getzel had not con?rmed its accuracy or completeness. The September 2017 Financial Statement stated that Cohen had total assets of $33,430,000, total liabilities of $45,630,000, and a negative net worth of $12,200,000. Notably, unlike Cohen?s May 2017 Financial Statement, the September 2017 Financial Statement Statement indicated that Cohen?s assets were comprised of $1,250,000 in cash, $17,630,000 in 'closely held companies (such as the taxi medallion entities and his real estate holdings), 5 $3,200,000 in real estate investments, and his $11,000,000 personal residence (which, for the first time, he indicated was held in trust). The September 2017 Financial Statement included assets and liabilities not held in Cohen?s name, such as various entities associated with his taxi medallions and some of his real estate investment entities. 0. From my participation in an interview with Sterling Employe e?2, and my review of records maintained by Sterling, I have also learned that at or around the time Cohen provided Sterling with these ?nancial statements?in or around September 2017?Cohen stopped paying loan payments on his taxi medallion loans altogether. According to Sterling Employee? 2, Cohen informed Sterling, in sum and substance, that he had insufficient funds to pay the principal and interest payments on his medallion loans. By in or about December 2017, Sterling and Melrose had not been paid approximately $276,937.92 in principal and interest payments on the medallion loans. Based on Cohen?s ?nancial condition as conveyed in the 5 Notably, the September 2017 Financial Statement valued each of Cohen?s thirty?two New York taxi medallions at approximately $180,187.50, which was considerably less than the $650,000 valuation ascribed to each medallion in the Coher term sheet. 17 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 53 of 105 September 2017 Financial Statement, and his delinquency in making payments to Sterling, among other things, the bank?s credit underwriting committee determined (and memorialized in a December 2017 memorandum) that the Coher_transaction was favorable for the bank - that is, that-would be a better borrower than Cohen. p. On or about December 26, 2017, Sterling sent Cohen a demand letter requesting the immediate receipt of past?due loan payments. On December 29, 2017, Sterling sent Cohen a ,rss?elligr3WW - corporations. Cohen did not make an immediate payment on the loans, but instead sent an e?mail to Sterling Employee?1 on or about January 24, 2018, from the Cohen Account, stating that during the closing of the Cohen-_ transaction, Cohen would ?bring all payments up to date as well as deposit the payoff differential.? Cohen also requested by email sent from the Cohen Account on January 24, 2018, that at the closing of the Cohen??-transaction, Sterling provide a letter stating that all of Cohen?s debts have been satisfied and that Cohen?s personal guarantees of the medallion loans had been terminated. q. The Coher-transaction, however, did not close. On or about January 29, 2018-the-ttorney, emailed attorneys for Sterling from the-Account and stated that ?at this time there is no deal with Michael Cohen. Some of the numbers have changed and we are not prepared to go forward.? I. Based on my participation in the interview with Sterling Employee-2 and my review of records maintained by Sterling, I know that after the Cohen-deal fell apart, Sterling assigned Cohen?s loans to an employee at Sterling who specializes in collecting on defaulting loans (?Sterling From my review of telephone call notes, 1 know that Sterling Employee?3 spoke to Cohen on or about January 30, 2018 about paying down and/or 18 02.23.2018 Case Document 48-4 Filed 07/18/19 Page 54 of 105 restructuring Cohen?s outstanding taxi medallion loans. Based on my review of an email between Sterling Employee?3 and Cohen, I know that on the January 30, 2018 call, Cohen stated that he would send a ?corrected curren version of his personal ?nancial statement. Following that call, on or about January 31, 2018, Cohen emailed Sterling Employee?3 from the Cohen Account a copy ot the September 2017 Financial Statement. Later that day, Cohen again emailed Sterling Employee?3 from the Cohen Account and proposed paying $500,000 to bring the loans current an :76 0,0 0 a-lrb alanceto?$20 :5 0 0,0 0 0::Gohenralso:su gestederevisedanenth-l?yvrn? interest payment amounts. On or about January 31, 2018, Sterling Employee-3 responded to Cohen at the Cohen Account and stated, in sum and substance, that Cohen would need to pay the entirety of the overdue payments and pay down the principal balance of the loan to $20,000,000 (in total, a payment of approximately $1,750,000), and would need to make larger interest payments. 5. On or about February 1, 2018, Cohen emailed Sterling Employee?3 from the Cohen Account and proposed ?[p]ayment of $1.250m which ALL can be used to pay down principal, if [Sterling] will waive past due amounts,? but stated do NOT have more than the $1.250m.? . (Emphasis in original.) Cohen also stated, in sum and substance, that he had insuf?cient ?nancial resources to post additional collateral or pre?fund payments. Based on my participation in an interview with Sterling Employee?2, I have learned that Sterling continues to renegotiate the medallion loans with Cohen based on Cohen?s representations about his current ?nancial position. 19 02.28.2018 .. Case Document 48-4 Filed 07/18/19 Page 55 of 105 C. Cohen Made Material Misrepresentations About His Finances to Banks Cohen Concealed from Sterling and Melrose Cash Derived from Consulting Work 15. As set forth in detail below, despite multiple representations by Cohen to Sterling (and, by extension, Melrose6) that he had insuf?cient funds to pay down the principal balance of the medallion loans, make interest payments, or pay past?due amounts, it appears that between 2016 and the present, Cohen opened and maintained bank accounts at First Republic Bank (E?First med?consulting mm? accounts, which he did not disclose to Sterling. Cohen set up these accounts and received these funds during the very period in which he made disclosures to Sterling about his personal ?nances (including his assets and liabilities) and his ability to make payments on the medallion loans. In these disclosures to Sterling?and despite being asked about these bank accounts by his accountanthohen withheld information about liquid ?nancial assets at First Republic. 16. Speci?cally, based on my review of documents and bank records produced pursuant to a subpoena by First Republic, and my participation in and review of reports of interviews with two First Republic employees, I have learned, among other things, the following: a. Cohen and his wife have been customers of First Republic since approximately June 2011. Cohen controls several checking and loan accounts, some in his own name and others in the names of corporate entities. 6 Based on my review of a rep01t of an interview conducted with an employee of Melrose, 1 have learned that, pursuant to the participation agreement between Sterling and Melrose, Cohen?s ?nancial statements and other records in Sterling?s possession were forwarded to Melrose so that Melrose could make a determination as to whether to approve of the Cohen? transaction. Based on my review of reports of interviews with employees, 1 also know that Cohen called employees at Melrose regarding the Cohen ransaction. 20 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 56 of 105 b. On or about October 26, 2016, in Manhattan, New York, Cohen opened a new checking account at First Republic in the name of Essential Consultants LLC (the ?Essential Consultants Accoun Cohen was the only authorized signatory on the account. When Cohen opened the Essential Consultants Account, a First Republic employee (?First Republic Employee? conducted an in-person interview of Cohen. In response to a series of know?your-customer questions7 about the purpose of the account??the answers to which First Republic Employee?1 Consultants as a real estate consulting company to collect fees for investment consulting work, and all of his consulting clients would be domestic individuals based in the United States. Cohen also stated, in sum and substance, that his purpose in setting up the account was to keep the revenue from his consulting business?which he said was not his main source of income?separate from his personal ?nances. As set forth. below, there is probable cause to believe that Cohen?s statements about the intended purpose of the account and source of funds for the account were false. Speci?cally, the account was not intended to receivewand does not appear to have receivedwmoney in connection with real estate consulting work; in addition, the account has received substantial payments from foreign sources. c. First, on or about October 27, 2016?the day after he opened the Essential Consultants Account, Cohen used the account to wire $130,000 to an account held in the name of attorney Keith Davidson?s law ?rm. Based on my review of emails between Cohen and Davidson, 7 Certain ?nancial institutions are required to conduct such procedures pursuant to the Bank Secrecy Act and its implementing regulations. See 31 U.S.C. 5318; 31 C.F.R. 1020.220. 8 First Republic Employee?1 ?rst ?lled out the form on the day he interviewed Cohen, October 26, 2016. On or about December 19, 2016, at the request of bank compliance personnel, First Republic Employee?1 updated the form to add more detail about Cohen?s statements. 21 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 57 of 105 obtained pursuant to the Prior Cohen Account Warrants, I believe? that this payment did not relate to any real estate consulting work, but rather was a ?settlement? payment made to Davidson?s client. 9 Based on my review of public sources, Ihave learned that Davidson?s client is alleged to . have had an extramarital affair with Donald Trump. On or about February 13, 2018, Cohen made a public statement that a private transaction in 2016, I used my own personal funds to facilitate a payment of $130,000 to [Davidson?s client].? j: Ghe. duled-. by an FBI forensic accountant that after Cohen opened the Essential Consultants Account, Cohen received payments into that account from foreign businesses and entities that do not re?ect the stated client pro?le for the residential and commercial real?estate consulting services. Speci?cally, from my review of the Essential Consultants Account schedule and public sources, I know the following: i. Beginning on or about January 31, 2017, Cohen began receiving payments of $83,333 from an entity called Columbus Nova LLC, which were deposited into the Essential Consultants Account. According to public sources, Columbus Nova is an investment management ?rm controlled by Renova Group, an industrial holding company based in Zurich, Switzerland that is controlled by Russian national Viktor Vekselberg. From January 2017 to August 2017, the Essential Consultants Account received seven payments totaling $583,332.98 from Columbus Nova LLC. 9 Speci?cally, I have learned from my review of bank records that on or about October 26, 2016, Cohen transferred $131,000 from a home equity line of credit account at First Republic to the Essential Consultants Account; on or about October 27, 2016, Cohen transferred $130,000 from the Essential Consultant Account to an account held in the name of Davidson?s law ?rm at a bank based in Los Angeles; and on or about November 1, 2016, a wire transfer in the amount of approximately $96,645 was made from Davidson?s account to a bank account in the name of Davidson?s client. 22 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 58 of 105? ii. Beginning on or about April 5, 2017, Cohen began receiving payments from Novartis Investments, SARL, which I believe to be the in?house ?nancial subsidiary of the Swiss pharmaceutical company Novartis International AG (??Novartisi?). Between April 2017 and January 2018, the Essential Consultants Account received ten wire payments from a Swiss bank account held in the name of Novartis, each in the amount of $99,980, for a total of $999,800. Beginning in or about April 2017, the Essential Consultants Account started Inc. Speci?cally, on or about April 14, 2017, wired $100,000 to the Essential Consultants Account and, ?om in or about June 2017 to in or about January 2018, the Essential Consultants Account received nine $50,000 payments from In total, wired $550,000 to the Essential Consultants Account. iv. On or about May 10, 2017, June 9, 2017, July 10, 2017, and November 27, 2017, the Essential Consultants Account received four deposits in the amount $150,000 (totaling $600,000) from a bank account in South Korea. The account holder from which the money was sent is Korea Aerospace Industries Ltd. KAI is a South Korea-based company that . produces and sells ?xed?wing aircraft, helicopter aircraft, and satellites to the United States Department of Defense, among other customers. v. On or about May 22, 2017, the Essential Consultants Account received a $150,000 deposit from an account at Kazkommertsbank, a Kazakhstani bank. The listed account holder at Kazkommertsbank was a second Kazakhstani bank named BTA Bank, A0. A message accompanying the wire payment indicated that the payment was a consulting fee as per Inv DD May 10, 2017 consulting agreement DD 08 05 2017 CNTR 08/05/2017.? 23 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 59 of 105 vi. In total, from on or about January 31, 2017 to on or about January 10, 2018, the Essential Consultants Account received approximately $2,883,132.98 in transfers and checks from the aforementioned entities. As of on or about January 10, 2018, the balance in the Essential Consultants Account was $1,369,474.23. e. On or about April 4, 2017, Cohen opened another new checking account at First Republic, this one in the name of Michael D. Cohen Associates, PC. (the Accoun ?-WW?wGohenr Account received ten wire transfers and one check from an account in the name of Squire Patton Boggs, a law firm. In total, from on or about April 5, 2017, to on or about January 2, 2018, the Account received $426,097.70 in deposits, and the balance in the account as of January 2, 2018, was $344,541.35. As discussed below, Cohen never disclosed any of the balance in the Essential Consultants or accounts to Sterling during the negotiations with respect to the -7ansaction, including in his May 2017 Financial Statement and September 2017 Financial Statement. 17. Based on my review of emails from the Cohen Account that were seized pursuant to the Prior Cohen Account Warrants, and my review of reports of interviews with employees of and Nevart'is, it appears that the aforementioned payments to the Essential Consultants Account and Account ostensibly were for political consulting work, including consulting for international clients on issues pending before the Trump administration.10 Speci?cally, from my review of emails from the Cohen Account and public soUrces, I have learned the following: 10 Based on my review of public sources, I have learned that Cohen is not registered as a lobbyist or as a person acting as an agent of foreign principals, as may have been required by the Foreign Agents Registration Act. 24 02.23.2013 Case Document 48-4 Filed 07/18/19 Page 60 of 105 a. On or about April 28, 2017, Cohen sent an email from the Cohen Account to an individual whom I believe is af?liated with KAI. In the email, Cohen attached a document purporting to be a ?Consulting Agreement? between KAI and Essential Consultants dated as of about May 1, 2017. The document indicates that Essential Consultants would render ?consulting and advisory services, as requested? by KAI, and that KAI would pay Essential Consultants ?a consulting fee of One Million Two Hundred Thousand US Dollars,? disbursed WW b. On or about May 10, 2017, Cohen sent an email from an alternate email address, copying the Cohen Account, to an employee of BTA Bank. To the email, Cohen attached an invoice to BTA Bank in the name of Essential Consultants. The invoice contemplated a $150,000 payment to Essential Consultants for a consulting fee.? 0. On or about February 13, 2017, Cohen emailed an employee from the Cohen Account what appears to be a consulting agreement, which contemplates that Essential Consultants ?shall render consulting and advisory services to and that would ?advise [Essential Consultants] of those issues and matters with respect to which Services desires [Essential Consultants]?s assistance and advice.? The contract calls for ?to pay the Consultant for his services . . . a consulting fee of Fifty Thousand ($50,000) Dollars . . . per month.? Based on my review of reports of interviews with employees, I have learned that retained Cohen to consult on political issues, including net neutrality, the merger between and Time Warner, and tax reform. d. On or about January 17, 2017, Cohen emailed to a representative of Novartis from the Cohen Account a contract between Novartis and Essential Consultants, which provides that Essential Consultants will ?provide consulting and advisory services to Novartis on matters that 25 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 61 of 105 relate to the repeal and replacement of the Affordable Care Act in the US and any other issues mutually agreeable to [Essential Consultants] and Novartis.? The contract provides for a ?consulting fee of One Million Two Hundred Thousand ($1,200,000) US dollars,? to be paid to Essential Consultants in even installments over the course of a year. Based on my review of reports of interviews with Novartis employees, I have learned that Novartis retained Cohen to provide political consulting services and to gain access to relevant policymakers in the Trump W, ,7 a, e. On or about April 3, 2017, Squire Patton Boggs, a law ?rm, announced on its website that is had formed a ?strategic alliance? with Michael D. Cohen Associates and would ?jointly represent clients.? 18. Despite the signi?cant amount of money that Cohen received into the Essential Consultants Account and the Account, and the cash balance in both accounts, Cohen did not disclose that information to Sterling or Melrose. Speci?cally, based on my review of documents provided by Getzel, and my review of notes an__ I have learned the following: a. In or about May 2017, Getzel met with Cohen at a law ?rm in Manhattan, New YOrk. At the meeting, Cohen told Getzel, in sum and substance, that he had set up a law practice called Michael D. Cohen Associates RC, and a consulting comp any called Essential Consultants LLC. Cohen told Getzel, in sum and substance, that he expected to earn $75,000 per month in connection with his law practice, and that he expected gross revenues for the consulting business to be between ?ve and siX million dollars annually. b. In or about October 2017, if not earlier, Getzel was preparing a personal ?nancial statement for Cohen. On or about October 6, 2017, Getzel sent an email to Cohen at the Cohen 26 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 62 of 105 Account in which Getzel wrote that ?[a]ttached is a draft of the new PFS as of September 30, 2017? and attached a draft of the September 2017 Financial Statement. The draft statement re?ected that as of September 30, 2017, Cohen had only $1,250,000 in cash, total assets of approximately $33,430,000 (comprised of taxi medallion interests, real estate interests, and his personal residence and property), and liabilities of approximately $45,630,000, leaving him purportedly over $12 million in debt. In the same email, Getzel questioned Cohen, in sum and substance, about the fact Account or the Account: did not add any value for you[r] two operating entities Michael D. Cohen Associates POC [Sic] and Essential Consultants LLC. Please advise whether or not these should be disclosed and what value.? c. On or about October 6, 2017, Cohen called Getzel by telephone??which is re?ected on toll records for Cohen?s cellphone?and told Getzel, in sum and substance, not to include Essential Consultants or in the September 2017 Financial Statement because they had no value. d. On or about October 6, 2017, following the call with Getzel, Cohen, using the Cohen 1 Account, responded to Getzel?s email with the answer good to me.? Cohen never directed Getzel to make any changes to his cash position as listed in the September 2017 Financial Statement. Neither Essential Consultants nor was listed on the September 2017 Financial Statement that was provided to Sterling. 19. Based on the foregoing, and from my review of bank records and emails sent by Cohen to Sterling, I know that the September 2017 Financial Statement made no mention whatsoever of assets that Cohen held in the Essential Consultants Account or the Account. As of September 30, 2017?the date of the September 2017 Financial Statement?Cohen had 27 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 63 of 105 approximately $673,729.95 in the Essential Consultants Account and $24 8,619.28 in the ?Account. As of October 6, 2017, the date when Getzel asked Cohen about the two accounts, Cohen had approximately $823,709.95 in the Essential Consultants Account and $248,619.28 in the Account. Cohen Understated His Available Cash 20. In addition to withholding the existence of the Essential Consultants Account and the his available cash and cash equivalents in his ?nancial disclosures. Speci?cally, I know from my review of the September 2017 Financial Statement that Cohen provided to Sterling that Cohen represented that he had $1,250,000 in cash as of September 30, 2017. But, from my review of a summary of bank records that were scheduled by an FBI forensic accountant, I have learned that Cohen had over $5,000,000 in cash and cash equivalents as of September 30, 2017. Speci?cally, from my review of the account schedule and bank records, I have learned the following: a. Cohen has three checking and/or savings accounts at Capital One Bank, one of which is in his wife?s name. As of September 30, 2017, Cohen had $1,105,680.35 in his savings account, and $1,262,982.29 in total in the three accounts at Capital One Bank. b. Cohen has three accounts at Morgan Stanley in his name. As of September 30, 2017, the combined total in cash and cash equivalents in those three accounts was $1,270,600.41. c. As of September 30, 2017, Cohen had $260,689.18 in an account at Signature Bank. (1. In addition to the Essential Consultants Account and Account at First Republic, Cohen also had two joint checking accounts with Laura Cohen at First Republic. In total, as of September 30, 2017, Cohen had at least $1,876,209.27 in total in his four accounts at First Republic. 28 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 64 of 105 e. Cohen has an account at Bethpage Credit Union with $25,931.39 in it as of September 30, 2017. f. As of September 30, 2017, Cohen had $17,542.54 in accounts at Sterling. g. Cohen has two accounts at TD Bank?one in his name and one held jointly with his wife~??and the total balance across the two accounts as of September 30, 2017 was $300,096.72. h. In total, as of September 30, 2017, Cohen had at least $5,014,051.80 in his accounts ank;:B ethp Morgan Stanley. 21. Accordingly, based on the foregoing, it appears that Cohen?s representations to Sterling and Melrose that he did not have more than $1,250,000 were false, and that Cohen withheld information regarding approximately $5 million in funds from Sterling and Melrose in order to secure favorable terms in his renegotiation of his medallion loan. Based on my participation in an interview with Sterling Employee-2, and my review of reports of interviews with Sterling Employee-1 and two Melrose employees, it is my understanding that that Sterling and Melrose would View Cohen?s understating of his assets as material to its decision whether to renegotiate Cohen?s medallion loans and on what terms, or approve of the transfer of those loans to Cohen Had a Side Agreement With- 22. As set forth in detail below, it appears that during the course of Cohen?s negotiations to sell his interest in taxi medallions and the associated debt to_Cohen not only misrepresented his financial position to Sterling, but also failed to disclose a side deal he had negotiated with - it appears that -1greed to pay an above?market price for Cohen?s taxi cab medallions, and in exchange, Cohen agreed to pay _pproximately 29 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 65 of 105 $3.8 million in cash. Speci?cally, from my review of documents produced pursuant to a subpoena by Sterling, and reports prepared by law enforcement of?cers of interviews with Sterling Employee-1, as well as my participation in an interview with Sterling Employee?2, I have learned, among other things, the following: a. On or about September 5, 2017, an executed term sheet was circulated by Sterling Employee-1 to Cohen and - See supra 11 14(k). According to the term sheet, - that _Nas to acquire from Cohen. At a price of $20 million for thirty-two taxi medallions, I the proposed transaction valued each medallion as worth $625 ,000. The term sheet also contemplated a $1,265,913 pay?down of the principal balance of the loan. The term sheet made no mention of a $3.8 million payment from Cohen to _or any other form of payment or ?nancial transaction between the parties. b. Additionally, an internal Sterling credit memorandum, dated October 4, 2017, describing the terms of the Cohen-?-transaction and the new loan to _did not mention any payments from Cohen to including a $3.8 million payment. The memorandum also noted that the ?loan amount of indicates a purchase price per medallion? but ?it is recognized that this is not in line with current market values.? Indeed, according to an internal Sterling memorandum dated February 5, 2018, in the month of January 2018, taxi medallions sold for amounts ranging from $120,000 to $372,000. According to Sterling Employee?1 and Sterling Employee?2, they were never told that- agreed to a purchase price of $625,000 in exchange for a lump sum payment from Cohen, or that Cohen would make any payment to - 30 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 66 of 105 23. While Cohen and_ did not disclose any payment from Cohen to _in communications with Sterling, it appears that such a payment was contemplated. Indeed, based on my review of records maintained by Getzel, and a report prepared by law enforcement agents of an interview with Getzel, I have learned the following, in substance and in part, regarding the proposed side-payment from Cohen to -: a. On or about September 19, 2017, Getzel prepared a memorandum for Cohen 7:33:72: 2::Tentitle dgr??S and:]3 ebtrAs sumpt-ionl?: ether? A The Getzel Memorandum summarized the proposed transaction between Cohen and- in part, as follows: ?Michael and Laura Cohen will transfer ownership of their 13 NYC medallion entities to a Buyer who will assume their bank indebtedness, upon the [Cohens?] paying down the debt portfolio of the 13 entities by $500,000 and a cash payment to the Buyer of b. According to Getzel, Cohen told him the parameters of the deal, including the payment of $3,800,000 to - but Getzel did not know where Cohen was going to obtain $3,800,000 to pay_ As noted above, Cohen had more than $5,000,000 in cash and cash equivalents as of September 2017, but had only disclosed in his September 2017 Financial Statement that he had $1.25 million in cash. 24. Based on my review of records maintained by Sterling (as well as Melrose, the bank with the participating interest in the loans) and reports of interviews of representatives of Sterling (and Melrose), I have seen no evidence that Sterling, Melrose, or any other ?nancial institution involved in the potential deal with Cohen and '-was aware of the planned $3.8 million side payment from Cohen to - 11 The reference to thirteen medallions appears to be an error by Getzel. Cohen and his wife together owned sixteen corporations, which in turn owned 32 taxi medallions. 31 02.23.2013 Case Document 48-4 Filed 07/18/19 Page 67 of 105 D. Probable Cause Regarding the Subject Accounts 25. As set forth above, since at least September 2015, if not earlier, Cohen has told Sterling that he has dif?culty making payments on his medallion loans and, since at least October 2016, Cohen has been actively engaged in an attempt to sell his taxi medallions and the associated debts tc?t In the course of doing so, Cohen has used the Cohen Account and/or Account to engage in email communications regarding the terms of the transactions and the 010 ide=p?yment ~Wwith '73" -1t the-Account, and i- at the-Account. Speci?cally, as described above, there is probable cause to believe that the Subject Accounts have been used regarding the proposed Cohen- transaction with Sterling: a. Cohen has used the Cohen Account to, among other things, negotiate a pay?down of the principal amount of the loan, see supra 11 14(g), to send term sheets to Sterling, see supra Tl 140), to communicate with his accountant about the contents of ?nancial statements, see supra Ti 16, to send ?nancial statements to Sterling, see supra 14(i), to check on the status of the transaction as of January 24, 2018, see supra Tl 14(n), to negotiate a reduction of his debt with Sterling on or around January 31, 2018, see supra 11 14(0), to tell Sterling on February 1, 2018, he does not have the ability to pay more than $1,25 0,000, see supra 14(p), and to communicate with individuals responsible for sources of payments to the Essential Consultants Account, see supra Tl 15. In other words, from the communications described above, it appears likely that the Cohen Account will contain recent evidence of the Subject Offenses, including communications and potential misrepresentations to Sterling, and evidence indicating that statements made to Sterling are false or misleading. b. _has used the _Alccount to communicate about the proposed taxi medallion transaction with Cohen, which appears to have been discussed as early 32 02.28.2013 Case Document 48-4 Filed 07/18/19 Page 68 of 105 as October 2016. See supra 1] 14(g). 12 Speci?cally, as described above, as early as May 2, 2017, _used the?Account to inquire about the status of the transaction, see supra 11 14(h). He used the _Account to exchange drafts of the proposed term sheet with Cohen-and Sterling, see supra 11 140). The .?Account was also used by i-to send a personal ?nancial statement for?to Sterling, see supra 1] 14(1). The?Account was copied on emails from the statement as the contact email fo:_ see supra 1i 14(m). Additionally, based on my review of Header Information, I know that on or about September 1, 2017?at or around the time the_; and Cohen were negotiating a term sheet?_used the _chount to send and receive eight emails from Cohen at the Account. c. -has used the-recount to communicate with Sterling employees, Cohen, and?Lbout the proposed taxi medallion transaction since at least December 2016. See supra 14(g), 24(c). Speci?cally, on or about August 29, 2017, -:old Sterling that he should be included on ?all future e-mails? involving the proposed transaction, see supra ii 140). Additionally, i-vas involved in making revisions to the parties? term sheets, and he told Sterling on January 29, 2018 that-vould not go forward with the planned transaction, see supra 140), (11). Accordingly, there is probable cause to believe that the -Account will contain evidence of the negotiations between Sterling and the parties, evidence of a payment from Cohen to- and the reasons for the collapse of the Cohen?_transaction. 12 For instance, from records provided by Sterling, I know that on or about December 2, 2016,?sent an email to a Sterling employee using the. Account. The email forwarded correspondence between who was using the - Account, and an employee of Capital One regarding extending )an with Capital One. 33 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 69 of 105 26. Additionally, it appears that Cohen set up the Account to receive emails he .was previously receiving at the Cohen Account. Specifically, based on my review of records maintained by I have learned that on or about May 5, 2017, Cohen sent an email from the Account to a blind copy list of recipients stating that ?[d]ue to the overwhelming volume of phone calls and emails coming into my previous cellular number and email address, I have elected to create for Clients Only the following. Kindly use this new information for all future and ?Michael D. Cohen Associates, as well as the Account as the email address. 13 27. In addition, based on my review of emails from the Account produced pursuant to the Prior Cohen Account Warrants and the Header Information, Ihave learned that Cohen has used the Account to send and receive emails from the Cohen Account, to communicate with the .kccount, and to send and receive emails from other email accounts about this political consulting business. Additionally, from my review of the Header Information, it appears that since the November 13, 2017 search warrant on the Account, Cohen has continued to send and receive emails at the Account that appear likely to be relevant to the commission of the Subject Offenses. For example, emails obtained pursuant to the Prior Cohen Account Warrants, as well as the Header Information have revealed the following: a. On approximately eight occasions in August and September 2017, while Cohen,? _were communicating about a term sheet for the Cohen-taxi 13 Based on my review of emails from the Account obtained pursuant to subpoena, I have learned that Cohen has used the account to communicate with numerous individuals with whom he does not enjoy an attorney?client privilege, including some of the individuals described below. See infra 1] 27. 34 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 70 of 105 medallion transaction, see supra 14(k), Cohen used the Account to send or receive emails fron-at the -Alccount. For instance, on or about August 22, 2017, -used the-Account to send an email to Sterling Employee~1 and copied Cohen on the email at the MD CPC Account. On the same day, Sterling Employee-l responded tc-t the Z-chount and Cohen at the Account. On or about August 22, 2017, Cohen also used the Account to send an email to Sterling Lint?mm v- ?v to send or receive eight emails with the 2-5iccount. c. Cohen used the Account to send and receive emails from individuals who work at companies with whom it appears Cohen has a political consulting agreement. For example, beginning in April 2017?the same month when Cohen began receiving payments from see supra 16(d), used the Account to send and receive emails from employees. These emails contain, among other things, invoices from Cohen to for consulting work by Cohen. Similarly, beginning in April 2017thich is also the month Cohen began receiving payments from Novartis for consulting work, see supra 16(d), 17(d)W Cohen used the Account to send and receive emails from employees of Novartis. These emails concern, among other things, invoices from Cohen and requests for Novartis for Cohen?s assistance on an initiative relating to drug pricing. d. From my review of the Header Information, I have learned that Cohen has continued to use the Account to send and receive emails from individuals who work at companies with whom it appears Cohen had a political consulting agreement, such as Novartis and For instance, on approximately six occasions between November 28, 2017 and January 30, 2018, the Account was used to send and receive emails from accounts belonging to 35 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 71 of 105 individuals using @att.com email addresses. Similarly, on approximately seventeen occasions between December 1, 2017 and February 20, 2018, the Account was used to send and receive emails from accounts belonging to individuals using @novartis.com email addresses. Since November 15, 2017, the Account has also sent and received emails with individuals using the email domains @bta.kz, which I believe is the email domain used by employees of BTA Bank, see supra 1111 16(d), 17(b), and @squirepb.com, which I believe is the email domain used by employees of the lawwfirwrn which Cohen appears to have a consulting relationship with, see Supra 1W 16(e), 17(e). Accordingly, it appears that Cohen continues to use the Account to send and receive emails that will be relevant to whether he is maintaining a consulting business, what type of consulting work he is doing, and whether he is receiving money for that consulting work. 28. In addition to the foregoing, based on my review of the Pen Register Data, see supra 11 9, it appears that since the date of the last search warrant on the Cohen Account (123., November 13, 2017), Cohen has continued to use the Cohen Account to communicate with the - - Account, the-Account, and other email accounts that appear likely to be relevant to the commission of the Subject Offenses described above. For example, the Pen Register Data has revealed the following: a. Emails sent by the Cohen Account to the -chount on- or about December 18, 2017 at 8:26 December 21, 2017 at 9:35 December 22, 2017 at 4:32 January 3, 2018 at 8:01 January 3, 2018 at 2:56 and January 4, 2018 at 3:31 pm. b. An email sent by the Cohen Account to the_ Account on or about January 25, 2018 at 8:55 pm. 36 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 72 of 105 c. Emails from the Cohen Account to the email account_ on or about December 1, 2017 at 2:14 December 29,2017 at 10:20pm, January 2, 2018 at 3:52 January 2, 2018 at 5:44 and January 8, 2018 at 6:38 pm. Based upon my review of emails contained in the Cohen Account, I have learned that 12116?1 email account belongs to Jeffrey Getzel, Cohen?s accountant, through whom Cohen made misrepresentations to ?nancial institutions, as discussed above. including Sterling Employee-1, on or about January 25, 2018 at 10:23 January 26, 2018 at 12:55 am, January 29, 2018 at 5:30 January 29,2018 at 8:29 January 30, 2018 at 6:44 pm. e. An email sent ?om the Cohen Account to the email account on or about January 25, 2018 at 5:29 pm. As stated above, First Republic is the bank at which the Essential Consultants Account is held. f. Numerous emails sent from the Cohen Account to the email account including emails on or about December 4, 2017 at 2: 17 pm. and January 29, 2018 at 5 :43 pm. Based upon the email address and domain name, as well as my review of reports of interviews and documents re?ecting that Cohen?s taxi medallions were leased and operated by believe that the _email address belongs to 29. Based on my review of records maintained by Sterling, I know that Cohen used the Cohen Account to send and receive documents related to the Cohen-- transaction. Based on my training and experience, Iknow that Google allows users of e?mail accounts to easily save documents to file sharing and retention platforms such as Google Docs and Google Drive. I 37 02.28.2018 WW Case Document 48-4 Filed 07/18/19 Page 73 of 105 also know, from my training and experience, that users of email accounts often use instant messaging interfaces linked to their email accounts. Further, I have learned that the Providers maintain records of search and web histories associated with email accounts and, based on my training and experience, users of e?mail accounts use associated web search browsers associated with a subscriber?s account to research topics they are e~mailing about. Accordingly, there is probable cause to believe that content information associated with the Subject Accounts will also contain evidencerelate?d?ito?fh'e: WW 30. Thus, I respectfully submit that there is probable cause to believe that emails and other content information from the Subject Accounts will contain evidence of Cohen?s efforts to sell his taxi medallions and the associated debt, and his misrepresentations and omissions to Sterling and Melrose in connection with these negotiations. Although Cohen appears to have communicated with?primarily through the Cohen Account and Account, I know, based on my involvement in the investigation, that Cohen also used at least one other email account associated with his position at the Trump Organization. Thus, I respectfully submit that there is probable cause to believe that emails and other content information from th_chount, _Account and-Account since on or about October 1, 2016?the approximate date of when Cohen?s efforts to sell his taxi medallions and the associated debt beganwwill re?ect communications with the Cohen Account, Account, and possibly one or more additional accounts used by Cohen, and probable cause to believe that such emails will constitute evidence of Cohen?s commission of the Subject Offenses, including the extent to which Cohen did or did not inform other individuals involved in the conduct described above??such as??of his misstatements and omissions to financial institutions. 3 8 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 74 of 105 31. Temporal Limitation. This application seeks all emails and other requested content information specified in Attachments A, B, C, and for the following periods: a. For the Cohen Account, this application seeks all emails sent, created, or received between November 14, 2017, and the date of the proposed warrant, inclusive. As described above, pursuant to the Prior Cohen Account Warrants, the SCO obtained and provided to the USAO emails from the Cohen Account that were sent, created, or received before November 14, 2017. "i?i?rt that was created between December 1, 2014 (the month when Cohen entered into the medallion loans with Sterling), and the date of the proposed warrant, inclusive. b. For the Account, this application seeks all emails sent, created, or received between November 14, 2017, and the date of the proposed warrant, inclusive. As described above, pursuant to a prior warrant, the SCO obtained and provided to the USAO emails from the Account that were sent, created, or received before November 14, 2017. c. For the_ Account and _Account, this application seeks emails and all other content information specified above sent, created, or received between October 1, 2016, and the date of the proposed warrant, inclusive. As described above, October 2016 is the month in which Cohen began negotiating the taxi medallion sale with the - d. For the _Account, this application seeks emails and all other content information speci?ed above sent, created, or received between December 1, 2016, and the date of the proposed warrant, inclusive. As described above, December 2016 is the month in which- began representing the-in relation to the taxi medallion transaction. E. Evidence, Fruits and Instrumentalities 32. Based upon the foregoing, I respectfully submit there is probable cause to believe that information stored on Google?s servers associated with the Cohen AcCount will contain evidence, . 39 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 75 of 105 fruits, and instrumentalities of violations of the Subject Offenses, as more fully described in Section II of Attachment A to the proposed warrant for the Cohen Account and Account, including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the Cohen Account or Account. b. Communications, records, documents, and other ?les involving Sterling, MelroseCommunications, records, documents, and other ?les involving a plan, proposal, or agreement for Cohen and/ or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to and/or entities associated with him; d. Communications, records, documents, and other ?les involving Essential Consultants, LLC or Michael D. Cohen Associates, including those which indicate the nature and purpose of payments made to or from Essential Consultants or Michael D. Cohen Associates; e. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) - including records that reveal the whereabouts of the person(s) who communicated with the Cohen Account and/or Account about any matters relating to Essential Consultants, LLC, or about any plan or proposal or agreement for Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to _1nd/or entities associated with him; f. Communications between the Cohen Account and/or MD CPC Account and Jeffrey Getzel relating to Cohen?s bank accounts, taxes, debts, and/or ?nances; 40 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 76 of 105 g. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; h. Evidence indicating how and when the Cohen Account and Account was -. and events relating to the crimes under investigation and to the account owner; and i. Evidence indicating the Cohen Account and Account owner?s intent as it' relates to the Subject Offenses under investigation. 33. Based upon the foregoing, I further submit there is probable cause to believe that information stored on Google?s servers associated with the_ Account and - -Account will contain evidence, fruits, and instrumentalities of violations of the Subject Offenses, including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or used th_kccount and? Account; b. Communications, records, documents, and other ?les involving a plan or proposal or agreement for Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, tc-and/or entities associated with him; c. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who 41 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 77 of 105 Communicated with the-Account and ?Account about any matters relating to any plan or proposal or agreementfor Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to- - and/or entities associated with him; d. Communications between the?Account and? Account and others, including employees or representatives of Sterling, Melrose, or other ?nancial rm W, 2- e. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; f. Evidence indicating how and when the Account and- -Account were accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account g. Evidence indicating the-xccount and -_ccount owners? intent as it relates to the Subject Offenses under investigation. owner; 34. Based upon the foregoing, I further submit there is probable cause to believe that information stored on Oath?s servers associated with the .Account will contain evidence, fruits, and instrumentalities of violations of the Subject Offenses, including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the pe1?son(s) who created or used the-Account; 42 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 78 of 105 b. Communications, records, documents, and other ?les involving a plan or proposal or agreement for Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to i_1nd/or entities associated with him; 0. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who agreement for Cohen and/ or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, or entities associated with him; d. Communications between the .Account and others, including employees or representatives of Sterling, Melrose, or other ?nancial institution(s), regarding Cohen?s ?nances; and e. Communications, records, documents, and other ?les reflecting false representations to a ?nancial institution with relation to the intended purpose of an account or lo an at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of ?inds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution. Review of the Information Obtained Pursuant to the Warrant 35. Pursuant to 18 U.S.C. 2703(g), the presence of a law enforcement of?cer is not required for service of a search warrant issued under 2703, or for the collection or production of responsive records. Accordingly, the warrant requested herein will be transmitted to the Providers, which shall be directed to produce a digital copy of any responsive records to law enforcement personnel within 30 days from the date of service. Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the ESI and the 4.3 0228,2018 Case Document 48-4 Filed 07/18/19 Page 79 of 105 status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) will retain the records and review them for evidence, fruits, and instrumentalities of the Subject Offenses as speci?ed in Section of Attachments A, and to the proposed warrant. 36. In conducting this review, law enforcement personnel may use various methods to I undertaking a cursory inspection of all emails within the Subject Account. This method is analogous to cursorily inspecting all the ?les in a ?le cabinet in an of?ce to determine which paper evidence is subject to seizure. Although law enforcement personnel may use other methods as well, particularly including keyword searches, I know that keyword searches and similar methods are typically inadequate to detect all information subject to seizure. As an initial matter, keyword searches work only for text data, yet many types of ?les commonly associated with emails, including attachments such as scanned documents, pictures, and videos, do not store data as searchable text. Moreover, even as to text data, keyword searches cannot be relied upon to capture all relevant communications in an account, as it is impossible to know in advance all of the unique words or phrases that investigative subjects will use in their communications, and consequently there are often many communications in an account that are relevant to an investigation but that do'not contain any keywords that an agent is likely to search for. 37. Because Cohen and-are attorneys, the review of the content within the Subject Accounts will be conducted pursuant to established screening procedures to ensure that the law enforcement personnel involved in the investigation, including attorneys for the Government, collect evidence in a manner reasonably designed to protect any attorney-client or other applicable 44 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 80 of 105 privilege. When appropriate, the procedures will include use of a designated ??lter team,? separate and apart from the investigative team, in order to review potentially privileged communications and determine which communications to release to the investigation and prosecution team. IV. Request for Non-Disclosure and Sealing Order 38. The existence and scope of this ongoing criminal investigation are not publicly known; As a result, premature public disclosure of this af?davit or the requested warrants could alert otherwise seriously jeopardize the investigation. In particular, based on my experience investigating white collar cases, including cases featuring documents such as agreements, drafts of agreements, notes of conversations, and other documentary evidence, premature disclosure of an investigation may cause the target of the investigation to attempt to destroy or conceal such evidence. In addition, as also set forth above, Cohen uses computers and electronic communications in furtherance of his activity and thus could easily delete, or otherwise conceal such digital evidence from law enforcement were he to learn of the Government?s investigation. See 18 U.S.C. 2705(b)(3). Cohen also appears to have the financial means that would facilitate his flight from prosecution. See 18 U.S.C. 2705(b)(2), (5). 39. Accordingly, there is reason to believe that, were the Providers to notify the subscriber or others of the existence of the warrant, the investigation would be seriously jeopardized. Pursuant to 18 U.S.C. 2705 I therefore respectfully request that the Court direct the Providers not to notify any person of the existence of the warrant for a period of 180 days from issuance, subject to extension upon application to the Court, if necessary. - 40. For similar reasons, I respectfully request that this af?davit and all papers submitted herewith be maintained under seal until the Court orders otherwise, except that the Government be permitted without further order of this Court to provide copies of the warrant and af?davit as 45 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 81 of 105 need be to personnel assisting it in the investigation and prosecution of this matter, and to disclose those materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. V. Conclusion 41. Based on the foregoing, I respectfully request that the Court issue the warrants sought herein pursuant to the applicable provisions of the Stored Communications Act, 18 U.S.C. relevant provisions of Federal Rule of Criminal Procedure 41. Special Agent Mason Posilkin United States Attorney?s Of?ce Southern District of New York Sworn to before me this 28th day of February, 2018 HONORABLE GABRIEL W. GORENSTEIN Chief United States Magistrate Judge Southern District of New York 46 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 82 of 105 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Information Associated with the Email Accounts @gmailcom, Maintained at Premises Controlled by Google, Inc., USAO Reference No. 20 1 SROO 127 SEARCH WARRANT AND NON-DISCLOSURE ORDER TO: Google, Inc. (?Provider?) United States Attorney?s Of?ce for the Southern District of New York and the Federal - Bureau of Investigation (collectively, the ?Investigative Agencies?) 1. Warrant. Upon an af?davit of Special Ageni-of the United States Attorney?s Of?ce for the Southern District of New York, and pursuant to the provisions of the Stored Communications Act, 18 U.S.C. ?2703(b)(1)(A) and 2703(c)(1)(A), and the relevant provisions of Federal Rule of Criminal Procedure 41, the Court hereby ?nds there is probable cause to believe the email accounts and maintained at premises controlled by Google, Inc., contain evidence, fruits, and instrumentalities of crime, all as speci?ed in Attachments A and hereto. Accordingly, the Provider is hereby directed to provide to the Investigative Agencies, within 7 days of the date of service of this'Warrant and Order, the records speci?ed in Section II of Attachments A and hereto, fer subsequent review by law enforcement personnel as authorized in Sections and IV of Attachments A and B. The Government is required to serve a copy of this Warrant and Order on the Provider within 7 days of the date of issuance. The Warrant and Order may be served via Case Document 48-4 Filed 07/18/19 Page 83 of 105 electronic transmission or any other means through which the Provider is capable of accepting service. 2. Non?Disclosure Order. Pursuant to 18 U.S.C. 2705 the Court ?nds that there is reason to believe that noti?cation of the existence of this warrant will result in destruction of or tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the 180 days from the date of this Order, subject to extension upon application to the Court if necessary, except that Provider may disclose this Warrant and Order to an attorney for Provider for the purpose of receiving legal advice. 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which it was issued, be ?led under seal, except that the Government may without further order of this Court serve the Warrant and Order on the Provider; provide copies of the Af?davit or Warrant and Order as need be to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. Dated: New York, New York Date Issued Time Issued HONORABLE GABRIEL W. GORENSTEIN Chief United States Magistrate Judge Southern District of New York 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 84 of 105 Email Search Attachment A 1. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the ?Provider?), headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email account _@gmail.com (the ?Subject Account?) for the time period referenced below. seats? .. appropriate manner to the Provider. The Provider is directed to produce to the law enforcement of?cer an electronic copy of the information speci?ed in Section II below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories speci?ed in Section below. II. Information to be Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Account: 21. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Account, including all message content, attachments, and header information (speci?cally including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email) limited to items sent, received, or created between November 14, 2017 and the date of this warrant, inclusive. b. Address book information. All address book, contact list, or similar information associated with the Subject Account. 0. Subscriber and payment information. All subscriber and payment information regarding the Subject Account, including but not limited to name, username, address, telephone Case Document 48-4 Filed 07/18/19 Page 85 of 105 number, alternate email addresses, registration IP address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Account, including any 1P logs or other records of session times and durations, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. e. Customer correspondence. All correspondence with the subscriber or others associated ect?Accountyinel-uding. comp laints; inquiries; and records of actions taken, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. f. Search History. All search history and/or web history associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. g. Associated content. All Google Docs, files maintained on Google Drive, and instant messages or Gchats associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. h. Preserved or backup records. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 18 U.S.C. 2703(f) or otherwise. Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement officers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the records produced by the Provider in order to locate any evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud 2 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 86 of 105 the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the Subject Account; b. Communications, records, documents, and other ?les involving Sterling National Bank, Melrose Credit Union, and/or taxi medallions; - - agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including tt?and/or entities associated with him; d. Communications, records, documents, and other ?les involving Essential Consultants, LLC or Michael D. Cohen Associates, including those which indicate the nature and purpose of payments made to or from Essential Consultants or Michael D. Cohen Associates; e. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who communicated with the Subject Account about any matters relating to Essential Consultants, LL C, or about any plan or proposal or agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including t<_1nd/ or entities associated with him; f. Communications between the Subject Account and Jeffrey Getzel relating to Michael D. Cohen?s bank accounts, taxes, debts, and/or ?nances; g. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 87 of 105 institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; h. Evidence indicating how and when the Subject Account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; and ., i- ectt. i ML. - . Offenses under investigation. IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 88 of 105 Email Search Attachment I. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the ??Provider?), headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email and ?:the ?Subject Accounts?) for the time A law enforcement of?cer will serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement of?cer an electronic copy of the information speci?ed in Section 11 below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories speci?ed in Section below. II. Information to be Produced, by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Accounts: a. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Accounts, including all message content, attachments, and header information (speci?cally including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email). b. Address book information. All address book, contact list, or similar information associated with the Subject Accounts. 0. Subscriber and payment information. All subscriber and payment information regarding the Subject Accounts, including but not limited to name, usemame, address, telephone Case Document 48-4 Filed 07/18/19 Page 89 of 105 number, alternate email addresses, registration address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Accounts, including any logs or other records of session times and durations. e. Customer correspondence. All correspondence with the subscriber or others associated with the Subject Accounts, including complaints, inquiries, or other contacts with support services W..- .. a W. f. Search History. All search history and/or web history associated with the Subject Accounts. g. Associated content. All Google Docs, ?les maintained on Google Drive, and instant messages or Gchats associated with the Subject Accounts. h. Preserved or backup records. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 18 U.S.C. 2703(f) or otherwise. Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement officers? and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the records produced by the Provider in order to locate any evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other filesinecessary to establish the identity of the person(s) who created or used the Subject Accounts; 2 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 90 of 105 b. Communications, records, documents, and other ?les involving a plan or proposal or agreement for Michael D. Cohen and/ or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, and/or entities associated with him; c. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who agreement for Michael D. Cohen and/ or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, tc_and/or entities associated with him; i d. Communications between the Subject Accounts and others, including employees or representatives of Sterling National Bank, Melrose Credit Union, or other ?nancial institution(s), regarding Michael D. Cohen?s ?nances; e. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with relation to the intended purpoSe of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; f. Evidence indicating how and when the Subject Accounts was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating the Subject Accounts oWners? intent as it relates to the Subject Offenses under investigation. 02.2 8.2018 Case Document 48-4 Filed 07/18/19 Page 91 of 105 IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 92 of 105, UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Information Associated with the Email Account @aol.com, Maintained at Premises Controlled by Oath, Inc., USAO Reference No. 2018R00127 SEARCH WARRANT AND ORDER TO: Oath, Inc. (?Provider?) United States Attorney?s Of?ce for the Southern District of New York and the Federal Bureau of Investigation (collectively, the ?Investigative Agencies?) 1. Warrant. Upon an affidavit of Special Agent - of the United States Attorney?s Office for the Southern District of New York, and pursuant to the provisions of the Stored Communications Act, 18 U.S.C. and 2703 and the relevant provisions of Federal Rule of Criminal Procedure 41, the Court hereby finds there is probable cause to believe the email maintained at premises controlled by Oath, Inc., contains evidence, fruits, and instrumentalities of crime, all as specified in Attachment hereto. Accordingly, the Provider is hereby directed to provide to the Investigative Agencies, within 7 days of the date of service of this Warrant and Order, the records specified in Section II of Attachment hereto, for subsequent review by law enforcement personnel as authorized in Sections and IV of Attachment C. The Government is required to serve a copy of this Warrant and Order on the Provider Within 14 days of the date of issuance. The Warrant and Order may be served via electronic transmission or any other means through which the Provider is capable of accepting service. Case Document 48-4 {Filed 07/18/19 Page 93 of 105 2. Non?Disclosure Order. Pursuant to 18 U.S.C. 2705(b), the Court ?nds that there is reason to believe that noti?cation of the existence of this warrant will result in destruction of or tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the existence of this Warrant and Order to the listed subscriber or to any other person for a period of 180 days from the date of this Order, subject to extension upon application to the Court if for the purpose of receiving legal advice. 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which it was issued, be ?led under seal, except that the Government may without further order of this Court serve the Warrant and Order on the Provider; provide copies of the Af?davit or Warrant and Order as need be to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. Dated: New York, New York Date Issued Time Issued HONORABLE GABRIEL W. GORENSTEIN Chief United States Magistrate Judge Southern District of New York 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 94 of 105 Email Search Attachment 1. Subject Account and Execution of Warrant This warrant is directed to Oath, Inc. (the ?Provider?), headquartered at 22000 AOL Way, Dulles, Virginia 20166, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email account -@aol.com (the ?Subject Account?) for the time period between December 1, 2016 and the date of this warrant, inclusive. appropriate manner to the Provider. The Provider is directed to produce to the law enforcement of?cer an electronic copy of the information speci?ed in Section II below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories speci?ed in Section below. 11. Information to be Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Account: a. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Account, including all message content, attachments, and header information (speci?cally including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email). b. Address book information. All address book, contact list, or similar information associated with the Subject Account. c. Subscriber and payment information. All subscriber and payment information regarding the Subject Account, including but not limited to name, username, address, telephone number, alternate email addresses, registration IP address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. anothermzm Case Document 48-4 Filed 07/18/19 Page 95 of 105 d. Transactional records. All transactional records associated with the Subject Account, including any logs or other records of session times and durations. e. Customer correspondence. All correspondence with the subscriber or others associated with the Subject Account, including complaints, inquiries, or other contacts with support services and records of actions taken. f. Search Hismry. All search history and/or web history. categories of records, whether created in response to a preservation request issued pursuant to 18 U.S.C. 2703(f) or otherwise. Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement officers and. agents, attorneys for the government, attorney support staff, agency personnel assisting the govemment in this investigation, and outside technical experts under government control) are authorized to review the records produced by the Provider in order to locate any evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud the United States), 1005 (false bank entries); 1014 (false statements to a financial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other ?les neceSsary to establish the identity of the person(s) who created or used the Subject Account; b. Communications, records, documents, and other files involving a plan or proposal or agreement for Michael D. Cohen and/ or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to-ind/or entities associated with him; 02.28.2018 Document 48-4 Filed 07/18/19 Page 96 of 105 c. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who communicated with the Subject Account about any matters relating to any plan or proposal or agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to - and/or entities associated with him; - an. W- representatives of Sterling National Bank, Melrose Credit Union, or other ?nancial institution(s), regarding Michael D. Cohen?s ?nances; and e. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution. IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 97 of 105 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Information Associated with the Email Account :.com, maintained at Premises Controlled by 1 Internet, Inc., USAO Reference No. 201 8R00127 - TO: 1 1 Internet, IHC- (?Provider?) United States Attorney?s Of?ce for the Southern District of New York and the Federal Bureau of Investigation (collectively, the ?Investigative Agencies?) 1. Warrant. Upon an af?davit of Special Agent _of the United States Attorney?s Of?ce for the Southern District of New York, and pursuant to the provisions of the Stored Communications Act, 18 U.S.C. 2703(b)(l)(A) and 2703(c)(l)(A), and the relevant provisions of Federal Rule of Criminal Procedure 41, the Court hereby ?nds there is probable cause to believe the email account maintained at premises controlled by 1 Internet, Inc., contains evidence, fruits, and instrumentalities of crime, all as speci?ed in Attachment hereto. Accordingly, the Provider is hereby directed to provide to the Investigative Agencies, within 7 days of the date of service of this Warrant and Order, the records speci?ed in Section II of Attachment hereto, for subsequent review by law enforcement personnel as authorized in Sections and IV of Attachment D. The Government is required to serve a copy of this Warrant and Order on the Provider within 14 days of the date of issuance. The Warrant and Order may be served via electronic transmission or any other means through which the Provider is capable of accepting service. Case Document 48-4 Filed 07/18/19 Page?98 of 105 2. Non?Disclosure Order. Pursuant to 18 U.S.C. 2705(b), the Court ?nds that there is reason to believe that noti?cation of the existence of this warrant will result in destruction of or tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the existence of this Warrant and Order to the listed subscriber or to any other person for a period of 180 days from the-date of this Order, subject to extension upon application to the Court if for the purpose of receiving legal advice. 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which it was issued, be ?led under seal, except that the Government may without further order of this Court serve the Warrant and Order on the Provider; provide copies of the Affidavit or Warrant and Order as need be to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. Dated: New York, New York Date Issued Time Issued HONORABLE GABRIEL W. GORENSTEIN Chief United States Magistrate Judge Southern District of New York 02.28.2018 7:22:22? :trnecessaryyexc ept:that:P:r meyefereProvgiderre .. Case Document 48-4 Filed 07/18/19 Page 99 of 105 Email Search Attachment I. Subject Account and Execution of Warrant This warrant is directed to 1 Internet, Inc. (the ?Provider?), headquartered at 701 Lee Road, Suite 300, Chesterbrook, 19087, and applies to all content and other information within the Provider? possession, custody, or control associated with the email account _(the ?Subject Account?) for the time period between November 14, 2017 A law enforcement of?cer will serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement officer an electronic copy of the information speci?ed in Section II below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories specified in Section below. 11. Information to be Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Account: a. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Account, including all message content, attachments, and header information (specifically including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email). b. Address book information. All address book, contact list, or similar information associated with the Subject Account. o. Subscriber and payment information. All subscriber and payment information regarding the Subject Account, including but not limited to name, usemame, address, telephone Case Docu?ment 48-4 Filed 07/18/19 Page 100 of 105 number, alternate email addresses, registration IP address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Account, including any IP logs or other records of session times and durations. e. Customer correspondence. All correspondence with the subscriber or others associated with the Subject Account, including complaints, inquiries, or other contacts with support services WV f. Preserved or backup records. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 18 U.S.C. 2703(f) or otherwise. Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the records produced by the Provider in order to locate any evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other files necessary to establish the identity of the person(s) who created or used the Subject Account; b. Communications, records, documents, and other ?les involving Sterling National Bank, Melrose Credit Union, and/or taxi medallions; 0. Communications, records, documents, and other ?les involving a plan, proposal, or agreement for Michael D. Cohen and] or entities associated with him to transfer any interest in taxi 2 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 101 of 105 medallions, and any associated debts ?or liabilities, to others, including to_and/or entities associated With him; d. Communications, records, documents, and other ?les involving Essential Consultants, LLC or Michael D. Cohen Associates, including those which indicate the nature and purpose of payments made to or from Essential Consultants or Michael D. Cohen Associates; e. The identity of any person(s) including records that reveal the whereabouts of the 'personfsi) WW Consultants, LLC, or about any plan or proposal or agreement for Michael D. Cohen and/ or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including t(_and/ or entities associated with him; f. Communications between the Subject Account and Jeffrey Getzel relating to Michael D. Cohen?s bank accounts, taxes, debts, and/or ?nances; g. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; h. Evidence indicating how and when the Subject Account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; and i. Evidence indicating the Subject Account owner?s intent as it relates to the Subject Offenses under investigation. 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 102 of 105 IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 02.28.2018 Case Document 48-4 Filed 07/18/19 Page 103 of 105 UNITED STATES DISTRICT COURT for the Southern District of New York In the Matter of the Search of (Brie?y describe the property to be searched or identi?z the person by name and address) A Device Containing the ResuEts of Three Email Search Warrants, See Attachment A SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement of?cer An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or property located 1n the Southern District of New York (identi?z the person or desor the the property to be sear ched and give its location): A Device Containing the Results of Three Email Search Warrants, See Attachment A The person or property to be searched, described above, is believed to conceal (identi?z the person or describe the property to be seized): See Attachment A I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property. YOU ARE COMMANDED to execute this warrant on or before Mc?? ti? I (not to exceed 14 days) in the daytime 6:any time in the day or night as I ?nd reasonable cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises the property was taken, or leave the copy and receipt at the place where the property was taken. The of?cer executing this warrant or an of?cer present during the execution oF?thc?warran must prepare an inventory as required by law and return this warrant and inventory to the r1: of the Court. Upon its return this warrant and inventory should be ?led under seal by the Clerk of the Court itial?S if I ?nd that immediate noti?cation may have an adverse result listed 1n 18 US 2705 (except fo- delay of trial) and authorize the of?cer executing this warrant to delay notice to the person who or whose pi? opertv ill be searched or selzed (check the appropriate box) Elfor 30 days (not to exceed 30). . Eluntil, the fa ustifying, the later speci date of Date and time issued: 15% [0 ?Luca" Midge Signature City and state: New York. NY Hon. Gabriel w. Gorenstein. us. Magistrate Judge Printed name and title Case Document 48-4 Filed 07/18/19 Page 104 of 105 Attachment A I. Device to be Searched The device to be searched (the ?Subject Device?) is described as a black and red USB drive with a white label that says ?Tracking 180208140208?, which contains emails and other content information obtained pursuant to the three search warrants, numbered 17?mj?00503, l7-mj-0085 5 and 17?mj -00854, obtained by the Special Counsel?s Of?ce less the emails that were screened and removed by the privilege team. II. Review of ESI on the Subject Devices Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the ESI and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, interpreters, and outside vendors or technical experts under government control) are authorized to review the ESI contained on the Subject Device for evidence, fruits, and instrumentalities of one or more violations of 18 U.S.C. 371 (conSpiracy to defraud the United States), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (Wire fraud), and 1344 (bank fraud) (collectively, the ?Subject Offenses?), as listed below: a. Communications, records, documents, and other ?les involving Sterling National Bank, Melrose Credit Union, and/or taxi medallions; b. Communications, records, documents, and other ?les involving a plan, proposal, or agreement for Michael D. Cohen and] or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to_and/ or entities associated with him; i c. The identity of any person(s) including records that reveal the whereabouts of the person(s) who communicated with -@gmail.com and/or - (the ?Subject Accounts?) about any plan or proposal or agreement for Michael D. Cohen and/ or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to _and/or entities associated with him; d. Communications between the Subject Accounts and Jeffrey Getzel relating to Michael D. Cohen?s bank accounts, taxes, debts, and/or ?nances; Case Document 48-4 Filed 07/18/19 Page 105 of 105 6. Evidence indicating the owner of the Subject Accounts? intent as it relates to the Subject Offenses under investigation. Case Document 48-5 Filed 07/18/19 Page 1 of 73 UNITED STATES DISTRICT 8 MAG 2 8 7 7 SOUTHERN DISTRICT OF NEW YORK In the Matter of a Walrant for All TO BE FILED UNDER SEAL Content and Other Information Associated with the Email Accounts AGENT AFFIDAVIT @gmail.com, -@gmail.com, and 1, Maintained at Premises Controlled by Google, Inc, 3 USAO Reference No. 201 811001 2? Agent Af?davit in Support of Application for a Search Warrant Electronic?Communicati?s STATE OF NEW YORK ss. COUNTY OF NEW YORK Special Agent of the United States Attorney's Of?ce for the Southern District of New York, being duly sworn, deposes and states: I. Introduction 1. I am a Special Agent with the United States Attorney?s Of?ce for the Southern District of New York (the I have been a Special Agent with the USAO since August 2016. I previously served as a Special Agent with the United States Department of Labor Inspector General from May 2011 to August 2016. In the course of my experience and training in these positions, I have participated in criminal investigations into federal offenses involving a wide array of ?nancial crimes, including frauds on ?nancial institutions. I also have training and experience executing search warrants, including those authorizing the search of email accounts. 2. I make this affidavit in support of an application for a search warrant pursuant to 13 U.S.C. 2703 for all content and other information associated with the email accounts and (the ?Subject Accounts"), maintained and controlled by Google, Inc. (the ?Provider?), headquartered at 1600 Case Document 48-5 Filed 07/18/19 Page 2 of 73 Amphitheatre Parkway, Mountain View, California 94043. The information to be searched is described in the following paragraphs and in Attachments A and to the proposed warrant. 3. On or about February 28, 2018, 1 submitted an Affidavit in support of an application for a search warrant pursuant to 18 U.S.C. 2703 for all content and other information associated with ?re Subject Accounts maintained and controlled by the ?Provider, a true and correct copy of which is attached hereto as Exhibit A (the ?Original Af?davit?), and which is incorporated by reference as if fully set forth herein.1 4. On?that?same date, the l?Itmorahle Gabriel Gore?neteiri, United States-Magistrate Judge, issued a search warrant for the requested data, a true and correct copy of which is attached hereto as Exhibit (the ?Original Search Warrant?). Shortly thereafter, the Provider was served with the Original Search Warrant. On or about March 7, 2018, the Provider provided a response to the Original Search Warrant. That return was incomplete because the Provider declined to produce data that it stored on computer servers located outside of the United States. It is my understanding, from speaking with the Assistant United States Attorney assigned to this matter as well as other law enforcement agents, that the Provider? 3 refusal to provide foreign stored data was in light of the Second Circuit?s decision in which it held that Microsoft Corporation was not required to produce foreign stored data pursuant to a warrant issued wider the Stored Communications Act. See Matter of Warrant to Search a Certain E?Mail Account onri?oli'ad and Maintained by Microso?? Corporation, 829 F.3d 197 (2d Cir. 2016), cert. granted 138 S. Ct. 356 (2017) (the ?Microsoft Litigation"). The Original Affidavit also sought content information for two additional email accounts hosted by different providers. This af?davit only requests a search warrant with respect to the Subject Accounts described herein. 201103.25 Case Document 48-5 Filed 07/18/19 Page 3 of 73 5. On March 23, 2018, the Clarifying Lawful Overseas Use of Data Act (the Act?) was enacted and became law. The CLOUD Act clari?es that in responding to legal process issued under the Stored Communications Act, providers are required to disclose data even if it is stored abroad. Speci?cally, section 103 of the CLOUD Act amended 18 U.S.C. 2713 as follows: 2713. Required preservation and disclosure of communications and records A provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose the contents of a wire or electronic communication and any record or other information pertaining to a customer or subscriber within such provider?s possession, custody, or control, regardless of whether such communication, record, or otherinformationis located withinonoutside of the United_ . . States. From my background, training, and experience in this investigation and in others, I knew that, in general, any email (which can include attachments such as documents, images, and videos) sent to or from a subscriber?s account, or stored in draft form in the account, is maintained on the Provider?s servers unless and until the subscriber deletes the email. If the subscriber does not delete the email, it can remain on the Provider?s computers inde?nitely, Even if the subscriber deletes the email, it may continue to be available on the Provider?s servers for a certain period of time. In addition, from my review of other search warrant returns in this investigation, I know that the subjects of the investigation maintained email data relevant to the investigation in email . accounts for many months after the email was sent or received. 7. Accordingly, I respectfully submit this Af?davit seeking the issuance of the attached proposed search warrant which seeks the same data as was sought in the Original Search Warrant, for the reasons set forth in the Original Af?davit and herein. II. Request for Non-Disclosure and Sealing Order 8. The existence and scope of this ongoing criminal investigation are not publicly known. As a result, premature public disclosure ofthis affidavit or the requested warrants could alert target 2017.03.25 Case Document 48-5 Filed 07/18/19 Page 4 of 73 subject Michael Cohen that he is under investigation, causing him to destroy evidence, ?ee from prosecution, or otherwise seriously jeopardize the investigation. In particular, based on my experience investigating white collar cases, including cases featuring documents such as agreements, drafts of agreements, notes of conversations, and other documentary evidence, premature disclosure of an investigation may cause the target of the investigation to attempt to destroy or conceal such evidence. In addition, as Set forth in the Original Af?davit, Cohen uses computers and electronic communications in furtherance of his activity and thus could easily delete, _o?therwise conceal such digital evidence fromlaw enforcement were he to learn of the Government?s investigation. See 18 U.S.C. 2705(1))(3). Cohen also appears to have the ?nancial means that would facilitate his ?ight from prosecution. See 18 U.S.C. (5). 9. Accordingly, there is reason to believe that, were the Provider to notify the subscriber or others of the existence of the warrant, the investigation would be seriously jeopardized. Pursuant to 18 U.S.C. 2705(b), I therefore respectfully request that the Court direct the Provider not to notify any person of the existence of the warrant for a period of 130 days from issuance, subject to extension upon application to the Court, if necessary. 10. For similar reasons, I respectfully request that this af?davit and all papers submitted herewith be maintained under seal until the Court orders otherwise, except that the Government be permitted without further order of this Court to provide copies of the warrant and af?davit as need be to personnel assisting it in the investigation and prosecution of this matter, and to disclose those materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. 219110325 Case Document 48-5 Filed 07/18/19 Page 5 of 73 HI. Conclusion 11. Based on the foregoing, I respectfully request that the Court issue the warrant sought herein pursuant to the applicable provisions of the Stored Communications Act, 13 [1.8.0 2703(b)(1)(A) (for contents) and 2703(c)(1)(A) (for records and other information), and the relevant provisions of Federal Rule of Criminal Procedure United States Attorney?s U?lce Southern District of New York Sworn to before me this {Li dag.r of April, 2018 LDENRY B. PITMAN United States Magistrate Judge Southern District of New York 2m 103.25 Case Document 48-5 Filed 07/18/19 Page 6 of 73 Exhibit A Case Document 48-5 Filed 07/18/19 Page 7 of 73 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of 3. Warrant for All . . . Content and Other Information A TO BE FEED UNDER SEAL A ?restated With the Email Accounts @gmail.com, AGENT -@g1nail.eom, and Maintained at Premises Controlled bv Gooale. 1110., the Email Account? 6 . Maintained atPren?ses Controlled by 1 8 MAG. - Oath, - ?maintained at Premises Controlled by 1 dz: 1 Internet, Inc, USAO Reference No. EDIERODIET Agent Af?davit in Support of Application for a Search Warrant for Stored Electronic Communications STATE OF NEW YORK COUNTY OF NEW YORK 3 SS. Special Agent _3f the United States Attorney?s D?ice for the Southern District of New York, being duly sworn, deposes and states: I. Introduction A. Affiant l. I am a Special Agent with the United Staten Attorney? 5 Of?ce for the Southern District of New York (the Ihave been a Special Agent with the USAO since August 2016; I previously served as a special Agent 1aritlt the United States Department of Labor Inspector General ?rorn May 2011 to August. 2016. In the course of my experience and training in these positions, I have partieip ated in criminal investigations into federal offenses involving a wide array Case Document 48-5 Filed 07/18/19 Page 8 of 73 of ?nancial crimes, including frauds 'on ?nancial institutions. I also have training and experience executing search warrants, including those authorizing the search of email accounts. B. The I'rcvider, the Subject Account and the Subject Offenses 2. I make this af?davit in support of an application for a search warrant pursuant to 18 USE. 2703 for all content and other information associated with the email accounts _@gmail.con1 (the ?Cohen Account"), {the ?more . (the ant-@aolcom (the (collectively, the "Subject Accounts?). The Cohen Account, _.ccount, and? Account are maintained and controlled by Google, Inc, headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043 (?Google?), the Account is maintained and controlled by .1 dc 1-lntemet, Ina, headquartered at 701 Lee Road, Suite 300, Chesterbroolc, 19037 dz and is maintained and controlled by Oath, Inc, 22000 AOL Way, Dulles, Virginia 20166 (?Oath?) (together, the ?Providers?). The information to be searched is described in the following paragraphs and in Attachments A, B, C- and to the preposed wairants. 3. As detailed below, there is probable cause to believe that the Subject Accounts contain evidence, ?nite, and instrumentalitiesof violations of 18 U.S.C. 371 (conspiracy to defraud the United States), 1005 (false bank entries), 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud) (collectively, the ?Subject Offenses?). The Target Subjects of this investigation are COHEN (?Cohen?) and others knoWn and m?mown. This af?davit is based upon my personal knowledge, my review of documents produced pursuant to grand jury subpoenas and prior search wan'ants, my review of interview reports prepared by other law enforcement of?cers, and my conversations with other law enforcement officers, as well as 2 02.2mm Cas - - e1.18cr00602?WHP Document48?5 Filed 07/18/19 Page90f73 my training and experience concerning the use of email in criminal activity. Because this af?d avit is being submitted for the limited purpose of establishing probable cause, it does not include all the facts I have learned during my investigation. Where the contents of do cements and the actions, statements, and conversations of others are reported herein, they are reported in substance and in part, except where otherwise indicated. C. Services and Records of the Provider 4. I have learnedthe following.aboutthel?roviders: . - a. The Providers offer email services to the public. In particular, Google permits subscribers to maintain email accounts under the domain name gmailnom. Googic also allows a subscriber to maintain email accounts under any domain name under the subscrib er?s control. For example, if a subscriber controls the domain namr_ Google enables the subscriber to host any email address under this domain name on servers operated by Google. Oath permits subscribers to maintain email accounts under the domain name aol.com. 1 85 1 permits subscribers to maintain email accounts under any domain name under the subscriber's cohtrol. For example, if a subscriber controls the domain namr? 1 3r. 1 enables the subscriber to host any email address under this domain name on servers operated by '1 8c 1. A subscriber using the Providers? services can access his or her email account from any computer connected to the Internet. b. The Providers maintain the following records and information with respect to every subscriber account: i. Email contents. In general, any email (which can include attachments such as documents, images, and videos) sent to or from a subscriber?s account, or stored in draft form in the account, is maintained on the Providers? servers unless and until the subscriber deletes the email. If the subscriber does not delete the email, it can remain on the Providers? computers 3 02.28.2013 Case Document 48-5 Filed 07/18/19 Page 10 of 73 inde?nitely. Even if the subscriber deletes the email, it may continue to be available on the Provider?s servers for a certain period of time. ii. Address book. The Providers also allow subscribers to maintain the equivalent of an address book, comprising email addresses and other contact information of other email users. Subscriber and billing information. The Providers collect and maintain (typically-unveri?ed) identifying?mformation about each subscriber, including, for. example, name, usemame, address, telephone number, and alternate email addresses. The Providers also maintain records concerning the date on which the account was created, the Internet protocol address of the user at the time of account creation, the current status of the account (nag, active or closed), the length of service, and the types of services utilized by the subscriber. Additionally, for'paving subscribers, the Providers maintain records of the subscriber?s means and source of payment, including any credit card or bank account number. iv. Iransucrionoi information The Providers also typically retain certain transactional information about thense of each account on its system. This information can include records of logic session) times and durations and the methods used to connect to the account (such as logging into the account through the Providers? website). v. Customer correspondence. The Providers also typically maintain records of any customer service contacts with or about the subscriber, including any inquiries or complaints concerning the subscriber?s account. I vi. Search history. Google and Oath also typically maintain records of any search historyr or web history associated with the subscriber?s account. 02.23.2{118 ?an Case Document 48-5 Filed 07/18/19 Page 11 of 73 vii. Associated content. Google also typically maintains content and records relating to the following applications that are associated with its e?mail accounts: (A) ?Google Docs,? which provides document-editing software that can be used to create, share, store, and manage documents online; (13) ?Google Drive,? which enables users to store ?les on Google servers, where they can be accessed remotely by the user and others; and (C) ?Gchat'? or ?Instant Messenger,? which provides a chat hater-face through which users can communicate with each ?other'in real time: Oath also typically maintains content and records relating to AOL instant? message, vvhich provides a chat interface through users can communicate with each other in real time. Preserved and backup records. The Providers also maintain preserved copies of the foregoing categories of records with respect to an account, for at least 90 days, upon receiving a preservation request from the Government pursuant to 13 U.S.C. 2703a). The Providers may also maintain backup copies of the foregoing categories of records pursuant to its own data retention policy. 1). Jurisdiction and Authority to Issue Warrant 5. Pursuant to 13 U.S.C. 2703(a), (1)91) 35 the Govermnent may require a provider of an electronic communications service or a remote computing service, such as the Providers, to disclose all stored content and all non-content records or other information pertaining to a subscriber, by obtaining a warrant issued using the procedures described in the Federal Rules of Criminal Procedure, 6. A search warrant under 2703 may be issued by ?any district court of the United States (including a magistrate judge of such a. court)? that ?has jurisdiction over the offense being investigated.? 13 U.S.C. 2711(3)(A)(i). 02.23 .2013 ?v . Case Document 48-5 Filed 07/18/19 Page 12 of 73 7. When the Government obtains records under 2703 pursuant to a search warrant, the Government is not required to notify the subscriber of the existence of the warrant. 18 U.S.C. 2703(a), 8t: (3). Additionally, the Gorernment may obtain. an order precluding the Provider from notifying the subscriber or any other person of the warrant, for such period as the Court deems appropriate, where there is reason to believe that such noti?cation will seriously jeopardize an investigation. 18 11.8.0. {3 2705(1)). - E.-PriorApplicaticns - - 8. On or about Iuly 18, 2017, in connection with an investigation being conducted by the O?iee of the Special Counsel the Federal Bureau of Investigation-CTR?) sought and obtained from the Honorable Beryl A. HcWell, Chief United States District Judge for the District of Columbia, a search warrant for emails inthe Cohen Account sent or received between January 1, 2016 and July 18, 2017. On or about November 13, 2017, the FBI sought and obtained from Judge HOWell search warrants for emails in the Cohen Account sent or received between June 1, 2015 and November 13, 2017, and emails in the Account sent or received between the opening of the account and November 13, 2017. The 800 has since referred certain aspects of their investigation into Cohen to the USAD, which is working with the New York Field oraoe. As part of that referral, the sco provided the case with emails and other content information obtained pursuant to the search warrants executed by the SCO, which had already been reviewed for privilege.1 As discussed below, this af?davit is based in part on my review of 1 In an abundance of caution, in a separate application the USAO has sought authorization, pursuant to Fed. R. Grim. P. 41, to review the emails obtained pursuant to the Prior Cohen Account Warrants for evidence related to certain additional conduct that was not the focus of the Prior Cohen Account Wan-ants. The emails obtained from the Prior Cohen Account Warrants that relate to that additional conduct do not form a basis for the instant application. 6 02.23.2013 Ir?l?h?I?e Case Document 48-5 Filed 07/18/19 Page 13 of 73 responsive materials pro duced pursuant to the July 18 and November 13, 2017 warrants (the ?Prior Cohen Account Warrants?). 9. On or about November 7, 2017, and January-4, 2018, as well as certain prior dates, the SCO sought and obtained from Judge Howell orders authorizing and extending the installation and use of pen registers and trap and trace devices to record conununications sent to or ?oor the Cohen Account The 800 has provided pen registe1 data obtained pursuant to those orders to the USAC) This af?davit, as discussed below, is based in part on my review of? the- pen register data obtained? pursuant to the November 7, 2017 and January 4, 2018 orders (the ?Pen Register Data?). 10. On or about Februaryr 16, 2018, the USAO sought and obtained from the Honorable Debra Freeman, United States Magistrate Judge for the Southern District ofNew York, an order pursuant to 18 U.S.C. 2703 for email header information associated with the Account. This af?davit, as discussed below, is based in part on my review of email header information produced by d: 1 in response to that order (the Header Information?). Probable Cause A. Overview 11. The United States Attm?ney?s Of?ce for the Southern District of New York and FBI are investigating, among'other things, a scheme by Target Subject Michael Cohen to defraud multiple banks. Cohen is an attornev who currently holds himself out as the personal attorney for President Donald and who previously served for over a. decade as an executive in the Trump Organization, an international conglomerate with real estate and other holdings. - 12. The investigation has revealed that Cohen has made affirmative misrepresentations in and omitted material information from ?nancial statements and other disclosures that Cohen provided to multiple banks in connection with a transaction intended to relieve Cohen of approximately $22 million in- debt he owed on taxi medallion loans from the banks. As set forth. 7' 02.23.2013 ?Ln?hhauuF-V Case Document 48-5 Filed 07/18/19 Page 14 of 73 in detail below, in these ?nancial statements, and in his oral and other Written statements to these banks, Cohen appears to have intentionally omitted cash assets that he began receiving in 2017 item new consulting work; (ii) signi?cantly understated his total holdings of cash and cash equivalents; and failed to inform the banks from which he was seeking debt relief that he had agreed to make a $3.8 million cash paymentto a third party,_ in connection with - acquisition of the taxi medallions securing Cohen?s debt. By making these misrepresentations and material-omissions, Cohen-avoidedmaldng payments on his - loans, and attempted to and had assured proposed agreements from the banks to relieve him of certain repayment obligations worth millions of dollars. 13. Based on my review of emails obtained from the Prior Cohen Account Warrants, MUCPC Header Information, and documents produced pursuant to subpoenas, I have learned that Cohen has used the Cohen Account andfor WCPC Account to, among other things, communism with? ad the ?ame- about the proposed transfer of Cohen?s medallions and associated debts; (ii) negotiate spay-down of the principal amount of the taxi medallion loans; communicate with his accountant about the contents of the false ?nancial statements at issue; and (iv) send these false ?nancial statements to have Account?Account an -rccount, respectively, to communicate with Cohen about the status of the taxi medallion transaction, and to send relevant ?nancial statements to . banks. Accordingly, and as set forth in more detail below, there is probable cause to believe that the Subject Accounts will include evidence of the Subject Offenses. B. Cohen?s Statements to Sterling National Bank 14. As set forth a detail below, in 2014, Cohen, through limited liability corporations controlled by him and his wife, Laura Cohen, entered into a series of loans from Sterling 8 02.23.2013 Case Document 48-5 Filed 07/18/19 Page 15 of 73 National Bank C?Sterling?) and the Maltese Credit Union C?Melrose?), secured by taxi medallions, for approximately $20 million. Though entered into by LLCs, the loans were also secured by personal guarantees in the names of both Cohen and his wife. Over time, as the taxi industry weakened and the medallions were devalued, Cohen sought to renegotiate the terms of the se lo ans audior relieve himself from their obligations, including the personal guarantees. As part of that effort, Cohen made a series of representations to Sterling and Melrose about his not worth, assets, avm'lable cash, and ?nancial outlook. Speci?cally, based on my-t'eview'of-reoords maintained by? Sterling and Meh'ose, and public sources concerning the taxi industry and the value of taxi medallions, as Well as my review of reports prepared by law enforcement of?cers of interviews with a Sterling executive vicepresident (the ?Sterling Employee-1?) and my participation in an hiterview with a Sterling employee (the ?Sterling I have leamed, among other things, the following: a. Taxi medallions are small metal plaques affixed to taxis. Without a medallion, it is illegal to operate ataxi in cities with medallion systems, such as New York City. Cohen and his wife own multiple LLCs that collectively own 32 taxi medallions (each LLC owns two medallions) .2 Cohen?s purchase of these New York taxi medallions was originally ?nanced by loans from Capital One Bank, for which the medallions served as collateral. Cohen was not a taxi operator, and leased his medallions to a third party. That third party made payments to Cohen, who in mm used some ofthose proceeds to pay his loan payments. b. In early 2014, Cohen became a customer of Sterling when he sought to re?nance a mortgage on a rental preperty that he owned. In or around April 2014, Cohen raised with Sterling 1 One of these companies, Mad Dog Cab Corp, was jointly owned by Sondra Cohen, who I believe is Cohen?s mother. 03.28.2018 Case Document 48-5 Filed 07/18/19 Page 16 of 73 the prospect of re?nancing his taxi medallion loans, which were then at Capital One Back. By in or about September 2314, Cohen began negotiating a lending transaction with Sterling that would allow Cohen to pay o? his loans at Capital One and borrow more money from the then-increase in value of the medallions. According to Sterling Employee?1, in 2014, prior to the recent upheaval in the taxi i11dust1y?~as a result of the emergence of ride-sharing services, such as Uberrtaxi medallion loans were viewed by banks and investors as-safe, short term credits, as the market value "oftaxi medallions was-consistently rising. Consequently?asi medallion loans?like the-loans held by Cohen?rwei'e frequently re?nanced at increasing amounts as the value of the medallions rose. According to Sterling Employeed, borrowers typically cashed out the increase in the loan amount and used the additional funds for other purposes. Cohen appears to have followed this approach in 2014, when- he agreed to re?nance his medallion loans for approximately $22 million, which? according to letters from Capital One Bank in Sterling?s tiles?was greater than his previous debt at Capital One Bank ($21 million, of which $14.6 million was a line of credit to Cohen). This allowed Cohen to cash out the proceeds from the transaction. c. Based on my leview of records maintained by Sterling, I have learned that on or about December 8, 2014, each of Cohen?s sixteen taxi medallion corporations entered into loan agreements and promissory notes vvith Sterling for the principal sum of$ 1,3 75,000, with repayment due on December S, 2016. Each loan was signed by Michael or Laura Cohen, depending on who was the sole shareholder of the comoration. The loans Were also each secured by a security agreement, dated the same day, making the medallions collateral for the notes. To give Sterling additional seem-ity, Michael and Laura Cohen. signed personal guarantees and confessions of judgment, giving Sterling the right to pursue collection against the Cohens' personal assets were their corporations to default under the loan agreements. In total, Sterling agreed to lend 02232013 - Case Document 48-5 Filed 07/18/19 Page 17 of 73 approximately $22 million to the Cohens? companies. Pursuant to participation agreements, Sterling transferred. 45 percent of that debt to Melrose.3 Under the terms of Sterling?s participation agreements with Melrose, Sterling was precluded from amending or modifying the loans without the consent of Melrose. d. In cyaluating Cohen?s requested refinancing of the taxi. medallions, Sterling (and Melrose, consistent with its participation in the deal) conducted due diligence. At Sterling?s request, Cohen provided Sterling-with a-statement-of ?nancial?condition, dated August?l, 2014? (the ?August 2014 Financial Statement?), which indicated that Cohen had $100,740,000 in total assets, $23,550,000 in total liabilities, and a net worth of $77,190,000.4 From my review ofa Sterling credit memorandum, dated September 29, 2014, I know that Sterling viewed the transaction favorably because, accounting for loan payments, cash ?ows from the medalli0ns were projected to be positive, the value of the collateral (as estimated by Sterling) exceeded $42 million, and the net worth of Cohen?who was the direct obligor under the guarantee agreements?ewes over $77 million. An internal Sterling credit and risk rating analysis report, dated October 20, 2014, recommended approVal of the loans for substantially the same reasons. e. Based on my review of records maintained by Sterling and public sources, I have is amed that over time, the collateral Cohen?s loans (taxi medallions) less ened in value due to the rise in ridesharing companies and signi?cant devaluation of taxi medallions. Additionally, 'Cohen began falling behind on loan payments to Sterling and Melrose. II know from necords maintained?by 'Sterlingand? an'interview with beginning- in- or-aremid 3 Melrose, which had a business principally focused on teed medallion loans, is now in conseivatorship by the National Credit Union Administration 4 Cohen subsequently provided Sterling with a revised statement of ?nancial condition, also dated August 1, 2014, which reported assets of $99,420,000, total liabilities of $23,550,000, and a networth of $75,370,000. 11 02.23.2013 -I Case Document 48-5 Filed 07/18/19 Page 18 of 73 September 2.015, Cohen told Sterling, in sum and substance, that the individual leasing Cohen?s medallions had fallen behind in melting payments to Cohen, and that as a result, the cash ?ow from his taxi medallions had been reduced, leaving him with a shortfall of approximately $16,000 each month. For instance, I have reviewed an email from-Sterling Employee?2, dated September 9, 2015, sutmnarizing a call with Cohen?which'according to the email and toll records for Cohen?s cellphone occurred on September 8, 2015-?during winch Cohen told Sterling -Employee-2, in sum and substance, about his cash ?ow problems and shortfall of approximately $16,000. ln'that same email, Sterling Employee-2 commentedthat despite Cohen?s statements, his personal ?nancial information ?indicate[d] a strong ability to malce up the difference in payments.? Cohen, however, according to Sterling Employee-2, pushed the bank for a reduction r? in Cohen?s payments. f. From my review of records maintained by Sterling and my participation in an interview with Sterling Employee?2, I have learned that Cohen and Sterling Employee-2 spoke again on September 28, 2015, and that during the call Cohen stated, in sum and substance, that the individual to whom Cohen leases the medallions had again reduced payments to Cohen. I know from my review of records maintained by Sterling that between in or about September 2015 and November 2015, Sterling raised the possibility?both internally and with Cohen?of Cohen posting his real estate holdings, personal residence, or some other collateral as additional security for the banks. According to these records, however, Cohen resistedthese requests. From my review of loan documents and records maintained by Sterling, I know that in or about November 2015, as a result of Cohen?s representation that he was not earning suf?cient returns on his medallions to cover interest payments, Sterling and Melrose agreed to amend their loans with Cohen by, 12 02.23.2013 Case Document 48-5 Filed 07/18/19 Page 19 of 73 among other things, reducing the interest rate Cohen paid to Mali-nae and extending the loan maturity date to December 3, 2017. g. I know from interviews with Sterling Employee?l and Sterling Employee~2, as well as emails I have reviewed, that in or about October 2016, Cohen told Sterling Employee-1 that Cohen had a potential buyer of his tairi medallions, named_ who would agree to assume Cohen?s debt with Sterling and Melrose. Based on my review of records maintained by as the interviews with-Sterling Einployee=1and?terling Employee?-referenoed above, llmow that by or before October 2016, Cohen had entered into negotiations to sell his shrieen corporate taxi medallions to - who is a medallion and taxi operator, for the balance of the loans, which at the time was $21,376,000. I know from my review of records maintained by Sterling, and my participation in an interview with Sterling Employee-2, that as a condition of the transfer of the medallion loans?and because Sterling was unfamiliar wit}- -?Sterling requested that Cohen make a substantial principal payment on the loan, .of approximately one million dollars, prior to the hamster. Cohen rejected this request initially. But on or about January 3 I, 20 Cohen told Sterling Employeel, in sum and sub stance, that he would make a one million dollar principal reduction payment in order to move forward with the medallion transfer deal witl- Indeed, in an email sent from the Cohen Account to Sterling Employee-2. on or about February 22, 201?, Cohen continued that he ?agreed to pay down 1 million from the loan amount.? h. Pursuant to the participation agreements betWeen Sterling and Melrose, Sterling Was requiredto secure Melroso?s agreement-to participate in the transfer of the taxi medallion debt from Cohen to _fJn or about April 17, 2017, Sterling sent a memorandum to Melrose summarising the terms of the proposed transaction, and noting the requirement that 13 consents Case Document 48-5 Filed 07/18/19 Page 20 of 73 Maltese agree to the terms. On or about May 2, 2017,_emailed Sterling Employee?l from the _.dlccount to inquire about the status of the transaction. Sterling Employee-l responded to the?Account that Melrose had agieed to the deal, and that Sterling would be sending? term sheet shortly. i. In order for the banks to evaluate the proposed transaction fully, they requested ?nancial parties. On or about Gctober 26, 2016, a Sterling employee emailed - the -Accounl: about the ?Cohen Medallion Purchase,? and stated order to proceed with the assumption of Michael?s loans,? Sterling needed certain ?nancial information ?esdd eds at tin?Account, that he would send a ?nancial statement and tan retains shortly. Additionally, on or about I one 7, 2017, Sterling Employee?__1 emailed Cohen to request an ??rpdated personal ?nancial completed jointly with Cohen?s strife, and Cohen?s most recent federal income tax return. On or about June 8, 2017, Cohen emailed Sterling Employeesl item the Cuban Account, attaching a Sterling personal ?nancial statement form that had been ?lled out by hand, which re?nanced a statement of ?nancial condition, dated May 1, 2017 (the ?May 2017 Financial Statement?), that was also attached. ?l?he May 2017 Financial Statement included a cover letter from Cohen?s accountant, Jeffrey Getzel, stating, in sum and substance, that the information in the statement came from Cohen and that Getzel had not con?rmed its accuracy or completeness. The May 2017 Financial Statement stated that Cohen had total assets of $41,955,000, total liabilities of $39,130,000, and a net worth of $2,825,000. The May 2017 Financial Statement indicated that Cohen?s assets were comprised of $1,250,000 in I 14 02.23.2013 Case Document 48-5 Filed 07/18/19 Page 21 of 73 cash, $26,155,000 in closely held companies (such as the taxi medallion entities and his real estate holdings), $3,200,000 in real estate investments, and his $1 1,00 0,000 personal residence. j. Based on my review of reports of law enforcement interviews of Sterling Employee-1, Ihave learned?t'hat Sterling Employee?1 reviewed each line ofthe May 2017 Financial Statement with Cohen to, among other things, verify its accuracy, and Sterling Employee-1 asked - Cohen about the cash amount listed on the May 2017 Financial Statement. Cohen stated to Sterling 'Emplovcml; in sum and substance, that the May 20 17 - Financial Statement vvas accura 11.011 or about August 16, 2017, Sterling Employee-1 emailed Cohen at the Cohen Account and_ at the _Account, attaching a non-binding term sheet memorializing the potential transaction between Sterling, Meh'ose, Cohen, and - - On or about August 29, 2017, -:ruailed Sterling Employee?1 from the- Aceount, requesting that he be included on ?all future e?mails tt_ andfor - concerning this matter,? and providing proposededits to the term sheet. On or about August so, 2017, Sterling Employee-1 emailed a the Account, Cohen at the Cohen ant-at the-account, and provided them with a revised term sheet. 011 or about Septembe 5, 2017, Sterling Employeed sent. at the_ Account, Cohen at the Cohen Account, an-Lt thi-tccount a copy of the executed term sheet. According to the tem sheen?would borrow $20,000,000 from Sterling and Melrose, to be secured by the medallions that-was to acquire from Cohen. 1. As part of the agreement, according to the term sheet, $1,265,913 in principal (which is what would remain after the $20,000,000 payment on the outstanding loan balance) would be repaid by- Cohen and-the into banks, with Cohen paying ?fty percent and the banks dividing the 15 cansacts Case Document 48-5 Filed 07/18/19 Page 22 of 73 remaining half of the balance. Based on my review of an internal Sterling credit memorandum, dated October 4, M17, the panics reached a preliminary agreement that Cohen would pay $632,956 of the remaining $1,265,912 principal loan balance, and Sterling and Melrose would absorb $3 57,167 and $236,789 respectively in the form of charge?offs. According to Sterling Employeo- 1, Sterling was willing to divide the repayment of the outstanding principal balance?despite its prior insistence that Cohen make a principal pay-down of at least one million dollars?because Cohen represented 'on'atelephone call with Sterling Employee-1, in contend-substance, that he ha - insu?icient liquidity to pay the full outstanding principal balance. As part of the agreement, Sterling and Melrose also agreed to relieve Cohen and his wife of the personal guarantees that they made on behalf of the LLCs. Thus, after completing tin-ransaction, Cohen aton no longer have had any outstanding obligations to Sterling or Maltese. m. Based on my review of emails sent by Sterling employees, I have learned that because the transaction between the parties was subject to full credit underwriting by lSterling and Melrose (as well as Melrose?s regulators at NCUA), in August and September 2017, Sterling required and requested additional ?nancial statements for Cohen and - for its credit underwriting process. In response to Sterling?s requests, on or about October 5, 2017, - -:nt from the _Aecount to a Sterling employee acopy of- _}ersonal ?nancial statement. The ?nancial statemant lists the Account as the email contact fo:_ Additionally, on or about October 5, 2017, (Johan, using the Cohen Account, re-sent Sterling Employee?2 a copy of his May 2017 Financial Statement. A day later, on October 6, 2017, Cohen, using the Cohen Account, emailed Sterling Employee-2 a statement of ?nancial condition, dated September 30, 2017 (the "September 2017 Financial Statement?). 16 mascara . . m?I mu.- Case Document 48-5 Filed 07/18/19 Page 23 of 73 11. Like the. May 2017 Financial Statement, the September 2017 Financial Statement included a cover letter ?'om Jeffrey Getael, Cohen?s accountant, stathig, in sum and substance, that the information in the statement came ??nm Cohen, and that Getzel had not confirmed its accuracy or completeness. The September 2017 Financial Statement stated that Cohen had total assets of $33,430,000, total liabilities of $45,631 0,000, and a negative net worth of $12,200,000. Notably, unlike Cohen?s May 2017 Financial Statement, the September 2017 Financial Statement representedtc Sterling that Cohen?had a negative net worth.? The September 20151-Financial Statement indicatecl that Cohen?s assets were comprised of $1,250,000 in cash, $17,030,000 in closely held companies (such as the taxi medallion entities and his real estate holdings), 5 $3,200,000 in real estate myesttnents, and his $11,000,000 personal residence (which, for the ?rst time, he indicated was held in trust). The September 2017 Financial Statement included assets and liabilities not held in Cohen?s name, such as various entities associated with his taxi medallions and some? of his real estate investment entities. c. From my participation in an interview with Sterling Employee?2, and my review of records maintained by Sterling, I have also learned that at or around the time Cohen provided Sterling with these ?nancial statementsgin or around September stopped paying loan payments on his taxi medallion loans altogether. According to Sterling Employee? 2, Cohen informed Sterling, in arm and substance, that he had insu?icient funds to pay the principal and interest payments on his medallion loans. By in or about December 2017, Sterling and Melrose had not been paid approximately $276,937.92 in principal and interest J?H'payments on the medallion loans. Based on Cohen?s ?nancial condition as conveyed in the 5 Notably, the September 2.01? Financial Statement valued each of Cohen?s thirty-two New York taxi medallions at approximately $130,137.50, which was considerably less than the $65 0,000 valuation ascribed to each medallion in the Cohen- tennsheet. - 17 02232013 Case Document 48-5 Filed 07/18/19 Page 24 of 73 September 2017 Financial Statement, and his delinquency in making payments to Sterling, among other things, the bank?s credit underwriting committee determined (and memorialiaed in a I December 2017 memorandum) that the Cohen-transaction was favorable for the bank that is, that-would be a better than Cohen. p. On or about December 26, 2017, Sterling sent Cohen a demand letter requesting the immediate receipt of pastndue loan payments. On December 29, 2017, Sterling sent Cohen a 'letter stating tharhe?was' in default under the-loans- between Sterling and-Cohen?s medallion- corporations. Cohen did not make an immediate payment on the loans, but instead sent an e-mail to Sterling Employeel on or about January 24, 20 18, from the Cohen Account, stating that during the closing of the Cohen-1 transaction, Cohen would ?bring all payments up to date as. well as deposit the payoff differential.? Cohen also requested by email sent from the Cohen Account on January 24, 2013, that at the closing of the Cohen-transaction, Sterling provide a letter stating that all of Cohen?s debts have been satis?ed and that Cohen?s personal guarantees of the medallion loans had been terminated. q. The Cohen-ransaction, however, did not close. On or about January 29, 2013,. the -attorney, emailed attorneys for Sterling from ?re-tecount and stated that ?at this time there is no deal with Michael Cohen. Some of the numbers have changed and we are not prepared to go forward.? r. Based on my participation in the interview with Sterling Employee?! and my review of records maintained by Sterling, Ilmow that a?er the Genet-deal fell apart, Sterling assigned Cohen?s loans to an employee at Sterling 1:th specializes in collecting on defaulting loans (?Sterling Employee?3?). From my review of telephone call notes, I lmow that Sterling Employee?i spolre to Cohen on or about January 30, 2018 about paying andfor 13 02.232013 Case Document 48-5 Filed 07/18/19 Page 25 of 73 restructuring Cohen?s outstanding taxi medallion loans. Based on my review of an email between Sterling Employee-3 and Cohen, I loiow that on the January 30, 2018 call, Cohen stated that he would send a ?corrected current" version of his personal ?nancial statement. Following that call, on or about January 31, 2018, Cohen emailed Sterling E1nployee~3 ??om the Cohen Account a copy of the September 2017 Financial Statement. Later that day, Cohen again entailed Sterling Employee-3 from the Cohen Account and proposed paying $500,000 to bring the loans current and-$05 0,000 to bring the princip al-balance to 00,000 .- Cohen also suggested revised interest payment amounts. On or about January 31, 2018, Sterling Employee-3 responded to I Cohen at the Cohen Account and stated, in sum and substance, that Cohen would need to pay the entirety of the overdue payments and pay down the principal balance of the loan to $20,000,000 (in total, a payment of approxhnatcly 1,75 0,000), and would need to make larger interest payments. - s. On or about February 1, 2018, Cohen emailed Sterling Employee?3 from the Cohen Account and proposed ?[p]ayment of $125013: which ALL can be used to pay down principal, if [Sterling] will waive past due amounts,? but stated do NOT have more than the $1.250m.? (Emphasis in original.) Cohen alSo stated, in sum and substance, that he had insuf?cient ?nancial resources to post additional collateral or pro?fund payments. Based on my participation in an interview with Sterling e?2, I have learned that Sterling continues to renegotiate the medallion loans with Cohen based on Cohen?s representations about his current ?nancial position. 19 02.23.2012 Case Document 48-5 Filed 07/18/19 Page 26 of 73 C. Cohen Made Material Msrepresentations About His Finances to Banks Cohen Concealed from Sterling and Melrose Cash Derived from Consulting Work 15. As set forth in detail below, despite multiple representations by Cohen to Sterling (and, by extension, Melrose?) that he had insufficient funds to pay down the principal balance of the medallion loans, make interest payments, or pay past-due amounts, it appears that between 20 16 and the present, Cohen opened and maintained bank accounts at First Republic Bank - (?First millions of dollars in purported?consulting payments in these. . . accounts, which he did not disclose to Sterling. Cohen setup these accounts and received these ?mds during the very period in which he made disclosures to Sterling about his personal ?nances (including his assets and liabilities) and his ability to make payments on the medallion loans. In these disclosures to Sterling?and despite being asked about these bani?: accounts by his accountant?Cohen withheld information about liquid ?nancial assets at First Republic. 16. Specifically, based on my review oi? documents and banlt records produced pursuant to a subpoena by First Republic, and my participation in and review of reports of interviews with twe First Republic employees, I have learned, among other things, the following: a. Cohen and his wife have been customers of First Republic since approximately June 2011. Cohen controls several checking and loan accounts, some in his own name and others in the names of corporate entities. 5 Based on my review of a. report of an interview conducted with an employee of Melrose, I have learned that, pursuant to the participation agreement between Sterling and Melrose, Cohen?s ?nancial statements and other records in Sterling?s possession were foiwarded to Melrose so that Melrose could make a determination as to whether to approve of the Coher transaction. Based on my review-of reports of interviews with Melrose employees, I also know that Cohen called employees at Melrose regarding-the Coher? transaction. 20 02232012 Case Document 48-5 Filed 07/18/19 Page 27 of 73 b. On or about October 26, 2016, in Manhattan, New York, Cohen opened a new checking account at First Republic in the name of Essential Consultants LLC (the ?Essential Consultants Account?). Cohen was the only authorized signatory on the account. When Cohen opened the Essential Consultants Account, a First Republic employee (?First Republic Employee conducted an in-person interview of Cohen.- In reaponse to a series of know~yotir?custcme1' questions"? about the purpose of the answers to which First Republic Employee-1 "entered into a forms?Cohen?stated, in sum and substance, that he was opening --Essential Consultants as a real estate consulting company to collect fees for investment consulting work, and all of his consulting clients would be domestic individuals based in the United States. Cohen also stated, in sum and substance, that his purpose in setting up the account was to keep the revenue from his consulting business?~which he said was not his main source of income?separate from his personal ?nances. As set forth below, there is probable cause to believe that Cohen?s statements about the intended purpose of the account and source of funds for the account Were false. Speci?cally, the account was not intended to receiyewand does not appear to have recei_ved??Inoney in connection with real estate consulting work; in addition, the account has received substantial. payments from foreign sources. I o. First, on or about October 2'7, 2016hthe day after he opened the Essential Consultants Account, Cohen. used the account to wire $130,000 to an account held in the name of attorney Keith Davidson? law firm. Based on my review of emails between Cohen and Davids on, 7 Certain ?nancial institutions are required to conduct such procedures poi-slant to the Bank Secrecy Act and its implementing regulations. See 31 U.S.C. 5318; 31 (1F .R. 1020.220. 3 First Republic Employee-1 ?rst ?lled out the form on the day he interviewed Cohen, October 26, 2016. On or about December 19, 2016, at the request of bank compliance personnel, First Republic updated the form to add more detail about Cohen?s statements. 21 02.28.2018 Case Document 48-5 Filed 07/18/19 Page 28 of 73 obtained pursuant to the Prior Cohen Account Warrants, I believe that this payment did not relate to any real estate consulting work, but rather was a ?settlement? payment made to Davidson?s client. 9 Based on my review of public sources, I have learned that Davidson?s client is alleged to have had an extramarital affair with Donald Tnunp. On or about February 13, 2018, Cohen made a public statement that a private transaction in 2016, I used my own personal funds to facilitate a payment of $13 0,000 to [Davidson?s c1ient].? from my review of First Republic'b'ank records that were scheduled by an FBI forensic accountant that after Cohen opened the Essential Consultants Account, Cohen received payments into that account from foreign'businesses and entities that do not re?ect the stated client pro?le for the residential and commercial realuestate consulting services. Speci?cally, from my review of the Essential Consultants Account schedule and public sources, I lmovv the following: 1. Beginning on or about January 31, 2017, Cohen began receiving payments of $83,333 ?om an entity called Cclumbuslcha LLC, which were deposited into the Essential Consultants Account. According to public sources, Columbus Nova is an investment management ?rm controlled by Renova Group, an industrial holding company based in Zurich, Switzerland that is controlled by Russian national Viktor Vekselberg. From January 2017 to August 2017', the Essential Consultants Account received seven payments totaling $583,332.93 from Columbus Nova LLC. 5' Speci?cally, I have learned ?'om my review of bank records that on or about October 26, 2016, Cohen transferred $131,000 from a home equity line of credit account at First Republic to the Essential Consultants Account; on or about October 27, 2016, Cohen transferred $130,000 from the Essential Consultant Account to an account held in the name ofDavidscn?s law ?rm at a bank based in Los Angeles; and on or about November 1, 2016, a wire transfer in the amount of approximately $96,645 was made from Davidson?s account to a bank account in the name of Davidson?s client. 22 02.232013 Case Document 48-5 Filed 07/18/19 Page 29 of 73 ii. Beginning on or about April 5, 2017, Cohen began receiving payments from Novastis Investments, SARL, which I believe to be the in-house financial subsidiary of the Swiss pharmaceutical company,r Nevattis Intemational AG (?Novartis?). Between April 2017 and January 2013, the Essential Consultants Account received ten wire payments from a Swiss bank account held in the name ofNovartis, each in the amount of $99,980, for a total of $999,800. Beginning in or about April 201 7, the Essential Consultants Account started feceitmg'whe payments from a bank account'associated?with the telecomnnmications company Inc. Speci?cally, on or about April 14, 2017, wired $100,000 to the Essential Consultants-Account and, from in or about June 2017 to in or about January 2018, the Essential Consultants Account received nine $50,000 payments from In total, wired $550,000 to the Essential Consultants Account. iv. On or about May 10, 2017, lime 9, 2017, July 10, 2017, and November 27, 2017, the Essential Consultants Account received four deposits in the amount $150,000 (totaling $600,000) from a bank account in South Korea. The account holder from which the money was sent is Korea Aerospace Industries Ltd. KAI is a South Korea-based company that produces and sells fated?wing aircraft, helicopter aircraft, and satellites to the United. States Department of Defense, among other customers. it. On or about May 22, 2017, the Essential Consultants Account received a $150,000 deposit from an account a Kazakhstani bank. The listed account holder at Kazkommertsbank was a second Kazakhstani bank named?BTA Bank, A0. A mes sage accompanying the wire payment indicated that the payment was a consulting fee as per luv era-.101 on May 10, 2017 agreement WIN on as as 2017 cars W?tDb 03f05f2017.? 23 ceasama W. .Imer??u. Case Document 48-5 Filed 07/18/19 Page 30 of 73 vi. In total, ?'om on or about January 31, 201?? to on or about auuary 10, 2018, the Essential Consultants Account received approximately $2,883,132.19? in transfers and checks from the aforementioned entities. As of on or about January 10, 2018, the balance inthe Essential Consultants Account-was $1,369,474.23. I e. On'or about April 4, 2017, Cohen opened another newchecking account at First Republic, this one in the name of Michael D. Cohen Associates, P.C. (the Account?). Cohen was mainly autholi'zecl'sig?at?rfo? the account. Among?other things, the mean;- Account received ten wire transfers and one check from an account in the name of Squire Patton Boggs, a law ?rm. In total, from on or about April 5, 2.017, to on or about January 2, 2018, the MDCM Account received $426,097.70 in deposits, and the balance in the account as of January 2, 2013, was $344,541.35. 'As discussed below, Cohen never disclosed any of the balance in the Essential Consultants or accounts to Sterling during the negotiations with respect to the -transaction, including in his May 2017 Financial Statement and September 2017 Financial Statement. 17. Based on my review of emails from the Cohen Account that were seized pursuant to the Prior Cohen Account Warrants, and my review of reports of interviews with employees of and Novartis, it appears that the aforementioned payments to the Essential Consultants Account and 11211304th Account ostensibly were for political consulting work, including consulting for international clients on issues pending before the Trump administration.? Speci?cally, ?oor my review of emails hen: the Cohen Account and public sources, I have learned the following: 1? Based on my review of public sources, I have learned that Cohen 13 not registered as a lobbyist o1 as a person acting as an agent of foreign principals, as may have been required by the Foreign Agents Regi station Act. 24 02.28.2013 Case Document 48-5 Filed 07/18/19 Page 31 of 73 a On or about April 23, 201?, Cohen sent an email from the Cohen Account to an individual whom I believe is affiliated with KAI. In the email, Cohen attached a document purporting to be a ?Consulting Agreement? between KAI and Essential Consultants dated as of about May 1, 20.17. The document indicates that Essential Consultants would render ?consulting and advisory services, as requested? by KAI, and that KAI would pay Essential Consultants ?a consulting fee of One Million Two Hundred Thousand US Dollars," disbursed through-eight $150,000 installments between May 120 1-7 and December 2017; - b. On or about May 10, 2017, Cohen sent an email from an alternate email address, copying the Cohen Account, to an employee of ETA Bank. To the email, Cohen attached an invoice to ETA Banlc in the name of Essential Consultants. The invoice contemplated a $150,000 payment to Essential Consultants for a consulting fee.? c. On or about February 13, 2017, Cohen emailed employee from the Cohen Account what appears to be a consulting agreement, which contemplates that Essential Consultants ?shall render consulting and advisory services to and that would ?advise [Essential Consultants] of those issues and matters with respect to which Services desires [Essential ConsultantsJ?s assistance and advice." The contract calls for ?to pay the Consultant for his services . . . a consulting fee of Fifty Thousand ($50,000) Dollars . . . per month.? Based on my review of reports of interviews with employees, Ihave learned that retained Cohen to consult on political issues, including net neutrality, the merger hetwaen and Time Warner, and tax reform. d. On_or_ about I 313110le 2017, Cohen emailed to a representative of Nevada from the Cohen Account a contract between Novartis and Essential Consultants, which provides that Essential Consultants will ?provide consulting and advismy services to Novartis on matters that 25 {32.232013 Case Document 48-5 Filed 07/18/19 Page 32 of 73 relate to the repeal and replacement of the Affordable Care Act in the US and any other issues mutually agreeable to [Essential Consultants] and Novartis." The contract provides for a ?consulting fee of One Million Two Hundred Thousand ($1,200,000) US dollars,? to be paid to Essential Consultants in even installments over the course of a year. Based on my review of reports of interviews with Nevartis employees, I have learned that Novartis retained Cohen to provide political consulting services and to gain access to relevant policymakers in the Trump Administration c. On or about April 3, 2017, Squire Patton Boggs, a law ?rm, announced on its website that is had formed a ?strategic alliance? with Michael D. Cohen Associates and would ?jointly represent slice 18. Despite the signi?cant amount of money that Cohen received into the Essential consultants Account and the Account, and the cash balance in both accounts, Cohen did not disclose that information to Sterling or Metrose. Speci?cally, based on my review of documents provided by Getzel, and my review of notes anr? I have learned the following: a. In or about May 2017, Gctzel met with Cohen at a law ?rm in Manhattan, New York. At the meeting, Cohen told Getzel, in sum and substance, that he had set up a law practice called Michael D. Cohen 32; Associates P.C., and a consulting company called Essential Consultants LLC. Cohen told Getzel, in sum and substance, that he expected to earn $75,000 per month in oonnecti on with his law practice, and that he expected gross revenues for the consulting business to be between ?ve and six: million dollars annually. b. In or about October 2017, if not earlier, Getael was preparing a personal ?nancial statement for Cohen. On or about October 6, 2017, Getzel sent an email to Cohen at the Cohen 26 02232013 Case Document 48-5 Filed 07/18/19 Page 33 of 73 Account in which Getzel wrote that is a draft of the new PFS as of September 30, and attached a dralt of the September 2017 Financial Statement The drait statement reflected that as of September 30, 2017, Cohen had only $1,250,000 in cash, total assets of approximately $33,430,000 (comprised after-ti medallion interests, real estate interests, and his personal residence and property), and liabilities of approximately $45,630,000, leaving him purportedly over $12 million in debt. In the same email, Getzel questioned Cohen, in sum and substance, about the fact "that'the ?nancial statement?did not list any assetsasso'ciated either the-Essential Consultants Account or the MDCM Account: did not add any 1value for you[r] two operating entities - Michael D. Cohen Associates POC [sic] and Essential Consultants LLC. Please advise whether or not these should be disclosed and what value.? c. on or about October 6, 2017, Cohen called Getzel by telephone?which is re?ected on toll records for Cohen?s cellphone?and told Gates], in sum and substance, not to include Essential Consultants or in the September 2017 Financial Statement because they had no value. d. On or about October 6, 2017, following? the call with Getzel, Cohen, usingthe Cohen Account, responded to Getzel?s email with the answer goodlto me.? Cohen neVer directed Getzel to make an},Jr changes to his cash position as listed in the September 2017 Financial Statement. Neither Essential Consultants nor was listed on the September 2017 Financial Statement. that was provided to Starling. . i 19. Based on the foregoing, and from my leview of-banlc records and emails sent by Cohen to Sterling, I know that the September 2017 Financial Statement made no mention whatsoever of assets that Cohen held in the Essential Consultants Account or the Account. As of September 30, date of the September 2017 Financial Statement?Cohen had 27 02.23.2013 Case Document 48-5 Filed 07/18/19 Page 34 of 73 approximately $623,729.95 in the Essential Consultants Account and $248,619.23 in the Account. As of October 6, 2017, the date when Getzel asked Cohen about the two accounts, Cohen had approximately $823,709.95 in the Essential Consultants Account and $248,151 9.28 in the WCM Account. Cohen Understated His Available Cash 20. In addition to withholding the existence of the Essential Consultants Account and the Account from Sterling and Melrose, it appears thatCohcn' also substantially understated his available each and cash equivalents in his ?nancial disclosures. Specifically, I know from my review of the September 2017 Financial Statement that Cohen provided to Sterling that Cohen represented that he had $1,125 0,000 in cash as of September 30, 2017. But, from my review of a I summary of hard: records that were scheduled by an FBI forensic accountant, I have learned that Cohen had over $5,000,000 in cash and cash equivalents as of September 30, 2012. Speci?cally, from my review of the account schedule and bank records, I have learned the following: a. Cohen has three checking andfor savings accounts at Capital One Bank, one of which is in his wife?s name. As of September 30, 2017, Cohen had $1,105,680.35 in his savings account, and $1,262,932.29 in total in the three accounts at Capital One Bank. b. Cohen has three accounts at Morgan Stanley in his name. As of September 30, 2017, the combined total in cash and cash equivalents in those three accounts was $1,270,60 0.41. c. As of September 30, 2017, Cohen had $260,689.13 in an account at Signature Bank. d. .In addition to the Essential Consultants Account and Account at First Republic, Cohen also had two joint checking accounts with Laura Cohen at First Republic. In total, as of September 30, 2017, Cohen had at least $1,376,209.27 in total in his four accounts at First Republic. 23 assume Case Document 48-5 Filed 07/18/19 Page 35 of 73 6. Cohen has an account at Bethpage Credit Union with $25,931.39 in it as of September 30, 2017. f. As of September 30, 2017, Cohen had $17,542.54 in accounts at Sterling. g. Cohen has two accounts at TD Bank?one in his name and one held jointly with his wife?and the total balance across the two accounts as of September 30, 2017 was $300,096.72. h. In total, as of September 30, 2017, Cohen had at least $5,014,051.80 in his accounts '?"?atCapital One BankTSignature-Bank, TD Banis-Bethpagc Credit Union-First Republic, and Morgan Stanley.- 21. based on the foregoing, it appears that Cohen?s representations to Sterling and Melrose that he did not have more than $1,250,000 were false, and that Cohen withheld information regarding approximately $5 million in funds from Sterling and Melrose in order to secure favorable tense in his renegotiation of his medallion loan. Based on my: participation in an interview with Sterling Employee-2, and my review of reports of intewiews with Sterling Employee-1 and two Melrose employees, it is my understanding that that Sterling and Melrose would View Cohen?s understating of his assets as material to its decision whether to renegotiate Cohen?s medallion loans and on what terms, or approve of the transfer of these loans to Cohen Had a Side Agreement With- 22. As set forth in detail below, it appears that during the course of Cohen?s negotiations to sell his interest in taxi medallions and the associated debt to_ Cohen not only misrepresented his ?nancial position to Sterling, but also failed to disclose a side deal he had negotiated with - it appears that - agreed to pay an above-market price for Cohen?s taxi cab medallions, and in exchange, Cohen agreed to pay-pproximately 29 mascara Case Document 48-5 Filed 07/18/19 Page 36 of 73 $3.8 million in-cash. Speci?cally, from my review of documents produced pursuant to a subpoena by Sterling, and reports prepared by law enforcement of?cers of interviews with Sterling Employee-1, as Well as my participation in an interview with Sterling Employee-2, Ihare learned, among other things, the follondng: a. On or about September 5, 2017, an executed term sheet was circulated by Sterling Employee] to Cohen and - Sea supra if 140;). According to the term shoe.- -Wouldhoirow Sterling and Melrose:to'be secured'by the medallions that-sac to acquire from Cohen. At aprlce of $20 million for thirty-two taxi medallions, the proposed transaction valued each medallion as worth $625,000. The term sheet also contemplated a $1,265,913 pay?down of the principal balance of the loan. The term sheet made no mention of a $3.8 million payment ?'om Cohen to - or any other form of payment or ?nancial transaction between the parties. 13. Additionally, an internal Sterling credit memorandum, dated October 4, 2017, describing the terms of the Cohen-transaction and the new loan 1-iid not mention any payments from Cohen to - including a $3.8 million payment. The memorandum also noted that the ?loan amount of indicates a pinchase price per medallion? but ?it is recognized that this is not in line with current market values.? Indeed, according to an internal Sterling memorandum dated February 5, 2018, in the month of January 2018, taxi medallions sold for amounts ranging from $120,000 to $372,000. According to Sterling Employee?1 and Sterling Employee"; they were never told ths- agreed to a purchase price of $625,000 in exchange for a lump sum payment from Cohen, or that Cohen would make any payment. a - 30 amazon; Case Document 48-5 Filed 07/18/19 Page 37 of 73 23. While Cohen and -did not disclose any payment from Cohen to -in conmnmications with Sterling, it appears that such a payment was contemplated. Indeed, based on my review of records maintained by Getzel, and a report prepared by law enforcement agents of an interview with Getael, I have learned the following, in substance and in part, regarding the proposed side-payment from Cohen tu? a On or about September 19, 2017, Getzel prepared a memorandum for Cohen ?enti?ed, ?Sale of?NYC?Medallion Entities and Debt Assumption? (the-?Getzel The Getzel Memorandum summarized the proposed transaction between Cohen and- in part, as follows: ?Michael and Laura Cohen will transfer ownership of their 13 NYC medallion entities to a Buyer who will assume their bank indebtedness, up on the [Cohens?] paying down the or? debt portfolio of the 13 entities by $5 00,000 and a cash payment to the Buyer of $3,800,00 13. According to Getael, Cohen told him the parameters of the deal, including the payment of $3,800,000 t-It Gates] did not know where Cohen was going to obtain $3,300,000 to paj- As noted above, Cohen had more than $5,000,000 in cash and cash equivalents as of September 2.017, but had only disclosed in his September 201?? Financial Statement that he had $1.25 million in cash. 24. Based on my retdew of records maintained by Sterling (as well as Maltese, the bank I With the participating interest in the loans) and reports of interviews of representatives of Sterling - (and Maltese), I have seen no evidence that Sterling, Maltese, or any other ?nancial institution 0 involved in the potential deal with Cohen and-was aware of the planned $3.8 million side payment from Cohen t- 11 The reference to thirteen medallions appears to be an error by Getzel. Cohen and his wife together owned sixteen corporations, which in turn owned 32 taxi medallions. 3 1 02.23.2013 Case Document 48-5 Filed 07/18/19 Page 38 of 73 D. Probable Cause Regarding the Subject Accounts 25 . As set forth above, since at least September 2015, if not earlier, Cohen has told Sterling that he has dif?culty making payments on his medallion loans and, since at least October 2015, Cohen has been acutely engaged in an attempt to sell his taxi medallions and the associated debts 111?. In the course of doing so, Cohen has used the Cohen Account andlor Account to engage in email communications regarding the terms of the transactions and the tmdisclosed?side?payment with_ at the-_ Account; -- -at the-Account, an- at the-iccouut. Speci?cally, as described above, there is probable cause to believe that the Subject Accounts have been used regarding the proposed Cohen-transaction with Sterling: 9.. Cohen has used the Cohen Acootmt to, among other things, negotiate a pay-donor of the principal amount of the loan, see supra 11 Mfg), to send term sheets to Sterling, see supra 1[ 140), to communicate with his accountant about the contents of ?nancial statements, see supra 1 16, to send financial statements to Sterling, see supra 1[ 14(i), (1), to check on the status of the transaction as of January 2.4, 2?18, see supra 1i 14(n), to negotiate a reduction of his debt with Sterling on or around January 31, 2013, see supra '11 14(0), to tell Sterling on February 1, 2018, he does not have the ability to pay more than $1,115 0,000, sea supra 11 14(p), and to with individuals responsible for sources of payments to the Essential Consultants Account, see supra 1[ 15. In other words, from the conununications described above, it appears likely that the Cohen Account will contain recent evidence of the Subject Offenses, including communications and potential misrepresentations to Sterling, and evidence indicating that statements made to Sterling are false or misleading. I). _1as used the _Account to communicate about the proposed taxi medallion transaction with Cohen, which appears to have been discussed as early 32 02.28.2013 .-. Case Document 48-5 Filed 07/18/19 Page 39 of 73 as October 2016. See supra 14(g). 12 Speci?cally, as described above, as early as May 2, 2017, used the-recount to inquire about the status of the transaction, sec supra 1i 1461). He used tit?Account to exchange drafts of the proposed term sheet with and Sterling, sac snore 1 14G). was also used by send a personal ?nancial statement for?to Sterling, see supra 1i 14(1). The?Account was copied on emails ?'om the "Account ?abcut'thc transaction, sac saprar?? 1'46), and was 'h'sted-on'_ ?nancial? statement as the contact email for_ sea supra 'll 14(m). Additionally, based on my review of Header Information, Ilmow that on or about September 1, 2017?at or around the time ?it-and Cohen were negotiating a term sheet?_used the Account to send and receitre eight emails ?'om Cohen at the MIDCPC Account. c. -has used tht-chcunt to communicate with Sterling employees, Cohen, and?about the proposed taxi medallion transaction since at least December 20 1 6. See supra 1m 14(g), 24c). Speci?cally, on or about August 29, 2017, -tcld Starling that he should be included on ?all ?xture e?mails" involving the proposed transaction, sea supra 1i 146). Additionally,-was involved in making revisions to the parties? term sheets, and he told Sterling on January 29, 2013 that- would not go forwatd with the planned transaction, sea 31.;er ll 14G), (11). Accordingly, there is probable cause to believe that the-Account will contain evidence of the negotiations between Sterling and the parties, etddence of a payment ?om Cohen to- and the reasons for the collapse of the Cuber-hansaction. ?2 For instance. ?'cm records provided by Sterling, that on or about December 2, 2016? out an email to a Sterling emplovee using the Account. The email forwarded correspondence betweei who was using the - Account, and an employee of Capital One regarding extending loan with Capital One. 33 02.232013 Case Document 48-5 Filed 07/18/19 Page 40 of 73 26. Additionally, it appears that Cohen setup the Account to receive emails he was previously receiving at the Cohen Account. Speci?cally, based on my review of records maimained by I have learned that on or about May 5, 2017, Cohen sent an mn'ail from the Account to a blind copy list of recipients stating that ?[d}ue to the overwhelming volume of phone calls and emails coming into my previous cellular number and e-mail address, There elected to create for Clients Only the following. Kindly use this new information for all future sonnet and Communications.? 'Tl? signattue line on ?ie'em?a'illi'sted ?Essential and ?Michael D. Cohen ch Associates, as well as Account as the email address. 13 2.7. In addition, based on. my review of emails from the WCPC Account produced pursuant to the Prior Cohen Account Warrants and Header Information, I have learned that Cohen has used the Account to send and receive emails from the Cohen Account, to commtmicate with thr-Account, and to send and receive emails from other email accounts about his political consulting business. Additionally, from my review of the Header Infonnation, it appears that since the November 13, 2017 search warrant on the Account, Cohen has continued to send and receive emails at the Account that appear liker to be relevant to the commission of the Subj ect Offenses. For example, emails obtained pursuant to the Prior Cohen Account Warrants, as well as the Header Information hare revealed. the following: a. On approximately eight occasions in August and September 2017, while Cohen, ?vere communicating about a term sheet for the Coho-taxi 13 Based on my review of emails ?'om the Account obtained pursuant to subpoena, I here learned that Cohen has used the account to communicate with numerous individuals with whom he does not enjoy an attorney-client privilege, including some of the individuals described below. See train 34 02.23.2013 Case Document 48-5 Filed 07/18/19 Page 41 of 73 medallion uansaction, sea supra 1i 14(Ic), Cohen used the Account to send or receive emails fret-at the-Account. For instance, on or about August 22, 2017 ,-used tit-account to send an email to Sterling Employee-1 and copied Cohen on the email at the Account. Oaths same day, Ste?ing Employee-1 responded to-at tin-Account and Cohen at the Account. On or about August 22, 2017, Cohen also used the Account to send an email to Sterling Employeed. b. ?As noted above, 'on or aboutSeptemher 1, 201-7, Cohen-used-the Accotmt to send or receive eight emails with the - Account. c. Cohen used the Account to send and receive emails from individuals who work at companies with whom it appears Cohen has a political consulting agreement. For example, beginning in April 2017-??th same month when Cohen began receiving payments from see supra 16(d), ?(tn?Cohen used the Account to send and receive emails from ATri?eT employees. These emails contain, among other things, invoices from Cohen to for consulting work by Cohen. Sbnilarly, beginning in April EON?which is also the month Cohen began receiving payments from Novartis for consulting work, see supra 16(d), 17(d)? Cohen used the Account to send and receiVe emails from employees ofNovartis. These emails concern, among other things, invoices from Cohen and requests for Nevartis for Cohen?s assistance on an initiative relating to drug pricing. d. From my review ofthe Header Information, I have learned that Cohen-has continued to use the MIJGPC Account to send and receive emails ?om individuals who work at companies with whom it appears Cohen had a political consulting agreement, such as Novartis and For instance, on approximately six: occasions between November 28, 2017 and January 30, 2018, the Account was used to send and receive emails from accounts belonging to 3-5 transom Case Document 48-5 Filed 07/18/19 Page 42 of 73 individuals using @att.com email addresses. Similarly, on approximately seventeen occasions between December 1, 2017 and February 20, 2013, the Account was used to send and receive emails from accounts belonging to individuals using @novartisnom email addresses. Since November 15, 201 7, has also sent and received emails with individuals using the email domains @btalte, which I believe is the email domain used by employees Bank, see supra 16(d), 17(b), and @squirepb.com, which I believe is the email domain used by eifplojfees of the lavtr??mi'Squire Patton of which Cohen appears'to have a consulting relationship with, sea supra 16(e), 17(e). Accordingly, it appears that Cohen continues to use the WCPC Account to send and receive emails that will be relevant to whether he is maintaining a consulting business, what type of consulting work he is doing, and whether he is receiving money for that consulting work. 23. In addition to the foregoing; based on my review of the Pen Register Date, see more 9, it appears that since the date of the last search Warrant on the Cohen Account (in, November 13, 2017), Cohen has continued to use the Cohen Account to communicate with the - -3count, the -ltccount, and other email accounts that app ear likely to be relevant to the of the Subject Offenses described above. For example, the Pen Register Data has revealed the following: a. Emails sent by the Cohen Account to the-recount on or about December 13, 2017 at 3:26 December 21, 2017 at 9:35 December 22, 2017 at 4:32 January 3, 2013 at 3:01 a.n1., Jsmuary 3, 2013' at 2:56 and January 4, 2013 at 3:31 p.111. b. An email sent by the Cohen Account to the _Lccount on or about January 25, 2013 at 3:55 pan. 36 caasscis Case Document 48-5 Filed 07/18/19 Page 43 of 73 c. Emails from the Cohen Account to the email accouII?on or about December I, 201? at 2:14 December 29, 2017 at 10:20 13.11, January 2, 2018 at 3:52 January 2, 2018 at 5:44 and January 8, 2018 at 6:38 pm. Based upon my review of emails contained in the Cohen Account, Ihave learned that the- email account belongs to e?i'ey Getzel, Cohen?s accountant, through whom Cohen made misrepresentations to ?nancial institutions, as discussed above. - 'dj' Emails from me Cohen?eeount to email accounts belonging to Sterling employees;?- including Sterling Employee?1, on or about anuary 2.5, 2018 at 10:23 January 26, 2018 at 12:55 am, January 29, 2013 at5:30 January 29, 2013 at 3:29 January 30, 2018 at 6:44 p.111. ei An email sent ?om the Cohen Account to the email account on or about January 25, 2013 at 5:29 pan. As stated above, First Republic is the bank at which the Essential Consultants Account is held. f. Ntunerous emails sent from the Cohen Account to the email account including emails on or about December 4, 2017, at 2:17 pan. and auuary 29, 2018 at 5 :43 pm. Based upon the email address and domain name, as Well as my review of reports of interviews and documents re?ecting that Cohen?s taxi medallions were leased, and operated by I believe that the email address belongs to 29. Based on my review of records mamtained by Sterling, I know that Cohen used the Cohen Account to send and receive documents related to the Centaur-transaction. Based on my training and experience, Iknow that Goo gle allows users of e?mail accounts to easilyr save docmnents to ?le sharing and retention platforms such as Google Docs and Google Drive. I 37 amazon Case Document 48-5 Filed 07/18/19 Page 44 of 73 also lorovv, from my training and experience, that users of e?mail accounts often use instant messaging interfaces linked to their email accounts. Further, I have learned that the Providers maintain records of search and Web histories associated with email accounts and, based on my training and experience, users of c-ma? accounts use associated web search browsers associated with a subscriber?s account to research topics they are e?mailing about. Accordingly, there is probable cause to believe that content information associated with the Subject Accounts will also ??ccntain evidence related't? the Subject Bft'enses. 30. Thus, Iresp ectt?ully submit that there is probable cause to believe that emails and other content information from the Subject Accounts will contain evidence of Cohen?s efforts to sell his taxi medallions and the associated debt, and his nnsnepresentations and emissions to Sterling and Melrose in connection with these negotiations. Although Cohen appears to have communicated with?nimarily through the Cohen Account and - Account, Ilcnovv, based on my involvement in the investigation, that Cohen also used at least one other email account associated with his position at the Trump Organization. Thus, I respectfully submitthat there is probable cause to believe that emails and other content information from the _Account, 4-.Account and -Account since on or about October 1, 201 6?t11e approximate date of when Cohen?s efforts to sell his taxi medallions and the associated debt began?will re?ect communications with the Cohen Account, IVEIDCPC Account, and possibly one or more additional accounts used by Cohen, and probable cause to believe that such emails will constimte evidence of Cohen?s connoission of the Subject Offenses, including the extent to which Cohen did or did not inform other individuals involved in the conduct assesses awn s?sf ss ass emissions to ?nancial institutions. 38 amazon Case Document 48-5 Filed 07/18/19 Page 45 of 73 31. Temporal Limitation. This application seeks all emails and other requested content information speci?ed in Attachments B, C, and for the following periods: a. For the Cohen Account, this application seeks all emails sent, created, or received between November 14, 2017, and the date of the proposed warrant, inclusive. As described above, . pursuant to the Prior Cohen Account Warrants, the SCO obtained and provided to the USAU emails from the Cohen Ace cunt that were sent, created, or received before November 14, 2.017. This ap?u?arWso seeks other hitc?rfn?zition speci?ed above'associated withthe Cohen Account-- that was created between December 1, 2014 (the month when Cohen entered into the medallion loans with Sterling), and the date of the proposed warrant, inclusive, b. For the Account, this application seeks all emails sent, created, or recciVed between November 14, 2017, and the date of the proposed warrant, inclusive. As described above, pursuant to aprior warrant, the SCO obtained and provided to the USAO emails from the Account that were sent, created, or received before November 14, 2017. I c. For the-account and ._Account, this application seeks emails and all other content information speci?ed above sent, created, or received between October 1, 2016, and the date of the proposed warrant, inclusive. As described above, October 2016 is the month in which Cohen began negotiating the taxi medallion sale with tl- d. For the -tccount, this application seeks emails and all other content information speci?ed above sent, created, or received between December 1, 2016, and the date of the proposed warrant, inclusive. As described above, December 2016 is the month in which. began representing tl- relation to the taxi medallion transaction. E. Evidence, Fruits and Instrumentalities 32. Based upon the foregoing, I respectfully submit there is probable cause to believe that information stored on Google?s servers associated with the Cohen Account will contain evidence, 39 02.23.2013 senior taxi medallions; Case Document 48-5 Filed 07/18/19 Page 46 of 73 fruits, and instrumentalities of violations of the Subject Offenses, as more fully described in Section 11 ofAttachmentAto the proposed warrant for the Cohen Account and Account, including the following: a. records, documents, and other ?les necessary to establish the identity of the person(s)- who created or used the Cohen Account or Account. b. Communications, records, documents, and other ?les involving Sterling, Mclrose, o. Communications, records, documents, and other ?les involving a plan, proposal,'or agreement for Cohen and! or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including tt_lttd/01? entities associated with him; I d. Communications, records, documents, and other ?les involving Essential Consultants, LLC or Michaell?). Cohen dz Associates, including those which indicate the nature and purpose of payments made to or from Essential Consultants or Michael D. Cohen 35 Associates; e. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) - including records that reveal the whereabouts of the person(s) who communicated with the Cohen Account andfor Account about any matters nelating to Essential Consultants, LLC, or about any plan or proposal or agreement for Cohen andfor entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to -md/or entities associated with him; f. Communications between the Cohen Account Account and Jeffrey Getzel relating to Cohen?s bank accounts, taxes, debts, and/or ?nances; 40 02.23.2015 Case Document 48-5 Filed 07/18/19 Page 47 of 73 g. Communications, records, documents, and other ?les reflecting false representations to a?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; h. Evidence indicating how and when the Cohen Account and Account was accessed bins?edito detennine the'g'ec?aphic and chronological?context of account access-mac,- and events relating to the crimes under investigation and to the account owner; and i. Evidence indicating the Cohen Account and WCPC Account owner?s intent as it relates to the Subject O?fenses under investigation. 33. Based upon the foregoing, I fin-that submit there is probable cause to believe that information stored on Google?s servers associated with the_ Account and- will contain evidence, fruits, and insnumentalities ofviolations of the Subject O??enses, including the following: a Communications, records, documents, and other ?les necessary to establish the identity of the .person(s) who created or used tl?_Account and- Account; b. Communications, records, documents, and other files involving a plan or proposal or agreement for Cohen andfor entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, tt-andfor entities associated with him; c. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who 41 02.23.2013 .n-aua-vuu- Hm. was m?im-ma? Im?W-Wm?u Case Document 48-5 Filed 07/18/19 Page 48 of 73 communicated with the-account and Account about any matters relatingto any plan or proposal or agreement for Cohen andfor entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to - -tndi?or entities associated with him; d- Comntunica?ons between tit-Account and - Account and others, including employees or representatives of Sterling, Meh'os e, or other ?nancial institutionCis), ?nances; 3. Communications, records, documents, and other ?les re?ecting false representations to a?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a fmancial institution; the source of funds ?owing into an account; or the purpose or nation of any ?nancial transactions involving that ?nancial institution; f. Etddence indicating how and when the _Account and - -Account were accessed or used, to determine the geograpl?c and chronological content of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating thI-l Account and r_Account owners? intent as it relates to the Subject Offenses under investigation. 34. Based upon the foregoing, I ?lrther submit there is probable cause to believe that info1n1a?on stored on Oath?s servers associated with the-recount wiIl contain evidence, ?nite, and insh'umentalities of violations of the Subject Offenses, including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or usedthe-ccount; 42 canes-ms Case Document 48-5 Filed 07/18/19 Page 49 of 73 13. Communications, records, documents, and other ?les involving apian or proposal or agreement for Cohen andfor entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, tu_and/cr entities associated with him; c. Communications, records, documents, and other files necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who communicated with the -Account_aboth any matters Elatii? to any plan or granted or agreement for Cohen and] or entities associated with- him to transfer any interest'in taxi medallions, and any associated debts or liabilities, t_ndfor entities associated with him; d. Communications between t-account and others, including employees or representatives of Sterling, Meirose, or other ?nancial institution(s), regarding Cohen?s ?nances; and I e. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; ?ne nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution. 111. Review of the Information Obtained Pursuant to the Warrant 35. Pursuant to 13 U.S.C. the presence of a law enforcement of?cer is not required for service of a search warrant issued under 2703, or for the collection or production of responsiVe records. Accordingly, the warrant requested herein will be transmitted to the Providers, which shall be directed to produce a digital copy of any responsive records to law enforcement personnel within 30 days from the date of service. Law enforcement personnel (including, in addi?on to law enforcement of?cers and agents, and depending on the nature of the ESI and the 43 02.28.2131}? Case Document 48-5 Filed 07/18/19 Page 50 of 73 status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) will retain the records and review them for evidence, fruits, and instrumentalities of the Subject O?enses as speci?ed in Section of Attaclnnents A, and to the proposed wan-ant. 36. In conducting this review, law enforcement personnel may use various methods to "l?fe evidence, finit?s,Tndi?striimentalities of the Siihject Offenses, including" but not limited to undertaking a cursory inspection of all emails within the Subject Account. This method is analogous to cursorily inspecting all the ?les in a ?le cabinet in an office to determine which paper evidence is subject to seizure. Although law enforcement personnel may use other methods as well, particularly including keyword searches, I know that keyword searches and similar methods are typically inadequate to detect all information subject to seizure. As an initial matter, keyword searches work only for text data, yet many types of ?les commonly associated with emails, including attachments such as scanned documents, pictures, and videos, do not store data as searchable text. Moreover, even as to test data, keyword searches cannot be relied upon to capture all relevant communications in an account, as it is impossible to lmovv in advance all of the unique words or phrases that investigative subjects will use in their communications, and consequently there are o?en many conununications in an account that are relevant to an investigation but that do notcontain any keywords that an agent is likely to search for- 37. .Because Cohen ant-Ire attorneys, the review of the content within the Subject Accounts will he conducted pursuant to established screening procedures to ensure that the lav'v enforcement personnel involved in the investigation, including attorneys for the Government, collect evidence in a manner reasonably designed to protect any attomeyuclient or otherapplicable 44 02.23.2013 Case Document 48-5 Filed 07/18/19 Page 51 of 73 privilege. When appropriate, the procedures will include use of a designated ?filter team,? separate and apart from the investigative team, in order to review potentially privileged communications and determine which communications to release to the investigation and prosecution team. IV. Request for Non-Disclosure and Sealing Order 38. The existence and scope of this ongoing criminal investigation are not publiclyr known. As a result, premature publicdisclosnre of this af?davit or the requested warrants could alert Cohen?that he is under hivesligation, causing him to destroy'evidenee, ?ee from prosecution, or otherwise seriously jeopardize the investigation. - In particular, based on my experience investigating white collar cases, including cases featuring documents such as agreements, drafts of agreements, notes of conversations, and other documentary evidence, premature disclosure of an. investigation may cause the target of the investigation to attempt to destroy or conceal such evidence. In addition, as also set forth above, Cohen. uses computers and electronic communications in ?ntherance of his activity and thus could easily delete, or otherwise conceal such digital evidence from lawr enforcement were he to learn of the Government?s investigation. See 18 U. S. C. Cohen also appeals to have the ?nancial means that would facilitate his ?ight from prosecution. See 18 U.S.C. 2705(b)(2), (5). 39. Accordingly, there is reason to believe that, were the Providers to notify the subs crib er or others of the existence of the warrant, the investigation would be seriously jeopm?diZed. . Pursuant to 18 U.S.C. 2705(b), Itherefore respectfully,r request that the Court direct the Providers not to notify any person of the existence of the warrant for a period of 180 days from issuance, subject to extension upon application to the Court, if necessary. 40. For similar reasons, I respectfully request that this af?davit and all papers submitted herewith be maintained under seal until the Court orders otherwise, except that the Government be permitted without further order of this Court to provide copies of the warrant and af?davit as 45 02.232013 Case Document 48-5 Filed 07/18/19 Page 52 of 73 need be to personnel assisting it in the investigation and prosecution of this matter, and to disclose those materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. V. Conclusion 41. Based on the foregoing, I respectfu?y request that the Court issue the warrants sought herein pursuant to the applicable provisions of the Stored Communications Act, 18 U.S.C. 2703 (for?contents) and 2TO3 and otherinfortnation), and the - releVant provisions of Federal Rule of Criminal Procedure 41. United States Attomey?s Of?ce Southern District of New York Sworn to before me this 28th day of February, 2013 46 02.28.2013 Case Document 48-5 Filed 07/18/19 Page 53 of 73 Exhibit Case Document 48-5 Filed 07/18/19 Page 54 of 73 tetrac- fies UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Information Associated with the Email Accounts ngaileorn, . Maintained at Premises Controlled by Google, Inc, USAO Reference No. 201 81100127 SEARCH WARRANT AND NON-DISCLOSURE ORDER TO: Google, Inc. (?Provider?) United States Attoniey?s Office for the Southern District of New York and the Federal Bureau of Investigation (c oIIectiveljr, the ?Investigative Agencies?) 1. Warrant. Upon an af?davit of Special Agent?if the United States Attomey?s Of?ce for the Southern District of New York, and pursuant to the" provisions of the I Stored Comunr'cations Act, 18 U.S.C. ?2703(b)(1)(A) and and the relevant provisions of Federal Rule of Criminal Procedure 41, the Court hereby ?nds there is probable cause to believe the email and maintained at premises controlled by Google, Inc, contain evidence, fruits, and instrumentalities of crime, all as speci?ed in Attachments A and hereto. Accordingly, the Provider is hereby directed to provide to the hirestigative Agencies, within 7 days of the date of service of this Warrant and Order, the records speci?ed in Section of Attachments A and hereto, for subsequent review by law enforcement'personnel as authorized in Sections and IV of Attachments A and B. ?re Govermnent is required to some a copy of this Warrant and Order on the Provider within 7 days of the date of issuance. The Warrant and Order may he served via a Case Document 48-5 Filed 07/18/19 Page 55 of 73 electronic transmission or any other means. through which the Provider is capable of accepting service. 2. Non-Disclosure Order. Pursuant to 18 U.S.C. 2705(1)), the Court ?nds that there is reason to believe that noti?cation of the existence of this warrant will result in destruction of or tampering with evidence or ?ight ?orn prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the existence- of this Warrant and Order to the listed subscriber or to any- other person for a? period of 180 days from the date of this Order, subject to extension upon application to the Court if necessary, except that Provider may disclose this Warrant and Order to an attorney for Provider for the purpose of receiving legal advice. 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which it was issued, he ?led under seal, except that the Government may without further order of this Court serve the Warrant and Order on the Provider; provide copies of the Affidavit or Warrant and Order as need be to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. Dated: New York, New York Eml?lvl (I I 2,97 7'5 [i rs if I hate Issued Time Issued :v I if. -. I creases]; . 1 - manner? Chief Southern Disaster ili?lb??i 02.23.2013 .7-- Case Document 48-5 Filed 07/18/19 Page 56 of 73 Email Search Attachment A 1. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the i?Pro?videri?li, headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email account -@gmail.com' (the ?Subj ect Account?) for the time period referenced below. A law enforcement of?cer will. servethis warrant by transmitting ittda email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement of?cer an electronic copy of the information speci?ed in Section II below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories specified in Section below. 11. Information to he Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Account: a. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Accotmt, including all message content, attachments, and header . information (speci?cally including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email) limited to items sent, receired, or created between November 14, 2017 and the date of this warrant, inclusive. b. Address book All address book, contact list, or similar information associated with the Subject Accomtt. c. Jabscriber- and payment information. All subscriber and payment information regarding the Subject Account, including but not limited to name, nsername, address, telephone Mum?u. . Case Document 48-5 Filed 07/18/19 Page 57 of 73 number, altemate email addresses, registration IP address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Account, including an}r 1P logs or other records of session times and durations, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. e. Customer correspondence. All correspondence Withthe subscriber or others associated with the Subject Account, including complaints, inquiries,- or other contacts with support- services and records of actions taken, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. f. Search History. All search history audior web history associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. g. Associated content. All Google Docs, files. maintained on Google Drive-and instant messages or Gchats associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. Preserved or beam records. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 13 U.S.C. 27936) or otherwise. Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement officers and - agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the records produced by the Provider in order to locate any evidence, ?nite, and instrumentalities of violations of 13 U.S.C. 371 (conspiracy to commit offense or to de?'aud 2 masses V.) un . Case Document 48-5 Filed 07/18/19 Page 58 of 73 the United States), 1005 (false bank entries); 1014 (false statements to a?nancial institution), 1343 (Wire trend), and 1344 (bank fraud), including the following: a. records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the Subject Account; I b. Communications, records, documents, and other ?les inrolving Sterling National Bank, Melrose Credit Union, andfor taxi medallions; c. Communications, records, documents,- and other ?les involving a plan, proposal; on?- agreement for Michael D. Cohen and/or entities associated with him to transfer an}r interest inta'si medallions, and any associated debts or liabilities, to others, including-.ndfor entities associated with him; Commrmicaticns, records, documents, and other ?les imrolving Essential Consultants, LLC or Michael D. Cohen :35 Associates, including those which indicate the nature and purpose of paments made to'or from Essential Consultants or Michael D. Cohen 32: Associates; e. Commtmications, records, documents, and other ?les necessary to establish the identitjr of any person(s) including records that reveal the whereabouts of the person(s) who communicated with the Subject Account about any matters relating to Essential Consultants, LLC, or about any plari or proposal oragreernent for Mohael D. Cohen andfor entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including 1- and/or entities associated with him; f. Communications between the Subject Account and Jeffrey Getzel relating? to Michael D. Cohen?s bank accounts, taxes, debts, andJ'or ?nances; Communications, records, documents, and other files re?ecting false representations to a fmancial institution with relation to the intended purpose of an account or loan at that ?nancial 02,23 .2013 Case Document 48-5 Filed 07/18/19 Page 59 of 73 institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the 1311113036 or nature of any ?nancial transactions involving that ?nancial institution; 11. Evidence indicating how and when the Subject Account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; and i. I Evidence indicatingthe'Suhject Account-owner?s intent as it relates-to-the-Subject Offenses under investigation. W. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedtu'es designed to collect evidence in a manner reasonably designed to protect. anyattomey-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart ?'orn the hivestig'ative team, in order to address potential privileges. {12.2 3.1018 Case Document 48-5 Filed 07/18/19 Page 60 of 73 Email Search Attachment I. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the ?Provider?), headquartered at 1600 Amphitheatre Parkway, Mountain Wow, California 94043, and applies to all content and other information within the Provider?s possession, custody, or control associated 1with the email accounts ar_ (the ?Subject Accounts?) for the time period between-Qctober l, 2016 and the dateof this warrant, inclusive. A law enforcement of?cer can serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement of?cer an electronic copy of the information speci?ed in Section II below. Upon receipt of the production, law enforcement personnel 1still review the information for items falling witlnn the I categories speci?ed in Section below. 11. Information to be Produced by the Provider To the extent within the Provider's possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Accounts: 3. Email cement. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Accounts, including all message content, attachments, and header information (specifically including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email). b. Address book information. All address book, contact list, or similar information associated with the Subject Accounts. c. Subscriber and payment information. All subscriber and payment information regarding the Subject Accounts, including but not limited to name, usernanie, address, telephone Case Document 48-5 Filed 07/18/19 Page 61 of 73 number, alternate email addresses, registration JP address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Accounts, including any logs or other records of session times and durations. e. Customer correspondence. All conespondencc with the subscrib or or others associated with the Subject Accounts, including complaints, inquiries, or other contacts with support services ?and records of actions'taken: - f. Search History. All search history andfor web history associated with the Subject Accounts. g. Associated content All Google Docs, ?les maintained on Googlc Drive, and instant messages or Gchats associated with the Subj ectAccounts. h. Preserved or backup records. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 18 U.S.C. ?27D3(i) or otherwise. Review of Information by the Government Law enforceth personnel (who may?include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the in this hivestigation, and outside technical, experts under government control). are authorized to review the records produced by the Provider in order to locate any and inshumentalitics of violations of 18 U.S.C. 3?1 (conspiracy to commit offense or to defraud the United States), 1005 (false bani: entries); 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the Subject Accounts; 2 01.28.2013 Case Document 48-5 Filed 07/18/19 Page 62 of 73 b. Communications, records, documents, and other ?les involving a plan or proposal or agreement for Michael D. Cohen andfor entities associated with him to transfer any interest intaxi medallions, and any associated debts or liabilities, to -and/or entities associated with him; I c- Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the personCs) who communicated-with the Subject Accounts-about any matters relating to any planer-proposal or agreement for Melisa] D. Cohen andlor entities associated with him to transfer any interest in taxi medallions, and anyr associated debts or liabilities, to _1ndfor entities associated with him; d. Communications between the Subject Accounts and others, including employees or representatives of Sterling National Bank, Melrose Credit Union, or other ?nancial institution(s), regarding Michael D. Cohen?s ?nances; e. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; f. Evidence indicating how and when the Subject Accounts was accessed or used, to detennine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account unmet; g. Evidence indicating the Subject Accounts owners? intent as it relates to the Subject Offenses under investigation. 02.232013 Case Document 48-5 Filed 07/18/19 Page 63 of 73 IV. Re?ew Protocols Review of the items deseribed in this Attachment shall he conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect an}; atto1*ney?client or other applicable prisilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and ap art from the investigative team, in order to address potential privileges. 02.23.2013 Case Document 48-5 Filed 07/18/19 Page 64 of 73 remap STATES DISTRICT COURT SOUTHERN DISTRICT or NEW YORK - the Matter of a Warrant for All a Content and Other Information 5 Associated with the Email Accounts ?agmaircom _@grnail.com, and r, Maintained at Premises Controlled by Google, Inc., USAO Reference No. 2018110012? WARRANT AND NON-DISCLOSURE ORDER- TO: Googlc, Inc. (?Provider?) United States Attorney?s Of?ce for the Southern District of New York and the Federal Bureau of Investigation (collectively, the ?Investigative Agencies?) 1. Warrant. Upon an af?davit of Special Agent -:1f the United States Attorney?s Of?ce for the Southern District of New York, and pursuant to the provisions of the Stored Comniunications Act, 18 U.S.C. ?2703(b)(1)(A) and and the relevant provisions of Federal Rule of Criminal Procedure 41, the Court hereby ?nds there is probable cause to believe the email accounts -@gmail.com, -@gmail.com, and maintained at premises controlled by Google, Inc, contain evidence, fruits, and instrumentalities of crime, all as speci?ed in Attachments A and hereto. Accordingly, the Provider is hereby directed to provide to the Investigative Agencies, within 7 days of the date of service of this Warrant and Order, the records speci?ed in Section II of Attachments A and hereto, for subsequent review by law enforcement personnel as authorized in Sections Ill and IV of Attachments A and B. The Government is required to serve a cop}r of this Warrant and Order on the Provider within 14 days of the date ofissuance. The Warrant and Order may he served via Case Document 48-5 Filed 07/18/19 Page 65 of 73 electronic transmission or any other means through which the Provider is capable of accepting service. 2. oil?Disclosure Order. Pursuant to 13 U.S.C. 270503), the Court ?nds that there is reason to believe that noti?cation of the existence of this warrant will result in in destruction of or tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the existence of this Warrant and Order to the listed subscriber 01' to any other person for a period of 180 days from the date of this Order, subject to extension upon application to the Court if necessary, except that Provider may disclose this Warrant and Order to an attorney for Provider for the purpose of receiving legal advice. 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which it was issued, be ?led under seal, except that the Government may without further order of this Court serve the Waii'ant and Order on the Provider; provide copies of the Af?davit or Wairant and Order as need be to personnel assisting the Goverrnnent in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosrn'e obligations in any prosecutions related to this matter. Dated:New York, New York We 5" {219/ Date issued Time Issued 7 MOI/l?sa?m HONORABLE HENRY shirts/mu UNITED ST MAGISTRATE JUDGE Southern District of New Yerk 20 I 113325 Case Document 48-5 Filed 07/18/19 Page 66 of 73 Email Search Attachment A I. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the ?Provider?; headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email account -@gmai1.com (the ?Subject Account?) for the time period referenced below. A law enforcement of?cer will serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider isdirecgd to produce to the law enforcement of?cer an electronic copy of the information speci?ed in Section 11 below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories speci?ed in Section below. II. Information to be Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated With the Subject Account: it. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Account, including all message content, attachments, and header information (speci?cally including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email) limited to items sent, received, or created between November 14, 2017 and February 28, 2018, inclusive. I b. Address book information. All address book, contact list, or similar information associated with the Subject Account. c. Subscriber and payment iry?hrmatz'on. All subscriber and payment information regarding the Subject Account, including but not limited to name, user-name, address, telephone Case Document 48-5 Filed 07/18/19 Page 67 of 73 number, alternate email addresses, registration IP address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Account, including any IP logs or other records of session times and durations, limited to items sent, received, or created between December 1, 2014 and February 28, 2018, inclusive. e. Customer correspondence. All correspondence with the subscriber or others associated with the Subject Account, including complaints, inquiries, or other contacts with support services and records of actions taken, limited to items sent, received, or created between December 1, 201:5r and February 28, 2018, inclusive. f. Search History. All search history andfor web history associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and February 28, 2018, inclusive. g. Associated content. All Google Docs, files maintained on Google Drive, and instant messages or Gchats associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and February 28, 2013, inclusive. h. Preserved or backup records. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 13 U.S.C. 27036) or otherwise. Review of Information by the Government Law enforcement persmnel (who may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the records produced by the Provider in order to locate any evidence, fruits, 2017.03.25 Case Document 48-5 Filed 07/18/19 Page 68 of 73 and of 18 U.S.C. 371 (conspiracy to commit offense or to defraud the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the Subject Account; b. Communications, records, documents, and other ?les involving Sterling National Bank, Melrose Credit Union, andfor taxi medallions; c. Communications, records, documents, and other ?les involving a plan, proposal, or agreement for Michael D. Cohen andfor entities associated with him to transfer any interest in taxi medallions, and an),r associated debts or liabilities, to others, including to-andz'or entities associated with him; d. Communications, records, documents, and other ?les involving Essential Consultants, LLC or Michael D. Cohen :95 Associates, including those which indicate the nature and purpose of payments made to or from Essential Consultants or Michael D. Cohen 6r Associates; e. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who communicated with the Subject Account about any matters relating to Essential Consultants, LLC, or about any plan or proposal or agreement for Michael D. Cohen andz?or entities associated with him to transfer an},r interest in taxi medallions, and any associated debts or liabilities, to others, including tt_andjor entities associated with him; f. Communications between the Subject Account and Jeffrey Getzel relating to Michael D. Cohen?s bank accounts, taxes, debts, andfor ?nances; 201103.23 Case Document 48-5 Filed 07/18/19 Page 69 of 73 g. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the sotu'ce of funds ?owing into an account; or the pu1pcse or nature of any f'mancial transactions involving that ?nancial institution; 11. Evidence indicating how and when the Subj ect Account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; and i. Evidence indicating the Subject Account owner?s intent as it relates to the Subject Offenses under investigation. IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney- client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 2017.03.25 Case Document 48-5 Filed 07/18/19 Page 70 of 73 Email Search Attachment 1. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the ?Provider?), headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email and (the ?Subject Accounts?) for the time period between October 1,20l? and February 28, 2018, inclusive. A law enforcement of?cer will serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement of?cer an electronic copy of the information speci?ed in Section 11 below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories speci?ed in Section below. II. Information to be Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Accounts: a. Emoii content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Accounts, including all message content, attachments, and header information (speci?cally including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email). b. Address book information. All address book, contact list, or similar information associated with the Subject Accounts. 201103.25 Case Document 48-5 Filed 07/18/19 Page 71 of 73 c. Subscriber and pmmiear information. All subscriber and payment information regarding the Subject Accounts, including but not limited to name, username, address, telephone number, alternate email addresses, registration IP address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Tiamaca'onotr records. All transactional records associated with the Subject Accounts, including any IP logs or other records of session times and durations. e. Customer correspondence. All con'espondence with the subscriber or others associated with the Subject Accounts, including complaints, inquiries, or other contacts with support services and records of actions taken. f. Search History. All search history andfor web history associated with the Subject Accounts. g. Associated content. All Google Docs, ?les maintained on Google Drive, and instant messages or Gchats associated with the Subject Accounts. h. Preserved or backup records. Any preserved or backup copies of any of the foregoing categories of records, whether created in reaponse to a preservation request issued pursuant to 13 U.S.C. 2703(f) or otherwise. Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, attomeys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under govenunent control) are authorized to review the records produced by the Provider in order to locate any evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud 201103.25 Case Document 48-5 Filed 07/18/19 Page 72 of 73 the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other ?les necessary to establish the identity of the person(s) who created or used the Subject Accounts; b. Communications, records, documents, and other ?les involving a plan or proposal or agreement for Michael D. Cohen and! or entities associated with him to transfer any interest in taxi with him; c. Communications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) - who communicated with the Subject Accounts about any matters relating to any plan or proposal or agreement for Michael D. Cohen andf or entities associated him to transfer any interest in taxi medallions, and any associated debts or liabilities, to_and/or entities associated with him; Communications between the Subject Accounts and others, including employees or representatives of Sterling National Bank, Melrose Credit Union, or other ?nancial institution(s), regarding Michael D. Co hen?s ?nances; e. Communications, records, documents, and other files re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?otiving into an account; or the purpose or nature of any fmancial transactions involving that ?nancial institution; 11133.25 Case Document 48-5 Filed 07/18/19 Page 73 of 73 f. Evidence indicating how and when the Subject Accounts vvas accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating the Subject Accounts owners? intent as it relates to the Subject Offenses under investigation. IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedtu'es designed to collect evidence in a manner reasonably designed to protect any attorney-client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team," separate and apart from the investigative team, in order to address potential privileges. 201 1(3325 Case Document 48-6 Filed 07/18/19 Page 1 of 80 A0 93 (SDNY Rev. 05/10) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the Southern District of New York Case No. In the Matter of the Search of (Brie?y describe the property to be searched or identify the person by name and address) Three Electronic Devices, See Attachment A SEARCH AND SEIZURE WARRANT An application by a federal law enforcement officer or an attorney for the government requests the search of the following person or property located in the Southern District of New York (identijjz the person or describe the property to be searched and give its location): Three Electronic Devices, See AttachmentA The person or property to be searched, described above, is believed to conceal (identijy the person or describe the property to be seized): See Attachment A I ?nd that the affidavit(s), or any recorded testimony, establish probable cause to 583.1 ch and seize the person or property. YOU ARE COMMANDED to execute this warrant on or before by", a. i i (not to exceed 1 4 days) CI in the daytime 6:any time in the day or night as I find. reast?jnable cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant mid a?1ecr=1ptfor the property taken to the person from whom or from whose premises, the property was taken, or leave the cepy and receipt at the place Where the property was taken. The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to the Clerk of the Coart. Upon its return, this warrant and inventory should be ?led under seal by the Clerk of the Court 694% USMJInitials if I ?nd that immediate noti?cation may have an adverse result listed iIi18 C. i? 2705?i(except tor delay of trial), and authorize the of?cer executing this warrant to delay notice to the epe?rs?on who, or Whose preperty will be searched 01? 861Zed (check the appropriate box) Elfor 30 days (not to exceed 30) Duntil, the facts justifying, the later specr?c date oI Date and time issued: 4/ :3 ?were?? rife, . 5/ Judge? City and state: New York, NY Hon. Henrv B. Pitman, U.S. Maoistrate Judoe Printed name and title .Case Document 48-6 Filed 07/18/19 Page 2 of 80 AC) 93 (Rev. 01/09) Search and Seizure Warrant (Page 2) Return Case No.: Date and time warrant executed: Copy of warrant and inventory left with: Inventory made in the presence of Inventory of the property taken and name of any person(s) seized: Certi?cation I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant - to the Court. Date: Executing o?icer ?3 Signature Printed name and title Case Document 48-6 Filed 07/18/19 Page 3 of 80 Attachment A I. Devices to be Searched The devices to be searched (the ?Subject Devices?) are described as: a. Subject Device?1 A black and red USB drive with a white label that says ?Tracking 180208140208.? b. Subject Device-2: A silver DVD with a white label that reads ?Cohen 2018.03.07.? c. Subject Device?3: A white DVDL labelled ?2-28-18 Cohen SW Returns Google 311mm,? . . ., II. Review of ESI on the Subject Devices Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the ESI and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, interpreters, and outside vendors or technical experts under government control) are authorized to review the ESI contained on the Subject Devices for evidence, fruits, and instrumentalities of one or more violations of 52 U. S. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offense?), as listed below: a. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. b. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. 0. Evidence of communications with American Media, Inc., David Pecker, and/ or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougal. d. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. Case Document 48-6 Filed 07/18/19 Page 4 of 80 e. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape. f. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. g. Evidence indicating Michael Cohen?s intent With respect to the Subject Offense, including Whether the payment to Clifford and any similar payments were made to in?uence the Presidential election. Case Document 48-6 Filed 07/18/19 . Page 5 of 80 A0 106 (Rev. 06/09) Application for a Search Warrant UNITED STATES DISTRICT COURT for the Southern District of In the Matter of the Search of (Brie?y describe the property to be searched or identi?t the person by name and address) Three Electronic Devices, See Attachment A APPLICATION FOR A SEARCH WARRANT I, a federal law enforcement of?cer or an attorney for the government, request a search warrant and state under penalty of perjury that I .have reason to believe that on the following person or property (identi?t the person or describe the ., . . 7 . 7 - See Attachment?A (rg located in the Southern District of New York there is now concealed (idehtz'?t the person or describe the property to be seized): PLEASE SEE ATTACHED AFFIDAVIT AND RIDER. The basis for the search under Fed. R. Crim. P. 41(0) is (check one or more): ?ievidence of a crime; contraband, fruits of crime, or other items illegally possessed; El property designed for use, intended for use, or used in committing a crime; a person to be arrested or a person who is unlawfully restrained. The search is related to a violation of: Code Section O??ertse Description 52 USC 30116(a)(1)(A), 30109 Illegai campaign contributions The application is based on these facts: PLEASE SEE ATTACHED AFFIDAVIT AND RIDER. IEI Continued on the attached sheet. [if Delayed notice of 30 days (give exact ending date if more than 30 days: is requested under 18 USC. 3103a, the basis of which is set forth on the attached sheet. Ir?l' . 't I?tinted name .ahd titleSworn to before me and signed in my presenceDate: [49/ ?r 3557/57 . W/?efi?rew 'j I gt? Judge - 5 ,City and state: 4/ hi5?? Rafa/4} M?ot/ Vet/37L Hon Henry Pitrnan, US gistiate Judge Prmted r?tarme and title Case Document 48-6 Filed'O7/18/19 Page6of80 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of the Application of the United TO BE FILED UNDER SEAL States Of America for a Search Warrant for Three Electronic Devices, USAO Reference No Agent Af?davit in Support of 2018R00127 5 Application for a Search Warrant SOUTHERN DISTRICT OF NEW YORK) ss.: Special Agent - of the United States Attorney?s Of?ce for the Southern District of New duly sworn, deposes and says: I. Introduction A. Af?ant 1. I have been a Special Agent with the USAO since August 2016. Ipreviously served as a Special Agent with the United States Department of Labor Inspector General from May 2011 to August 2016. In the course of my experience and training in these positions, I have participated in criminal investigations into federal offenses involving a wide array of ?nancial crimes, including frauds on ?nancial institutions, and have been involved in investigations involving violations of campaign ?nances laws and regulations. I also have training and experience executing search warrants, including those authorizing the search of email accounts and electronic devices. 2. I make this Af?davit in support of an application pursuant to Rule 41 of the Federal Rules of Criminal Procedure for a warrant to search the electronic devices speci?ed below (the ?fSubject Devices?) for the items and information described in Attachment A. This af?davit is based upon my personal knowledge; my review of documents and other evidence; my conversations with other law enforcement personnel; and my training, experience and advice received concerning the use of computers in criminal activity and the forensic analysis of 2 Case Document 48-6 Filed 07/18/19 Page 7 of 80 electronically stored information Because this af?davit is being submitted for the limited purpose of establishing probable cause, it does not include all the facts that I have learned during the course of my investigation. Where the contents of documents and the actions, statements, and conversations of others are reported herein, they are reported in substance and in part, except where otherwise indicated. B. Prior Warrants and the Subject Devices 3. The USAO and the Federal Bureau of Investigation have been investigating, among other things, a scheme by Michael Cohen to defraud multiple banks. Cohen is an attorney who currently holds himself out as the personal attorney for President Donald Trump, and who previously served for over a decade as an executive in the Trump Organization, an international conglomerate with real estate and other holdings. 4. In connection with an investigation then being conducted by the Of?ce of the Special Counsel the FBI sought and obtained from the Honorable Beryl A. Howell, Chief United States District Judge for the District of Columbia, three search warrants for emails and other content information associated with two email accounts used by Cohen, and one search warrant for stored content associated with an iCloud account used by Cohen. Speci?cally: a. On or about July 18, 2017, the FBI sought and obtained a search warrant for emails in the. account-@gmailcom (the ?Cohen Gmail Account?) sent or received between January 1, 2016 and July 18, 2017. This warrant, which is numbered 17?mj-00503, is attached as Exhibit A (the ?First Cohen Gmail Warrant?). b. On or about August 8, 2017, the FBI sought and obtained a search warrant for content stored in the iCloud account associated with Apple ID -@gmail.com (the ?Cohen iCloud Account?). This warrant, which is numbered, l7?mj-005 70, is attached as Exhibit (the ?Cohen iCloud Warrant?). Case Document 48-6 Filed 07/18/19 Page 8 of 80 c. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the Cohen Gmail Account sent or received between June 1, 2015 and November 13, 2017. This warrant, which is numbered 17?mj?00855, is attached as Exhibit (the ?Second Cohen Gmail Warrant?). d. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the account-_the ?Cohen Account?) sent or received between the opening of the Cohen Account1 and November 13, 2017. This warrant, which is numbered 17-mj?00854, is attached as Exhibit (the ?First Cohen Warrant?). 5. The SCO has since referred certain aspects of its investigation into Cohen to the USAO, which is working with the New York Field Of?ce. As part of that referral, on or about February 8, 2018, the SCO provided the USAO with all non-privileged emails and other content information obtained pursuant to the First Cohen Gmail Warrant, Second Cohen Gmail Warrant, and Cohen Warrant. On or about March 7, 2018, the SCO provided the USAO with all non?privileged content obtained pursuant to the Cohen iCloud Warrant.2 A ?lter team working with the SCO had previously reviewed the content produced pursuant to these warrants for privilege. 6. On or about February 28, 2018, the USAO sought and obtained search warrants for emails in Cohen Gmail Account and Cohen Account, among other accounts, sent or 1 Based on my review of this warrant and the af?davit in support of it, I know that the warrant did not specify a time period, but the af?davit indicated that, pursuant to court order, the service provider had provided non?content information for the Cohen Account that indicated that the account contained emails from the approximate period of March 2017 through the. date of the warrant. - 2 The SCO had previously provided a subset of this non?privileged content on or about February 2, 2018. Case Document 48-6 Filed 07/18/19 Page 9 of 80 received between November 14, 2017 and February 28, 2018. These warrants, which are both numbered 18 Mag. 1696, are attached as Exhibits (the ?Third Cohen Gmail Warrant?) and (the ?Second Cohen Warrant?), reSpectively. The content produced pursuant to these warrants is being reviewed for privilege by an SDNY ?lter team. 7. The search warrants described above are referred to collectively herein as the ?Prior Warrants.? 8. The returns of the Prior Warrants are presently contained on three electronic devices. In particular: a. Subject Device-J The non?privileged emails and content returned in response to the First Cohen Gmail Warrant, the Second Cohen Gmail Warrant, and the First Cohen Warrant are contained on Subject Device?1, which is particularly described as a black and red USB drive with a white label that says ?Tracking 180208140208.? b. ?Subject Device-2: The non?privileged content returned in response to the Cohen iCloud Warrant is contained on Subject Device-2, which is particularly described as one silver DVD with a white label that reads ?Cohen 2018.03.07.? c. Subject Device-3: The content returned in response to the Third Cohen Gmail Warrant and the Second Cohen Warrant is contained on Subject Device?3, which is particularly described as one white DVD labelled ?2-28?18 Cohen SW Returns Google and 9. The Subject Devices are presently located in the Southern District of New York. C. The Subject Offenses 10. The af?davits in support of the Prior Warrants describe evidence of several different courses of conduct by Cohen, including, among other things, false statements to financial institutions relating to the purpose of an account he opened in the name of Essential Consultants 5 Case Document 48-6 Filed 07/18/19 Page 10 of 80 LLC and the nature of funds ?owing into that account; false statements and fraudulent omissions by Cohen in connection with this attempt to re?nance his debts with certain financial institutions; and activities undertaken by Cohen on behalf of certain foreign persons or foreign entities without having registered as a foreign agent. The Prior Warrants accordingly de?ne the evidence to be seized by reference to subject offenses and speci?c categories of information related to these courses of conduct. The subject offenses in the Prior Warrants are summarized as follows: EM Subject Offenses in Prior Warrant3 A First Cohen Gmail ,18 U.S.C. 371 (conspiracyto defraud the United States), 1005 (false Warrant bank entries), 1014 (false statement to ?nancial institution), 1343 (wire fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 611 et seq. (Foreign Agents Registration Act Second Cohen Gmail 18 U.S.C. 371 (conspiracy to defraud the United States), 1005 (false Warrant bank entries), 1014 (false statement to ?nancial institution), 1343 (wire fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 611 et seq. (FARA) Cohen Warrant 18 U.S.C. 371 (conspiracy to defraud the United States), 1005 (false bank entries), 1014 (false statement to ?nancial institution), 1343 (wire fraud), 1344 (bank fraud), 1956 (money laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 611 et seq. (FARA) Cohen iCloud Warrant 18 U.S.C. 1014 (false statement to ?nancial institution), 1344 (bank fraud), 195 6 (money laundering), 951 (acting as an unregistered foreign agent), and 22 U.S.C. 611 etseq. (FARA) Third Cohen Gmail 18 U.S.C. 371 (conspiracy to commit offense or to defraud the United Warrant States), 1005 (false bank entries), 1014 (false statements to ?nancial. institution), 1343 (Wire fraud), 1344 (bank fraud) Second Cohen 18 U.S.C. 371 (conspiracy to commit offense or to defraud the United Warrant States), 1005 (false bank entries), 1014 (false statements to ?nancial institution), 1343 (wire fraud), 1344 (bank fraud) 1 1. Based on my participation in this investigation, including my review of documents obtained pursuant to subpoena and court order, my conversations with witnesses and review of reports of conversations with witnesses, and my review of publicly available information, I have 3 On or about February 28, 2018, the USAO sought and obtained a Rule 41 warrant, authorizing it to expand its search of the email returns for the warrants attached as Exhibits (the First Cohen Gmail Warrant, Second Cohen Gmail Warrant, and First Cohen Warrant) for additional offenses not authorized in the original warrants for those accounts. The below chart therefore lists both the subject offenses listed in the original warrants for these accounts and the subject offenses? authorized in the February 28, 2018 warrant. Case Document 48-6 Filed 07/18/19 Page 11 of 80 learned of evidence of an additional Subject Offense'committed by Cohen, described below, which was not listed in the Prior Warrants.4 12. I am therefore requesting authority to expand the search of the returns of the Prior Warrants, as contained on the Subject Devices, for evidence related to the additional Subject Offense. As set forth below, in addition to the categories of evidence already described in the Prior Warrants, there is probable cause to believe that the Subject Devices contain evidence of violations of 52 U.S.C. 30116(a)(1)(A) and 30109(d)(l)(A)(l) (illegal campaign contributions) (the ?Subject II. Probable Cause Regarding the Subject Offense 13. As set forth above, the USAO and the FBI have been investigating, among other things, a scheme by Michael Cohen to defraud multiple banks. During the course of this investigation, the USAO and FBI have obtained evidence that Cohen has also committed a criminal violation of the campaign ?nance laws by making an excessive in?kind contribution to the presidential election campaign of then?candidate Donald Trump in the form of a $130,000 payment to Stephanie Clifford, an individual who was rumored to have had an extramarital affair with Trump, in exchange for her agreement not to disclose that alleged affair. As set forth below, there is probable cause to believe that this payment was intended to keep Clifford from making public statements about the rumored affair on the eve of the 2016 presidential election, and thus constitutes a campaign contribution in excess of the applicable limit. 4 As set forth below, I base this application in part on my review of emails and text messages obtained pursuant to the Prior Warrants. Each of the cited emails or texts messages is either responsive to the applicable Prior Warrant and/or was discovered in plain view during a review of the emails or texts returned pursuant to the applicable Prior Warrant. 5 The Prior Warrants describe categories of information that likely encompass evidence of the additional Subject Offense. Nevertheless, in an abundance of caution, I am seeking eXplicit authorization to search the Subject Devices for evidence of the Subject Offense. 7 Case Document 48-6 Filed 07/18/19 Page 12 of 80 14. From my review of public sources, I have learned the following: a. In or around October 2011, there were rumors published on the gossip websites heDirty. com that Trump had had an extramarital affair with Clifford, an adult ?lm actress whose screen name is Stormy Daniels, in or around July 2006. In or about October 2011, Life Style Magazine, a tabloid sold in supermarkets, also published an article, based on the report in TheDz?rtycom, alleging an affair had occurred between Trump and Clifford. Both Trump and Clifford, through their representatives, issued denials in response to the articles. b. Speci?cally, on or about October 11,2011, Keith-Davidson, who. identi?ed himself I I as Clifford?s attorney, sent a cease and desist letter to heDirty. com, demanding that the article regarding Trump and Clifford be removed from the website. Additionally, on or about October 12, 2011, Cohen, who was then Executive Vice?President and Special Counsel to the Trump Organization, stated to News that ?[t]he totally untrue and ridiculous story . . . emanated from a sleazy and disgusting website. . . . The Trump Organization and Donald J. Trump will be bringing a lawsuit . . . [and] Mr. Trump and the Trump Organization would like to thank and commend Stormy Daniels and her attorneys for their honesty and swift actions.? 15. On or about June 16, 2015, Trump formally launched his 2016 presidential campaign. On or about May 4, 2016, Trump became the presumptive Republican Party nominee for president, and on July 19, 2016, Trump of?cially became the nominee. Based on my review of public sources, I have learned that while it does not appear that Cohen had an of?cial title as part of the Trump campaign, on multiple occasions Cohen made public statements on behalf of Trump or his campaign. For instance, on or about August 18, 2016, Cohen appeared on CNN to defend Trump?s polling numbers. Case Document 48-6 Filed 07/18/19 Page 13 of 80 16. On or about October 7, 2016, The Washington Post published online a video and accompanying audio in which Trump referred to women in what the article described as ?vulgar terms? in a 2005 conversation with Billy Bush, who was then the host of Access Hollywood. The following day, on October 8, 2016, Trump appeared in a video in which he stated, among other things, ?I?ve said and done things-I regret and words released today on this more than a decade old video are one of them. 'Anyone who knows me knows these words don?t re?ect who I am. I said it. I was wrong and I apologize.?- Based on my review of public sources, I also know that representatives of the Trump Campaign stated, in sum and substance, that the Access Hollywood comment was an old and isolated incident. 17. Based on-my review of public sources, including an article published in Slate magazine by a reporter who interviewed Clifford, that around this same time, in or about October 2016, Clifford was in discussions with Good Morning America show and Slate magazine, among other media sources, to provide these media outlets with her statement about her alleged relationship with Trump. According to the article in Slate, which the author based on conversations with Clifford over the telephone and by text message, Clifford wanted to be paid for her story or be paid by Trump not to disclose her accusation. AsCohen summarized in a 2018 email obtained pursuant to the Cohen Email warrants: ?In October 2016, I was contacted by counsel for Ms. Clifford stating that news outlets, including ABC News, were pursuing the 2011 story of an alleged affair between Mr. Trump and Ms. Clifford.? 18. From my review of telephone toll records6 and information produced pursuant to the iCloud Warrant and Cohen Email Warrants, I have learned that in the days following the Access 6 My attribution of certain telephone numbers to certain individuals as described in this affidavit is based on my review of the vCard (virtual contact ?le) obtained from Cohen?s telephone pursuant to the iCloud Warrant. Case Document 48-6 Filed 07/18/19 Page 14 of 80 Hollywood video, Cohen exchanged a series of calls, text messages, and emails with Keith Davidson, who was then Clifford?s attorney, David Pecker and Dylan Howard of American Media, Inc. the publisher of the National Enquirer,7 Trump, and Hope Hicks, who was then press secretary for Trump?s presidential campaign. Based on the timing of these calls, and the content of the text messages and emails, I believe that at least some of these communications concerned the need to prevent Clifford from going public, particularly in the wake of the Access Hollywood story. In particular, I have learned the following: a. On October 8, 2016, at approximately 7:20 Cohen received a call from Hicks. Sixteen seconds into the call, Trump joined the call, and the call continued for over four minutes.8 Based on the toll records that the USAO has obtained to date, I believe that this was the first call Cohen had received or made to Hicks in at least multiple weeks, and that Cohen and Trump spoke about once a month prior to this date speci?cally, prior to this call on October 8, 2016, Cohen and Trump had spoken once in May, once in June, once in July, zero times in August, and twice in September. b. Approximately ten minutes after the call ended, Hicks and Cohen spoke again for about two minutes. 7 Pecker is President of AMI and, according to his own statements in public reports, a personal friend of Trump. Howard is the chief content of?cer of AMI, who according to public records reports directly to Pecker. 8 I believe that Trump joined the call between Cohen and Hicks based on my review of toll records. Specifically, I know that a call was initiated between Cohen?s telephone number and Trump?s telephone number at the same time the records indicate that Cohen was talking to Hicks. After the Cohen-Trump call was initiated, it lasted the same period of time as the Cohen?Hicks call. Additionally, the toll records indicate a and then Trump?s telephone number, which, based on my training and experience, means that the call was either transferred to Trump, or that Trump was added to the call as a conference or three~way call participant. In addition, based on my conversations with an FBI agent who has interviewed Hicks, I have learned that Hicks stated, in substance, that to the best of her recollection, she did not learn about the allegations made by Clifford until early November 2016. Hicks was not speci?cally asked about this three?way call. 10 Case Document 48-6 Filed 07/18/19 Page 15 of 80 c. At 7:39 pm, immediately after the second call with Hicks ended, Cohen called David Pecker (as noted above, the President of American Media Inc., or AMI) and they connected for thirty seconds. Approximately four minutes later, Cohen called Pecker again and they spoke for more than a minute. Three minutes after ending his call with Pecker, Cohen received a call from Dylan Howard (as noted above, "the Chief Content Of?cer of AMI), and they spoke for approximately a minute. According to toll records, it does not appear that Cohen and Howard spoke regularly prior to October 8, 2016, as it had been over a month since they had called each other. d. At 7:56 pm, approximately eight minutes after his call with Howard ended, Cohen called Hicks and they connected for two minutes. At approximately the same time this call ended, Cohen received a call from Pecker, and they spoke for about two minutes. At 8:03 pm, about three minutes after ending his call with Pecker, Cohen called Trump, and they spoke for nearly eight minutes. e. At 8:39 pm. and 8:57pm., Cohen received calls from Howard and spoke to him for about four and six minutes, respectively. At 9:13 pm, about ten minutes after Cohen and Howard hung up from the second of these calls, Howard sent Cohen a text message that said: ?Keith will do it. Let?s reconvene tomorrow.? Based on my involvement in this investigation, I believe that when Howard wrote ?Keith,? he was referring to Keith Davidson, the attorney for Stephanie Clifford. At 3 :31 now on October 9, 2016, Cohen sent Howard a text message in response that said: ?Thank you.? Eight minutes later, Cohen sent Howard a text message that said: ?Resolution Consultants LLC. is the name of the entityI formed a week ago. Whenever you wake, please call my cell.? 11 Case Document 48-6 Filed 07/18/19 Page 16 of 80 f. The following day, on October 10, 2016,. at 10:58 a.n1., Howard sent a text message to Cohen and Davidson, which stated: ?Keith/Michael: connecting you both in regards to that business opportunity. Spoke to the client this AM and they?re confirmed to proceed with the opportunity. Thanks. Dylan. Over to you two.? At 12:25 pm, Davidson sent Cohen a text message that stated: ?Michael if we are ever going to close this deal In my opinion, it needs to be today. Keit Davidson and Cohen then spoke by phone for about three minutes. Based on my participation in this investigation, I believe that when Howard wrote that the ?client? was ?con?rmed to proceed with the opportunity,? he was referring to Clifford?s agreement in principle to accept money from Cohen in exchange for her agreement not to discuss any prior affair with then?candidate Trump.9 g. Based on my review of records obtained pursuant to the Cohen Email Warrants, I know that on or about October 10, 2016, Clifford and Davidson app ear to have signed a ?side letter agreemen that stated it was an exhibit to a ?con?dential settlement agreement and mutual release? between ?Peggy Peterson? and ?David Dennison.? The purpose of the document, according to the agreement, was to de?ne the ?true name and identity? of persons named by pseudonym in ?con?dential settlement agreement and mutual release.? The side letter agreement specifies the identity of ?Peggy Peterson? to be Clifford, but the space for ?Dennison?s? identity is blank. The agreement also includes a signature page for ?Peterson,? ?Dennison,? and their attorneys. The signature page is signed by ?Peterson? and his attorney, Davidson, but the 9 As set forth below, AMI was also involved in a payment to model Karen McDougal. However, because these communications were in close temporal proximity to the events involving the negotiation of a payment to Clifford, the execution of the agreement with Clifford, and the payment of money to Clifford, I believe that these communications were related to Clifford. Additionally, based on my review of public statements by McDougal, I have learned that she negotiated an agreement with AMI several months prior to these communications between Cohen and Pecker, Howard, and Davidson. 12 Case Document 48-6 "Filed 07/18/19 Page 17 of 80 document is unsigned by ?Dennison? and his attorney. Based on my involvement in this investigation, I believe that Davidson sent Cohen this partially?signed ?side letter agreemen in order to facilitate the closing of a deal between Davidson?s client and Cohen or his client on October 10, 2016. 19. It appears that on October 13, 2016, and the days that followed, Cohen took steps to complete a transaction with Davidson, including attempting to open an account from which Cohen could transfer funds to Davidson. Speci?cally, from my review of toll records, information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, records maintained by First Republic, as well as my participation in interviews with First Republic employees, I have learned the following: a. On the morning of October 13, 2016, at 8 :54 Cohen sent Pecker a text message that stated: need to talk to you.? At 9:06 Pecker sent a text message to Cohen that stated, called please call me back.? The tolls between Cohen and Pecker do not show a telephone call between 8:54 am. and 9:06 am. However, based on my review of text messages, I have learned . that Cohen and Pecker communicate with each other over Signal, which is an communications cellphone application that allows users to send text messages and make calls. b. At 9:23 Cohen sent an email that stated ?call me? to a banker at First Republic Bank (?First Republic Employee?2?). The email attached documents from the Secretary of State of Delaware indicating that Cohen had formed a limited liability company called ?Resolution Consultants on September 30, 2016. As noted above, ?Resolution ConsultantS? is the name of the entity that Cohen had told Howard he had formed recently after Howard said Davidson would ?do it.? At 10:44 Cohen called First Republic Employee?2 and told him, in sum and 13 Case Document 48-6 Filed 07/18/19 Page 18 of 80 substance, that he needed an account in the name of ?Resolution Consultants? opened immediately, and that he did not want an address on the checks written out of the account. Later that day, another employee at First Republic emailed Cohen account opening paperwork to complete. Cohen returned the account opening documents partially completed, but failed to provide a copy of his driver?s license or passport, and did not respond to the employee?s question of how he wanted to fund the account. As a result, the account was never opened. 0. On October 17, 2016, Cohen incorporated Essential Consultants LLC in Delaware. That same day, he filed paperwork to dissolve Resolution Consultants LLC. 20. Despite these steps taken by Cohen, it appears that the negotiation between Cohen and Davidson was not progressing suf?ciently fast enough for Davidson or his client, Clifford, and they threatened to go public with Clifford?s allegations just days before the presidential election. Specifically, based on my review of toll records, information obtained pursuant to the iCloud Warrant, and public sources, I know the following: a. According to an article in The Washington Post, which quoted emails sent from Cohen?s email account hosted by the Trump Organization, on October 17, 2016, Davidson emailed Cohen and threatened to cancel the aforementioned ?settlement agreemen Cohen did not complete the transaction.10 According to the article, Davidson sent Cohen a second email later in the day that stated in part, ?Please be advised that my client deems her settlement agreement canceled and void.? At 4:00 pm. that day, Cohen called Davidson and they spoke for over ?ve minutes. 10' Due to the partially covert nature of the investigation to this date, the Government has not requested documents from the Trump Organization or Davidson, and thus does not possess the email referenced in this article. 14 Case Document 48-6 Filed 07/18/19 Page 19 of 80 b. Cohen?s 4:00 pm. call with Davidson and/or Davidson?s threats to cancel the ?settlement agreemen appear to have touched off a ?urry of communications about the settlement agreement and whether Clifford would go public. Speci?cally: i. At 4:43 pm, Howard sent Cohen a text message that stated: ?I?m told they?re going with DailyMail. Are you aware?? One minute later, Cohen responded: ?Call me.? Based on my involvement in this investigation, I understand Howard?s text to mean that he heard that Clifford was going to take her story of an extramarital affair with Trump to the Daily Mail, a tabloid newspaper. ii. At 4:45 pm, Howard called Cohen and they spoke for over two minutes. Moments later, Davidson and Cohen spoke for about two minutes. At 5:03 pm, Cohen attempted to call Trump, but the call only lasted eight seconds. This was Cohen?s first call after he spoke with Davidson. iv. At 5:25 pm, Cohen texted Howard, stating: v. At 6:44 pm, Howard responded to Cohen?s text, stating: ?Not taking my calls.? Cohen responded one minute later: ?You?re kidding. Who are you trying to reach?? Howard responded one minute later: ?The ?agent. Based on my involvement in this investigation, I understand Howard?s text messages to mean that he attempted to contact Davidson about the matter involving Clifford, but that Davidson was not taking Howard?s calls. vi. At 6 :49 pm, Cohen called Howard and they spoke for nearly four minutes. 0. The following day, on October 18, 2016, heSmokingGun.c0m, a website that publishes legal documents and mugshots, published an article called: ?Donald Trump and the Porn Superstar,? which. alleged that Trump had an extramarital affair with Clifford. However, the article noted that Clifford had declined to comment. 15 Case DocUment 48-6 Filed 07/18/19 Page about October 25, 2016, the communications between Cohen, Davidson, Howard and Pecker picked up again, apparently concerning a transaction involving Clifford. Speci?cally, based on my review 0f toll records, information obtained pursuant to the Cohen Email Warrants and iCloud Warrant, as well as my review of public sources, I have learned the following: a. On October 25, 2016, at 6:09 Howard sent Cohen a text message stating: ?Keith calling you urgently. We have to coordinate something on the matter he?s calling you about or its [sic] could look awfully bad for everyone.? One minute later, Davidson sent Cohen a text message stating all me.? Cohen and Davidson called each other several times over the next half hour but appear not to have connected. At 6:42 Cohen and Davidson spoke for about eight minutes. At 7:11 they spoke for another two minutes. b. The next morning, on or about October 26, 2016, at 8:26 am, Cohen called Trump and spoke to him for approximately three minutes. At 8:34 am, Cohen called Trump again and connected for a minute and a half. 0. At approximately 9:04 than thirty minutes after speaking with Trump? Cohen sent two emails to the person who had incorporated Resolution Consultants and Essential Consultants for him, and stated ?can you send me asap the ?ling receipt? and then, in the second email, ?for Essential Consultants That person responded with the ?ling receipt two minutes later at 9:06 am. and with the certi?cation of formation 23 minutes later, at 9:27 am. d. Shortly after that, Cohen contacted First Republic Employee?2 and told him, in sum . and substance, that he decided not to open anaccount in the name of ?Resolution Consulting? and instead would be opening a real estate consulting company in the name of ?Essential Consultants.? Cohen told First Republic Employee?2 that he was at Trump Tower, and wanted to go to a First Republic branch across the street to open the account, so First Republic Employee?2 called, a 16 _Case Document 48-6 Filed 07/18/19 Page 21 off 80 preferred banker at that branch (?First Republic Employee?1?), to assiSt Cohen. At 11:00 am, First Republic Employee~1 called Cohen. I know from my participation in an interview with First Republic Employee-1, that around the time of the call he went to Cohen?s office in Trump Tower? on the same ?oor as the Trump Organization?Hand went through account opening questions, including know your customer questions, with Cohen. In response to a series of know?your? customer questions about the purpose of the account?the answers to which First Republic Employee-1 entered into a form?Cohen stated, in sum and substance, that he was opening Essential Consultants as a real estate consulting company to collect fees for investment consulting work, and all of his consulting clients would be domestic individuals based in the United States. Based on my review of records obtained from First Republic, it appears that this account (the ?Essential Consultants Account?) was created at a time between 11:00 am. and 1:00 pm. e. At 1:47 Cohen called Davidson and they spoke for approximately two minutes. At approximately 1:49 Davidson emailed Cohen wiring instructions for an attorney client trust account at City National Bank. f. After the Essential Consultants Account was opened on October 26, 2016, Cohen transferred $131,000 from a home equity line of credit that Cohen had at First Republic to the Essential Consultants Account. Following the transfer, at approximately 4: 15 pm. on October 26, 2016, First Republic Employee?2?s assistant emailed Cohen at his Trump Organization email address to tell him that the funds had been deposited into the Essential Consultants Account. Cohen forwarded that email to the Cohen Gmail Account and then forwarded it to Davidson. g. At 6:37 Cohen asked Pecker by text message, ?Can we speak? Important.? Cohen called Pecker at 6:49 pm. and connected for thirty seconds. At 6:57 Cohen sent Howard a text message, stating: ?Please call me. Important.? Cohen called Howard at 7:00 pm. 17 Case Document 48-6 Filed 07/18/19 Page 22 of 80 and connected for about thirty seconds. At 7:06 pm, Cohen called Peckerxagain and they spoke for nearly thirteen minutes. At 7:24 Howard sent a text message to Cohen that: ?He said he?d call me back in 20 minutes. Itold him what you are asking for his [sic] reasonable. I?ll get it sorted.? Approximately an hour later, at 8:23 Howard told Cohen by text message to ?check your Gmail for email from my private accoun In an email sent at 8:23 pm. by Howard to Cohen and Davidson, with the subject line ?Con?rmation,? Howard stated, ?Thank you both for chatting with me earlier. Con?rming agreement on: - Executed agreement, hand-signed by Keith?s client and returned via overnight or same?day FedEx to Michael, - Change of agreement to re?ect the correct LLC, - Transfer of funds on Thursday AM to be held in escrow until receipt of agreement.? After receiving that email, at approximately 8:27 Cohen asked Howard by text message, ?Can you and David [Pecker] give me a call.? Howard responded: ?David is not around I think. I?ll call.? At 8:28 pm, Howard called Cohen and they spoke for three minutes. 22. On October 27, 2016, Cohen made a payment to Davidson of $130,000?with the ?mds intended for Clifford?for the purpose of securing her ongoing silence with respect to the allegations that she had an extramarital affair with Trump. Speci?cally, based on my review of toll records, bank records, and information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, I have learned the following: a. At 9:47 am, Cohen sent Davidson an email, stating: ?Keith, kindly con?rm that the wire received today, October 27, 2016 shall be held by you in your attorney?s trust account until such time as directed for release by me, in writing. Additionally, please ensure that all paperwork contains the correct name of Essential Consultants LLC. I thank you in advance for your assistance and look forward to hearing from you later.? 18 Case Document 48-6 Filed 07/18/19 Page 23 of 80 b. At approximately 10:01 am, according to records provided by First Republic Bank, Cohen completed paperwork to wire $130,000 from the Essential Consultants Account?? which had been funded a day prior from Cohen?s home equity line of credit?to the attorney client trust account at City National Bank that Davidson had speci?ed in the wiring instructions he sent to Cohen. The wire transfer was made shortly thereafter. 0. At 10:02 am, Davidson responded to Cohen?s email from 9:47 stating: con?rm that I will work in good faith that no funds shall be disbursed unless until the plaintiff . personally signs all necessary settlement paperwork, (the form of which will match the prior agreement). The settlement docs will name the correct corporation, (Essential Consultants LLC). Plaintiff? signature will be notarized and returned to you via FedEx. Only after you receive FedEx will I disburse. air?? d. At 10:50 am, First Republic Employee?1 sent Cohen an email con?rming that the payment had been sent'and providing him with the wire number. 23. On October 28, 2016, and the days that followed, Cohen ?nalized the transaction with Davidson. Speci?cally, based on my review of toll records, information obtained pursuant to the iCloud Warrant, public sources, and bank records, I know the following: a. On October 28, 2016, at 11:48 am, Cohen spoke to Trump for approximately ?ve minutes. Beginning at 1:21 Cohen attempted a series of phone calls to Davidson, Pecker, and Howard throughout the day, although it appears he may only have connected with Howard. b. Later that day, at approximately 7:01 pm, Davidson stated to Cohen by text message that ?all is AOK. I should have signed, notarized docs on Monday. You should have them on Tuesday.? Cohen thanked him and said hope we are good.? Davidson responded, assure you. We are very good.? Howard also texted Cohen at 7:08 ?Keith [Davidson] says 19 Case Document 48-6 Filed 07/18/19 Page 24 of 80 we are good.? Cohen then responded to Howard and ?Excellent? to Davidson. At approximately 10:30 Cohen spoke to Hicks for three minutes. c. On October 31, 2016, Cohen called Howard at 8:22 pm. and they spoke for over three minutes. At 8:32 pm, Cohen received text messages from both Howard and Davidson. Howard said: ?You?ll have paperwork tomorrow says Davidson said: ?We are AOK. You will be receiving a package tomorrow.? Cohen responded ?Thank you? to Howard and ?Thanks Keith. Will call you then? to Davidson. From my involvement in this investigation, I believe Davidson was referring to a signed nondisclosure agreement when he told Cohen that he would receive apackage. (1. Based on my review of court ?lings that became public in 2018, I have learned that on or about October 28, 2016, LLC and/or David Dennison? entered into a ?con?dential settlement agreement and mutual release? with ?Peggy Peterson,? pursuant to which ?Peterson? agreed not to disclose certain ?confidential information pertaining to [Dennison]? in exchange for $130,000. The agreement provided that would wire the funds to ?Peterson?s? attorney, who would then transfer funds to ?Peterson.? Cohen signed the agreement on behalf of The agreement stated that the address for which was later referred to in the agreement as ?Essential Consultants, was Cohen?s residence. e. Consistent with the ?con?dential settlement agreement and mutual release,? on or about November 1, 2016, Davidson transferred $96,645 from his attorney client trust account at City National Bank to a bank account in Clifford?s name. The wire had the annotation ?net settlemen On the same day, at approximately 9:48 am. Davidson sent Cohen a text message with a picture of a FedEx delivery confirmation, stating that at approximately 9:09 am. a package shipped by Davidson the previous day had arrived for Cohen at his Trump Organization 20 Case Document 48-6 Filed 07/18/19 Page 25 of 80 address. On the same day, at approximately 6:14 Davidson sent Cohen an email with an audio ?le attached and said ?Give this a lesson [sic] and then call me.? The audio attachment was titled and was a ?ve-minute recording of Davidson interviewing Clifford about recent public allegations made by an adult ?lm star named Jessica Drake regarding her alleged past affair with Trump in the recording, Clifford explained the reasons she believed that Drake was not credible. Less than an hour later, at approximately 7:05 Cohen called Trump, but it appears that they did not connect. Cohen then called a telephone number belonging to Kellyanne Conway, who at the time was Trump?s campaign manager. They did not connect. At approximately 7:44 however, Cohen received a return call from Conway, which lasted for approximately six minutes. 24. On November 4, 2016, just three days after the Clifford transaction was completed and just four days before the presidential election, the Wall Street Journal published an article alleging that the National Enquirer had ?Shielded Donald Trump? from allegations by Playboy model Karen McDougal that she and Trump had an affair. The article alleged that AMI had agreed to pay McDougal to bury her story. McDougal, like Clifford, had been represented by Davidson. Based on my review of toll records, information obtained pursuant to the Cohen Email Warrants and iCloud Warrant, and public sources, it appears that Cohen spoke frequently to Davidson, Howard, Pecker, and Hicks around the time of this article?s publication?just days before Election Day?about the importance of preventing the McDougal and Clifford stories from gaining national traction. Speci?cally, I have learned the following: a. Between 4:30 and 8:00 pm. on November 4, Cohen communicated several times with Howard, Pecker and Davidson. For instance, at approximately 4:49 Cohen sent Howard a' text message with a screenshot of an email forwarded to him by another'Trump Organization 21 Case Document 48-6 Filed 07/18/19 Page 26 of 80 lawyer. The forwarded email was from a Wall Street Journal reporter, and asked for comment from Trump and/or the campaign on the story. Cohen also spoke with Hicks several times, including shortly before and/or after calls with Pecker, Howard and Davidson. Indeed, at approximately 7:33 pm, using two different cellphones subscribed to him, Cohen appears to have been talking to Davidson and Hicks at the same time. b. At approximately 8:51 pm, Cohen sent Howard a message, stating: ?She?s being really difficult with giving Keith a statement. Basically went into hiding and unreachable.? One minute later, Howard responded: ?I?ll ask him again. We just need her to disappear.? Cohen responded, ?She definitely disappeared but refuses to give a statement and Keith cannot push her.? At approximately 8:55 pm, Howard responded to Cohen?s text: ?Let?s let the dust settle. We don?t want to push her over the edge. She?s on side at present and we have a solid position and aplausible position that she is rightfully employed as a columnist.? Based on my involvement in this investigation, I believe Cohen and Howard were referring to Karen McDougal when they were discussing ?she? and ?her.? Additionally, I believe Howard?s statement that ?we have . . . a plausible position that she is rightfully employed as a columnist? was ?a reference to the fact that AMI had given McDougal payments for her role as a purported columnist for the company. c. At approximately 8:58 pm. on November 4, 2016, Howard attempted to reassure Cohen about the effect of the forthcoming Wall Street Journal article, texting, think it?ll be ok pal. I think it?ll fade into the distance.? Cohen responded, ?He?s pissed.? Howard wrote back, ?I?m pissed! You?re pissed. Pecker is pissed. Keith is pissed. Not much we can do.? Based on my involvement in this investigation, Ibelieve Cohen was referring to Trump when he stated ?he?s pissed.? Cohen asked Howard at approximately 9:00 pm. how the Wall Street Journal could 22 Case Document 48-6 Filed 07/18/19 Page 27 of 80 publish its article if ?everyone denies.? Howard responded, ?Because there is the payment from AMI. It looks suspicious at best.? d. At approximately 9:03 pm, Hicks called Cohen and they spoke for two minutes. At approximately 9:11 pm, Cohen called Howard and spoke to him for ?ve minutes. At approximately 9:15 pm, Hicks called Cohen and they spoke for nearly seven minutes. Again, Cohen used different phones for these two calls, such that he appearsto have been on both calls for about a minute of overlap. At approximately 9:32 pm, Cohen texted Pecker, ?The boss just tried calling you. Are you free?? A minute later, Cohen texted Howard, ?Is there a way to ?nd David quickly?? e. At approximately 9:50 pm, the Wall Street Journal article was published online, Howard and Hicks both sent web links for the article to Cohen. Over the next half hour, Cohen and Howard exchanged several text messages commenting on how the story came across. The next morning on November 5, 2016, at approximately 7:35 Cohen texted Hicks, ?So far I see only 6 stories. Getting little to no traction.? Hicks responded, ?Same. Keep prayingll It?s working!? Cohen wrote back, ?Even CNN not talking about it. No one believes it and if necessary, I have a statement by Storm denying everything and contradicting the other porn stars statement. I wouldn?t use it now' or even discuss with him as no one is talking about this or cares!? Based on my involvement in this investigation, I believe Cohen was referring to the above?referenced recorded audio statement by Clifford that he obtained from Davidson, and was stating that such a statement could be used to in?uence potential negative media relating to Trump, but was unnecessary at that time. Based on a text message from Hicks to Cohen, I believe that later that morning, Pecker spoke to Trump. 23 Case Document 48-6 Filed 07/18/19 Page 28 of 80 25. On or about November 8, 2016, Trump won the election for President of the United States. i 26. On or about January 12, 2018, the Wall Street Journal ?rst reported that Cohen arranged a payment to Clifford. On or about January 22, 2018, Common Cause, a government watchdog group, ?led a complaint with the Federal Election Commission, alleging that Cohen had violated campaign ?nance laws by making the payment to Clifford. Based on my review public sources following that report, as well as emails obtained pursuant to the Cohen Email Warrants, I have learned the following: a. On or about January 23, 2018, the day after Common Cause ?led its complaint, Cohen began emailing himself drafts of statements describing his payment to Clifford. Additionally, on January 23, 2018, Cohen emailed the following draft of that statement to an individual who appears to be writing a book on Cohen?s behalf: In October 2016, I was contacted by counsel for Ms. Clifford stating that news outlets, including ABC news, were pursuing the 2011 story of an alleged affair between Mr. Trump and Ms. Clifford. Despite the fact that both parties had already denied the allegation, as Mr. Trump?s longtime Special counsel and protector, I took it upon myself to match the offer and keep the story from breaking. I knew the allegation to be false, but I am also a realist who understands that just because something is false doesn ?t mean that it doesn ?t create harm and damage. I could not allow this to occur. I negotiated a non-disclosure agreement with Ms. Clifford?s counsel and tendered the funds. I did this through my Delaware LLC and transferred personal funds to cover the agreement. I was not reimbursed any monies from Mr. Trump, the Trump Organization, any third party or the Presidential campaign. At no point did I ever advise Mr. Trump of my communications or actions regarding this agreement. As outlandish and unusual as this may appear, the Trumps have been like family to me for over a decade. It?s what you do for family. (Emphasis added.) Based on my involvement in this investigation, I believe that the above email is an acknowledgement that the allegation of the affair had existed for some time ..the 20] 1 story. . but that Cohen was motivated to ?keep the story from breaking? again in October 2016. 24 Case Document 48-6 Filed 07/18/19 Page 29 of 80 b. On or about February 13, 2018, Cohen said in a statement to The New ark Times that ?Neither the Trump Organization nor the Trump campaign was a party to the transaction with Ms. Clifford. The payment to Ms. Clifford was lawful, and was not a campaign contribution or a campaign expenditure by anyone.? Cohen declined to answer follow-up questions including whether Trump had been aware of the payment, why Cohen made the payment, or whether similar payments had been made to other people. c. On or about February 14, 2018, Cohen was asked by The New York Times whether Trump had reimbursed him, whether he and Trump had made any arrangement at the time of the payment, or whether he had made payments to other women. Cohen stated in response, can?t get into any of that.? On or about February 14, 2018, Cohen also stated to The Washington Post that: ?In a private transaction in 2016, I used my own personal funds to facilitate a payment of $130,000 to Ms. Stephanie Clifford. Neither the Trump Organization nor the Trump campaign was a party to the transaction with Ms. Clifford, and neither reimbursed me for the payment, either directly or indirectly.? d. On or about March 9, 2018, Cohen stated to ABC News that ?the funds were taken from my home equity line and transferred internally to my LLC account in the same bank.? 27. Accordingly, for the foregoing reasons, there is probable cause to believe that Cohen committed Violations of the Subject Offense by making an in-kind contribution to Trump or the Trump campaign in the form of a $130,000 payment to Clifford on the eve of the election. Indeed, while he denies having given an unlawful contribution, in his own statements Cohen has admitted that he paid $130,000 of his ?personal funds? to Clifford and that the payment occurred less than two weeks before the election, as Trump was facing negative media allegations about his behavior toward women, even though allegations of an affair between Trump and Clifford 25 Case Document 48-6 Filed 07/18/19 Page 30 of 80 existed since 2011. In addition, the communication records set forth above make evident that Cohen communicated with members of the Trump campaign about his negotiation with Clifford?s attorney and the need to preclude Clifford from making a statement that would have re?ected negatively on the candidate in advance of the forthcoming election. 28. Therefore, there is probable cause to believe that a search of the Subject Devices will reveal evidence, fruit and instrumentalities of the Subject Offenses, including the following: a. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. b. Evidence of communications involving Michael Cohen, Donald Trump and/or agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. c. Evidence of communications with American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and/or Karen McDougal. d. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. e. Evidence of communications with Donald Trump and/or agents or associates of the Trump Campaign about the Access Hollywood tape. f. Evidence relating to Cohen?s knowledge of the campaign finance laws, campaign contribution reporting requirements, and campaign contribution limits. 26 Case Document 48-6 Filed 07/18/19 Page 31 of 80 g. Evidence indicating Michael Cohen?s intent with respect to the Subject Offense, including whether the payment to Clifford and any similar payments were made to in?uence the Presidential election. Procedures for Searching ESI A. Review of E81 29. Law enforcement personnel (including, in addition to law enforcement officers and agents, and depending on the nature of the E81 and the status of the investigation and related proceedings, attorneys forthe government, attorney support staff, agency personnel assisting. the government in this investigation, interpreters, and outside vendors or technical experts under government control) will review the E81 contained on the Subject Devices for information responsive to the warrant. 30. In conducting this review, law enforcement personnel may use various methods to locate evidence, fruits, and instrumentalities of the Subject Offense, including but not limited to undertaking a cursory inspection of all emails, texts or files contained on the Subject Devices. This method is analogous to cursorily inspecting all the files in a ?le cabinet in an of?ce to determine which paper evidence is subject to seizure. Although law enforcement personnel may use other methods as well, particularly including keyword searches, I know that keyword searches and similar methods are typically inadequate to detect all information subject to seizure. As an initial matter, keyword searches work only for text data, yet many types of files commonly associated with emails, including attachments such as scanned documents, pictures, and videos, do not store data as searchable text. Moreover, even as to text data, keyword searches cannot be relied upon to capture all relevant communications in an account, as it is impossible to know in advance all of the unique words or phrases that investigative subjects will use in their communications, and 27 Case Document 48-6 Filed 07/18/19 Page 32 of 80 consequently there are often many communications in an account that are relevant to an investigation but that do not contain any keywords that an agent is likely to search for. IV. Conclusion and Ancillary Provisions 31. Based on the foregoing, I respectfully request the court to issue a warrant to seize the items and information speci?ed in Attachment A to this af?davit and to the Search and Seizure Warrant. 32. In light of the con?dential nature of the c0ntinuing investigation, and for the reasons more fully set forth in the Accompanying Af?davit, I respectfully request that this af?davit and all papers submitted herewith be maintained under seal until the Court orders otherwise. Special Agent, USAO Sworn to before me on 7th day of April, 20,13} i . f} t" HON. HBNR PITMAN UNITED 1? A I ES MAGISTRATE JUDGE ., ., - v. 28 Case Document 48-6 Filed 07/18/19 Page 33 of 80 Attachment A I. Devices to be Searched The devices to be searched (the ?Subject Devices?) are described as: a. Subject Device?J A black and red USB drive with a white label that says ?Trackin 180208140208.? . b. Subject Device~22 A silver DVD with 'a white label that reads ?Cohen 2018.03.07.? 0. Subject Device?3: A white DVD labelled ?2?28?18 Cohen SW Returns Google and . . . . .. II. Review of ESI on the Subject Devices Law enforcement personnel (including, in addition to law enforcement of?cers and agents, and depending on the nature of the ESI and the status of the investigation and related proceedings, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, interpreters, and outside vendors or technical experts under government control) are authorized to review the ESI contained on the Subject Devices for evidence, fruits, and instrumentalities of one or more violations of 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offense?), as listed below: a. Evidence relating to payments to Stephanie Clifford, Karen McDougal, or their agents or legal representatives, including any nondisclosure agreements and related documents, and any communications related to such agreements. b. Evidence of communications involving Michael Cohen, Donald Trump and/or: agents or associates of the Trump Campaign about Stephanie Clifford or Karen McDougal, or payments to Stephanie Clifford or Karen McDougal. 0. Evidence of communications with American Media, Inc., David Pecker, and/or Dylan Howard about Donald Trump, the Trump Campaign, Stephanie Clifford, and! or Karen McDougal. d. Evidence relating to Cohen?s role in the Trump Campaign, and coordination or consultation with the Trump Campaign. Case Document 48-6 Filed 07/18/19 Page 34 of 80 6. Evidence of communications with Donald Trump and/ or agents or associates of the Trump Campaign about the Access Hollywood tape. I f. Evidence relating to Cohen?s knowledge of the campaign ?nance laws, campaign contribution reporting requirements, and campaign contribution limits. g. Evidence indicating Michael Cohen?s intent with respect to the Subject Offense, including whether the payment to Clifford and any similar payments were made to in?uence the Presidential election. Case Document 48-6 Filed 07/18/19 Page 35 of 80 Exhibit A Case Document 48-6 Filed 07/18/19 Page 36 of 80 r: 4?23 JUL 22 an UNITED STATES DISTRICT COURT mm 3 Wm for the Edd District of Columbia A0 93 (Rev. 11MB) Search and Seizure Warrant In the Matter of the Search of 0503 (Brie?y describethepropertyto be searched . 633821 17 ml 0 Ell Beryl A or identr?z the person by name and address) AS?lgFled TO ASSOCIATED WITH THE EMAIL pat? 7? and Warrant Dese'nptInn: 393m - SEARCH AND SEIZURE WARRANT To Any? authorizedlawenforcementofti oer - An application by a federal law enforcement of?cer or an attorney for the government requests the search of the following person or property located in the . Northern District of California (identtfir the person or describe the properlyI to be searched and give its location): See Attachment A. I ?nd that the or any recorded testimony, establish probable cause to search and seize the person or property described above, and that such search will reveal (tdentt?; the person or describe the property to be seized): See Attachment 8. YOU ARE COMMANDED to execute this warrant on or before 1, 2017 1 {not to exceed 14 days) [ill in the daytime 6:00 am. to 10:00 pm. Cl at any time in the day or night because good cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to Hond?eryi A. Howell United States Magistrate Judge) El Pursuant to 18 U.S.C. 3103a(b), I ?nd that immediate noti?cation may have an adverse result listed in 18 U.S.C. 2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose property, will be searched or seized (check the appropriate box) Cl for days (not to exceed 30) [3 until, the facts justi?ling, the later speci?c date of Date and time issued: [145% .23? 453i?? Judge' signature City and state: Washington, DC. Hon. Howell Chief S. DIstrIct Judge Printed name and title um Case Document 48-6 Filed 07/18/19 Page 37 of 80 A0 93 (Rev I l/l3) Search and Seizure Warrant (Page 2) Return Case No:: I 7 Date and [in ?e warrant executed: Copy of warrant and inventory left With: inventory t?ade in the presence of Inventory of the property taken andnenie of any per?o'nts) seiiedt Delta" 55,; 1 Letter? {569067 119190501? 2017071q~ gap A ?For MC 'pwcfevf?lm? JUL 21? 23!? Clerk, U.S. an Bankruptcy Courts 7 . Certi?cation declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the designatedjudge. A Date: 7/36/wa . Primed name and Inn: Case Document 48-6 Filed 07/18/19 Page 38 of 80 ATTACHMENT A This warrant applies to information associated with the Google Mail Account -@gmai1.com that is stored at premises owned, maintained, controlled, or operated by Google, a company headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043. Case Document 48-6 Filed 07/18/19 Page 39 of 80 I. ATTACHMENT Information to be disclosed by? Google To the extent that the information described in Attachment A is within the possession, custody, or control of the Google (hereinafter ?the Provider?), regardless of whether such information is stored, held or maintained inside or outside of the United States, and including any emails, records, files, logs, or information that have been deleted but are still available to the Provider, the Provider is required to disclose the following information to the government for each accoUnt or?identi?er listed in AttachmentA: 7 a. The contents of all emails associated with the account, including stored or preserved copies of emails sent to and from the account, draft emails, the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email; All records or other information regarding the identi?cation of the account, to include full name, physical address, telephone numbers and other identi?ers, records of session times and durations, the date on which the account was created, the length of service, the IP address used to register the account, log?in IP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log ?les, and means and source of payment (including any credit or bank account number); The types of service utilized; All records or other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and ?les; All records pertaining to communications between the Provider and any person regarding the account, including contacts with support services and records of actions taken; and other identifiers, records of session times and durations, the date on which the account was created, the length of service, the types of service utilized, the IP address used to register the account, log?in IP addresses associated with .session times and dates, aceount status, alternative e?mail, addresses provided Case Document 48-6 Filed 07/18/19 Page 40 of 80 during registration, all other user names associated with the account, all account names associated with the subscriber, methods of connecting; f. All search history or web history; g. All records indicating the services available to subscribers of the accounts; All usernames associated with or sharing a login IP address or browser cookie with the accounts; i i. All cookies, including third-party cookies, associated with the user; j. All records that are associated with the machine cookies associated with the user; and . 7 R. All telephone or instrument numbers associated with the Account (including MAC II. addresses, Electronic Serial Numbers Mobile Electronic Identity Numbers Mobile Equipment Identi?er Mobile Identi?cation Numbers Subscriber Identity Modules Subscriber Integrated Services Digital Network Number International Mobile Subscriber Identi?ers or International Mobile Equipment Identities Information to be Seized by the Government information described above in Section I that constitutes evidence, contraband, fruits, and/or instrumentalities of violations of 18 U.S.C. 101.4 (false statements to a ?nancial institution) and 18 U.S.C. 1956 (money laundering), as well as 18 U.S.C. 95] (acting as an unregistered foreign agent) and the Foreign Agents Registration Act 22 U.S.C. 611 et seq, involving Michael Dean Cohen and occurring on or after January 1, 2016, including, for each account or identi?er listed on Attachment A, information pertaining to the following matters: a. Communications, records, documents, and other ?les involving Essential Consultants, Communications, records, documents, and other ?les involving Bo and Abe Realty, Communications, records, documents, and other ?les that false representations to a ?nancial institution with relation to intended the purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an Case Document 48-6 Filed 07/18/19 Page 41 of 80 account a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; d. Records of any funds or bene?ts received by or offered to Michael Dean Cohen by, or on behalf of, any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; e. Communications, records, documents, and other ?les that reveal efforts by Michael Dean Cohen to conduct activities on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or forej gnprinnipals: f. Evidence indicating how and when the account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating the account owner?s. state of mind as it relates to the crimes under investigation; h. The identity of the person(s) who created or used the account, including records that help reveal the whereabouts of such person(s); and it The identity of any records that help reveal the whereabduts of the communicated with the account about any matters relating to activities conducted by Michael Dean Cohen on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals. Case Document 48-6 Filed 07/18/19 Page 42 of 80 Exhibit Case Document 48-6 Filed 07/18/19. Page 43 of 80 A0 93 (Rev. 11/13) Search and Seizure Warrant UNITED STATES DISTRICT COURT for the District of Columbia 1n the Matter of the Search of (Brie?y describe the property to? be searched or idenrpji the by name and address} INFORMATION ASSOCIATED WITH THE EMAIL ACCOUNT COM 0332: Assigned To: Chref Judge Howell, Beryl A Assign Date: 1111312017 Desc?riptien: Search and Seizure Warrant SEARCH AND smug}; WARRANT -- I An application by a federal iaW enforcement officer or an attorney for the government requests the sear-ch of the following ?perSOH Or property located in the Northern - District of Califbrnia the person or describe the property re be searched arid give its location): See Attachment A. I ?nd'that-the af?davitCs), or any recorded testimony, establish probable cause to search and seize the person or property described above, and that search will reveal (ideht?r?) the person or describe'rhe property to be seized): See Attachment E3. YOU ARE COMMANDED to execute this warrant on or before November 20. 2017 (not to exceed 1:4 days) in the daytime 6:00 am. to 10:00 p.111. at any time in the day or night because good caUSe has been established. Unless delayed notice is authorized below, you must give a copy of the remnant and a receipt for the property? taken to the person from?whoms or from Whose premises,- the propelty Was taken, Or leave the copy and receipt at the place where the property was, taken. The of?cer executing this Warrant, or an officm' preSent during the execution of the warrant, tnust prepare an invieritory as required by law and return this warrant and inventory to Hon. Beryl A. Howell A (Urrima? States Magistl are Judge) CI Pursuant to 18 3103a(b), i ?nd that immediate noti?cation may have an adVelse result listed at 18 C. 2-705 (except foi delay of trial), and authorize the af?ne executing this warrant to delay notice to the person Who, or whose property will be searched or seized (check the box) far days {not {a exceedSO) until, the facts justifying,_ the later speci?c date of Date-vandtirneissued; 3143/ 259/ ?it [egg/ff Jadge? Signaarre City and state: Washington, Dc Hon. Beryl a. Hewett, chier'us. District Judge Printed name and ri?e Case Document 48-6 Filed 07/18/19 Page 44 of 80 A0 93 (Elev. 11/13) Search and Seizure Warrant (Page 2) 3.493%. Return Case No.: Date and time warrant executEd: Copy 'of Warrant and inventory left with: Inventmy made in the presence of: Inventory of the prbp'e'rty taken and flame of any person(s) Seized: Certi?eatibn designated judge. Date: I declare Under penalty of perjury that this inventory is correct and was l?etufned along With the original warrant to; the Eat?euti?g o?icer? ?3 Signature ,Prfn'te?dnapie and title- Case Document 48-6 Filed 07/18/19 Page 45 of 80 ATTACHMENT A This warrant applies to information associated with the Google Mai] Account -@gmail.com that is stored at. premises owned, maintained, or operated by Google, ecompany headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043. Case Document 48-6 Filed 07/18/19 Page 46 of 80 1. ATTACHMENT Information to be disclosed by Google To the extent that the information described in Attachment A is within the possession, custody, 01' control of the Google (hereinafter ?the Provider?), regardless of whether such information is stored, held or maintained inside or outside of the United States, and including any emails, records, ?les, logs, or information that have been deleted "but are still available to the Provider, the Provider is required to disclose the following information to the government for each account or identi?er listed in Attachment a. The contents of an emails associated vulth the account, including stored orpreserved copies of emails Sent to and from the account, draft entails, the source and destination addresses associated with each email, the date and time at which each email Was sent, and the sizeand length of each email; All records or other information regarding the identification of the account, to include full name, physical address, telephone numbers and other identi?ers, records of session times and durations, the date on which the account Was created, the length of service, the iP address used to register the account, log-in IP addresses associated with schiOn times and dates, actiount status, alternative email addresses provided during registration, methods of connecting, log ?les, and means and s?ourCe of payment (including any credit ?o?r'bank account number); The types of serviCe utilized; All records .or other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and ?les;- All, records pertaining to communications betWeen the Provider and any person regarding the account, including Contacts with support services. and records of actions taken; and other identi?ers, records of Session times and durations, the date on which the a'ccount'wes created, th'e length of Service, the types of serviCe utilized, the IP address used to register the account, log-in IP addresses associated with session times and dates, account status, alternative e-mail addresses provided during registratidn, all other user names associated With the aecount, all account- names associated with the 'subScriber, methods of cennecting; Case Document 48-6 Filed 07/18/19 Page 47 of 80 All search history or web history; All records indicating the services available to subscribers of the accounts; All usernames associated with or sharing a,login IP address or broWser cookie with the accounts; All cookies, including thirdnparty cookies, associated with the user; All records that are associated with the machine cookies associated with'th?e user; and All telephone or instrument numbers associated with the Account (including MAC II. Numbers Mobile Equipment Identifier Mobile Identi?cation Numbers Subscriber Identity Module-s Mobile Subscriber Integrated Services Digital Network Number International Mobile Subscriber Identi?ers or International Mobile Equipment Identities Information to be Seized by the Government All information described above in Section [that constitutes evidence, contraband, fruits! and/or instrumentalities of violations of 18 U.S.C. 1014 (false statements to a ?nancial institution), is use. 1343 (wire fraud), 18- 1344 (bank fraud), and 18 use. 1956 (money laundering), as well as 18 11.8.0. 951 (acting as an unregistered foreign agent) and the Foreign Agents Registration Act 611 at S?tq., involving Michael Dean Cohen and occurring on or after June 1, 2015, including, for each account or identi?er listed on Attachment A, information pertaining to the following matters: _aa records, documents, and other ?les involving Essential Consultants, Communications, record's, documents, and other? ?les that false repreSentations to. a' ?nancial institution with relation to intended the purpOSe of an account Or lean at that ?nancial institution; the nature of-any business or entity associated withvan account a ?nancial institutibn; thesource of funds ?owing into 'an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; Case Document "48-6 Filed 07/18/19 Page 48 of 80 Records of any funds or- bene?ts received by or offered to MichaelDean Cohen by, or on behalf of, any foreign government, foreign of?oial's, foreign entities, foreign persons, or foreign principals; Communications, records, documents5 and other ?les that reveal efforts by Michael Dean Cohen to conduct activities On behalf of, for the bene?t of, or at the direction of any foreign government, foreign officials, foreign entities, foreign persons, or foreign principals; Evidence indicating how and when the account was accessed or used, to determine 11. user and events relating to the crimes under investigation and to the account owner; Evidence indicating the account owneris "state of mind as it relates to the crimes- under investigation; The identity of the person(s) who created ?or used the account,'including records that help reveal the whereabouts-of such personCs); and i The identity of any records that help reveal the whereabouts of the communicated with the account about any matters relating to activities conducted by Michael Dean Cohen on behalf of, for the benefit of, or at the direction of any foreign government, foreign officials, foreign entities, foreign persons, or foreign principals. Review Protocols, Review of the items described in Attachment A and Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner consistent with professional responsibility requirements concerning the maintenance of attorney-client and other Operative privileges. When appropriate, the procedures shall include use of a designated ??lter team,?se atate and a the investivative team, in order to address otenti'al rivile es. a Case Document 48-6 Filed 07/18/19 Page 49 of 80 Exhibit Case Document 48-6 Filed 07/18/19 Page 50 of 80 Jammy?1 rm 9 um. A0 .93 (Rev. [1113) Search and Seizure Warrant UNITED STATES DISTRICT COURT - for the Disitrict of Columbia in the Matter of the Search of (Brie?y describe the. property to he: searched Case: 'o?r iderr?tp?lthEperson by name and address) Assigned T0 Chief Judge Beryl ASSOCIATED WITH THE ACCOUNT Date I 11/131'2017 '5 STORED AT THE Description: Search and Seizure Warrant PREMISES OF 1&1 INTERNET iNc SEARCH AND SEIZUREWARRANT of?cer .77 .. .A 7 An application 'by? a federal law enforcement of?cer or an attorney for the government requests the search pf the following person or property located in the Northern District of California (id?rr'rigfiz the person 0r describe Thepreperry to be searched and give ifs jeearfon)?: See Attachment A. I find that the af?davitCS), or any recorded testimony, establish probable cause to search and seize the person or property deSC-ribed above, and that such search will reveal (remap: tfiepersbn er derc?rrbe theproperzy-?m be seized): See Attachment 13. YOU ARE COMMANDED to execute this Walrant on or before November'ZO. 2017 (no: to exceed 14 days) Elf in the daytime 6:00 am. to 10:00 p.111. at any time in the day or night because good cause has been established. Unless delayed notice is-authorize?d below. you must give a copy of the warrant and a receipt for the property taken to the person from whom, Or from" whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. The officer ertecnting this Warrant, or an officer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant'and inventory to Hon. Beryl A. Howell . . . rldagr'strme Judge) El Pursuant to 18 U. 7S. 3103510)), I ?nd that immediate noti?cation inay have an adverse result listed in 18 .C. 2705 (except for delay of trial) and authorize the of?cer executing this warrant to delay notice to the person who or WhoSe property be seal ched (check the appi opqule box) for days (170110 exceed 30) until, the facts justifying, the later Speci?c date of Date. and timei's?sued: [fit/ll sz?fiff?m ef?gy?? 11/? fW Judge 5' sigrratur City and state: Washington, DC . Hon. Beryl A. Hewet? ?cmer'ue. District Judge Printed name and ri?e Case Document 48-6 Filed 07/18/19 Page 51 of 80 w- A0 93 (Rev. Seatoh and Seizure Warrant (PageZ) Return "Case No.: Date and time warrant executed: Copy ofwam?ant and inventory left with: Inventory made in'the presence of -: Inventory of the property taken and name of any lpei?SonCs) seized: CErii??a?On A designated judge. Date: I declare, under penalty of pel?jury that this inventory is correct and Was returned along with the original warrantto the Executing of?cer sigizqittre I P?n?r?ed name mid ri?e Case Document 48-6 Filed 07/18/19 Page 52 of 80 PIS-N .7 ATTACHMENT A This warrant applies to information associated with the. email -_hat is stored at premises owned, maintained, controlled, or operated ?by 1&1 Internet: Inc. an electronic communication arid/or remote computinglsetvice provider headquartered in Sunnyvale, California. Case Document 48-6 Filed 07/18/19 Page 53 of 80 I. ATTACHMENT Information to be disclosed by 1&1 To the extent that the information described in Attachment A is Within the possession, custody, or control ofthe 1&1 (hereinafter ?the Provider"), regardless of whether such infennation is stored, held 0r maintained inside or outside of the United States, and including any ?einails, records, ?les, logs, or information that have been deleted but are still available to the Provider, the Provider is required to disclose the following information to the government for each account or identi?er listed in Attachment A: Va" The aerator? ?reserved copies of emails sent to and from the account, draft emails, the source and destination addresses associated with each email, the date and time at which each email was-sent, and the size and length of'each? email; All records or other information regarding the identi?cation of the account, to include full name, physical address, telephonenumbers and other identi?ers, records of session times and durations,the date on which the account was created, the length of serviCe, the IP- address used to register the account, log?in IP addresses associated'with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log files, and means and source of payment (including any credit or bank account number); Thetypes of-servi?ce utilized;- All records or other information stored at any time by an individual using the account, including. address books, contact and buddy lists, calendar data, pictures, and ?les; All rec01?ds pertaining to, communications between the Provider and any person regarding the account, including centac?ts with ?fservices and records of actions taken; and other identi?ers, records of ~ses:Sion'ti1nes and durations, the-date on which the account?was created, the length of service, the types of service utilized, the IP?address used: to register the account, log-in IP addresses associated with Session times and dates, account status, alternative carnal} addresses provided during registration, all other user names associated with the account, all account names associated with the subscriber, methods of connecting; Case Document 48-6 Filed 07/18/19 Page 54 of 80 ?as m, i All search history or web history; All records indicating the services available to subscribers of the accounts; All usernarnes (associated with or sharing a lo gin IP address or browsercookie with the accounts; All Cookies, including tliird~party cookies, associated with the user; All records that are associated with, the machine cookies associated with the user; and All telephone or instrument numbers associated with. the Account (including MAC II. Numbers Mobile Equipment Identi?er Mobile Identi?cation Numbers Subscriber Identity Modules Mobile Subscriber Integrated Services Digital Network Number International Mobile Subscriber Identi?ers or International Mobile Equipment Identities Information to be Seized by the Government All informatiOn described above in Section I that constitutes evidence, contraband, fruits, and/or instrumentalities of violations of 18 U.S.C-. 1014 (false statements to a financial institution), 18 U.S.C. 1343 (Wire fraud), 18 U.S.C. 1344 (bank fraud), and 18 U.S.C. 1956 (money laundering), as well as 18 U.S.C. 951 (acting as an unregistered foreign agent) and the Foreign Agents Registration Act 22 U.S.C. 611 at 5351., involving Michael Dean Cohen, including, for each account or identifier listed. on Attachment A, information pertaining to the following matters: a. Communications, records, documents, and other ?les involving Essential Consultants, Communications, records, documents, and other tiles-that) false representations to a ?nancial institution with relation to intended the purpose of an amount (Dr loan at that, financial institution; the nature of any business or entity associated with an I aecount a financial institution; the'sour'ce of funds flowing into anaCcount; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; Case Document 48-6 Filed 07/18/19 Page 55 of 80 Q's, Records of any funds or bene?ts received by or offered to Michael Dean Cohen by, or on behalf of, any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; Communications, records, documents, and other ?les that reveal efforts by Michael Dean Cohen to cenduct activities on behalf'of, for the bene?t of, or at the directien "of any foreign government, foreign of?cials, foreign entities, foreign persons, 0r foreign principals; Evidence indicating how and when the account was accessed or used, to determine to the crimes under investigation and to the account owner;- Evidence indicating the account owner?s state of mind as it relates to the crimes under investigation; - The identity of the person(s) who created or used the account, including records that help reveal the whereabouts of such and The identity of any records that help reveal the whereabouts of the communicated with the account about any matters relating to activities. conducted by Michael Dean Cohen on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals, Review Protocols Review of th'eitems described in Attachment A and Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner consistent with professional responsibility requirements concerning the maintenance of attorneyaclient and other operative privileges, When appropriate, the proCedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address- p?otential privileges. Case Document 48-6 Filed 07/18/19 Page 56 of 80 Exhibit Case Document 48-6 Filed 07/18/19 Page 57 of 80 A0 93 (Rev. Search and Seizure Warrant UNITED STATES DISTRICT COURT for the District of Columbia In the Matter ofthe Search of Case: Nani?00570 Assigned To Howell, Beryl A. Assign.? Date 8172017 i {Brie?y describe the property to be searched ASSOCIATED WITH THE APPLE ID i I Descriptioni Search and Seizure Warrant or idemy?ji the person by name and address) THAT is STORED AT PREMISES CONTROLLED BY APPLE, SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement of?cer An application by a federal iaw enforcement of?cer or an attorney for the government requests the search of the following person or property located in the District of . California {he person or describe the preperry to be searched and girls its locan'bn)! See Attachment A. i ?nd that the or any recorded testimony, establish probable cause to search and seiZe the person or property described abOVe, and that such search will reveai (identi?r the person or describe (be properly (a be seized}: See Attachment YOU ARE COMMANDED to execute this warrant on or before . . August 2:1. 2017 (not to exceed days) in the daytime 6:00 am. to 10:00 pm. at any time in the day or night because good cause has been established. Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the property was taken. . The of?cer executing this warrant, or an of?cer present during the execution of the warrant, must prepare an inventory as required by law and return this warrant and inventory to 7 Hon. Beryi A. Howell ?(Unir??b? States Magi'srrare Judge) [3 Pursuant to 18 U.S.C. 3103a(b), I ?nd that immediate notification may have an adverse result listed in 18 USS. 2705 (except for delay of trial), and authorize the of?cer executing this warrant to delay notice to the person who, or whose property. will be searched or seized (check (he apprapriale box} for days (not to exceed 30) until, the facts justifying, the later speci?c date of Date andtime issued: @f 733 .. @yfj? m?g? . Jndge ?s signalure City and state: Washington, DC Hon. Beryl A. Howell, Chief US. District Judge 7: Primed name and Iii/er tee Case Document 48-6 Filed 07/18/19 Page 58 of 80 A0 93 (Rev. llt13) Search and Seizure Warrant (Page 2) Return base Noni Date and tinie warrant executed-:- Copy of 'warrantand inventory le?r'With: Inventory made in of Inventory of the property taken and name oteny person(s) seized: 'Eer?ti?eetie?n- Date: I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the designated judge. Executing o?icer's signature Printed name and title Case Document 48-6 Filed 07/18/19 Page 59 of 80 ATTACHMENT A. This warrant applies to information ?associated with the Apple ID that is stored at premises owned, maintained, controlled, or operated by Apple, Inc. (?Apple?), a company headquartered at 1 In?nite Loop, Cupertino, CA 95014. Case Document 48-6 Filed 07/18/19 Page 60 of 80 1. ATTACHMENT Information to be disclosed by Apple, Inc. To the extent that theinformation described in Attachment A is within the possession, custody, or control of Apple, lnc. (hereinafter ?the Provider?), regardless of whether such information is stored, held or maintained inside or outside ofthe United States, and including any emails, records, files, logs, or information that have been deleted but are still available to the Provider, the Provider is required to disclose the following information to the government for each account or identi?er listed in Attachment A: a. The contents of all emails associated with the account, including stored or preserved copies of emails sent to and from the account, draft emails, the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email; All records or other information regarding the identi?cation of the account, to include full name, physical address, telephone numbers and other identi?ers, records of session timesand durations, the date on which the account was created, the length of service, the 1P address used to register the account, log-in lP addresses associated with session times and dates, account status, alternative email addresses provided during registration, methods of connecting, log files, and means and source of payment (including any credit or bank account number); The types of service utilized; All recordsior other information stored at any time by an individual using the account, including address books, contact and buddy lists, calendar data, pictures, and ?les; All records pertaining to communications between the Provider and any person regarding the account, including contacts with support services and records of actions taken; and other identifiers, records of session times and durations, the date on which the account was created, the length of service, the types of service utilized, the 1P address used to register the account, log?in lP addresses associated with session times and dates, account status, alternative e-_mail addresses provided Case Document 48-6 Filed 07/18/19 Page 61 of 80 during registration, all other user names associated with the account, all account names associated with the subscriber, methods of connecting; f. All search history or web history; All records indicating the services available to subscribers of the accounts; h. All usernames associated with or sharing a login IP address or browser cookie with the accounts; i. All cookies, including third?party cookies, associated with the user; j. All records that are associated with the machine cookies associated with the user; and R. All telephone or instrument numbers associated with the Account (including MAC II. addresses, Electronic Serial Numbers Mobile Electronic Identity Numbers Mobile Equipment Identi?er Mobile Identification Numbers Subscriber Identity Modules Mobile Subscriber Integrated Services Digital?Network Number International Mobile Subscriber Identi?ers or International Mobile Equipment Identities .. Information to be Seized by the Government All information described above in Section I that constitutes evidence, contraband, fruits, and/or instrumentalities of violations of 18 U.S.C. 1014 (false statements to a financial institution), [8 U.S.C. 1344 (bank fraud), 18 U.S.C. 1956 (money laundering), 18 U.S.C. ?95 1? (acting as an unregistered foreign agent), and 22 U.S.C. 611 at seq. (Foreign Agents Registration Act), involving Michael Dean Cohen and occurring on or afterJanuary I, 2016, including, for each account or identifier listed on Attachment A, information pertaining to the following matters: a. Communications, records, documents, and other ?les involving Essential Consultants, Communications, records, documents, and other ?les involving Bo and Abe Realty, Communications, records, documents, and other ?les that false representations to a ?nancial institution with relation to intended the purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an Case Document 48-6 Filed 07/18/19 Page 62 of 80 account a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; d. Records of any funds or bene?ts received by or offered to Michael Dean Cohen by, or on behalf of, any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals; e. Communications, records, documents, and other ?les that reveal efforts by Michael Dean Cohen to conduct activities on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign?principals; f. Evidence indicating how and when the account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating the account owner?s state of mind as it relates to the crimes under investigation; I h. The identity of the person(s) who created or used the account, including records that help reveal the whereabouts of such person(s); and i. The identity of any records that help reveal the whereabouts of the communicated with the account about any matters relating to activities conducted by Michael Dean Cohen on behalf of, for the bene?t of, or at the direction of any foreign government, foreign of?cials, foreign entities, foreign persons, or foreign principals. Case Document 48-6 Filed 07/18/19 Page 63 of 80 Exhibit Case Document 48-6 Filed 07/18/19 Page 64 of 80 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Information Associated With the Email Accounts @grnailcom, . _@gmail.com, and Maintained at Premises Controlled by Google, Inc., USAO Reference No. 201 SROO 127 SEARCH WARRANT AND ON-DISCLOSURE ORDER . TO: Goo gle, Inc. (?Provider?) United States Attorney?s Office for the Southern District of New York and the Federal Bureau of Investigation (collectively, the ?Investigative Agencies?) 1. Warrant. Upon an af?davit of Special Agent -of the United States Attorney?s O?ce for the Southern District of New York, and pursuant to the? provisions of the Stored Communications Act, 18 U.S.C. ?2703(b)(1)(A) and and the relevant provisions of Federal Rule of Criminal Procedure 41, the Court hereby finds there is probable cause to believe the email accounts -@gmail.com, -@grnail.com, and g. maintained at premises controlled by Google, Inc., contain evidence, fruits, and instrumentalities of crime, all as specified in Attachments A and hereto. Accordingly, . the Provider is hereby directed to provide to the Investigative Agencies, Within 7 days of the date of service of this Warrant and Order, the records specified in Section II of Attachments A and hereto, for subsequent review by law enforcement'personnel as authorized in Sections and IV of Attachments A and B. The Government is required to serve a copy of this Warrant and Order on the Provider Within 7 days of the date of issuance. The Warrant and Order may be served via Case Document 48-6 Filed 07/18/19 Page 65 of 80 electronic transmission or any other means through which the Provider is capable of accepting service. a 2. Non~Disclosure Order. Pursuant to 18 U.S.C. 2705(b), the Court ?nds that there is reason to believe that noti?cation of the existence of this warrant will result in destruction of or tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the eXistencepf scrib er ~orrtov any otherp'erson'vforap erio d7 of 180 days from the date of this Order, subject to extension upon application to the Court if necessary, except that Provider may disclose this Warrant and Order to an attorney for Provider for the purpose of receiving legal advice, 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon Which it was issued, be ?led under seal, except that the Government may without further order of this Court serve the Warrant and Order on the Provider; provide copies of the Af?davit or Warrant and Order as need be to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. Dated: New York, New York 4? 1f 11.: a; SI my; I 4 fl" Sid-3Bate Issued Time Issued isomers Gasman Chiernited States'Magistra?Le Judge Southern District oi New York 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 66 of 80 4 Email Search Attachment A I. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the ?Provider?), headquartered at 1600 Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other information within the Provider?s possession, custody, or control associated with the email account _@gmail.com' (the ?Subject Account?) for the time period referenced below. Arlaw~enforcement~ email: or?another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement officer an electronic copy of the information specified in Section l1 below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories specified in Section 111 below. I II. Information to be Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Account: I a. Email content. All emails sent to or from, stored in draft form in, or otherwise associated with the Subject Account, including all message content, attachments, and header . information (specifically including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email) limited to items sent, received, or created between November 14, 2017 and the date of this warrant, inclusive. b. Address book information. All address book, contact list, or similar information associated with the Subject Account. 0. Subscriber and payment information. All subscriber and payment information regarding the Subject Account, including but not limited to name, username, address, telephone Case Document 48-6 Filed 07/18/19 Page 67 of 80 number, alternate email addresses, registration address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Account, including any IP logs or other records of session times and durations, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. e. Customer correspondence. All correspondence with the subscriber or others associated and records of actions taken, limited to items sent, received, or created-between December 1, 2014 and the date of this warrant, inclusive. f. Search History. All search history and/or web history associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. g. Associated content. All Google Docs, tiles, maintained on Google Drive,and instant messages or Gchats associated with the Subject Account, limited to items sent, received, or created between December 1, 2014 and the date of this warrant, inclusive. Preserved or backup records. Any preserved or baclcup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 18 use. 2793(1) or otherwise. 111. Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, .attomeys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under government control) are authorized to review the records produced by the Provider in order to locate any evidence, ?uits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud 2 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 68 of 80 the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (Wire fraud), and 1344 (bank fraud), including the following: a. Con?ununications, records, documents, and other files necessary to establish the identity of the person(s) who created or used the Subject Account; I b. Communications, records, documents, and other ?les involving Sterling National Bank, Melrose Credit Union, and/or taxi medallions; agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to -and/or entities associated with him; I d. Communications, records, documents, and other ?les involving Essential Consultants, LLC or Michael D. Cohen Associates, including those which indicate the nature and purpose of payments made to'or from Essential Consultants or Michael D. Cohen Associates, e. Communications, records, documents, and other files necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who communicated With the Subject Account about any matters relating to Essential Consultants, LLC, . or about any plan or proposal oragreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to _1Ild/ or entities associated with him; i Communications between the Subject Account and Jersey Getzel relating to Michael D. Cohen?s bank accounts, taxes, debts, and] or ?nances; g. Communications, records, documents, and other ?les re?ecting false representations .to a financial institution with relation to the intended purpose of an account or loan at that financial 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 69 of 80 institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; h. Evidence indicating how and when the Subject Account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under mvestigation and to the account owner; and 1. b?v1dence indicating th?SnbjEtiAccount?owner?s intent as i?elatesvtovthevSubj'e?ctr" Offenses under investigation. IV. Re?ew Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect anyattorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart ??orn the investigative team, in order to address potential privileges. 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 70 of 80 Email Search Attachment I. Subject Account and Execution of Warrant This warrant is directed to Google, Inc. (the ?Provider?), headquartered at 1600 i Amphitheatre Parkway, Mountain View, California 94043, and applies to all content and other information within the Provider?s ossession, custod or control associated with the email accounts -gmail.com and?(the ?Subject Accounts?) for the time A law enforcement of?cer will serve this warrant by transmitting it Via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement officer an electronic copy of the information specified in Section Ii below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories specified in Section below. II. Information to be Produced by the Provider To the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Accounts: a. Email content. All emails sent to or from, stored in dra? form in, or otherwise associated with the Subject Accounts, sincluding all message content, attachments, and header information (speci?cally including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email). b. Address book information. All address book, contact list, or similar information associated with the Subject Accounts. 0. Subscriber and payment information. All subscriber and payment information regarding the Subject Accounts, including but not limited to name, username, address, telephone Case Document 48-6 Filed 07/18/19 Page 71 of 80 number, alternate email addresses, registration IP address, account creation date, account status, length of service, type-s of services utilized, means and source of payment, and payment history, d. Transactional records. All transactional records associated with the Subject Accounts, including any IP logs or other records ofsession times and durations. e. I Customer correspondence. A11 correspondence with the subscriber or others associated with the Subject Accounts, including complaints, inquiries, or other contacts with support services f. Search History. All search history and/or web history associated with the Subject Accounts. g. Associated content. All Goo gle Docs, files maintained on Google Drive, and instant messages or Gchats associated with the Subject Accounts. h. Preserved or backup re cords. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation request issued pursuant to 18 U.S.C. 2703(f) or otherwise. Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside te chnical, experts under government control). are authorized to review the records produced by the Provider in order to locate any evidence,fruits, and instrumentalities of violations of .1 8 US . C. 371 (conspiracy to commit offense or to defraud the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire ?aud), and 1344 (bank including the following: a. Communications, records, documents, and other files necessary to establish the identity of the person(s) who created or used the Subject Accounts; 2 02.23.2013 Case Document 48-6' Filed 07/18/19 Page 72 of 80 b. Communications, records, documents, and other ?les involving a plan or proposal or agreement for Michael Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to and/or entities associated with him; A c. Cormnunications, records, documents, and other ?les necessary to establish the identity of any person(s) including records that reveal the whereabouts of the person(s) who oreproposaleor agreement for Michael D. Cohen and/ or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to _and/ or entities associated d. Communications between the Subject Accounts and others, including employees or representatives of Sterling National Bank, Melrose Credit Union, or other ?nancial institution(s), regarding Michael D. Cohen?s ?nances; e. Communications, records, documents, and other files re?ecting false representations to a ?nancial institution with relation to the intended purpose of an account or loan at that financial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; f. Evidence indicating how and when the Subject Accounts was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; g. Evidence indicating the Subject Accounts owners? intent as it relates to the Subject Offenses under investigation. 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 73 of 80 IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney?client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart from the investigative team, in order to address potential privileges. 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 74 of 80 Exhibit Case Document 48-6 Filed 07/18/19 Page 75 of 80 is are res UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In the Matter of a Warrant for All Content and Other Information Associated with the Email Account maintained at Premises Controlled by 1 85 1 Internet, Inc., USAO Reference NoInternet, Inc. (?Provider?) United States Attorney?s O?ce for the Southern District of New York and the Federal Bureau of Investigation (collectively, the ?Investigative Agencies?), 1. Warrant. Upon an af?davit of Special Agents-of the United States Attorney?s Office for the Southern District of New York, and pursuantto the provisions of the Stored Communications Act, 18 U.S.C. and and the relevant provisions of Federal Rule of Criminal Procedure 41, the Court hereby ?nds there is probable cause to believe the email account-?naintained at premises controlled by 1 85 1 Internet, Inc, contains evidence, fruits, and instrumentalities of crime, all as speci?ed in Attachment hereto; Accordingly, the Provider is hereby directed to provide to the hlvestigative Agencies, Within 7 days. of the date of service of this Warrant and Order, the records speCi?ed in Section II of Attachment hereto, for subsequent review by law enforcement personnel as . authorized in Sections and IV of Attachment D. The Government is required to serve a copy of this Warrant and Order on the Provider Within 14 days of the date of issuance. The Warrant and Order may be served via electronic transmission or any other means through which the Provider is capable of accepting service. Case Document48?6 Filed 07/18/19 Page 76 of 80 2. Oil-Disclosure Order. Pursuant to 18 U.S.C. 2705(b), the Court ?nds that there is reason to believe that noti?cation of the existence of this warrant will result in destruction of or tampering with evidence or ?ight from prosecution, or otherwise will seriously jeopardize an ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the existence of this Warrant and Order to the listed subscriber or to any other person for a period of 180 days from the date. of this Order, subject to extension upon application to the Court if for the purpose of receiving legal adviCe. 3. Sealing. It is further ordered that this Warrant and Order, and the Af?davit upon which it was issued, be ?led under seal, except that the Government may without further order of this Court serve the War-rant and Order on the Provider; provide copies of the Af?davit or Warrant and Order as need be to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure . obligations in any prosecutions related to this matter. Dated: New York, New York Date-Issued Time Issued United States 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 77 of 80 Email SearchAttachment I. Subject Account and Execution of Warrant This warrant is directed to 1 1 Internet, Inc. (the ?Provider?), headquartered at 701 Lee Road, Suite 300, Chesterbrook, 19087, and applies to all content and other information within the Provider? possession, custody, or control associated with the email account -- (the ?Subject Account?) for the time period between November 14, 2017 -. A law enforcement of?cer will serve this warrant by transmitting it via email or another appropriate manner to the Provider. The Provider is directed to produce to the law enforcement I officer an electronic copy of the information speci?ed in SectiOn 11 below. Upon receipt of the production, law enforcement personnel will review the information for items falling within the categories speci?ed in Section below. II. Information to be Produced by the Provider To?the extent within the Provider?s possession, custody, or control, the Provider is directed to produce the following information associated with the Subject Account; 3.. Email content. All emails Sent to or from, stored in draft form in, or otherwise associated with the Subject Account, including all message content, attachments, and header information (specifically including the source and destination addresses associated with each email, the date and time at which each email was sent, and the size and length of each email). b. Address book information. All address book, contact list, or similar information associated with the Subject Account. o. Subscriber and payment information. All subscriber ?and payment information regarding the Subject Account, including but not limited to name, username, address, telephone Case Document 48-6 Filed 07/18/191 Page 78 of 80 number, alternate email addresses, registration IP address, account creation date, account status, length of service, types of services utilized, means and source of payment, and payment history. d. Transactional records. All transactional records associated with the Subject Account, including any IP logs or other records of session times and durations. 6. Customer correspondence. All correspondence withthe subscriber or others associated with the Subject Account, including complaints, inquiries, or other contacts with support services andrecords?ofa'cti'onstaken. f. Preserved or backup records. Any preserved or backup copies of any of the foregoing categories of records, whether created in response to a preservation reuuest issued pursuant to 18 U.S.C. 2703(f) or otherwise. Ill Review of Information by the Government Law enforcement personnel (who may include, in addition to law enforcement of?cers and agents, attorneys for the government, attorney support staff, agency personnel assisting the government in this investigation, and outside technical experts under goverrnnent control) are authorized to review the records produced by the Provider in order to locate any evidence, fruits, and instrumentalities of violations of 18 USC. 371 (conspiracy to commit offense or to de?aud the United States), 1005 (false bank entries); 1014 (false statements to a ?nancial institution), 1343 (wire fraud), and 1344 (bank fraud), including the following: a. Communications, records, documents, and other files'necessary to establish the identity of the person(s) who created or used the Subject Account; b. Communications, records, documents, and other ??les' involving Sterling National Bank, 'Melrose Credit Union, and/or taxi medallions; I 0. Communications, records, documents, and other files involving a plan, proposal, or agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 2 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 79 of 80 medallions, and any associated debts or liabilities, to others, including to -i'nd/ or entities associated with him; d. Communications, records, documents, and other ?les involving Essential Consultants, LLC or Michael D. Cohen 85 Associates, including those which indicate the nature and purpose of payments made to or from Essential Consultants or Michael D. Cohen Associates; e. The identity of anylperson(s) including records that reveal the whereabouts of the Consultants, LLC, or about any plan or proposal or agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi medallions, and any associated debts or liabilities, to others, including to _and/or entities associated with him; f. Communications between the Subject Account and Jeffrey Getzel relating to Michael D. Cohen?s bank accounts, taxes, debts, and/or ?nances; g. Communications, records, documents, and other ?les re?ecting false representations to a ?nancial institution with'relation to the intended purpose of an account or loan at that ?nancial institution; the nature of any business or entity associated with an account at a ?nancial institution; the source of funds ?owing into an account; or the purpose or nature of any ?nancial transactions involving that ?nancial institution; h. Evidence indicating how and when the Subject Account was accessed or used, to determine the geographic and chronological context of account access, use, and events relating to the crimes under investigation and to the account owner; and i. Evidence indicating the Subject Account owner?s intent as it relates to the Subject Offenses under investigation. 02.28.2018 Case Document 48-6 Filed 07/18/19 Page 80 of 80 IV. Review Protocols Review of the items described in this Attachment shall be conducted pursuant to established procedures designed to collect evidence in a manner reasonably designed to protect any attorney~client or other applicable privilege. When appropriate, the procedures shall include use of a designated ??lter team,? separate and apart fromthe investigative team, in order to address potential privileges. 02.28.2018 Case Document 48-7 Filed 07/18/19 Page 1 of 38 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In re: Warrant and Order For Prospective and Historical Location Information and WARRANT AND ORDER Pen Register Information for the Cellphones Assigned Call Numbers and 18 Mag. USAO Reference No. 2018R00127 Warrant and Order for Cellphone Location Information and Pen Register Information "and for Sealing andNon?Disclosure TO: (?Service Provider?), and any subsequent provider of service to the Target Cellphones speci?ed below (?Subsequent Service Provider?) United States Attorney?s Of?ce and Federal Bureau of Investigation (?Investigative Agencies?) Upon the Application and Agent Af?davit submitted by the Government in this matter: 1. Findings The Court hereby ?nds: l. The Target Cellphones (the ?Target Cellphones?) that are the subject of this Order are assigned call numbers and_, are subscribed to in the name of Michael Cohen (the ?Sub scriber?) and are currently serviced by the Service Provider. 2. Pursuant to 18 U.S.C. 2703(c)(1)(A) and the applicable provisions of Rule 41 of the Federal Rules of Criminal Procedure, the Government?s application sets forth probable cause to believe that the prospective and historical location information for the Target Cellphone will reveal evidence, fruits, or instrumentalities of suspected violations of 52 U.S.C. 30116(a)(l)(A) and 30109(d)(1)(A)(1) (?the subject Offense?). Pursuant to 18 U.S.C. 2703(d), the Government?s application also sets forth speci?c and articulable facts showing that there are reasonable grounds to believe that the historical Case 1:18-cr-p00602-WHP Document 48-7 Filed 07/18/19 Page 2 of 38 location information anditoll records for the Target Cellphone are relevant and material to an ongoing criminal investigation. 4. Pursuant to 18 U.S.C. 3123(b)(l), the Government has certi?ed that the pen register information-for the Target Cellphones is relevant to an ongoing investigation by the Investigating Agencies of Michael Cohen and others unknown in connection with suspected violations of the Subject Offense. 5. Pursuant to 18 U.S.C. 2705(b), there is reason to believe that noti?cation of the existence of this Warrant and Order will result in destruction of or tampering with evidence, danger to the physical safety of an individual, ?ight from prosecution, and/or intimidation of potential witnesses, or otherwise will seriously jeopardize an ongoing investigation. NOW, THEREFORE, pursuant to Fed.- R. Crim. P. 41, 18 U.S.C. 3121 et sea, 18 U.S.C. 2701 et seq, and 18 U.S.C. 3103a, IT IS HEREBY ORDERED: II. Order to Service Provider 6. Service Provider. This Order shall apply to the Service Provider speci?ed above, and to any subsequent provider of service to the Target Cellphones without need for further Order of this Court. 7. Prospective Location Information. The Service Provider shall provide to the Investigating Agencies on a prospective basis, for a period of 45 days from the date of this Order (or the date that the Target Cellphones are seized, whichever Comes ?rst), information concerning the location of the Target Cellphones (?Prospective Location Information?), including all available: a. precision location information, including GPS data, E-911 Phase II data, and latitude-longitude data; and 2017.02.09 Case Document 48-7 Filed 07/18/19 Page 3 of 38 b. cell site data, including any data re?ecting the cell towers and sectors thereof utilized in routing any phone, text, or data communication to or from the Target Cellphones, and the approximate range of the target phone from the cell towers during the communication (including per?call measurement or round-trip time or data); 8. Historical Location Information and Records. The Service Provider shall provide to the Investigating Agency all available historical cell site location information reflecting the cell towers and sectors thereof utilized in routing any phone, text, or data communication to or from the Target Cellphones, and the approximate range of the target phone from the cell towers I during the communication or NELOS data), for the period from October 1, 2016 -- as well as all available toll records (including call detail, SMS detail, 02ft)?: . . . . . 34M or data sessmn detail records) for the commumcations. I L013 1 9. Pen register with caller identi?cation and/or trap and trace device. The Service 7% (?Mod Provider shall provide to the Investigating Agencies, for a period of 60 days from the date of this order (or the date that the Target Cellphones are seized, whichever comes ?rst), all dialing, routing, addressing, or signaling information associated with each voice, text, or data communication transmitted to or from the Target Cellphones, including but not limited to: a. any unique identi?ers associated with the phone, including ESN, MEIN, MSISDN, IMSI, IMEI, SIM, MIN, or MAC address; b. source and destination telephone numbers and] or Internet protocol addresses; 1 1 The Service Provider is not required to provide post?cut?through dialed digits or digits that are dialed after a telephone call from the Target Phone has been connected. If possible, the Service Provider will forward only pre-cut?through?dialed digits to the Investigative Agency. However, if the Service Provider?s technical capabilities require it to forward all dialed digits, including to the Investigative Agency, the Investigative Agency will only decode and 3 20170209 Case Document 48-7 Filed 07/18/19 Page 4 of 38 0. date, time, and duration of the communication; and d. cell-site information as speci?ed above. 10. Technical Assistance. The Service Provider shall furnish the lnvesti gating Agency all information, facilities, and technical assistance necessary to accomplish the disclosure of all of the foregoing information relating to the Target Cellphones unobtrusively and with the minimum interference to the service presently provided to the Subscriber. 11. Non-Disclosure to Subscriber. The Service Provider, including its affiliates, of?cers, employees, and agents, shall not disclose the existence of this Warrant and Order, or the underlying investigation, to the Subscriber or any other person, for a period of 180 days from the date of this Warrant and Order, subject to extension upon application to the Court, if necessary. Additional Provisions 12. Compensation for Costs. The Investigating Agency shall compensate the Service Provider for reasonable expenses incurred in complying with the Warrant and this Order. 13. Sealing. This Warrant and Order, and the supporting Application and Agent Af?davit, shall be sealed until otherwise ordered by the Court, except that the Government may Without further order of this Court: serve this Warrant and Order on the Service Provider; provide'copies of the Warrant and Order or the supporting Application and Agent Af?davit as need be to forward to the agents assigned to the investigation, the numbers that are dialed before the call is cut through. 4 2017.02.09 Case Document 48-7 Filed 07/18/19 Page 5 of 38 personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. Dated: New York, New York 9/3? In; ,157/37 Date Issued Time Issued 3.: r" Ix} 2017.02.09 SouthenrDi?stijict of New York Case Document 48-7 Filed 07/18/19 Page 6 of 38 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In re: Warrant and Order For Prospective and Historical Location APPLICATION Information and Pen Register: Information for the Cellphones; 18 Mag. Assigned Call Numbers and USAO Reference - N0. 2018R00127 Application for Warrant and Order for Cellphone Location and Pen Register Information The United States of America, by its attorney, Robert Khuzami, Attorney for the United States Acting Under Authority Conferred by 28 U.S.C. 515, Assistant United States Attorney, of counsel, respectfully requests that the Court issue the accompanying proposed Warrants and Orders for prospective and historical location information and pen register information for two cellphones (the ?Target Cellphones?). As grounds for this Application the Government relies on the following facts and authorities. I. Introduction 1. I am an Assistant United States Attorney in the U. S. Attorney?s Of?ce for the Southern District of New York. This Application is submitted in conjunction with the accompanying af?davit of a law enforcement agent (?Agent Affidavit?), to be sworn before this Court, and incorporated by reference herein. I make this Application based on information and belief, including the Agent Affidavit, my review of other documents in the case, and information received from investigative personnel. Case Document 48-7 Filed 07/18/19 Page 7 of 38 2. The Investigating Agency, Target Cellphones, Subscriber, Target Subject(s), Service Provider, Subject Offenses, Successor Service Provider, and Successor Cellphones referenced in this Application are as speci?ed in the Agent Af?davit. II. Legal Authority A. Prospective Location Information 3. The Government seeks to obtain both precision location information and cell site data for the Target Cellphones on a prospective basis (the ?Prospective Location Information?) for a I period of 45 days fronithe_date of this order; themsame period of time forwhich a warrant for a tracking device may be granted under Rule It bears noting, however, that while the Prospective Location Information may permit ?tracking? the user of the phone in the colloquial sense, this is not an application for a warrant for a ?tracking device? as de?ned in Fed. R. Crim. P. and 18 U.S.C. 3117(b). Those provisions only apply where an agent is seeking to physically install a tracking device on a given object. Instead, the Prospective Location Information will be obtained by requiring the Service Provider to provide the information. 4. The authority for. this application is found.in.1.8 U.S.C. which authorizes .. a court of competent jurisdiction to require any electronic communication service provider (which includes a cellular telephone service providerl) to disclose any ?record or other information pertaining to a subscriber? other than the ?contents of communications,? when the government obtains, inter alia, a warrant under the procedures of Rule 41. See 18 U.S.C. 1 See 18 U.S.C. 2711(1) (incorporating by cross?reference statutory de?nitions set forth in 18 U.S.C. 2510); 18 U.S.C. 2510(15) (de?ning ?electronic communication service? as ?any service which provides to users thereof the ability .to send or receive wire or electronic communications?). 2 Another provision of 18 U.S.C. 2703(c)(1), speci?cally, 2703(c)(1)(B), enables the Government to compel an electronic communication service provider to disclose non?content information pertaining to a subscriber by obtaining an order issued under 18 U.S.C. 2703(d), 1 2017.02.09 Case Document 48-7 Filed 07/18/19 Page 8 of 38 Because data concerning a subscriber?s location, such as precision location information and cell site data, constitutes ?information pertaining to a subscriber? that does not include the ?contents of communications,? that data is among the types of information available under 1? 2703 Further, as speci?ed in 18 U.S.C. 2711(3), this Court is a court of competent jurisdiction under the Stored Communications Act because it has jurisdiction over the Subject Offenses. 5. The Government?s request for cell site data also implicates the pen register statute, because such data constitutes signaling information used by the Service Provider to route communications to and from the Target Cellphones. In order to collect such data, a valid pen register order is required.4 Accordingly, I hereby certify pursuant to 18 U.S.C. 3122 that such instead of a warrant. Rather than requiring a showing of probable cause, a 2703(d) order requires only a showing that there are reasonable grounds to believe that the information sought is relevant and material to an ongoing criminal investigation. However, given that continued monitoring of an individual?s speci?c location through precision location information arguably implicates Fourth Amendment interests, see United States v. Jones, 565 US. 400, 418 (2012) (Alito, ., concurring in the judgment), the Government. here. Location Informationsought . herein by a 2703 warrant rather?than a 2703(d) order. 3 See In re Application, 460 F. Supp. 2d 448, 459?60 n. 55 (S.D.N.Y. 2006) (Kaplan, J.) (cellphone location information falls within 2703 accord, e. g. United States v. Caraballo, 963 F. Supp. 2d 341, 361 2013); In re Order, 632 F. Supp. 2d 202, 207 (E.D.N.Y. 2008); In re Application, 405 F. Supp. 2d 435, 444?45 (S.D.N.Y. 2005). But see In re Application, 849 F. Supp. 2d 526, 574 201 1) (rejecting view that cellular location data falls within the scope of the SCA and ?nding that phone must be treated as ?tracking device? for purposes of Rule 41 where used to collect location data); In re Application, 2009 WL 159187, at (S.D.N.Y. an.13, 2009) (McMahon, J.) (same). . 4 See 18 U.S.C. 3121 (prohibiting use of pen register or trap and trace device without an order under the pen register statute); 3127(3) (4) (de?ning pen register and trap and trace device to include devices or processes that record, inter alia, signaling information). Although cell site data constitutes ?signaling? information within the meaning of the pen register statute, a separate statute precludes the Government from relying ?solely? on the authority provided by the pen register statute to ascertain: a subscriber?s location. 47 U.S.C. 1002(a). Here, the Government seeks to obtain such data pursuant to 18 U.S.C. 2703(c) as well as the pen register statute, rather than ?solely? under the latter statute. See In re Application, 460 F. Supp. 2d at 456559. 2 2017.02.09 Case Document 48-7 Filed 07/18/19 Page 9 of 38 signaling information is relevant to an ongoing investigation being conducted by the Investigating Agency into suspected violatiOns of the Subject Offenses by the Target Subject(s). B. Historical Location Information 6. The Government also seeks historical cell site data for the Target Cellphones for the (21.0 16 Us,? ll 20 l% period from October 1, 2016 to the?present (the ?Historical Location Information?). Because such data constitutes non?content information concerning a subscriber, the Court is authorized to order the Service Provider to provide this data pursuant to a warrant application under 18 U.S.C. 2703(c)or an application-?form order under- 18 U.S.C. 2703(d). Pursuant to 18 U.S.C. 2703 I respectfully submit that the Agent Af?davit offers speci?c and articulable facts showing that there are reasonable grounds to believe that the Historical Location Information is relevant and material to an ongoing criminal investigation. Further, although a warrant for the Historical Location Information is not required, I respectfully submit that the same probable cause supporting the Government?s request for a warrant to obtain the Prospective Location Information requested above also supports the issuance of a warrant under 2703(c) for the Historical Location Information.5 In addition, the Government seeks toll records for the same 5 A warrant is not required to obtain historical cell site information. Individuals do not have a reasonable expectation of privacy in historical cell site information because individuals voluntarily convey that information to third-party service providers. See United States v. Graham, 824 F.3d 421, 424-25 (4th Cir. 2016) (en banc); United States v. Davis, 785 F.3d 498, 511?13 (11th Cir. 2015) (en banc), cert. denied, 136 S. Ct. 479 (2015); In re Application of US. for Historical Cell Site Data, 724 F.3d 600, 614-15 (5th Cir. 2013); United States v. Guerrero, 768 F.3d 351, 358?59 (5th Cir. 2014); see also United States v. Pascual, 502 F. App?X 75, 80 n.6 (2d Cir. 2012), cert. denied, 134 S. Ct. 231 (2013) (?general principles? of third?party doctrine ?point[ toward this conclusion regarding cell-site records); but see United States v. Ulbricht, 858 F.3d 71, 97 n.29 (2d Cir. 2017) (declining to express its view as to whether the Fourth Amendment applies to historical cell site location information). Moreover, because historical cell site information does not enable law enforcement to conduct live menitoring of a person?s location within private spaces such as ?the interior of the [person?s] home,? it is not comparable to prospective precision location information, for which a warrant is arguably required. See In re Application of US. for Order Directing Provider of Elec. Commc ?n Serv. to Disclose Records to Gov 620 F.3d 304, 312?15 (3d Cir. 2010). Nevertheless, because the Supreme Court has recently granted certiorari to review 3 2017.02.09 Case Document 48-7 Filed 07/18/19 Page 10 of 38. period as the Historical Location Information is requested, which the Government is also authorized to obtain pursuant to 18 U.S.C. ?2703(d). C. Pen Register Information 7. Finally, the Government seeks an order pursuant to 18 U.S.C. 3121?26 authorizing the use of a pen register on the Target Cellphones for a period of 60 days from the date of this order (or the date that the Target CellphOnes are seized, whichever comes ?rst). Speci?cally, the Government seeks an order directing the Service Provider to furnish any information, facilities, and technical assistance necessary-Ito Ioperate, unobtrusively and with minimum disruption of service, a pen register and trap and trace device to capture all dialing, routing, addressing, or signaling'inforrnation associated with each call transmitted to or from the Target Cellphones, as speci?ed further in the proposed Warrant and Order (the ?Pen Register 8. I hereby certify pursuant to 18 U.S.C. 3122 that the Pen Register Information is relevant to an ongoing investigation being conducted by the Investigating Agency into suspected violations of the Subject Offenses by the Target Subject(s). the Sixth Circuit?s decision in United States v. Carpenter, 819 F.3d 880, 887?90 (6th Cir. 2016) (holding Government?s collection of business records containing historical cell site data did not constitute Search under Fourth Amendment), cert. granted, 137 S. Ct. 2211 (June 5, 2017) 16?402), the Government, in an abundance of caution, requests a warrant under 18 U.S.C. 2703 upon articulation of probable cause as set forth in the Agent Af?davit. 6 The Government is also not seeking authorization to obtain post-cut-through dialed digits or digits that are dialed after a telephone call from the Target Phone has been connected. Pursuant to the attached Order, if possible, the Provider will forward only pre-cut? through-dialed digits to the Investigating Agency. However, if the Provider?s technical capabilities require 'it to forward all dialed digits, including to the Investigating Agency, the Investigating Agency will only decode and forward to the agents assigned to the investigation the numbers that are dialed before the call is cut through. 4 2017.02.09 Case Document 48-? Filed 07/18/19 Page 11 of 38 D. Sealing and Non?Disclosure Order to Service Provider 9. When the Government obtains records or information under 27 03(c), it is not required to notify the subscriber or customer. 18 U.S.C. 2703(c)(3). Additionally, the Government may obtain an order precluding the Provider from notifying the subscriber or any other third-party of the warrant or order obtained, for such period as the Court deems appropriate, where there is reason to believe that such noti?cation will result in endangering the life or physical safety of an individual, ?ight from prosecution, destruction of or tampering with evidence, or intimidation of potential witnesses, or will otherwise seriouslyj eopardize the investigation. 18 U.S.C. 2705 10. Further, l8 U.S.C. 3123(d) provides that an order directing installation of a pen register or trap and trace device shall direct the pertinent service provider ?not to disclose the existence of the pen register or trap and trace device or the existence of the investigation to the listed subscriber, or to any other person unless or until otherwise ordered by the Court.? 11. Accordingly, as explained further in the Agent Af?davit, in light of the confidential nature of the continuing criminal investigation and the adverSe consequences expected in the event of prematurenotification, the Government respectfully requests that the Court direct the Service Provider not to notify the Subscriber or any other person of the Warrant and Order sought herein for a period of 180 days, subject to extension upon application to the Court, if necessary. 12. For similar reasons, I respectfully request that the proposed Warrant and Order, this Application, and the accompanying Agent Affidavit, be maintained under seal until the Court orders otherwise, except that the Government be pennitted without further order of this Court to serve this Warrant and Order on the Service Provider; provide copies of the Warrant and Order or the supporting Application and Agent Af?davit as need be to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. 5 2017.02.09 Case Document 48-7 Filed 07/18/19 Page 12 of 38 Prior Requests 14. Except as may be set forth above, no prior request for the relief requested herein has been made. Dated: New York, New York April 7, 2018 Assistant United States Attorney Tel.: (212) 637?: 2017.02.09 Case Document 48-7 Filed 07/18/19 Page 13 of 38 UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF NEW YORK In re: Warrant and Order For Prospective and Historical Location Information and AGENT AFFIDAVIT Pen Register Information for the Cellphones Assigned Call Numbers and 18 Mag. . USAO Reference No. 2018R00127 Agent Af?davit in Support of Warrant and Order for Cellphone Location and Pen Register Information STATE OF NEW YORK ss. COUNTY OF NEW YORK Special Agent? of the United States Attorney?s Of?ce for the Southern District of New York, being duly sworn, deposes and states: I. Introduction 1. I am a Special Agent with the United States Attorney?s Office for the Southern District of New York (?Investigating Agency?). As such, I am a ?federal law enforcement officer? within the meaning of Federal Rule of Criminal Procedure that is, a government agent engaged in enforcing the criminal laws and duly authorized by the Attorney General to request a search warrant. I have been a Special Agent with the USAO since August 2016. I previously served as a Special Agent with the United States Department of Labor Inspector General from May. 2011 to August 2016. In the course of my experience and training in these positions, I have participated in numerous investigations involving the use of cellphone location data. 2. Requested Information. I respectfully submit this Affidavit pursuant to 18 U.S.C. 2703(0) and and the applicable procedures of Federal Rule of Criminal Procedure 41; 18 U.S.C. 2703(d) 2705; and 18 U.S.C. 3121?3126, in support ofa warrant and order for prospective location information, historical location information, toll records, and pen register Case Document 48-7 Filed 07/18/19 Page 14 of 38 information, for the Target Cellphones identi?ed below (collectively, the ?Requested Information?). 3. Basis for Knowledge. This Af?davit is based upon my participation in the investigation, my examination of reports and records, and my conversations with other law enforcement agents and other individuals, as well as my training and experience. Because this Af?davit is being submitted for the limited purpose of obtaining the Requested Information, it does not include all the facts that have learned during the course of this investigation. Where the contents of documents and the actions, statements, and conversations of others are reported herein, they are reported in substance and in part, except where otherwise indicated. In addition, unless otherwise indicated, statements by others referenced in this Af?davit were not necessarily made to me, but may have been provided to me by someone else to whom lhave spoken or whose report have read (and who in turn may have had either direct or indirect knowledge of the statement). Similarly, unless otherwise indicated, information in this Af?davit resulting from surveillance does not necessarily set forth my personal observations, but may have been provided to me by other law enforcement agents who observed the events, and to whom I have spoken or whose report I have read. 4. Target Cellphones, Subscriber, Target Subject, and Service Provider. The Target Cellphones referenced in this Af?davit are the cellphones assigned call numbers and_. As further discussed below, the Target Cellphones are subscribed to in the name of Michael Cohen (the ?Subscriber?). The subscriber is believed to use the Target Cellphones and is a Target Subject of this investigation. is the Service Provider for the Target Cellphones. 2018-04-07017.02.09 Case Document 48-7 Filed 07/18/19 Page 15 of 38 5. Precision Location Capability. Cellphone service providers have technical capabilities that allow them to collect at least two kinds of information about the locations of the cellphones to which they provide service: precision location information, also known as E-91 1 Phase II data, GPS data, or latitude?longitude data, and cell site data, also known as ?tower/face? or ?tower/sector? information. Precision location information provides relatively precise location information about a cellphone, which a provider can typically collect either via GPS tracking technology built into the phone or by triangulating the device?s signal as received by the provider?s nearby cell towers. Cell site data, by contrast, re?ects only the cell tower and sector thereof utilized in routing any communication to and from the cellphone, as well as the approximate range of the cellphone from the tower during the communication (sometimes referred to as ?per~call measurement? or ?round?trip time? or data). Because cell towers are often a half?mile or more apart, even in urban areas, and can be ten or more miles apart inrural areas, cell site data is typically less precise than precision location information. Based on my training and experience, I know that the Service Provider has the technical ability to collect precision location information from any cellphone on its network, including by initiating a signal on the Service Provider?s network to determine the phone?s location. I further know that cell site data is routinely collected by the Service Provider in the course of routing calls placed to or from any cellphone on its network.1 6. Successor Service Provider. Because it is possible that the Target Subject may change cellphone service provider during the course of this investigation, it is requested that the warrant 1 Toll records are sometimes necessary or helpful in order to obtain or interpret historical cell site data and are therefore also requested herein. Case Document 48-7 Filed 07/18/19 Page 16 of 38 and investigative order requested apply without need for further order to any Successor Service Provider who may prOvide service to the Target Cellphones during the time frames at issue herein. II. Facts Establishing Probable Cause 7. Although I understand that probable cause is not necessary to obtain all of the Requested Information, I respectfully submit that probable cause exists to believe that the Requested Information will lead to evidence of the crime of 52 U.S.C. 30116(a)(1)(A) and 30109(d)(l)(A)(1) (illegal campaign contributions) (the ?Subject Offense?), as well as the location I of the Target subject who-is engaged in the Subject Diff-ense. Introduction 8. The USAO and the Federal Bureau of Investigation (the are investigating a criminal violation of the campaign ?nance laws by Michael Cohen, a lawyer who holds himself out as the personal attorney for President Donald J. Trump. As detailed below, there is probable cause to believe that Cohen made an excessive in?kind contribution to the presidential election campaign of then?candidate Donald Trump in the form of a $130,000 payment to Stephanie Clifford, an individual who was rumored to have had an extramarital affair with Trump, in exchange for her agreement not to disclose that alleged affair on the eve of the 2016 presidential election. Prior Relevant Process 9. In connection with an investigation then being conducted by the Of?ce of the Special Counsel the FBI sought and obtained from the Honorable Beryl A. Howell, Chief United States District Judge for the District of Columbia, three search warrants for emails and other content information associated with two email accounts used by Cohen, and one search warrant for stored content associated with an iCloud account used by Cohen. Speci?cally: Case Document 48-7 Filed 07/18/19 Page 17 of 38 a. On or about July 18, 2017, the FBI sought and obtained a search warrant for emails in the account -@gmai1.com (the ?Cohen Gmail Account?) sent or received between January 1, 2016 and July 18, 2017 (the ?First Cohen Gmail Warrant?). b. On or about August 8, 2017, the FBI sought and obtained a search warrant for content stored in the iCloud account associated with Apple ID (the ?Cohen iCloud Account? and the ?Cohen iCloud Warrant?). c. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the Cohen Gmail Account sent or received between June 1, 2015 and November13, 2017 (the ?Second Cohen Gmail Warrant?). d. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the account ?_:the ?Cohen Account?) sent or received between the opening of the Cohen Account2 and November 13, 2017 (the ?First Cohen Warrant?). 10. The SCO has since referred certain aspects of its investigation into Cohen to the which is working with the New York Field Of?ce. 11. On or about February 28, 2018, the USAO sought and obtained Search warrants for emails in Cohen Gmail Account and Cohen Account, among other accounts, sent or received between November 14, 2017 and February 28, 2018 (the ?Third Cohen Gmail Warrant? and ?Second Cohen Warrant?). 2 Based on my review of this warrant and the af?davit in support of it, I know that the warrant did not specify a time period, but the af?davit indicated that, pursuant to court order, the service provider had provided non?content information for the Cohen Account that indicated that the account contained emails from the approximate period of March 2017 through the date of the warrant. . 2018?04?07017.02.09 Case Document 48-7 Filed 07/18/19 Page 18 of 38 12. The above?described warrants are referred to herein as the ?Cohen Emails Warrants? and, with respect to the iCloud Warrant, the ?Cohen iCloud Warrant.? The Illegal Campaign Contribution Scheme 13. From my review of public sources, I have learned the following: a. In or around October 2011, there were rumors published on the gossip website TheDirty. com that Trump had had an extramarital affair with Clifford, an adult ?lm actress whose screen name is Stormy Daniels, in or around July 2006. In or about October 2011, Life Style Magazine, a tabloid sold in supermarkets, also published an article, based on the report in TheDirty.com, alleging an affair had occurred between Trump and Clifford. Both Trump and Clifford, through their representatives, issued denials in response to the articles. 2 b. Speci?cally, on or about October 11, 2011, Keith Davidson, who identi?ed himself as Clifford?s attorney, sent-a cease and desist letter to heDz'rty. com, demanding that the article regarding Trump and Clifford be removed from the website. Additionally, on or about October 12, 2011, Cohen, who was then Executive Vice?President and Special Counsel to the Trump Organization, stated to News that ?[t]he totally untrue and ridiculous story . . . emanated from a sleazy and disgusting website. . . . The Trump Organization and Donald J. Trump will be bringing a lawsuit . . . [and] Mr. Trump and the Trump Organization would like to thank and commend Stormy Daniels and her attorneys for their honesty and swift actions.? 14. On or about June 16, 2015, Trump formally launched his 2016 presidential campaign. On or about May 4, 2016, Trump became the presumptive Republican Party nominee for president, and on July 19, 2016, Trump officially became the nominee. Based on my review of public sources, I have learned that while it does not appear that Cohen had an official title as part of the Trump campaign, on multiple occasions Cohen made public statements on behalf of Trump or his Case DOcument 48-7 Filed 07/18/19 Page 19 of 38 campaign. For instance, on or about August 18, 2016, Cohen appeared on CNN to defend Trump?s polling numbers. 15.1 On or about October 7, .2016, The Washington Post published online a video and accompanying audio in which Trump referred to women in what the article described as ?vulgar terms? in a 2005 conversation with Billy Bush, who was then the host of Access Hollywood. The following day, on October 8, 2016, Trump appeared in a video in which he stated, among other things, ?I?ve said and done things I regret and words released today on this more than a decade old video are one of them. Anyone who knows me knows these-words don?t re?ect who 1am. l-said it. I was wrong and I apologize.? Based on my review of public sources, I also know that representatives of the Trump Campaign stated, in sum and substance, that the Access Hollywood comment was an old and isolated incident. 16. Based on my review of public sources, including an article published in Slate magazine bya reporter who interviewed Clifford, that around this same time, in or about October 2016, Clifford was in discussions with ABC ?3 Good Morning America show and Slate magazine, among other media sources, to provide these media outlets with her statement about her alleged relationship with Trump. According to the article in Slate, which the author based on conversations with Clifford over the telephone and by text message, Clifford wanted to be paid for her story or be paid by Trump not to disclose her accusation. As Cohen summarized in a 2018 email obtained pursuant to the Cohen Email Warrants: ?In October 2016, I was contacted by counsel for Ms. Clifford stating that news outlets, including ABC News, were pursuing the 2011 story of an alleged affair between Mr. Trump and Ms. Clifford.? Case Document 48-7 Filed 07/18/19 Page 20 of 38 17. From my review of telephone toll records3 and information produced pursuant to the iCloud Warrant and Cohen Email Warrants, I have learned that in the days following the Access Hollywood video, Cohen exchanged a series of calls, text messages, and emails with Keith Davidson, who was then Clifford?s attorney, David Pecker and Dylan Howard of American Media, Inc. the publisher of the National Enquirer,4 Trump, and Hope Hicks, who was then press secretary for Trump?s presidential campaign. For these text messages and calls?~as well as all of the text messages and calls referenced in this affidavit involving Cohen?Cohen used one of the Target Cellphones forthe communication. 18. Based on the timing of the calls in the days following the Access Hollywood story, and the content of the text messages and emails, I believe that at least some of these communications concerned the need to prevent Clifford from going public, particularly in the wake of the Access Hollywood story. In particular, I have learned the following: a. On October 8, 2016, at approximately 7:20 Cohen received a call from Hicks. Sixteen seconds into the call, Trump joined the call, and the call continued for over four minutes.5 3 My attribution of certain telephone numbers to certain individuals as described in this af?davit is based on my review of the vCard (virtual contact file) obtained from Cohen?s telephone pursuant to the iCloud Warrant. 4 Pecker is President of AMI and, according to his own statements in public reports, a personal friend of Trump. Howard is the chief content officer of AMI, who according to public records reports directly to Pecker. 5 I believe that Trump joined the call between Cohen and Hicks based on my review of toll records. Specifically, I know that a call was initiated between Cohen?s telephone number and Trump?s telephone number at the same time the records indicate that Cohen was talking to Hicks. After the Cohen-Trump call was initiated, it lasted the same period of time as the Cohen?Hicks call. Additionally, the toll records indicate a and then Trump?s telephone number, which, based on my training and experience, means that the call was either transferred to Trump, or that Trump was added to the call as a conference or three-way call participant. In addition, based on my conversations with an FBI agent who has interviewed Hicks, Ihave learned that Hicks stated, in substance, that to the best of her recollection, she did not learn about the allegations made by Clifford until early November 2016. Hicks was not specifically asked about this three?way call. 8 2018-04-07017.02.09 Case Document 48-7 Filed 07/18/19 Page 21 of 38 Based on the toll records that the USAO has obtained to date, Ibelieve that this was the ?rst call Cohen had received or made to Hicks in at least multiple weeks, and that Cohen and Trump spoke about once a month prior to this date speci?cally, prior to this call on October 8, 2016, Cohen and Trump had spoken once in May, once in June, once in July, zero times in August, and twice in September. b. Approximately ten minutes after the call ended, Hicks and Cohen spoke again for about two minutes. c. At 7:39 pm, immediately after the second call with Hicks ended, Cohen called David Pecker (as noted above, the President of American Media Inc., or AMI) and they connected for thirty seconds. Approximately four minutes later, Cohen called Pecker again and they spoke for more than a minute. Three minutes after ending his call with Pecker, Cohen received a call from Dylan Howard (as noted above, the Chief Content Of?cer of AMI), and they spoke for approximately a minute. According to toll records, it does not appear that Cohen and Howard spoke regularly prior to October 8, 2016, as'it had been over a month since they had called each other. d. At 7:56 pm, approximately eight minutes after his call with Howard ended, Cohen 7 called Hicks and they connected for two minutes. At approximately the same time this call ended, Cohen received a call from Pecker, and they spoke for about two minutes. At 8:03 pm, about three minutes after ending?his call with Pecker, Cohen called Trump, and they spoke for nearly eight minutes. e. At 8:39 pm. and 8:57 pm, Cohen received calls from Howard and spoke to him for about four and six minutes, respectively. At 9:13 pm, about ten minutes after Cohen and Howard hung up from the second of these calls, Howard sent Cohen a text message that said: 2018-04-07017.02.09 Case Document 48-7 Filed 07/18/19 Page 22 of 38 ?Keith will do it. Let?s reconvene tomorrow.? Based on my involvement in this investigation, I believe that when Howard wrote ?Keith,? he was referring to Keith Davidson, the attorney for Stephanie CliffordOctober 9, 2016, Cohen sent Howard a text message in response that said: ?Thank you.? Eight minutes later, Cohen sent Howard a text message that said: ?Resolution Consultants LLC. is the name of the entity I formed a week ago. Whenever you wake, please call my cell.? f. The following day, on October 10, 2016, at 10:58 Howard sent a text message to Cohen and Davidson, which stated: ?Keith/Michael: connecting you both in regards to that business opportunity. Spoke to the client this AM: and they?re con?rmed to proceed with the opportunity. Thanks. Dylan. Over to you two.? At 12:25 pm, Davidson sent Cohen a text message that stated: ?Michael if we are ever going to close this deal In my opinion, it needs to be today. Keit Davidson and Cohen then spoke by phone for about three minutes. Based on my participation in this investigation, I believe that when Howard wrote that the ?client? was ?con?rmed to proceed with the opportunity,? he was referring to Clifford?s agreement in principle to accept money from Cohen in exchange for her agreement not to discuss any prior affair with then-candidate Trump.6 g. Based on my review of records obtained pursuant to the Cohen Email Warrants, I know that on or about October 10, 2016, Clifford and Davidson appear to have signed a ?side letter agreemen that stated it was an exhibit to a ?confidential settlement 'agreement and mutual 6 As set forth below, AMI was also involved in a payment to model Karen McDougal. However, because these communications were in close temporal proximity to the events involving the negotiation of a payment to Clifford, the execution of the agreement with Clifford, and the payment of money to Clifford, I believe that these communications were related to Clifford. Additionally, based on my review of public statements by McDougal, I have learned that she negotiated an agreement with AMI several months prior to these communications between Cohen and Pecker, Howard, and Davidson. 10 2018?04?07017.02.09 Case Document 48-7 Filed 07/18/19 Page 23 of 38 release? between ?Peggy Peterson? and ?David Dennison.? The purpose of the document, according to the agreement, was to define the ?true name and identity? of persons named by pseudonym in ?con?dential settlement agreement and mutual release.? The side letter agreement speci?es the identity of ?Peggy Peterson? to be Clifford, but the space for ?Dennison?s? identity is blank. The agreement also includes a signature page for ?Peterson,? ?Dennison,? and their attorneys. The signature page is signed by ?Peterson? and his attorney, Davidson, but the document is unsigned by ?Dennison? and his attorney. Based on my involvement in this investigation, I believe that Davidson sent Cohen. this partially?signed ?side letter agreemen in order to facilitate the closing of a deal between Davidson?s client and Cohen or his client on October 10, 2016. 19. It appears that on October 13, 2016, and the days that followed, Cohen took steps to complete a transaction with Davidson, including attempting to open an account from which Cohen could transfer funds to Davidson. Specifically, from my review of toll records, information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, records maintained by First Republic Bank (?First Republic?), as well as my participation in interviews with employees of First Republic, I have learned the following: a. On the morning of October 13, 2016, at 8:54 Cohen sent Pecker atext message that stated: need to talk to you.? At 9:06 Pecker sent a text message to Cohen that stated, called please call me back.? The tolls between Cohen and Pecker do not show a telephone call between 8:54 am. and 9:06 am. However, based on my review of text messages, I have learned that Cohen and Pecker communicate with each other over Signal, which is an communications cellphone application that allows users to send text messages and make calls. 11 Case Document 48-7 Filed 07/18/19 Page 24 of 38 b. At 9:23 am, Cohen sent an email that stated ?call me? to a banker at First Republic Bank (?First Republic Employee?2?). The email attached documents from the Secretary of State of Delaware indicating that Cohen had formed a limited liability company called ?Resolution Consultants on September 30, 2016. As noted above, ?Resolution Consultants? is the name of the entity that Cohen had told Howard he had formed recently after Howard said Davidson would ?do it.? At 10:44 Cohen called First Republic Employee~2 and told him, in sum and substance, that he needed an account in the name of ?Resolution Consultants? opened immediately, and that he did not want an. address on the checks written out of the account. Later that day, another employee at First Republic emailed Cohen account opening paperwork to complete. Cohen returned the account opening documents partiallycompleted, but failed to provide a copy of his driver?s license or passport, and did not respond to the employee?s question of how he wanted to fund the account. As a result, the account was never opened. 0. On October 17, 2016, Cohen incorporated Essential Consultants LLC in Delaware. That same day, he ?led paperwork to dissolve Resolution Consultants LLC. 20. Despite these steps taken by Cohen, it appears that the negotiation between Cohen and Davidson was not progressing suf?ciently fast enough for Davidson or his client, Clifford, and they threatened to go public with Clifford?s allegations just days before the presidential election. Specifically, based on my review of toll records, information obtained pursuant to the iCloud Warrant, and public sources, Iknow the following: a. According to an article in The Washington Post, which quoted emails sent from Cohen?s email account hosted by the Trump Organization, on October 17, 2016, Davidson emailed Cohen and threatened to cancel the aforementioned ?settlement agreement2018?04?070170209 Case Document 48-7 Filed 07/18/19 Page 25 of 38 if Cohen did not complete the transaction.7 According to the article, Davidson sent Cohen a second email later in the day that stated in part, ?Please be advised that my client deems her settlement agreement canceled and void.? At 4:00 pm. that day, Cohen called Davidson and they spoke for over ?ve minutes. b. Cohen?s 4:00 pm. call with Davidson and/or Davidson?s threats to cancel the ?settlement agreement? appear to have touched off a ?urry of communications about the settlement . agreement and whether Clifford would go public. Speci?cally: i. At 4:43 Howard sent Cohen a text message that stated: ?I?m told they?re going with DailyMail. Are you aware?? One minute later, Cohen responded: ?Call me.? Based on my involvement in this investigation, I understand Howard?s text to mean that he heard that Clifford was going to take her story of an extramarital affair with Trump to the Daily Mail, a tabloid newspaper. ii. At 4:45 Howard called Cohen and they spoke for over two minutes. Moments later, Davidson and Cohen spoke for about two minutes. At 5:03 Cohen attempted to call Trump, but the call only lasted eight seconds. This was Cohen?s ?rst call after he spoke with Davidson. iv. At 5:25 Cohen texted Howard, stating: v. At 6 :44 Howard responded to Cohen?s text, stating: ?Not taking my calls.? Cohen responded one minute later: ?You?re kidding. Who are you trying to reach?? Howard responded one minute later: ?The ?agent.? Based on my involvement in this investigation, I 7 Due to the partially covert nature of the investigation to this date, the Government has not requested documents from the Trump Organization or Davidson, and thus does not possess the email referenced in this article. 13 rams-04070110109 Case Document 48-7 Filed 07/18/19 Page 26 of 38 understand Howard?s text messages to mean that he attempted to contact Davidson about the matter involving Clifford, but that Davidson was not taking Howard?s calls. vi. At 6:49 Cohen called Howard and they spoke for nearly. four minutes. 0. The following day, on October 18, 2016, TheSmokingGun.com, a website that publishes legal documents and mugshots, published an article called: ?Donald Trump and the Porn Superstar,? which alleged that Trump had an extramarital affair with Clifford. However, the article noted that Clifford had declined to comment. 21. On or about October 25, 2016, the communications between Cohen, Davidson, Howard and Pecker picked up again, apparently concerning a transaction involving Clifford. Speci?cally, based on my review of toll records, information obtained pursuant to the Cohen Email Warrants and iCloud Warrant, as well as my review of public sources, I have learned the following: a. On October 25, 2016, at 6:09 Howard sent Cohen a text message stating: ?Keith calling you urgently. We have to coordinate something on the matter he?s calling you about or its [sic] could look awfully bad for everyone.? One minute later, Davidson sent Cohen a text message stating ?Call me.? Cohen and Davidson called each other several times over the next half hour but appear not to have connected. At 6:42 Cohen and Davidson spoke for about eight minutes. At 7:11 they spoke for another two minutes. b. The next morning, on or about October 26, 2016, at 8:26 Cohen called Trump and spoke to him for approximately three minutes. At 8:34 Cohen called Trump again and connected for a minute and a half. 0. At approximately 9:04 a.m.??less than thirty minutes after speaking with Trump# Cohen sent two emails to the person who had incorporated Resolution Consultants and Essential Consultants for him, and stated ?can you send me asap the filing receipt? and then, in the second 14 2018-04?070170209 Case Document 48-7 Filed 07/18/19 Page 27 of 38 email, ?for Essential Consultants That person responded with the ?ling receipt two minutes later at 9:06 am. and with the certi?cation of formation 23 minutes later, at 9:27 am. d. Shortly after that, Cohen contacted a particular employee at First Republic (?First Republic Employee?2?) and told him, in sum and substance, that he decided not to open an account in the name of ?Resolution Consulting? and instead would be opening a real estate consulting company in the name of ?Essential Consultants.? Cohen told First Republic Employee?2 that he was at Trump Tower, and wanted to go to a First Republic branch across the street to open the account, so First Republic Employee?2 called another-employee of First Republic (?First Republic Employee?1?), a preferred banker at that branch, to assist Cohen. At 11:00 am, First Republic Employee-1 called Cohen. I know from my participation in an interview with First Republic A Employee?l, that around the time of the call he went to Cohen?s of?ce in Trump Tower?on the same, ?oor as the Trump Organization?and went through account opening questions, including know your customer questions, with Cohen. In response to a series of know?your?customer questions about the purpose of the account?the answers to which First Republic Employee?1 entered into a form?~Cohen stated, in sum and substance, that he was opening Essential Consultants as a real estate consulting company to collect fees for investment consulting work, and all of his consulting clients would be domestic individuals based in the United States. Based on my review of records obtained from First Republic, it appears that this account (the ?Essential Consultants Accoun was created at a time between 11:00 am. and 1:00 pm. e. At 1:47 Cohen called Davidson and they spoke for approximately two minutes. At approximately 1:49 Davidson emailed Cohen wiring instructions for an attorney client trust account at City National Bank. 15 2018-04-07017.02.09 Case Document 48-7 Filed 07/18/19 Page 28 of 38 f. After the Essential Consultants Account was opened on October 26, 2016, Cohen transferred $131,000 from a home equity line of credit that Cohen had at First Republic to the Essential Consultants Account. Following the transfer, at approximately 4: 15 pm. on October 26, 2016, First Republic Employee?2?s assistant emailed Cohen at his Trump Organization email address to tell him that the funds had been deposited into ,the Essential Consultants Account. Cohen forwarded that email to the Cohen Gmail Account and then forwarded it to Davidson. g. At 6:37 Cohen asked Pecker by text message, ?Can we speak? Important.? Cohen called rPecker at 6:49 pm and connected for thirty seconds. At 6:57 VCohen sent Howard a text message, stating: ?Please call me. Important.? Cohen called Howard at 7:00 pm. and connected for about thirty seconds. At 7:06 Cohen called Pecker again and they spoke for nearly thirteen minutes. At 7:24 Howard sent a text message to Cohen that: ?He said he?d call me back in 20 minutes. I told him what you are asking for his [sic] reasonable. I?ll get it sorted.? Approximately an hour later, at 8:23 Howard told Cohen by text message to ?check your Gmail for email from my private accoun In an email sent at 8:23. pm. by Howard to Cohen and Davidson, with the subject line ?Confirmation,? Howard stated, ?Thank you both fer chatting with me earlier. Con?rming agreement on: - Executed agreement, hand-signed by Keith?s client and returned via overnight or same-day FedEx to Michael, Change of agreement to re?ect the correct LLC, - Transfer of funds on Thursday AM to be held in escrow until receipt of agreement.? After receiving that email, at approximately 8:27 Cohen asked Howard by text message, ?Can you and David [Pecker] give me a call.? Howard responded: ?David is not around I think. I?ll call.? At 8:28 Howard called Cohen and they spoke for three minutes. 16 2018~04~070l7.02.09 Case Document 48-7 Filed 07/18/19 Page 29 of 38 22. On October 27, 2016, Cohen made a payment to Davidson of 1 30,000?with the funds intended for Clifford?for the purpose of securing her ongoing silence with respect to the allegations that she had an extramarital affair with Trump. Speci?cally, based on my review of toll records, bank records, and information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, I have learned the following: a. At 9:47 Cohen sent Davidson an email, stating: ?Keith, kindly con?rm that the wire received today, October 27, 2016 shall be held by you in your attorney?s trust account until such time as directed- for release by me, in writing. Additionally, please ensure that all paperwork contains the correct name of Essential Consultants LLC. I thank you in advance for your assistance and look forward to hearing from you later.? b. At approximately 10:01 according to records provided by First Republic Bank, Cohen completed paperwork to wire $130,000 from the Essential Consultants Account? which had been funded a day prior from Cohen?s home equity line of credit?to the attorney client trust account at City National Bank that Davidson had speci?ed in the wiring instructions he sent to Cohen. The wire transfer was made shortly thereafter. 0. At 10:02 Davidson responded to Cohen?s email from 9:47 stating: con?rm that Iwill work in good faith that no funds shall be disbursed unless until the plaintiff personally signs all necessary settlement paperwork, (the form of which will match the prior agreement). The settlement docs will name the correct corporation, (Essential Consultants LLC). Plaintiff?s signature will be notarized and returned to you via Fe Only after you receive edEX will I disburse. Fair?? - (1. At 10:50 First Republic Employee?1 sent Cohen an email con?rming that the payment had been sent and providing him with the wire number. 17 Case Document 48-7 Filed 07/18/19 Page 30 of 38 23. On' October 28, 2016, and the days that followed, Cohen ?nalized the transaction with Davidson. Speci?cally, based on my review of toll records, information obtained pursuant to the iCloud Warrant, public sources, and bank records, I know the following: a. On October 28, 2016, at 11:48 Cohen spoke to Trump for approximately five minutes. Beginning at 1:21 Cohen attempted a series of phone calls to Davidson, Pecker, and Howard throughout the day, although it appears he may only have connected with Howard. b. Later that day, at approximately 7:01 Davidson stated to Cohen by text message that ?all is AOK. I should. have signed, notarized. does on Monday. You should have them on Tuesday.? Cohen thanked him and said hope we are good.? Davidson responded, assure you. We are very good.? Howard also texted Cohen at 7:08 ?Keith [Davidson] says we are good.? Cohen then responded to Howard and ?Excellent? to Davidson. At approximately 10:30 Cohen spoke to Hicks for three minutes.- c. On October 31, 2016, Cohen called Howard at 8:22 pm. and they spoke for over three minutes. At 8:32 Cohen received text messages from both Howard and Davidson. Howard said: ?You?ll have paperwork tomorrow says Davidson said: ?We are AOK. You will be receiving a package tomorrow.? Cohen responded ?Thank you? to Howard and ?Thanks Keith. Will call you then? to Davidson. From my involvement in this investigation, I believe Davidson was referring to a signed nondisclosure agreement when he told Cohen that he would receive a package. d. Based on my review of court ?lings that became public in 2018, I have learned that On or about October 28, 2016, LLC and/or David Dennison? entered into a ?confidential settlement agreement and mutual release? with ?Peggy Peterson,? pursuant to which ?Peterson? agreed not to disclose certain ?con?dential information pertaining to [Dennison]? in exchange for 1 8 2018?04?07017.02.09 Case Document 48-7 Filed 07/18/19 Page 31 of 38 $130,000. The agreement provided that would wire the funds to ?Peterson?s? attorney, who would then transfer funds to ?Peterson.? Cohen signed the agreement on behalf of The agreement stated that the address for which was later referred to in the agreement as ?Essential Consultants, was Cohen?s residence. e. Consistent with the ?con?dential settlement agreement and mutual release,? on or about November 1, 2016, Davidson transferred $96,645 from his attorney client trust account at City National Bank to a bank account in Clifford?s name. The wire had the annotation ?net settlement.? On the same day, at approximately 9:48 am. Davidson sent Cohen a text message with a picture of a FedEx delivery continuation, stating that at approximately 9:09 am. a package shipped by Davidson the previous day had arrived for Cohen at. his Trump Organization address. On the same day, at approximately 6:14 pm, Davidson sent Cohen an email with an audio ?le attached and said ?Give this a lesson [sic] and then call me.? The audio attachment was titled ?Stormy.mp3? and was a five?minute recording of Davidson interviewing Clifford about recent public allegations made by an adult ?lm star named Jessica Drake regarding her alleged past affair with Trump in the recording, Clifford explained the reasons she believed that Drake was not credible. Less than an hour later, at approximately 7:05 pm, Cohen called Trump, but it appears that they did not connect. Cohen then called a telephone number belonging to Kellyanne Conway, who at the time was Trump?s campaign manager. They did not connect. At approximately 7:44 pm, however, Cohen received a return call from Conway, which lasted for approximately six minutes. 24. On November 4, 2016, just three days after the Clifford transaction was completed and just four days before the presidential election, the Wall Street Journal published an article alleging that the National Enquirer had ?Shielded Donald Trump? from allegations by Playboy model 19 Case Document 48-7 Filed 07/18/19 Page 32 of 38 Karen McDougal that she and Trump had an affair. The article alleged that AMI had agreed to pay McDougal to bury her story. McDougal, like Clifford, had been represented by Davidson. . Based on my review of toll records, information obtained pursuant to the Cohen Email Warrants and iCloud Warrant, and public sources, it appears that Cohen spoke frequently to Davidson, Howard, Pecker, and Hicks around the time of this article?s publication?justdays before Election Day?about the importance of preventing the McDougal and Clifford stories from gaining national traction. Speci?cally, I have learned the following: aim-?Between 4:36 and 800 pm on communicated several times with Howard, Pecker and Davidson. 'For instance, at approximately 4:49 pm, Cohen sent Howard a text message with a screenshot of an email forwarded to him by another Trump Organization lawyer. The forwarded email was from a Wall Street Journal reporter, and asked for comment from Trump and/or the campaign on the story. Cohen also spoke with Hicks several times, including shortly before and/or after calls with Pecker, Howard and Davidson. Indeed, at approximately 7:33 pm, using two different cellphones subscribed to him, Cohen appears to have been talking to Davidson and Hicks at the same time. b. At approximately 8:51 pm, Cohen sent Howard a message, stating: ?She?s being really dif?cult with giving Keith a statement. Basically went into hiding and unreachable.? One minute later, Howard responded: ?I?ll ask him again. We just need her to disappear.? Cohen responded, ?She de?nitely disappeared but re?ises to give a statement and Keith cannot push her.? At approximately 8:5 5 Howard responded to Cohen?s text: ?Let?s let the dust settle. We don?t want to push her over the edge. She?s on side at present and we have a solid position and a plausible position that she is right?illy employed as a colunmist.? Based on my involvement in this investigation, I believe Cohen and Howard were referring to Karen McDougal when they were 20 Case Document 48-7 Filed 07/18/19 Page 33 of 38 discussing ?she? and ?her.? Additionally, I believe Howard?s statement that ?we have . . . a plausible position that she is rightfully employed as a columnist? was a reference to the fact that AMI had given McDougal payments for her role as a purported columnist for the company. 0. At approximately 8:58 pm. on November 4, 2016, Howard attempted to reassure Cohen about the effect of the forthcoming Wall Street Journal article, texting, think it?ll be ok pal. I think it?ll fade into the distance.? Cohen responded, ?He?s pissed.? Howard wrote back, ?I?m pissed! You?re pissed. Pecker is pissed. Keith is pissed. Not much we can do.? Based on my involvement in this investigation, I believe Cohen was referring to Trump when he stated ?I?he?s pissed.? Cohen asked Howard at approximately 9:00 pm. how the Wall Street Journal could publish its article if ?everyone denies.? Howard responded, ?Because there is the payment from AMI. It looks suspicious at best.? (1. At approximately 9:03 Hicks called Cohen and they spoke for two minutes. At approximately 9:11 Cohen called Howard and spoke to him for ?ve minutes. At approximately 9:15 Hicks called Cohen and they spoke for nearly seven minutes. Again, Cohen used different phones for these two calls, such that he appears to have been on both calls for about a minute of overlap. At approximately 9:32 Cohen texted Pecker, ?The boss just tried calling you. Are you free?? A minute later, Cohen texted Howard, ?Is there a way to ?nd David quickly?? e. At approximately 9:50 the Wall Street Journal article was published online. Howard and Hicks both sent web links for the article to Cohen. Over the next half hour, Cohen and Howard exchanged several text messages commenting on how the story came across. The next morning on November 5, 2016, at approximately 7:35 Cohen texted Hicks, ?So far I see only 6 stories. Getting little to no traction.? Hicks responded, ?Same. Keep prayinglt It?s 21 Case Document 48-7 Filed 07/18/19 Page 34 of 38 working!? Cohen wrote back, ?Even CNN not talking about it. No one believes it and-if necessary, I have a statement by Storm denying everything and contradicting the other porn stars statement. I wouldn?t use it now or even discuss with him as no one is talking about this or cares!? Based on my involvement in this investigation, I believe Cohen was referring to the ab ove-referenced recorded audio statement by Clifford that he obtained from Davidson, and was stating that such a statement could be used to in?uence potential negative media relating to Trump, but was unnecessary at that time. Based on a text message from Hicks to Cohen, I believe that later that morning, Becker spoke to Trump. 25. On or about November 8, 2016, Trump won the election for President of the United States. I 26. On or about January 12, 2018, the Wall Street Journal ?rst reported that Cohen arranged a payment to Clifford. On or about January 22, 2018, Common Cause, a government watchdog group, filed a complaint with the Federal Election Commission, alleging that Cohen had violated campaign ?nance laws by making the payment to Clifford. Based on my review public sources following that report, as well as emails obtained pursuant to the Cohen Email Warrants, I have learned the following: a. On or about January 23, 2018, the day after Common Cause ?led its complaint, Cohen began emailing himself drafts of statements describing his payment to Clifford. Additionally, on anuary'23, 2018, Cohen emailed the following draft of that statement to an individual who appears to be writing a book on Cohen?s behalf: In October 2016, I was contacted by counsel for Ms. Clifford stating that news outlets, including ABC news, were pursuing the 2011 story of an alleged affair between Mr. Trump and Ms. Clifford. Despite the fact that both parties had already denied the allegation, as Mr. Trump?s longtime special counsel and protector, I took it upon myself to match the offer and keep the storyfrom breaking. Iknew the allegation to be false, but I am 22 Case Document 48-7 Filed 07/18/19 Page 35 of 38 also a realist who understands that just because something is false doesn ?t mean that it doesn?t create harm and damage. I could not allow this to occur. - I negotiated a non-disclosure agreement with Ms. Clifford?s counsel and tendered the funds. I did this through my Delaware LLC and transferred personal funds to cover the agreement. I was not reimbursed any monies from Mr. Trump, the Trump Organization, any third party or the Presidential campaign. At no point did I ever advise Mr. Trump of my communications or actions regarding this agreement. As outlandish and unusual as this may appear, the Trumps have been like family to me for over a decade. It?s what you do for family. (Emphasis added.) Based on my involvement in this investigation, I believe that the above email for. some 2011 -- story. . but that Cohen was motivated to ?keep the story from breaking? again in October 2016. b. On or about February 13, 2018, Cohen said in a statement to The New York Times that ?Neither the Trump Organization nor the Trump campaign was a party to the transaction with Ms. Clifford. The payment to Ms. Clifford was lawful, and was not a campaign contribution or a campaign expenditure by anyone.? Cohen declined to answer follow?up questions including whether Trump had been aware of the payment, why Cohen made the payment, or whether similar payments had been made to other people. c. On or about February 14, 2018, Cohen was asked by The New York Times whether Trump had reimbursed him, whether he and Trump had made any arrangement at the time of the payment, or whether he had made payments to other women. Cohen stated in response, can?t get into any of that.? On or about February 14, 2018, Cohen also stated to The Washington Post that: ?In a private transaction in 2016, I used my own personal funds to facilitate a payment of $130,000 to Ms. Stephanie Clifford. Neither the Trump Organization nor the Trump campaign was a party to the transaction with Ms. Clifford, and neither reimbursed me for the payment, either directly or indirectly.? 23 Case Document 48-7 Filed 07/18/19 Page 36 of 38 d. On or about March 9, 2018, Cohen stated to ABC News that ?the funds were taken from my home equity line and transferred internally to my LLC account in the same bank.? 27. For the foregoing reasons, there is probable cause to believe that Cohen used the Target Cellphones to commit the Subject Offense. Cohen used the Target Cellphones to communicate with Davidson, Howard, Pecker, and others about the payment to Clifford on the eve of the election. Indeed, while Cohen denies having given an unlawful contribution, in his own statements Cohen has admitted that he paid $130,000 of his ?personal funds? to Clifford and that the payment occurred less than two weeks before the election, as Trump was facing negative media allegations about his behavior toward women, even though allegations of an affair between Trump and Clifford existed since 2011. In addition, the communication records set forth above make evident that Cohen communicated?using the Target Cellphones?with members of the Trump campaign and others about his negotiation with Clifford?s attorney and the need to preclude Clifford from making a statement that would have re?ected negatively on the candidate in advance of the forthcoming election. 28. I have reviewed records maintained by from which Ihave learned, in sub stance and in part, that the Target Cellphones are still active. Based on my training and experience, my familiarity with this investigation, and the information set forth above, I therefore believe that the Requested Information will lead to evidence of the Subject Offense. Specifically, the Requested Information includes historical location data for the Target Cellphones, which may show where the Target Cellphones?and by extension Cohen?was on particular dates and times between October 1, 2016??~the approximate time that negotiations regarding the Clifford payment be gan? and the present. That location information can, among other things, be used to corroborate any in? 24 Case Document 48-7 Filed 07/18/19 Page 37 of 38 person meetings between the Cohen and the other individuals involved in the negotiations of the the payment to Clifford. Based on my training and experience, I also know that historical location information can be useful to establish a pattern of behavior by a particular individual, which assists law enforcement in tracking such an individual?and, thereby, locating his electronic devices. Along with the historical information, the prospective information will also lead to the present location of the Target Cellphones; law enforcement may then obtain evidence from the Target Cellphones, by subpoena or search warrant, including but not limited to contact lists containing contact information for participants in the illegal campaign contribution scheme and well as text messages between these participants. 111. Request for Warrant and Order 30. Based on the foregoing I respectfully re quest that the Court require the Service Provider to provide the Requested Information as speci?ed further in the Warrant and Order proposed herewith, including prospective precision location and cell site data for a period of 45 days from the date of this Order (or the date that the Target Cellphones are seized, whichever comes ?rst), No din/whiff 33/ 233 and historical cell site data and toll records for the period from October 1, 2016 through the?datecf-this 31% ?an? Order, and pen register information for a period of 60 days from the date of this Order. 0 31. ondisclosure. The existence and scope of this ongoing criminal investigation are not publicly known. As a result, premature public disclosure of this af?davit or the requested Warrant and Order could alert potential criminal targets that they are under investigation, causing them to destroy evidence, ?ee from prosecution, or otherwise seriously jeopardize the investigation. Accordingly, I respectfully request that the Provider be directed not to notify the subscriber or others of the existence of the Warrant and Order for a period of 180 days, and that the Warrant and 25 Case DocUment 48-7 Filed 07/18/19 Page 38 of 38 Order and all supporting papers be maintained under seal until the Court orders otherwise, as speci?ed in the Application submitted in conjunction with this Af?davit. Sworn to beforemethis InWdfamm HENRY PITMAN United States {Magistrate Judge Southern District of l?i?fe?vtr York 26 United States Attorney?s Of?ce Southern District of New York Case Document 48-8 Filed 07/18/19 Page 1 of 62 IN THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF NEW YORK IN THE MATTER OF THE USE OF A SITE SIIVIULATOR TO LOCATE THE CELLULAR DEVICES ASSIGNED CALL NUMBERS AND - - AFFIDAVIT IN SUPPORT OF . AN APPLICATION FOR A SEARCH WARRANT being ?rst duly sworn, hereby depose and state as follows: INTRODUCTION AND AGENT BACKGROUND 1. I make this af?davit in support of an application for a search warrant under Federal Rule of Criminal Procedure 41 to authorize law enforcement to employ an electronic investigative technique, which is described in Attachment B, to determine the location of the cellular devices assigned call numbers _1nd (the ?Target Cellular Devices?), which are described in Attachment A. 2. I am a Special Agent with the Federal Bureau of Investigation I have been a Special Agent with the FBI since 2009. In the course of my experience and training in these positions, I have participated in criminal investigations into federal offenses involving a wide array of ?nancial crimes, including offenses involving public corruption. I also have training and experience executing warrants for cellphone location data. 3. The facts in this affidavit come ?om my personal observations, my training and experience, and information obtained ??om other agents and witnesses. This af?davit is intended to show merely that there is suf?cient probable cause. for the requested warrant and does not set forth all of my knowledge about this matter. ?til! Case Document 48-8 Filed 07/18/19 Page 2 of 62 4. One purpose of applying for this warrant is to determine with precision the Target Cellular Devices? location. However, there is reason to believe the Target Cellular Devices are currently located somewhere within this district because the Target Cellular Devices? owner is knoWn to spend most of his time in this district. Pursuant to Rule law enforcement may locate the Target Cellular Devices outside the district provided the device is within the district when the warrant is issued. 5. 7 Based on the facts set__ forth in this af?davit,there is probable causeto believe that violations of 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offense?) has been committed, are being committed, and will be committed by Michael Cohen and others. There is also probable cause to believe that the location of the Target Cellular Devices will lead to evidence of the Subject Offense, as detailed below. 6. Because collecting the information authorized by this warrant may fall within the statutory de?nitions of a ?pen register? or a ?trap and trace device,? see 18 U.S.C. 3127(3) (4), this warrant is designed to comply with the Pen Register Statute as well as Rule 41. See 18 U.S.C. 3121?3127. This warrant therefore includes all the information required to be included in a pen register order. See 18 U.S.C. 3123(b)(1). PROBABLE CAUSE Introduction 7. The United States Attorney?s Of?ce for the Southern District of New York and the FBI are investigating a criminal violation of the campaign fmance laws by Michael Cohen, a lawyer who holds himself out as the personal attorney for President Donald J. Trump. As detailed below, there is probable cause to believe that Cohen made an excessive in? kind contribution to the presidential election campaign of then-candidate Donald Trump in the 2 Case Document 48-8 Filed 07/18/19 Page 3 of 62 form of a $130,000 payment to Stephanie Clifford, an individual who is alleged to have had an extramarital affair with Trump, in exchange for her agreement not to disclose that alleged affair on the eve of the 2016 presidential election. I 8. The Target Cellular Devices referenced in this Affidavit are the cellphones assigned call numbers?and - As further discussed below, the Target Cellular Devices are subscribed to in the name of Michael Cohen (the ?Subscriber?). The Subscriber is believedto use the Target Cellphonesand is a Target Subject of this investigation._ is the Service Provider for the Target Cellphones. Prior Relevant Process 9. In connection with an investigation then being conducted by the Of?ce of the Special Counsel the FBI sought and obtained from the Honorable Beryl A. Howell, Chief United States District Judge for the District of Columbia, three search warrants for emails and other content information associated with two email accounts used by Cohen, and one search warrant for stored content associated with an iCloud account used by Cohen. Speci?cally: a. On or about July 18, 2017, the FBI sought and obtained a search warrant for emails in the (the ?Cohen Gmail Account?) sent or received between January 1, 2016 and July 18, 2017 (the ?First Cohen Gmail Warrant?). b. On or about August 8, 2017, the FBI sought and obtained a search warrant for content stored in the iCloud account associated with Apple ID -@gmai1.com (the ?Cohen iCloud Account? and the ?Cohen iCloud Warrant?). o. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the Cohen Gmail Account sent or received between June 1, 2015 and November 13, 2017 (the ?Second Cohen Gmail Warrant?). Case Document 48-8 Filed 07/18/19 Page 4 of 62 d. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the account ?Cohen Account?) sent or received between the opening of the Cohen Account1 and November 13, 2017 (the ?First Cohen Warrant?). 10. The SCO has since referred certain aspects of its investigation into Cohen to the USAO, which is working with the New York Field Of?ce. 11. On or about February 28, and FBI sought and obtained search warrants for emails in Cohen Gmail Account and Cohen Account, among other accounts, sent or received between November 14, 2017 and February 28, 2018 (the ?Third Cohen Gmail Warrant? and ?Second Cohen Warran 12. The above-described warrants are referred to herein as the ?Cohen Emails Warrants? and, with respect to the iCloud Warrant, the ?Cohen iCloud Warrant.? The Illegal Campaign Contribution Scheme 13. From my review of public sources, I have learned the following: a. In or around October 2011, there were rumors published on the gossip website heDz'rty. com that Trump had had an extramarital affair with Clifford, an adult actress whose screen name is Stormy Daniels, in or around July 2006. In or about October 2011, Life cf: Style 1 Based on my review of this warrant and the af?davit in support of it, I know that-the warrant did not specify a time period, but the affidavit indicated that, pursuant to court order, the service provider had provided non?content information for the Cohen Account that indicated that the account contained emails from the approximate period of March 2017 through the date of the warrant. 2 On or about February 28, 2018 and April 7, 2018, the USAO and FBI sought and obtained Rule 41 search warrants authorizing the search of emails and content obtained pursuant to previously issued warrants, for additional subject offenses. Case Document 48-8 Filed 07/18/19 Page 5 of 62 Magazine, a tabloid sold in supermarkets, also published an article, based on the report in TheDirly.com, alleging an affair had occurred between Trump and Clifford. Both Trump and Clifford, through their representatives, issued denials in response to the articles. b. Speci?cally, on or about October 11, 2011, Keith Davidson, who identi?ed himself as Clifford?s attorney, sent a cease and desist letter to TheDz?rtyeom, demanding that the article regarding Trump and Clifford be removed from the website. Additionally, on or about October 12, 2011, Cohen, who was then Executive Vice-President and Special Counsel to the Trump, Organization, stated to News that totally untrue and ridiculouslstory . . . emanated from a sleazy and disgusting web site. . . . The Trump Organization and Donald J. Trump will be bringing a lawsuit . . . [and] Mr. Trump and the Trump Organizationwould like to thank and commend Stormy Daniels and her attorneys for their honesty and swift actions.? 14. On or about June 16, 2015, Trump formally launched his 2016 presidential campaign. On or about May 4, 2016, Trump became the presumptive Republican Party nominee for president, and on July 19, 2016, Trump of?cially became the nominee. Based on my review of public sources, I have learned that while it does not appear that Cohen had an of?cial title as part of the Trump campaign, on multiple occasions Cohen made public statements on behalf of Trump or his campaign. For instance, on or about August 18, 2016, Cohen appeared on CNN to defend Trump?s polling numbers. 15. On or about October 7, 2016, The Washington Post published online avideo and accompanying audio in which Trump referred to women in what the article described as ?vulgar terms? .in a 2005 conversation with Billy Bush, who was then the host of Access Hollywood. The following day, on October 8, 2016, Trump appeared in a video in which he stated, among other things, ?I?ve said and done things i regret and words released today on this 5 Case Document 48-8 Filed 07/18/19 Page 6 of 62 more than a decade old video are one of them. Anyone who knows me knows these words don?t re?ect who I am. I said it. I was wrong and I apologize.? Based on my review of public sources, also know that representatives of the Trump Campaign stated, in sum and substance, that the Access Hollywood comment was an old and isolated incident. 16. Based on my review of public sources, including an article published in Slate magazine by a reporter who interviewed Clifford, that around this same time, in or about October 2016, Clifford wasin discussions with ABC?sGood Morning America and Slate 7? magazine, among other media sources, to provide these media outlets with her statement about her alleged relationship with Trump. According to the article in Slate, which the author based on conversations with Clifford over the telephone and by text message, Clifford wanted to be paid for her story or be paid by Trump not to disclose her accusation. As Cohen summarized in a 2018 email obtained pursuant to the Cohen Email Warrants: ?In October 2016, I was contacted by counsel for Ms. Clifford stating that news outlets, including ABC News, were pursuing the 2011 stoiy of an alleged affair between Mr. Trump and Ms. Clifford.? 17. From my review of telephone toll records3 and information produced pursuant to the iCloud Warrant and Cohen Email Warrants, I have learned that in the days following the Access Hollywood video, Cohen exchanged a series of calls, text messages, and emails with Keith Davidson, who was then Clifford?s attorney, David Pecker and Dylan Howard 3 My attribution of certain telephone numbers to certain individuals as described in this af?davit is based on my review of the vCard (virtual contact ?le) and text messages obtained from Cohen?s telephone pursuant to the iCloud Warrant. Case Document 48-8 Filed 07/18/19 Page 7 of 62 of American Media, Inc. the publisher of the National Jil'mguz'rer,4 "l?rump, and Hope Hicks, who was then press secretary for Trump?s presidential campaign. For these text messages and calls?as well as all of the text messages and calls referenced in this af?davit involving Cohen?Cohen used one of the Target Cellular Devices for the communication. 18. Based on the timing of the calls in the days following the Access Hollywood story, and the content of the text messages and emails, I believe that at least some of these communications concerned the need toprevent Clifford ?'om going public, particularly inthe wake . . of the Access Hollywood story. In particular, I have learned the following: a. On October 8, 2016, at approximately 7:20 pm, Cohen received a call from Hicks. Sixteen seconds into the call, Trump joined the call, and the call continued for over four minutes.5 Based on the toll records that the USAO has obtained to date, I believe that this was the ?rst call Cohen had received or made to Hicks in at least multiple weeks, and that Cohen and Trump spoke on the telephone about once a month prior to this date speci?cally, prior to this call on October 4 Pecker is President of AMI and, according to his own statements in public reports, a personal ?iend of Trump. Howard is the chief content of?cer of AMI, who according to public records reports directly to Pecker. 5 I believe that Trump joined the call between Cohen and Hicks based on my review of toll records. Speci?cally, I know that a call was initiated between Cohen?s telephone number and Trump?s telephone number at the same time the records indicate that Cohen was talking to Hicks. After the Cohen?Trump call was initiated, it lasted the same period of time as the Cohen?Hicks call. Additionally, the toll records indicate a and then Trump?s telephone number, which, based on my training and experience, means that the call was either transferred to Trump, or that Trump was added to the call as a conference or three?way call participant. In addition, based on my conversations with another law enforcement agent who has spoken to a law enforcement agent who has interviewed Hicks, I have learned that Hicks stated, in substance, to the best of her recollection, she did not learn about the allegations made by Clifford until early November 2016. Hicks was not speci?cally asked about this three?way call. 7 Case Document 48-8 Filed 07/18/19 Page 8 of 62 8, 2016, Cohen and Trump had spoken once in May, once in June, once in July, zero times in August, and twice in September. b. Approximately ten minutes after the call ended, Hicks and Cohen spoke again for about two minutes. 0. At 7:39 pm, immediately after the second call with Hicks ended, Cohen called David Pecker (as noted above, the President of American Media Inc., or AMI) and they connected ..for..thirty seconds. Approximately four minutes later, Cohen called Pecker again and they spoke for more than a minute. Three minutes after ending his call with Pecker, Cohen received a call from Dylan Howard (as noted above, the Chief Content Of?cer of AMI), and they spoke for approximately a minute. According to toll records, it does not appear that Cohen and Howard spoke regularly prior to October 8, 2016, as it had been over a month since they had called each other. d. At 7:56 p.1n., approximately eight minutes after his call with Howard ended, Cohen called Hicks and they connected for two minutes. At apprOximately the same time this call ended, Cohen received a call from Pecker, and they spoke for about two minutes. At 8:03 pm, about three minutes after ending his call with Pecker, Cohen called Trump, and they spoke for nearly eight minutes. e. At 8:39 pm. and 8:57 pm, Cohen received calls from Howard and spoke to him for about four and six minutes, respectively. At 9:13 pm, about ten minutes after Cohen and Howard hung up from the second of these calls, Howard sent Cohen a text message that said: ?Keith will do it. Let?s reconvene tomorrow.? Based on my involvement in this investigation, I believe that when Howard wrote ?Keith,? he was referring to Keith Davidson, the attorney for Stephanie Clifford. At 3:31 am, now on October 9, 2016, Cohen sent Howard a text message in 8 Case Document 48-8 Filed 07/18/19 Page 9 of 62 response that said: ?Thank you.? Eight minutes later, Cohen sent Howard a text message that said: ?Resolution Consultants LLC. is the name of the entity I formed a week ago. Whenever you wake, please call my cell.? f. The following day, on October 10, 2016, at 10:58 am, Howard sent a text message to Cohen and Davidson, which stated: ?Keith/Michael: connecting you both in regards to that business opportunity. Spoke to the client this AM and they?re con?rmed to proceed with the - opportunity. Thanks. DylannOver toyoutwo.? At 12:25 Davidson sent Cohen atext message that stated: ?Michael if we are ever going to close this deal In my opinion, it needs to be today. Keith.? Davidson and Cohen then spoke by phone for about three minutes. Based on my participation in this investigation, I believe that when Howard wrote that the ?client? was ?confirmed to proceed with the opportunity,? he was referring to Clifford?s agreement in principle to accept money ?'om Cohen in exchange for her agreement not to discuss any prior affair with then?candidate Trump.6 g. Based on my review of records obtained pursuant to the Cohen Email Warrants, I know that on or about October 10, 2016, Clifford and Davidson appear to have signed a ?side letter agreement? that stated it was an exhibit to a ?con?dential settlement agreement and mutual release? between ?Peggy Peterson? and ?David Dennison.? The purpose of the document, accordin to the agreement, was to de?ne the ?true name and identi of ersons named 6 As set forth below, AMI was also involved in a payment to model Karen McDougal. However, because these communications were in close temporal proximity to the events involving the negotiation of a payment to Clifford, the execution of the agreement with Clifford, and the payment of money to Clifford, I believe that these communications were related to Clifford. Additionally, based on my review of public statements by McDougal, I have learned that she negotiated an agreement with AMI several months prior to these communications between Cohen and Pecker, Howard, and Davidson. Case Document 48-8 Filed 07/18/19 Page 10 of 62 pseudonym in ?con?dential settlement agreement and mutual release.? The side letter agreement specifies the identity of ?Peggy Peterson? to be Clifford, but the space for ?Dennison? 5? identity is blank. The agreement also includes a signature page for ?Peterson,? ?Dennison,? and their attorneys. The signature page is signed by ?Peterson? and his attorney, Davidson, but the document is unsigned by ?Dennison? and his attorney. Based on my involvement in this investigation, I believe that Davidson sent Cohen this partially-signed ?side letter agreement? in ;ord_er;to_facilitateithe closing of a deal between Davidson?s client and Cohenor his client on October 10, 2016. 19. I It appears that on October 13, 2016, and the days that followed, Cohen took steps to complete a transaction with Davidson, including attempting to open an account from which Cohen could transfer funds to Davidson. Speci?cally, from my review of toll records, information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, records maintained by First Republic Bank (?First Republic?), as well as my participation in interviews with employees of First Republic, I have learned the following: a. On the morning of October 13, 2016, at 8:54 am, Cohen sent Pecker a text message that stated: need to talk to you.? At 9:06 Pecker sent a text message to Cohen that stated, called please call me back.? The tolls between Cohen and Pecker do not show a telephone call between 8:54 am. and 9:06 am. However, based on my review of text messages, I have learned that Cohen and Pecker communicate with each other over Signal, which is an communications cellphone application that allows users to send text messages and make calls. b. At 9:23 am, Cohen sent an email that stated ?call me? to a banker at First Republic Bank (?First Republic The email attached documents from the Secretary of State 10 Case Document 48-8 Filed 07/18/19 Page 11 of 62 of Delaware indicating that Cohen had formed a limited liability company called ?Resolution Consultants on September 30, 2016. As noted above, ?Resolution Consultants? is the name of the entity that Cohen had told Howard he had formed recently after Howard said Davidson would ?do it.? At 10:44 am, Cohen called First Republic Employee?2 and told him, in sum and substance, that he needed an account in the name of ?Resolution Consultants? opened immediately, and that he did not want an address on the checks written out of the account. Later that day, another employee at First Republicemailed Cohen account opening paperwork to complete. Cohen returned the account opening documents partially completed, but failed to provide a copy of his driver?s license or passport, and did not respond to the employee?s question of how he wanted to ?nd the account. As a result, the account was never opened. c. On October 17, 2016, Cohen incorporated Essential Consultants LLC in Delaware. That same day, he ?led paperwork to dissolve Resolution Consultants LLC. 20. Despite these steps taken by Cohen, it appears that the negotiation between Cohen and Davidson was not progressing suf?ciently fast enough for Davidson or his client, Clifford, and they threatened to go public with Clifford?s allegations just days before the presidential election. Speci?cally, based on my review of toll records, information obtained pursuant to the iCloud Warrant, and public sources, I know the following: a. According to an article in he Washington Post, which quoted emails sent from Cohen? 5 email account hosted by the Trump Organization, on October 17, 2016, Davidson emailed Cohen and threatened to cancel the aforementioned ?settlement agreemen Case Document 48-8 Filed 07/18/19 Page 12 of 62- if Cohen did not complete the transaction.7 According to the article, Davidson sent Cohen a second email later in the day that stated in part, ?Please be advised that my client deems her settlement agreement canceled and void.? At 4:00 pm. that day, Cohen called Davidson and they spoke for over ?ve minutes. b. Cohen?s 4:00 pm. call with Davidson. and/or Davidson?s threats to cancel the ?settlement agreemen appear to have touched off a ?urry of communications about the settlement . agreement and whether Clifford would go .. Speci?cally: i. At 4:43 Howard sent Cohen a text message that stated: ?I?m told they?re going with DailyMail. Are you aware?? One minute later, Cohen responded: ?Call me.? Based on my involvement in this investigation, I understand Howard?s text to mean that he heard that Clifford was going to take her story of an extramarital affair with Trump to the Daily Mail, a tabloid newspaper. ii. At 4:45 pm, Howard called Cohen and they spoke for over two minutes. Moments later, Davidson and Cohen spoke for about two minutes. At 5 :03 pm, Cohen attempted to call Trump, but the call only lasted eight seconds. This was Cohen?s first call after he spoke with Davidson. iv. At 5:25 Cohen texted Howard, stating: v. At 6:44 Howard responded to Cohen?s text, stating: ?Not taking my calls.? Cohen responded one minute later: ?You?re kidding. Who are you trying to reach?? Howard responded one minute later: ?The ?agent.?? Based on my involvement in this 7 Due to the partially covert nature of the investigation to this date, the USAO has not requested documents ?om the Trump Organization or Davidson, and thus does not possess the email referenced in this article. 12 Case Document 48-8 Filed 07/18/19 Page 13 of 62 investigation, Iunderstand Howard?s text messages to mean that he attempted to contact Davidson about the matter involving Clifford, but that Davidson was not taking Howard?s calls. vi. At 6:49 pm, Cohen called Howard and they spoke for nearly four minutes. 0. The following day, on October 18, 2016, heSmokz'ngGun. com, a website that publishes legal documents and mugshots, published an article called: ?Donald Trump and the Porn Superstar,? which alleged that Trump had an extramarital affair with Clifford. However, the article notedthat Clifford had declined, to comment. 21. On or about October 25, 2016, the communications between Cohen, Davidson, Howard and Pecker picked up again, apparently concerning a transaction involving Clifford. Speci?cally, based on my review of toll records, information obtained pursuant to the Cohen Email Warrants and iCloud Warrant, as well as my review of public sources, I have learned the following: a. On October 25, 2016, at 6:09 pm, Howard sent Cohen a text message stating: ?Keith calling you urgently. We have to coordinate something on the matter he?s calling you about or its [sic] could look awfully bad for everyone.? One minute later, Davidson sent Cohen a text message stating ?Call me." Cohen and Davidson called each other several times over the next half hour but appear not to have connected. At 6:42 pm, Cohen and Davidson spoke for about eight minutes. At 7:11 pm, they spoke for another two minutes. b. The next morning, on or about October 26, 2016, at 8:26 am, Cohen called Trump and spoke to him for approximately three minutes. At 8:34 am, Cohen called Trump again and connected for a minute and a half. 0. At approximately 9:04 a.m.??less than thirty minutes after speaking with mmp-~ Cohen sent two emails to the person who had incorporated Resolution Consultants and Essential 13 Case Document 48-8 Filed 07/18/19 Page 14 of 62 Consultants for him, and stated ?can you send me asap the ?ling receipt? and then, in the second email, ?for Essential Consultants That person responded with the ?ling receipt two minutes later at 9:06 am. and with the certi?cation of formation 23 minutes later, at 9:27 am. d. Shortly after that, Cohen contacted a particular employee at First Republic (?First Republic Employee-2?) and told him, in sum and substance, that he decided not to open an account in the name of ?Resolution Consulting? and instead would be opening a real estate consulting company in the name, of ?Essential Consultants?? . Cohen told First Republic Employee-2 that he 7 was at Trump Tower, and wanted to go to a First Republic branch across the street to open the account, so First Republic Employee-2 called another employee of First Republic (?First Republic a preferred banker at that branch, to assist Cohen. At 11:00 am, First Republic Employee-1 called Cohen. 1 know from my participation in an interview with First Republic Employee?1, that around the time of the call he went to Cohen?s of?ce in Trump Tower?on the same ?oor as the Trump Organization?and went through account opening questions, including know your customer questions, with Cohen. In response to a series of know-=your-customer questions about the purpose of the account?the answers to which First Republic Employee?1 entered into a form?Cohen stated, in sum and substance, that he was opening Essential Consultants as a real estate consulting company to collect fees for investment consulting work, and all of his consulting clients would be domestic individuals based in the United States. Based on my review of records obtained from First Republic, it appears that this account (the ?Essential Consultants Accoun was created at a time between 11:00 am. and 1:00 pm. 6. At 1:47 pm, Cohen called Davidson and they spoke for approximately two minutes. At approximately 1:49 pm, Davidson emailed Cohen wiring instructions for an attorney client trust account at City National Bank. 14 Case Document 48-8 Filed 07/18/19 Page 15 of 62 f. After the Essential Consultants Account was opened on October 26, 2016, Cohen transferred $131,000 from a home equity line of credit that Cohen had at First Republic to the Essential Consultants Account. Following the transfer, at approximately 4:15pm. on October 26, 2016, First Republic Employee?2?s assistant emailed Cohen at his Trump Organization email address to tell him that the funds had been deposited into the Essential Consultants Account. Cohen forwarded that email to the Cohen Gmail Account and then forwarded it to Davidson. At 6:37 Cohen asked Pecker by text message, ?Can we speak? Important.? Cohen called Pecker at 6:49 pm. and connected for thirty seconds. At 6:57 p.1n., Cohen sent Howard a text message, stating: ?Please call me. Important.? Cohen called Howard at 7:00 p.111. and connected for about thirty seconds. At 7:06 p.111., Cohen called Pecker again and they spoke for nearly thirteen minutes. At 7:24 pm, Howard sent a text message to Cohen that: ?He said he?d call me back in 20 minutes. I told him what you are asking for his [sic] reasonable. I?ll get it sorted.? Approximately an hour later, at 8:23 pm, Howard told Cohen by text message to ?check your Gmail for email from my private accoun In an email sent at 8:23 pm. by Howard to Cohen and Davidson, with the subject line ?Confnmation,? Howard stated, ?Thank you both for chatting with me earlier. Confirming agreement on: Executed agreement, hand?signed by Keith?s client and returned via overnight or same?day FedEx to Michael, - Change of agreement to re?ect the correct LLC, Transfer of funds on Thursday AM to be held in escrow until receipt of agreement.? After receiving that email, at approximately 8:27 pm, Cohen asked Howard by text message, ?Can you and David [Pecker] give me a call.? Howard responded: ?David is not around I think. I?ll call.? At 8:28 pm, Howard called Cohen and they spoke for three minutes. 15 Case Document 48-8 Filed 07/18/19 Page 16 of 62 22. On October 27, 2016, Cohen made a payment to Davidson of with the funds intended for Cliffordwfor the purpose of securing her ongoing silence with respect to the allegations that she had an extramarital affair with Trump. Speci?cally, based on my review of toll records, bank records, and information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, I have learned the follOwing: a. At 9:47 Cohen sent Davidson an email, stating: ?Keith, kindly con?rm that the wire received 27, 2016 shall be held by you in your attorney?s trust account until such time as directed for release by me, in writing. Additionally, please ensure that all paperwork contains the correct name of Essential Consultants LLC. I thank you in advance. for your assistance and look forward to hearing from you later.? b. At approximately 10:01 according to records provided by First Republic Bank, Cohen completed papelwork to wire $130,000 from the Essential Consultants Account?? which had been funded a day prior from Cohen?s home equity line of credit??to the attorney client trust account at City National Bank that Davidson had speci?ed in the wiring instructions he sent to Cohen. The wire transfer was made shortly thereafter. c. At 10:02 Davidson responded to Cohen?s email from 9:47 stating: con?rm that I will work in good faith that no funds shall be disbursed unless until the plaintiff personally signs all necessary settlement paperwork, (the form of which will match the prior agreement). The settlement docs will name the correct corporation, (Essential Consultants LLC). Plaintiff signature will be notarized and returned to you via FedEx. Only after you receive FedEx will I disburse. Fair?? d. At 10:50 First Republic Employee-1 sent Cohen an email con?rming that the payment had been sent and providing him with the wire number. 16 Case Document 48-8 Filed 07/18/19 Page 17 of 62 23. On October 28, 2016, and the days that followed, Cohen ?nalized the transaction with Davidson. Speci?cally, based on my review of toll records, information obtained pursuant to the iCloud Warrant, public sources, and bank records, I know the following: a. On October 28, 2016, at 11:48 am, Cohen spoke to Trump for approximately ?ve minutes. Beginning at 1:21 pm, Cohen attempted a series of phone calls to Davidson, Pecker, and Howard throughout the day, although it appears he may only have comiected with Howard. .13.. Later that day, at approximately 7:01 Davidson stated to Cohen by text message that ?all is AOK. I should have signed, notarized docs on Monday. You should have them on Tuesday.? Cohen thanked him and said hope we are good.? Davidson responded, assure you. We are very good.? Howard also texted Cohen at 7:08 pm, ?Keith [Davidson] says we are good.? Cohen then responded to Howard and ?Excellent? to Davidson. At approximately 10:30 pm, Cohen spoke to Hicks for threeminutes. c. On October 31, 2016, Cohen called Howard at 8:22 pm. and they spoke for over three minutes. At 8:32 pm, Cohen received text messages from both Howard and Davidson. Howard said: ?You?ll have paperwork tomorrow says Davidson said: ?We are AOK. You will be receiving a package tomorrow.? Cohen responded ?Thank you? to Howard and ?Thanks Keith. Will call you then? to Davidson. From my involvement in this investigation, I believe Davidson was referring to a signed nondisclosure agreement when he told Cohen that he would receive a package. (1. Based on my review of court filings that became public in 2018, I have learned that on or about October 28, 2016, LLC and/or David Dennison? entered into a ?con?dential settlement agreement and mutual release? with ?Peggy Peterson,? pursuant to which ?Peterson? agreed not to disclose certain ?con?dential information pertaining to [Dennison]? in exchange for 17 Case Document 48-8 Filed 07/18/19 Page 18 of 62 $130,000. The agreement provided that would wire the funds to ?Peterson?s? attorney, who would then transfer funds to ?Peterson.? Cohen signed the agreement on behalf of The agreement stated that the address for which was later referred to in the agreement as ?Essential Consultants, was Cohen?s residence. e. Consistent with the ?con?dential settlement agreement and mutual release,? on or about November 1, 2016, Davidson transferred $96,645 from his attorney client trust account at City National Banktoa bank account in Clifford?s name. The wire ?net settlemen On the same day, at approximately 9:48 am. Davidson sent Cohen a text message with a picture of a FedEx delivery con?rmation, stating that at approximately 9:09 am. a package shipped by Davidson the previous day had arrived for Cohen at his Trump Organization address. On the same day, at approximately 6:14 Davidson sent Cohen an email with an audio ?le attached and said ?Give this a lesson [sic] and then call me.? The audio attachment was titled ?Stormy.mp3? and was a five-minute recording of Davidson interviewing Clifford about recent public allegations made by an adult?lm star named Jessica Drake regarding her alleged past affair with Trump; in the recording, Clifford explained the reasons she believed that Drake was not credible. Less than an hour later, at approximately 7:05 pm, Cohen called Trump, but it appears that they did not connect. Cohen then called a telephone number belonging to Kellyanne Conway, who at thetime was Trump?s campaign manager. They did not connect. At approximately 7:44 pm, however, Cohen received a return call from Conway, which lasted for approximately six minutes. 24. On November 4, 2016, just three days after the Clifford transaction was completed and just four days before the presidential election, the Wall Street Journal published an article alleging that the National Enquirer had ?Shielded Donald Trump? from allegations by 18 Case Document 48-8 Filed 07/18/19 Page 19 of 62 Playboy model Karen McDougal that she and Trump had an affair. The article alleged that AMI had agreed to pay McDougal to bury her story. McDougal, like Clifford, had been represented by Davidson. Based on my review of toll records, information obtained pursuant to the Cohen Email Warrants and iCloud Warrant, and public sources, it appears that Cohen spoke frequently to Davidson, Howard, Becker, and Hicks around the time of this article?s publication?just days before Election Daywabout the importance of preventing the McDougal and Clifford stories from gaining national traction. Specifically, [have learned the following: a. Between 4:30 and 8:00 pm. on November 4, Cohen communicated several times . with Howard, Pecker and Davidson. For instance, at approximately 4:49 Cohen sent Howard a text message with a screenshot of an email forwarded to him by another Trump Organization lawyer. The forwarded email was from a Wall Street Journal reporter, and asked for comment from Trump and/or the campaign on the story. Cohen also spoke with Hicks several times, including shortly before and/or after calls with Pecker, Howard and Davidson. Indeed, at approximately 7:33 using two different cellphones subscribed to him, Cohen appears to have been talking to Davidson and Hicks at the same time. b. At approximately 8:51 Cohen sent Howard a message, stating: ?She?s being really difficult with giving Keith a statement. Basically went into hiding and unreachable.? One minute later, Howard responded: ?I?ll ask him again. We just need her to disappear.? Cohen responded, ?She de?nitely disappeared but refuses to give a statement and Keith cannot push her.? At approximately 8:55 Howard responded to Cohen?s text: ?Let?s let the dust settle. We don?t want to push her over the edge. She?s on side at present and we have a solid position and a plausible position that she is rightfully employed as a columnist.? Based on my involvement in this investigation, I believe Cohen and Howard were referring to Karen McDougal when they were 19 Case Document 48-8 Filed 07/18/19 Page 20 of 62 discussing ?she? and ?her.? Additionally, I believe Howard?s statement that ?we have . . . a plausible position that she is right?illy employed as a columnist? was a reference to the fact that AMI had given McDougal payments for her role as a purported columnist for the company. 0. At approximately 8:58 pm. on November 4, 2016, Howard attempted to reassure Cohen about the effect of the forthcoming Wall Street Journal article, texting, think it?ll be ok pal. I think it?ll fade into the distance.? Cohen responded, ?He?s pissed.? Howard wrote back, ?I?m pissed! You?re pissed. Peckeris pissed. ,Keith is pissed. Not much we cando.? Based on my involvement in this investigation, I believe Cohen was referring to Trump when he stated ?he?s pissed.? Cohen asked Howard at approximately 9:00 pm. how the Wall Street Journal could publish its a1ticle if ?everyone denies.? Howard responded, ?Because there is the payment ?'om AM. It looks suspicious at best.? d. At approximately 9:03 pm, Hicks called Cohen and they spoke for two minutes. At approximately 9: 11 pm, Cohen called Howard and spoke to him for ?ve minutes. At approximately 9:15 pm, Hicks called Cohen and they spoke for nearly seven minutes. Again, Cohen used different phones for these two calls, such that he appears to have been on both calls for about a minute of overlap. At approximately 9:32 pm, Cohen texted Pecker, ?The boss just tried calling you. Are you tree?? A minute later, Cohen texted Howard, ?Is there a way to ?nd David quickly?? e. At approximately 9:50 pm, the Wall Street Journal article was published online. Howard and Hicks both sent web links for the article to Cohen. Over the next half hour, Cohen and Howard exchanged several text messages commenting on how the story came across. The next morning on November 5, 2016, at approximately 7:35 am, Cohen texted Hicks, ?So far I see only 6 stories. Getting little to no traction.? Hicks responded, ?Same. Keep prayingll It?s 20 Case Document 48-8 Filed 07/18/19 Page 21 of 62 working!? Cohen wrote back, ?Even CNN not talking about it. No one believes it and if necessary, I have a statement by Storm denying everything and contradicting the other porn stars statement. I wouldn?t use it now or even discuss with him as no one is talking about this or cares 1? Based on my involvement in this investigation, I believe Cohen was referring to the above- referenced recorded audio statement by Clifford that he obtained from Davidson, and was stating that such a statement could be used to in?uence potential negative media relating to Trump, but was __unnecessary at that time. ,7 Based on a text Hicks to__Cohen, I believe that later that morning, Pecker spoke to Trump. 25. On or about November 8, 2016, Trump won the election for President of the United States. 26. On or about January 12, 2018, the Wall Street Journal ?rst reported that Cohen arranged a payment to Clifford. On or about January 22, 2018, Common Cause, a government watchdog group, ?led a complaint with the Federal Election Commission, alleging that Cohen had violated campaign ?nance laws by making the payment to Clifford. Based on my review public sources following that report, as well as emails obtained pursuant to the Cohen Email Warrants, I have learned the following: a. On or about January 23, 2018, the day after Common Cause ?led its complaint, Cohen began emailing himself drafts of statements describing his payment to Clifford. Additionally, on January 23, 2018, Cohen emailed the following draft of that statement to an individual who appears to be writing a book on Cohen?s behalf: In October 2016, I was contacted by counsel for Ms. Clifford stating that news outlets, including ABC news, were pursuing the 2011 story of an alleged affair between Mr. Trump and Ms. Clifford. Despite the fact that both parties had already denied the allegation, as Mr. Trump?s longtime special counsel and protector, I took it upon myself to match the offer and 21 Case Document 48-8 Filed 07/18/19 Page 22 of 62 keep the story from breaking. I knew the allegation to be false, but I am also a realist who understands that just because something is falSe doesn ?t mean that it doesn?t create harm and damage. I could not allow this to occur. I negotiated a non?disclosure agreement with Ms. Clifford?s counsel and tendered the funds. I did this through my Delaware LLC and transferred personal funds to cover the agreement. I was not reimbursed any monies from Mr. Trump, the Trump Organization, any third party or the Presidential campaign. At no point did lever advise Mr. Trump of my communications or actions regarding this agreement. As outlandish and unusual as this may appear, the Trumps have been like family to me for over a decade. It?s what you do for family. (Emphasis added.) 7, Based on my involvement in this investigation, lbelieye that the above email is an acknowledgement that the allegation of the affair had existed for some time . .the 20]] story. . but that Cohen was motivated to ?keep the story from breaking? again in October 2016, b. On or about February 13, 2018, Cohen said in a statement to The New York Times that ?Neither the Trump Organization nor the Trump campaign was a party to the transaction with Ms. Clifford. The payment to Ms. Clifford was lawful, and was not a campaign contribution or a campaign expenditure by anyone.? Cohen declined to answer follow?up questions including whether Trump had been aware of the payment, why Cohen made the payment, or whether similar payments had been made to other people. 0. On or about February 14, 2018, Cohen was asked by The New York Times whether Trump had reimbursed him, whether he and Trump had made any arrangement at the time of the payment, or whether he had made payments to other women. Cohen stated in response, can?t get into any of that.? On or about February 14, 2018, Cohen also stated to The Washington Post that: ?In a private transaction in 2016, I used my own personal funds to facilitate a payment of $130,000 to Ms. Stephanie Clifford. Neither the Trump Organization nor the Trump campaign was a party to the transaction with Ms. Clifford, and neither reimbursed me for the payment, either directly or indirectly.? 22 Case Document 48-8 Filed 07/18/19 Page 23 of 62 d. On or about March 9, 2018, Cohen stated to ABC News that ?the funds were taken from my home equity line and transferred internally to my LLC account in the same ba 27. For the foregoing reasons, there is probable cause to believe that Cohen committed the Subject Offense by making an in-kind contribution to Trump or the Trump campaign in the form of a $130,000 payment to Clifford on the election. Indeed, while Cohen denies having given an unlawful contribution, in his own statements Cohen has admitted that he paid. $130,000 of his ?personal funds? to Clifford and. that the payment occurred less than two weeks before the election, as Trump was facing negative media allegations about his behavior toward women, even though allegations of an affair between Trump and Clifford existed since 201 l. 28. have reviewed records maintained by from which I have learned, in substance and in part, that the Target Cellular Devices are still active. Based on my training and experience, my familiarity with this investigation, and the information set forth above, I therefore believe that the requested data will lead to evidence of the Subject Offense. Speci?cally, information will lead to the present location of the Target Cellular Devices; law enforcement may then obtain evidence from the Target Cellular Devices, by subpoena or search warrant, including but not limited to contact lists containing contact information for participants in the illegal campaign contribution scheme and well as text messages between these participants. WK OF EXECUTION 29. In my training and experience, I have learned that cellular phones and other cellular devices communicate wirelessly across a network of cellular infrastructure, including towers that route and connect individual communications. When sending or receiving a communication, a cellular device broadcasts certain cellular and wifi signals to the cellular tower 23 Case Document 48-8 Filed 07/18/19 Page 24 of 62 that is routing its communication. These cellular and Wi? signals include a cellular device?s unique identi?ers. 30. To facilitate execution of this warrant to determine the location of the Target Cellular Devices, law enforcement may use an investigative device or devices capable of broadcasting cellular and Wi? signals that will be received by the Target Cellular Devices or receiving cellular and wi? signals from nearby cellular devices, including the Target Cellular _e_vices.WS.uchwa..dexice may ?mction in some respects like a cellular tower, except that itwill not be connected to the cellular network and cannot be used by a cell phone to communicate with others. The device may send a signal to the Target Cellular Devices and nearby cellular devices and thereby prompt them to send cellular and wi? signals that include the unique identi?er of the device. Law enforcement may monitor the cellular and wi? signals broadcast by the Target Cellular Devices for non-content signal information and use that information to determine the Target Cellular Devices? location, even if it is located inside a house, apartment, or other building. The device will not intercept the contents of the Target Cellular Devices? communications, such as telephone calls, text messages, and other electronic communications. Further, the device will not collect any other data stored on the Target Cellular Devices, including e-mails, text messages, contact lists, images, or Global Positioning System (GPS) data. 31. The investigative device may interrupt cellular service of phones or other cellular devices within its immediate vicinity. Any service disruption to non?target devices will be brief and temporary, and all operations will attempt to limit the interference with such devices. In order to connect with the Target Cellular Devices, the device may brie?y exchange cellular and wi? signals with all phones or other cellular devices in its vicinity to determine whether those devices? unique identi?ers match the identi?ers of the Target Cellular Devices. These cellular 24 Case Document 48-8 Filed 07/18/19 Page 25 of 62 and wifl signals may include cell phone identi?ers. The device will not complete a connection with cellular devices determined not to be the Target Cellular Devices, and law enforcement will limit collection of information Eom devices other than the Target Cellular Devices. To the extent that any information from a cellular device other than the Target Cellular Devices is collected by the law enforcement device, law enforcement will delete that information, and law enforcement will make no investigative use of it absent further order of the court, other than distinguishing the Target Cellular Devices from all other cellular devices. AUTHORIZATION REQUEST 32. Based on the foregoing, I request that the Court issue the proposed search warrant, pursuant to Federal Rule of Criminal Procedure 41. The proposed warrant also will function as a pen register order under 18 U.S.C. 3123. 33. I further request, pursuant to 18 U.S.C. 3103a(b) and Federal Rule of Criminal Procedure that the Court authorize the officer executing the warrant to delay notice until 30 days from the end of the period of authorized surveillance, This delay is justi?ed because there is reasonable cause to believe that providing immediate noti?cation of the warrant may have an adverse result, as defined in 18 U.S.C. 2705. Providing immediate notice to the subscriber or user of the Target Cellular Devices would seriously jeopardize the ongoing investigation, as such a disclosure would give that person an opportunity to destroy evidence, change patterns of behavior, and notify confederates. See 18 U.S.C. 3103a(b)(1). There is reasonable necessity for the use of the technique described above, for the reasons set forth above. See 18 U.S.C. 3103a(b)(2). 25 Case Document 48-8 Filed 07/18/19 Page 26 of 62 34. I further request that the Court authorize execution of the warrant at any time of day or night, owing to the potential need to locate the Target Cellular Devices outside of daytime hours. 35. I ?rrther request that the Court order that all papers in support of this application, including the af?davit and search warrant, be sealed until further order of the Court. These documents discuss an ongoing criminal investigation that is neither public nor known to all of the targets of theinvestigation. Accordingly, there is good cause to seal these because their premature disclosure may seriously jeopardize that investigation. 36. A search warrant may not be legally necessary to compel the investigative technique described herein. Nevertheless, I hereby submit this warrant application out of an abundance of caution. Respectfully submitted, Federal Bureau of Investigation Subscribed and sworn to before 2.1; J, . On: #IWZe-hi-r ii! [if 61?! if?" itngg?m UNITED STKTES MAGISTRATE JUDGE 26 Case Document 48-8 Filed 07/18/19 Page 27 of 62 IN THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF NEW YORK SITE SIMULATOR TO LOCATE THE Case 1 2971 CELLULAR DEVICES ASSIGNED CALL NUMBERS IN THE MATTER OF THE USE OF A AND ORDER OF AUTHORIZATION Special Agents of the, Federal Bureau 9t Investigation and Other Authorized Personnel I. Findings The Court herebyjfinds: 1. Upon an af?davit of Special Agent - of the Federal Bureau of Investigation (?Affidavit?) and pursuant to Federal Rule of Criminal Procedure 41, there is probable cause to believe that violations of 52 U.S.C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offense?) have been committed by Michael Cohen (the ?Target Subject?), and that the Target Subject uses cellular devices assigned call numbers ?the (?Target Cellular Devices?), which are described in Attachment A. Further, there is probable cause to believe that the location of the Target Cellular Device will constitute evidence of the Subject Offense. Speci?cally, there is probable cause to believe that the location of the Target Cellular Devices will constitute evidence of those criminal violations, including leading to the location of the Target Cellular Devices, on which there is probable cause to believe evidence of these offenses exist, as detailed below. 2. Pursuant to 18 U.S.C. 3123(b)(1), the Government has certi?ed that the pen register information for the Target Cellular Devices is relevant to an ongoing investigation by the Case Document 48-8 Filed 07/18/19 Page 28 of 62 Investigating Agency of the Target Subject and others unknown in connection with suspected violations of the Subject Offense. NOW, THEREFORE, pursuant to Fed. R. Crim. P. 41, 18 U.S.C. 3121 et seq, and 18 U.S.C. 3103a, IT IS HEREBY ORDERED: ll. Warrant and Order of Authorization 3. Warrant. Law enforcement agents and other authorized law enforcement of?cials are hereby authorized to employ an electronic investigativetechnique, which is described in Attachment B, to the determine the location of the Target Cellular Devices, which are described in Attachment A. 4. Data Collection and Retention. In the course of employing the technique, law enforcement agents and other authorized law enforcement of?cials must make reasonable efforts to limit interference with cellular devices other than the Target Cellular Devices, must delete information collected from cellular devices other than the Target Cellular Devices once the Target Cellular Devices is located, and are prohibited from using data acquired beyond that necessary to locate the Target Cellular Devices, absent further order of the Court. 5. Delayed Notice. Pursuant to 18 U.S.C. 3103a(b) and Federal Rule of Criminal Procedure the Court authorizes the of?cer executing the warrant to delay in notice until 30 days from the end of the period of authorized surveillance. This delay is justified because there is reasonable cause to believe that providing immediate noti?cation of the warrant may have an adverse result, asidefmed in 18 U.S.C. 2705. Providing immediate notice to the subscriber or user of the Target Cellular Devices would seriously jeopardize the ongoing investigation, as such a disclosure would give that person an opportunity to destroy evidence, change patterns of behavior, and notify confederates. See 18 U.S.C. 3103a(b)(1). There is reasonable necessity 2 . Case Document 48-8 Filed 07/18/19 Page the technique described above, for the reasons set forth above. See 18 U.S.C. 3 103 6. Time of Execution. The Court authorizes execution of this Warrant at any time of day or night, owing to the potential need to locate the Target Cellular Devices outside of daytime hours. 7. Sealing. This Warrant and Order, and the supporting Agent Af?davit, shall be except that the Government may without ?lrther. order of this Court: provide copies of the Warrant and Order or the supporting Application and Agent Af?davit as need be to personnel assisting the Government in the investigation and prosecution of this matter; and disclose these materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. Dated: New York, New York 7:7 777 tr 77* 777 Date Issued Time Issued w, . ix STATES MAGISTRATE JUDGE Southern_Disrpict York?; .7 73!, - ?rm, a Case Document 48-8 Filed 07/18/19 Page 30 of 62 ATTACHMENT A This warrant authorizes the use of the electronic investigative technique described in Attachment to identify the location of the cellular devices assigned phone numbers - ?whose Wireless provider is and Whose listed subscriber is Michael Cohen. Case Document 48-8 Filed 07/18/19 Page 31 of 62 ATTACHMENT Pursuant to an investigation of Michael Cohen for a violation of 52 U.S.C. 301l6(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offense?), this Warrant authorizes the of?cers to whom it is directed to determine the location of the cellular devices identi?ed in Attachment A by collecting and examining: 1. radio cellular and wi? signals emitted by the target cellular device for the purpose of communicating with .. cellular infrastructure. including towers that route and connect individual communications; and 2. radio cellular and wi? signals emitted by the target cellular device in response to radio cellular and wi? signals sent to the cellular device by the of?cers; for a period of thirty days, during all times of day and night. This warrant does not authorize the interception of any telephone calls, text messages, other electronic communications, and this warrant prohibits the seizure of any tangible property. The Court ?nds reasonable necessity for the use of the technique authorized above. See 18 U.S.C. 3103a(b)(2). Case Document 48-8 Filed 07/18/19 Page 32 of 62 IN THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF NEW YORK IN THE MATTER OF THE USE OF A CELL- SITE SIMULATOR To LOCATE THE Case No. CELLULAR DEVICES ASSIGNED CALL NUMBERS AND - Filed Under Seal AFFIDAVIT IN SUPPORT OF being ?rst duly sworn, herebydepose and state as follows: INTRODUCTION AND AGENT BACKGROUND .. AN APPLICATIONFOR l. I make this af?davit in support of an application for a search warrant under Federal Rule of Criminal Procedure 41 to authorize law enforcement to employ an electronic investigative technique, which is described in Attachment B, to determine the locatiOn of the cellular devices assigned call numbers ?(the f?Target Cellular Devices?), which are described in Attachinent Special Agent with the Federal Bureau of Investigation I have been a Special Agent with the FBI since 2009. In the course of my experience and training in these positions, I have participated in- criminal investigations into federal offenses involving a wide array of ?nancial Crimes, including offenses involving public corruptiOn. I also have training and experience executing warrants for cellphone location data. 3. The facts in this af?davit come from ?my persOnal observations, my training and experience, and information obtained from other agents and witnesses. This af?davit is intended to Show merely that there is suf?cient probable cause for the requested warrant and does not set forth all of my knowledge about this matter. Case Document 48-8 Filed 07/18/19 Page 33 of 62 4. One purpose of applying for this warrant is to determine with precision the Target 8 Cellular Devices? location. However, there is reason to believe the Target Cellular Devices are currently located somewhere within this district because the Target Cellular Devices? owner is known to spend most of his time in this district. Pursuant to Rule law enforcement may locate the Target Cellular Devices outside the district provided the device is within the district . when the warrant is issued. 1 5. Based on the facts set forth in this af?davit, there is probable cause to believe that violations of 52 U. S. C. 30116(a)(1)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offense?) has been committed, are being committed, and will be committed by Michael Cohen and others. There is also probable cause to believe that the location of the Target Cellular Devices will lead to evidence of the Subject Offense, as detailed below. 6. Because collecting the information authorized by this warrant may fall within the statutory. de?nitions of a ?pen register? or a ?trap and trace device,? see 18 U.S.C., 3127(3) (4), this warrant is designed to comply with the Pen Register Statute as well as Rule 41. See 18 U.S.C. 3121?3127. This warrant therefore includes 'all the information required to be included . in a pen register order. See 18 U.S.C. 3123(b)(1). PROBABLE CAUSE Introduction 7. . The United States Attorney?s Office for the Southern District of New. York and the FBI are investigating'a criminal violation of the campaign finance laws by Michael Cohen, a lawyer who holds himself out as the personal attorney for President Donald J. Trump. As detailed below, there is probable cause to believe that Cohen made an excessive in? kind contribution to the presidential election campaign of then-candidate Donald Trump in the 2 . . Case Document 48-8 Filed 07/18/19 Page 34 of 62' form of a $130,000 payment to Stephanie Clifford, an individual who is alleged to have had an extramarital affair with Trump, in exchange for her agreement not to disclose that alleged affair on the eve of the 2016 presidential election. 8. i The Target Cellular Devices referenced in this Af?davit are the cellphones assigned call numbers?As further discussed below, the Target Cellular Devices are subscribed to in the name of Michael Cohen (the ?Subscriber?). The Subscriber is believed to use the Target Cellphones and IS a Target subject of this Investigation? ?mowwrt is the Service Provider for the Target Cellphones. I Prior Relevant Process 9. In connection with an investigation then being conducted by the Of?ce?of . the Special Counsel the FBI sought and obtained from the Honorable Beryl A. Howell,- Chief United States District 'Judge for the District of Columbia, three search warrants for emails and other content information associated with two email accounts used by Cohen, and one search warrant for stored content associated with an iCloud account used by Cohen. Speci?cally: a. On or about July 18, 2017, the?FBI sought and obtained a search warrant for emails in the account -Et)gmail. com (the "Cohen Gmail Account?) sent or received between January 1, 2016 and July 18, 2017 (the ?First Cohen Gmail Warrant?). b. On or about August 8, 2017, the FBI sought and obtained a search warrant for content stored in the iCloud account associated with Apple ID -@gmail.com (the ?Cohen iCloud Account? and the ?Cohen iCloud Warrant?). c. On or about November 13, 2017, the FBI sought and obtained a search warrant for emails in the Cohen Gmail Account sent or received betvizeen June 1, 2015 and November 13, 2017 (the ?Second Cohen Gmail Warrant?). Case Document 48-8 Filed 07/18/19 Page about November 13, 2017, the FBI sought and? obtained a search warrant for emails in the account '_:the ?Cohen Account?) sent or received between'the opening of the Cohen Account1 and November 13, 2017 (the ?First Cohen Warran i 10. The SCO has since referred certain aspects of its investigation into Cohen to the USAO, which is working with the New York Field Of?ce. 11. On orabout February 28, 2018, the USAO and FBI sought and obtained search warrants for emails in Cohen?Gmail Account andwCohen Account, among other accounts, sent or received between November 14, 2017 and February 28, 2018 (the ?Third Cohen . Gmail Warrant? and ?Second Cohen 12.' The above?described warrants are referred to herein as the ?Cohen Emails Warrants? and, with respect to the iCloud Warrant, the ?Cohen iCloud Warrant.? The Illegal Campaign Contribution Scheme 13. From-my review of public sources, I have learned the following: a. In or around October 2011, there were rumors published on the gossip website heDz?rty. com that Trump had had an extramarital affair with Clifford, an adult ?lm actress whose screen nameis Stormy Daniels, in. or around July 2006. In or about October 2011, Life Style 1 Based on my review of this warrant and the af?davit in support of it, I know that the warrant did not specify a time period, but the af?davit indicated that, pursuant to court order, the service provider had provided non-content information for the Cohen Account that indicatedthat the account contained emails fromthe approximate period of March 2017 through the date of the warrant. 2 On or about February 28, 2018 and April 7, 2018, and FBI sought and obtained Rule 41 search warrants authorizing the search of emails and content obtained pursuant to previously issued warrants for additional subject offenses. 4 Case Document 48-8 Filed 07/18/19 Page 36 of 62 Magazine, a'tabloid sold in supermarkets, also published an article, based on the report in heDz?rty. com, alleging an affair had occurred between Trump and Clifford. Both Trump and Clifford, through their representatives, issued denials in response to the articles. b. Speci?cally, on or about October 11, 2011, Keith Davidson, who identi?ed himself as Clifford?s attorney, sent a cease and desist letter to TheDz'rty. com, demandingthat the article regarding Trump and Clifford be removed from the website. Additionally, on or about October Counseletoatheqirurnpa Organization, stated to News that ?[t]he totally untrue and ridiculous story . . . emanated from a sleazy and disgusting website. . . The Trump Organization and Donald J. Trump will be bringing a lawsuit . . . [and] Mr. Trump and the Trump Organization would like to thank and commend Stormy Daniels and her attorneys for their honesty and swift actions.? 14. On or about June 16, 2015, Trump formally launched his 2016 presidential campaign. . On or about May 4, 2016, Trump became the presumptive RepublicanParty nominee for president, and on July 19, 2016, Trump of?cially became the nominee. Based on my review of public sources, I have learned that while it does not appear that Cohen had an of?cial title as part of the Trump campaign, on multiple occasions Cohen made public statements on behalf of Trump or his campaign. For instance, on or about August 18, 2016, Cohen appeared on CNN to defend Trump?s polling numbers. 15. On or about October 7, 2016, he Washington Post published online a video and accompanying audio in which Trump referred to women in what the article described as ?vulgar terms? in a 2005 conversation with Billy Bush, who was then the host of Access Hollywood. The following day, on October 8, 2016, Trump appeared in a video in which he stated, among other things, ?I?ve said and done things I regret and words released today on this 5 Case Document 48-8 Filed 07/18/19 Page 37 of 62 more than a decade old video are one of them. Anyone who knows me knows these words don?t reflect who I am. I said it. I was wrong and I apologize.? Based on my review of public sources, I also know that representatives of the Trump Campaign stated, in sum and substance, that the Access Hollywood comment was an old and isolated incident. 16. Based on my review of public sources, including an article published in Slate magazine by a reporter who interviewed Clifford, that around this same time, in or about 6,,ClifforcL was in discussions Morning; America Show and Slate. magazine, among ether media sources, to provide these media outlets with her statement about her I alleged relationship with TruInp. According to the article 1n Slate, which the author based on conversations with Clifford over the telephone and by text message, Clifford wanted to be paid for her story or be paid by Trump not to disclose her accusation. As Cohen summarized in a 2018 email obtained pursuant to the Cohen Email Warrants: ?In October 2016, I was contacted by counsel for Ms. Clifford stating that news outlets, including ABC News, were pursuing the 2011 story of an alleged affair between Mr. Trump and Ms. Clifford.? . 17. From my review of telephone toll records3 and information produced pursuant to the iCloud Warrant and Cohen Email Warrants, have learned that in the days following the Access Hollywood video, Cohen exchanged a series of calls, text messages, and emails with Keith Davidson, who was then Clifford?s attorney, David Pecker and Dylan Howard 3 My attribution of certain telephone numbers to certain individuals as described in this af?davit 1s based on my review of the vCard (virtual contact ?le) and text messages obtained from Cohen? telephone pursuant to the iCloud Warrant. Case Document 48-8 Filed 07/18/19 Page 38 of 62 of American Media, Inc. the publisher of the National Enquirer,4 Trump, and Hope Hicks, who was then press secretary for Trump?s presidential campaign. these text messages and calls?as well as all of the text messages and calls referenced in this af?davit involving Cohen?Cohen used one of the Target Cellular Devices for the communication. 18. Based on the timing of the calls in the days following the Access Hollywood story, and the content of the text messages and emails, I believe that at least some of these of the Access Hellywood story. In particular, I have learned the following: a. On October 8, 2016, at approximately 7:20 pm, Cohen received a call frOm Hicks. Sixteen seconds into the call, Trump joined the call, and the call continued for over four minutes.5 Based on the toll records that the USAO has obtained to date, I believe that this was the ?rst call Cohen had received or made to Hicks in at least multiple weeks, and that Cohen and Trump spoke on the telephone about once a month prior to this date speci?cally, prior to this call on October 4 Pecker is President of AMI and, according to his own statements in public reports, a personal friend of Trump. Howard is the chief content of?cer of AMI, who according to public records reports directly to Pecker. 5 I believe that Trump joined the call between Cohen and Hicks based on my review of toll records. Speci?cally, I know that a call was initiated between Cohen?s telephone number and Trump?s telephone number at the same time the records indicate that Cohen was talking to Hicks. After the Cohen-Trump call was initiated, it lasted the same period of time as the Cohen?Hicks call. Additionally, the toll records indicate a and then Trump?s telephone number, which, based on my training and experience, means that the call was either transferred to Trump, or that Trump was added to the call as a conference or three?way call participant. In addition, based on my conversations with another law enforcement agent who has spoken to a law enforcement agent who has interviewed Hicks, I have learned that Hicks stated, in substance, to the best of her recollection, she did not learn about the allegations made by Clifford until earlyNovember 2016. Hicks was not speci?cally asked about this three-way call. 7 I Case Document 48-8 Filed 07/18/19 Page 39 of 62 8, 2016, Cohen and Trump had spoken once in May, once in June, once in July, zero times in August, and twice in September. b. Approximately ten minutes after the call ended, Hicks and Cohen spoke again for about two minutes. c. At 7:39 pm, immediately after the second call with Hicks ended, Cohen called David Pecker (as noted above, the President of American Media Inc., or AMI) and they connected 7 for thirty seconds. ApprOximately four minutes later, Cohen called, Pecker again and they spoke for more than a minute. .Three minutes after ending his call with Pecker, Cohen received a call from Dylan Howard (as noted above, the Chief Content Of?cer of AMI), and they spoke for approximately a minute. According to toll records, it does not appear that Cohen and Howard . spoke regularly prior to October 8, 2016, as it had been over a month since they had called each other. (1. At 7:56 pm, approximately eight minutes after his call with Howard ended, Cohen called Hicks and they connected for two minutes: At approximately the same time this call ended, Cohen received a call from Pecker, and they spoke for about two minutes. At 8:03 pm, about three minutes after ending his call with Pecker, Cohen called Trump, and they spoke for nearly eight minutes. e. At 8:39 pm. and 8:57 pm, Cohen received calls from Howard and spoke to him for about four and six minutes, respectively. At 9:13 pm, about ten minutes after Cohen and Howard hung up ?om the second of these calls, Howard sent Cohen a text message that said: ??Keith will do it. Let? reconvene tomorrow.? Based on my involvement in this investigation,'l believe that when Howard wrote ?Keith,? he was referring to Keith Davidson, the attorney for Stephanie Clifford. . At 3:31 am, now on October 9, 2016, Cohen sent Howard a text message in 8 Case Document 48-8 Filed 07/18/19 Page 40 of 62 response that Said:? ?Thank you.? Eight minutes later, Cohen sent Howard a text message that said: ?Resolution Consultants LLC. is the name of the entity I formed a week ago. Whenever you wake, please call my cell.? i f. The following day, on OctoberlO, 2016, at 10:58 am, Howard sent ?a text message to Cohen and Davidson, which statedzv ?Keith/Michael: connecting you both in regards to that business opportunity. Spoke to the client this AM and. they?re con?rmed to proceed with the message that stated: ?Michael if we are ever going to close this deal In my opinion, it needs to be today. Keith.? Davidson and Cohen then spoke by phone for about three minutes. Based on my participation in this investigation, I believe that when Howard wrote that the ?clien was ?con?rmed to proceed with the opportunity,? he was referring to Clifford?s agreement in principle to accept money from Cohen in exchange for her agreement not to discuss any prior affair with then-candidate Trump.6 g. Based on my review of records obtained pursuantito the Cohen Email Warrants, I know that on or about October 10, 2016, Clifford and Davidson appear to have signed. a ?side letter agreement? that stated it was an exhibit to a ?con?dential settlement agreement and mutual release? between ?Peggy Peterson? and-?David Dennison.? The purpose of the document, according to the agreement, was to de?ne the ?true name and identity? of ?persons named by 6 As set forth below, AMI was also involved in a payment to model Karen McDougal However, because these communications were in close temporal proximity to the events involving the negotiation of a payment to Clifford, the execution of the agreement with Clifford, and the payment of money to Clifford, I- believe that these communications were related to Clifford. Additionally, based on my review of public statements by McDougal, I have learned that she negotiated an agreement with AMI several months prior to these communications between Cohen - and Pecker, Howard, and Davidson. Case Document 48-8 Filed 07/18/19 Page 41 of 62 pseudonym in ?con?dential settlement agreement and mutual release.? The side letter agreement speci?es the identity of ?Peggy Peterson? to be Clifford, but the space for ?Dennison?s? identity is blank. The agreement also includes a signature page for ?Peterson,? ?Dennison,? and their attorneys. The signature page is signed by ?Peterson? and his attorney, Davidson, but the document is unsigned by ?Dennison? and his attorney. Based on my involvement in this, investigation,1 believe that Davidson sent Cohen this partially-Signed ?side letter agreement? in his client on October 10, 2016. 19. 'It appears that on October 13, 2016, and the days that followed, Cohen took steps to complete a transaction with Davidson, including attempting to open an account from which Cohen could transfer funds to Davidson. Speci?cally, from my review of toll records, information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, records maintained by First Republic Bank (?First Republic?), as well as my participation in interviews with employees of First Republic, I have learned the following: a. On the morning of October 13, 2016, at 8:54 am, Cohen sent Pecker atext message that stated: need to talk to you.? At 9:06 am, Pecker sent a text message to Cohen that stated, called please call me back.? The tolls between Cohen and Pecker do not show a telephone call between 8:54 am. and 9:06 am. However, based on my review of text messages,.I have learned that Cohen and Pecker communicate with each other over Signal, which is an communications cellphone application that allows users to send text messages and make - calls. 9 b. At 9:23 Cohen sent an email that stated ?call me? to a banker at First Republic Bank (?First Republic The email attached documents from the Secretary of State 10' Case Document 48-8 Filed 07/18/19 Page.42 of 62 of Delaware indicating that Cohen had formed a limited liability company called ?Resolution Consultants on September 30, 2016. Asnoted above, ?Resolution Consultants? is the name of the entity that Cohen had told Howard he had formed recently after Howard said Davidson would ?do it.? At 10:44 Cohen called First Republic Employee?2 and told him, in sum and substance, that he needed an account in the name of ?Resolution Consultants? opened immediately, and that he did not want an address on the checks written out of the account. Later that day, Cohen returned the account opening documents partially completed, but failed to provide a copy of his driver?s license or passport, and did not respond to the employee?s question of ?how he wanted to fund the account. As a result, the account was never opened. c. On October 17, 2016, Cohen incorporated Essential Consultants LLC in Delaware: I That same day, he ?led paperwork to dissolve Resolution Consultants LLC. 20. Despite these steps taken by Cohen, it appears that the negotiation between Cohen and Davidson was not progressing suf?ciently fast enough for Davidson or his client, Clifford, and they threatened to go public with Clifford?s allegations just days before the- presidential election. Speci?cally, based on my review of toll records, information obtained pursuant to the iCloud Warrant, and public sources, I know the following: a. According to an article in The Washington Post, which quoted emails sent from Cohen?s email account hosted by the Trump Organization, on October 17, 2016, Davidson emailed Cohen and threatened to cancel the aforementioned ?settlement agreemen Case Document 48-8 Filed 07/18/19 Page 43 of 62 if cohen did not complete the transaction.? According to the article, Davidson sent Cohen a second email later in the day that stated in part, ?Please be advised that my client deems her settlement agreement canceled and void.? At 4:00 pm. that day, Cohen called Davidson and they spoke for over five minutes. b. Cohen?s 4:00 pm. call with Davidson and/or Davidson?s threats to cancel the ?settlement agreement? appear to have touched off a ?urry of communications about the settlement whether Clifford would go public. Speci?cally: i. At 4:43 pm, Howard sent Cohen a text message that stated: ?I?m told? they?re going with DailyMail. Are you aware?? One minute later, Cohen responded: ?Call me.? Based on my involvement in this investigation, I understand Howard? 3 text to mean that he heard that Clifford was going to take her story of an extramarital affair with Trump to the Daily Mail, a tabloid newspaper. - - ii. At 4:45 pm, Howard called Cohen and'they spoke for over two minutes. Moments later, Davidson and Cohen spoke for about two minutes, At 5:03 pm, Cohen attempted to call Trump, but the call only lasted eight seconds. This was Cohen?s ?rst call after he spoke with Davidson. iv. At 5:25 pm, Cohen texted Howard, stating: v. At 6:44 pm, Howard responded to Cohen?s text, stating: ?Not taking my calls.? Cohen responded one minute later: ?You?re kidding. Who are you trying to reach??, 373 Howard responded one minute later: ?The ?agent. Based on my involvement in this 7 Due to the partially covert nature of the investigation to this. date, the USAO has not requested documents from the Trump Organization or Davidson, and thus does not possess the email referenced in this article. 12' Case Document 48-8 Filed 07/18/19 Page 44 of 62 investigation, I understand Howard? 3 text messages to mean that he attempted to contact Davidson about the matter involving Clifford, but that Davidson was not taking Howard?s calls. vi. . At 6:49 pm, Cohen called Howard and they spoke for nearly four minutes. c. The following day, on October 18, .2016, MeSmokingGun.com, a website that publishes legal documents and mugshots, published an article called: ?Donald Trump and the Porn Superstar,? which alleged that Trump had an extramarital affair with Clifford. However, the 21. On or about October 25, 2016, the communications between Cohen, Davidson, Howard and P-ecker picked up again, apparently concerning a transaction involving Clifford. Speci?cally, based on my review of toll records, information obtained pursuantto the Cohen Email warrants and iCloud Warrant, as well as my review of public sources, I have learned the following: a. On October 25, 2016, at 6:09 pm, Howard sent Cohen a text message stating: ?Keith calling you urgently. We have to coordinate something on the matter he?s calling you about or its.[sic] could look awfully bad for everyone.? One minute later, Davidson sent Cohen a text message stating ?Call me.? Cohen and Davidson called each other several times over the next half hour but appear not to have connected. At 6:42 pm, Cohen and Davidson spoke for about eight minutes. I At 7:11 pm, they spoke for another two minutes. b. The next morning,on or about October 26, 2016, at 8:26 am, Cohen called-Trump and spoke to him for approximately three minutes, At 8:34 am, Cohen called Trump again and connected for a minute and a half. c. At approximately 9:04 a.m.??less than thirty minutes after speaking with Trump? Cohen sent two emails to the person who had incorporated Resolution Consultants and Essential 13 Case 1:18jcr-00602-WHP Document 48-8- Filed 07/18/19 Page 45 of 62 Consultants for him, and stated ?can you send me asap the ?ling receip and then, in the second email, ?for Essential Consultants That person responded with the ?ling receipt two minutes later at 9:06 am. and with the certi?cation of formation 23 minutes later, at 9:27 am. d. Shortly after that, Cohen contacted a particular employee at First Republic (?First Republic Employee?2?) and told him, in sum and substance, that he decided not to open an account in'the name of ?Resolution Consulting? and instead would be opening a real estate consulting company in the. name of ?Essential Consultants.? Cohen told First Republic Employee?2 that he was at Trump Tower, and wanted to go to a First Republic branch across the street to open the account, so First Republic Employee?2 called another employee of First Republic (?First Republic Employee?1?), a preferred banker at that branch, to assist Cohen. At 11:00 am, First Republic I Employee?1 called Cohen. I know from my participation in an interview with First Republic Employee-l, that around the time of the call he went to Cohen?s of?ce in Trump Tower?on the same ?oor as the Trump Organization?land went through account opening questions, including know your customer questions, with Cohen. In response to a series of know-your-customer questions about the purpose of the account?the answers to which First Republic Employee-1 entered into a form??Cohen stated, in sum and substance, that he was opening Essential Consultants as a real estate consulting company to collect fees for investment consulting work, and all of his consulting clients would be domestic individuals based in the United States. Based on my review of records obtained from First Republic, it appears that this account (the ?Essential Consultants Accoun was created at a time between 11:00 am. and 1:00 pm. e. ,At 1:47 Cohen called Davidson and they spoke for approximately two A - minutes. At approximately 1:49 Davidson emailed Cohen wiring instructions for an attorney client trust account at City National Bank. 14 Case Document 48-8 Filed 07/18/19 Page 46 of 62 f. After the Essential Consultants Account was opened on October 26,. 2016, Cohen transferred $131,000 from a home equity line of credit that Cohen had at First Republic to the Essential Consultants Account. Following the transfer, at. approximately 4:15 pm. on October 26, 2016, First Republic Employee-2?s assistant emailed Cohen at his Trump Organization email address to tell him that the funds had been deposited into the Essential Censultants Account. Cohen forwarded that email to the Cohen Gmail Account and then forwarded it to Davidson. 9? . 1 7 1 Cohen Called Pecker at 6:49 pm. and connected for thirty seconds. At 6:57 pm, Cohen sent Howard a text message, stating: ?Please call me. Important.? Cohen called Howard at 7:00 pm. and connected for about thirty seconds. At 7:06 pm, Cohen called Pecker again and they spoke for nearly thirteen minutes. At 7:24 pm, Howard sent a text message to Cohen that: ?He said he?d call me back in 20 minutes. I told him what you are asking for his [sic] reasonable. I?ll get it sorted.? Approximately an'hour later, at 8:23 pm, Howard told Cohen by text message to ?check your Gmail for email from my private account.? In an email sent at 8:23 pm. by Howard to Cohen and Davidson, with the subject line ?Con?rmation,? Howard stated, ?Thank you both for chatting with me earlier. Con?rming agreement on: - Executed agreement, hand-signed by Keith?s client and returned via overnight or same-day FedEx to Michael, - Change of agreement to re?ect the correct LLC, - Transfer of funds on Thursday AM to be held in escrow until receipt of agreement.? After receiving that email, at approximately 8:27 pm, Cohen asked Howard by text message, ?Can you and David [Pecker] give me a call.? Howard responded: ?David is not around I think.- I?ll call.? At 8:28 pm, Howard called Cohen and they spoke for three minutes. 15 Case Document 48-8 Filed 07/18/19 Page 47 of.62 22. On October 27, 2016, Cohen made a payment to Davidson of $130,000? with the funds intended for Clifford?for the purpose of securing her ongoing silence with respect to the allegations that she had an extramarital affair with Trump. Speci?cally, based on my review of toll records, bank records, and information obtained pursuant to the iCloud Warrant and Cohen Email Warrants, I have learned the following: a. At 9:47 Cohen sent Davidson an email, stating: ?Keith, kindly con?rm that byuyou in your attorney?s trust account until such time as directed for release by me, in Writing. Additionally, please ensure that all paperwork contains the correct name of Essential Consultants LLC. I thank you in advance for . your assistance and look forward to hearing from you later.? b. At approximately 10:01 according to records provided by First Republic . Bank, Cohen completed paperwork to wire $130,000 from the Essential Consultants Account?-? which had been funded a day prior from Cohen?s home equity line of credit?to the attorney client trust account at City National Bank that Davidson had speci?ed in the wiring instructions he sent. to Cohen. The wire transfer was made shortly thereafter. 0. At 10:02 Davidson responded to Cohen?s email from 9:47 stating: . con?rm that I will work in good faith that no funds shall be disbursed unless until the plaintiff personally signs all necessary settlement paperwork, (the form of which will match the prior agreement). The settlement docs will name the correct corporation, (Essential Consultants LLC). Plaintiff signature will be notarized and returned to you via FedEx. Only after you receive FedEx will I disburse. Fair?? d. At 10:50 First Republic Employee?1 sent Cohen an email con?rming that the payment had been sent and providing him with the wire number. 1 6 Case Document 48-8 Filed 07/18/19 Page 48 of 62 23. On October 28, 2016, and the days that followed, Cohen ?nalized the transaction with Davids on. Speci?cally, based on my review of toll records, information obtained pursuant to the iCloud Warrant, public sources, and bank records, Iknow the following: a. On?October 28, 2016, at 11:48 am, Cohen spoke to Trump for approximately ?ve 'minutes. Beginning at 1:21 pm, Cohen attempted a series of phone calls to Davidson, Pecker, and HoWard throughout the day, although it appears he may only have connected with Howard. message that ?all is AOK. I should have signed, notarized docs on Monday. You should have them on Tuesday.? Cohen thanked him and said hope we are good.? Davidson responded, assure you. We are very good.? Howard also texted Cohen at 7:08 pm, ?Keith [Davidson] says we are good.? Cohen then responded to Howard and ?Excellent? to Davidson. At approximately 10:30 Cohen spoke to Hicks for three minutes. 0. On October 31, 2016, Cohen called Howard at 8:22 pm. and they spoke for over three minutes. At 8:32 pm, Cohen received text messages from both Howard and Davidson. 1 Howard said: ?You?ll have paperwork tomorrow says Davidson said: ?We are AOK. You will be receiving a package tomorrow.? Cohen responded ?Thank you? to Howard and ?Thanks Keith. Will call you then? to Davidson. From?my involvement in this investigation, I believe - Davidson was referring to a signed nondisclosure agreement when he told Cohen that he would receive a package. d. Based on my review of court ?lings that became public in 2018, I have learned that on or about October 28, 2016, LLC and/or David Dennison? entered into a ?con?dential settlement agreement and mutual release? with ?Peggy Peterson,? pursuant to which ?Peterson? agreed not to disclose certain ?con?dential information pertaining to [Dennison]? in exchange for 17 Case Document 48-8 Filed 07/18/19 Page 49.0f 62 $130,000. The agreement provided that Would wire the funds to ?Peterson?s? attorney, who would then transfer funds to ?Peterson.? Cohen signed the agreement on behalf of . The agreement stated that the address for which was later referred to in the agreement as ?Essential Consultants, was Cohen?s residence. e. Consistent with the ?con?dential settlement agreement and mutual release,? on or about November 1, 2016, Davidson transferred $96,645 from his attorney client trust account at City National Bank to a bank account in Clifford?s Thewire had the annotation ?net settlemen On the same day, at'approximately 9:48 am. Davidson sent Cohen a text message with a picture of a FedEx'delivery continuation, stating that at approximately 9:09 am. a package shipped by Davidson the previous day had arrived for Cohen at his Trump Organization address. On the same day, at approximately 6:14 Davidson sent Cohen an email with an audio file attached and said ?Give this a lesson [sic] and then call me.? The audio attachment was titled ?Stormy.mp3? and was a ?ve?minute recording of Davidsoninterviewing Clifford about recent public allegations made by an adult ?lm star named Jessica Drake regarding her alleged past affair with Trump; in the recording, Clifford explained the reasons she believed that Drake was not credible. Less than an hour later, at approximately 7:05 Cohen called Trump, but it appears that they did not connect. Cohen then called a telephone number belonging to Kellyanne Conway, who at the time was Trump? 5 campaign manager. They did not connect. At approximately 7:44 however, Cohen received a return call from Conway, which lasted for approximately six minutes. 24.? On November 4, 2016, just three days after the Clifford transaction was completed and just four days before the presidential election, the Wall Street Journal published an article alleging that the National Enquirer had ?Shielded Donald Trump? ?omallegations by. 18 Case Document 48-8 Filed 07/18/19 Page 50 of 62 Playboy model Karen McDougal that she and Trump had an affair. The article alleged that AMI had. agreed to pay McDougal to bury her story. 'McDougal, like Clifford, had been represented by Davidson. Based on my review of toll records, information obtained pursuant to the Cohen. Email Warrants and iCloud Warrant, and public sources, it appears that Cohen spoke frequently to Davidson, Howard, Pecker, and Hicks around the time of this article?s publication?just days before Election Day?about the importance of preventing the McDougal and Clifford stories from a. Between 4:30 and 8:00 pm. on November 4, Cohen communicated several times with Howard,? Pecker and Davidson. For instance, at approximately 4:49 pm, Cohen sent Howard a text message with a screenshot of an email forwarded to him by another Trump Organization lawyer. The forwarded email was from a Wall Street Journal reporter, and asked for comment from Trump and/or the campaign on the story. Cohen also spoke with Hicks several times, including shortly before and/or after calls with Pecker, Howard and Davidson. Indeed, at approximately 7:33 pm, using two different cellphones subscribed to him, Cohen appearsto have been talking to Davidson and Hicks at the-same time. b. At approximately 8:51 pm, Cohen sent Howard a message, stating: ?She?s being really difficult with giving Keith a statement. Basically went into hiding and unreachable.? One . minute later, Howard responded: ?I?ll ask him again. We just need her to disappear.? Cohen responded, ?She definitely disappearedbut refuses to give a statement and Keith cannot push her.? At approximately 8 :55 pm, Howard responded to Cohen?s text: ?Let?s let the dust settle. We don?t want to push her over the edge. She?s on side at present and we have a solid position?and a plausible position that she is rightfully employed as a columnist.? Based on my involvement in this investigation, I believe Cohen and Howard were referring to Karen McDougal when they were 19 Case Document 48-8 Filed 07/18/19 Page 51 of'62 discussing ?she? and ?her.? Additionally, I believe Howard?s statement that ?we have . . . a plausible position that she is rightfully employed as a columnis was a reference to the fact that AMI had given McDougal payments for her role as a purported columnist for the company. - c. At approximately 8:58 pm. on November 4, 2016, Howard attempted to reassure Cohen about the effect of the forthcoming Wall Street Journal article, texting, think it?ll be ok pal. Ithink it?ll fade into the distance.? Cohen responded, ?He?s pissed.? Howard wrote back, Keith is pissed. Not much we can do.? Based on my involvement in this investigation, I believe Cohen was referring to Trump when he stated ?he?s pissed.? Cohen asked Howard at approximately 9:00 pm. how the Wall Street Journal could publish its article if ?everyonedenies.? Howard responded, ?Because there is the payment from AMI. It looks suspicious at best.? At approximately 9:03 pm, Hicks called Cohen and they spoke for two minutes. At approximately 9:11 pm, Cohen called Howard and spoke to him for five minutes. At approximately 9:15 pm, Hicks called Cohen and they spoke for nearly seven minutes. Again, Cohen used different phones for these two calls, such that he appears to have been on both calls for about a minute of overlap. At approximately 9:32 pm, Cohen texted Pecker, ?The boss just tried calling you. Are you free?? A minute later, Cohen texted HoWard, ?Is there a way to find David quickly?? e. At approximately 9:50 pm, the Wall Street Journal article Was published online. Howard and Hicks both sent web links for the article to Cohen. Over the next half hour, Cohen? and Howard exchanged several text- messages commenting on how the story Came across. The next morning on November 5, 2016, at approximately 7:35 am, Cohen texted Hicks, ?So far I see only 6 stories. Getting little to no traction.? - Hicks responded, ?Same. Keep prayingll It?s 20 Case Document 48-8 Filed 07/18/19 Page 52 of 62 working!?- Cohen wrote back, ?Even CNN not talking about it. No one believes it and if necessary, I have a statement by Storm denying everything and contradicting the other porn stars statement. I wouldn?t use it now or even discuss with him as no one is talking about this or cares!? Based on my involvement in this investigation, I'believe Cohen was referring to the above- referenced recorded audio statement by Clifford that he obtained from Davidson, and was stating that such a statement could be used to in?uence potential negative media relating to Trump, but that morning, Pecker spoke to Tlump. 25. On or about November 2016, Trump won the election for President of . the United States. 26. On or about January 12, 2018, the Wall Street Journal first reported that Cohen arranged a payment to Clifford. On oriabout January 22, 2018, Common Cause, a government watchdog group, filed a complaint with the Federal Election Commission, alleging that Cohen had violated campaign finance laws by making the payment to Clifford. Based on my review public sources following that report, as well as emails obtained pursuant to the Cohen Email Warrants, I have learned the following: a. On or about January 23, 2018, the day after Common Cause ?led its complaint,- Cohen began emailing himself drafts of statements describing his payment to Clifford. Additionally, on January 23, 2018, Cohen emailed the following draft of that statement to an individual who appears to be writing a book on Cohen?s behalf: In October 2016, I was contacted by counsel for Ms. Clifford stating that news outlets, including ABC news, were pursuing the 2011 story of an alleged affair between Mr. Trump and Ms. Clifford. Despite the fact that both parties had already" denied the allegation, as Mr. Trump?s longtime special counsel and protector, I took it upon myself to match the offer and 21 Case Document 48-8 Filed 07/18/19 Page 53 of 62 keep the story from breaking. I knew the allegation to be false, but I am also a realist who understands that just because something is false doesn?t mean that it doesn?t create harm and damage. I could not allow this to occur. I negotiated a non-disclosure agreement with Ms. Clifford?s counsel and tendered the funds. I did this through my Delaware LLC and transferred persDnal funds to cover the agreement. I was not reimbursed any monies from Mr. Trump, the Trump Organization, any third party or the Presidential campaign. At no point did I ever advise Mr. Trump of my communications or actions regarding this agreement As outlandish and unusual as this may appear, the Trumps have been like family to me for over a decade It?s what you do for family. ww(Empha31s added. )__Based onmy involvement in this investigation I believe that the above email is an acknowledgement that the allegation of the affair had existed for some time 20H story. . but that Cohen was motivated to ?keep the story from breaking? again in October 2016. b. On or about February 13, 2018, Cohen said in a statement to The New York Times that ?Neither the Trump Organization nor the Trump campaign was a party toithe transaction with Ms. Clifford. The payment to Ms. Clifford was lawful, and was not a campaign contribution or a campaign expenditure by anyone.? Cohen declined to answer follow-up questions including . whether Trump had been aware of the payment, why Cohen made the payment, or whether similar payments had been made to other people. i I c. On or about February 14, 2018, Cohen was asked by The New York imesz whether Trump had reimbursed him, whether he and Trump had made any arrangement at the time of the payment, or whether he had made payments to other women. Cohen stated in response, can?t get into any of tha On or about February 14, 2018, Cohen also stated to The Washington Post that: ?In a private transaction in 2016, I used my own personal funds to facilitate a payment of $130,000 to Ms. Stephanie Clifford. "Neither the Trump Organization nor the Trump campaign was a party to the transaction with Ms. Clifford, and neither reimbursed me for the payment, either directly or indirectly.? 22 Case Document 48-8 Filed 07/18/19 Page 54 of 62 d. On or about March 9, 2018, Coheli stated to ABC News that ?the funds were taken from myhome equity line and transferred internally to my LLC account in the same bank.? 27. For the foregoing reasons, there is probable cause to believe that Cohen committed the Subject Offense by making an in?kind contribution to Trump or the Trump campaign in the form of a $130,000 payment to Clifford onlthe- election. Indeed, While Cohen denies having given an unlawful contribution, in his own statements Cohen has admitted that he weeks before the election, as Trump was facing negative media allegations about his behavior toward women, even though allegations of an affair between Trump and Clifford existed since 201 1. 28. I have reviewed records maintained by from which I have learned, in substance and in part, that the Target Cellular Devices are stillactive. Based on my training and experience, my familiarity with this investigation, and the information set forth above, I therefore believe that the requested data will lead to evidence of the Subject Offense. Speci?cally, information will lead to'the present location of the Target Cellular Devices; law enforcement may then obtain evidence from the Target Cellular Devices, by subpoena or search warrant, including but not limited to contact lists containing contact information for participants in the illegal campaign contribution scheme and well as text messages between these participants. MANNER OF EXECUTION 29. . In my training and experience, I have learned that cellular phones and Other cellular devices communicate wirelessly across a network of cellular infrastructure, including towers that route and connect individual cOmmunications. When sending or receiving a communication, a cellular device broadcasts certain cellular and wi? signals to the cellular tower 23 Case DoCument 48-8 Filed 07/18/19 Page 55 of 62 that is routing its communication. These cellular and wi? signals include a cellular device?s unique identi?ers. 30. To facilitate execution of this warrant to determine the location of the Target Cellular Devices, law enforcement may use an investigative device or devices capable of broadcasting cellular and wi? signals that will be received by the Target Cellular Devices or receiving cellular and wi? signals from nearby cellular devices, including the Target Cellular Devices. Such a device may function in some respects like a cellular tower, except that it will not be connected to the cellular network and cannot be used by a cell phone to communicate with others. The device may send a signal to the Target Cellular Devices and nearby cellular. devices. and thereby prompt them to send cellular and wi? signals that include the unique identi?er of the device. Law enforcement may monitor the cellular and wi? signals broadcast by the Target Cellular Devices for non?content signal information and use that information to determine the Target Cellular Devices? location, even if it is located inside a house, apartment, or other building. The device will not interceptthe contents of the Target Cellular Devices" communications, such as telephone calls, text messages, and other electronic communications. Further, the device will not collect any other data stored on the Target Cellular Devices, including e-mails, text messages, contact lists, images, or Global Positioning System (GPS) data. 31. The investigative device may interrupt cellular service of phgnes- or other cellular devices within its immediate vicinity. Any service disruption to non-target devices will be brief and temporary, and all operations will attempt to limit the interference with such devices. In order to connect with the Target Cellular Devices, the device may brie?y exchange cellular and wi? signals with all phones or other cellular devices in its vicinity to determine whether those devices? unique identi?ers match the identi?ers of the Target Cellular Devices. These cellular 24 Case Document 48-8 Filed 07/18/19 Page 56 of 62 and Wi? signals may include cell phone identi?ers. The device will not complete a connection with cellular devices determined not to be the Target Cellular Devices, and law enforcement will limit collection-of information from devices other than the Target CellularDevices. To the extent that any information from a cellular device other than the~Target Cellular Devices is collected by the law enforcement device, law enforcement will delete that information, and law enforcement Will make no investigative uSe of it absent further order of the court, other than distinguishing the AUTHORIZATION REQUEST 32. Based on the foregoing, I reduest that the Court issue the proposed. search warrant, pursuant to Federal Rule of Criminal Procedure 41. The proposed warrant also will function as a pen register order under 18 U.S.C. 3123.? 33. I further request, pursuant to 18 U.S.C. 3103a(b) and Federal Rule of Criminal Procedure that the Court authorize the of?cer executing the warrant to delay notice until 30 days from the end of the period of authorized surveillance. This delay is justi?ed because there is reasonable cause to believe that providing immediate noti?cation of the warrant may have an adverse result, as de?ned in 18 U.S.C. 2705. Providing immediate notice to the subscriber or user of the Target Cellular Devices would seriously jeopardize the ongoing investigation, as such a disclosure would give that person an opportunity to destroy evidence,? change patterns of behavior, and notify confederates. See 18 U.S.C. 3103a(b)(l). There is reasonable necessity for the use of the technique described above, for the reasons set forth above. See 18 U.S.C. ?3103a(b)(2). 25 Case Document 48-8 Filed 07/18/19 Page 57 of 62 34. . I further request that the Court authorize execution of the warrant at any time of day or night, owing?to the potential need to locate the Target Cellular Devices outside of daytime hours. 35. I further request that the Court order that all papers in support of this application, including the af?davit and search warrant, be sealed until further order of the Court. These documents discuss an ongoing criminal investigation that is neither public nor known to all _o_f._the targets. of the investigation. Accordingly, is good cause to seal these documents because their premature disclosure may seriously jeopardize that investigation. 36. A search warrant may not be legally necessary to compel the investigative technique described herein. Nevertheless, I hereby submit this warrant application out of an abundance of caution. Respectfully submitted, Federal Bureau ot investlgatlon Subscribed and sworn to before me On: AWL. Klan?? pmum UNITED STATES MAGISTRATE JUDGE 26 Case Document 48-8 Filed 07/18/19 Page 58 of 62 IN THE UNITED STATES DISTRICT COURT FOR THE SOUTHERN DISTRICT OF NEW YORK IN THE MATTER OF THE USE OF A CELL- SITE SIMULATOR TO LOCATE THE Case No. CELLULAR DEVICES ASSIGNED CALL NUMBERS Filed Under Seal WARRANT AND ORDER OF AUTHORIZATION Special Agents of the Federal Bureau of Investigation. and Other Authorized, Pei?suffnei I I. Findings The Court hereby ?nds: 1. Upon an af?davit of Special Agent -of the Federal Bureau of Investigation (?Af?davit?) and pursuant to Federal Rule of Criminal Procedure 41, there is probable cause to believe that violations of 52 U.S.C. 301 and 30109(d)(l)(A)(1) (illegal campaign contributions) (the ?Subject Offense?) have been committed by Michael Cohen (the ?Target Subject?), and that the Target Subject uses cellular devices assigned call numbers ?the (?Target Cellular Devices?), which are described in Attachment A. Further, there is probable cause to believe that the location of the Target Cellular Device will constitute evidence of the Subject Offense. Speci?cally, there is probablecause to believe that the location of the Target Cellular Devices will constitute evidence of those criminal violations, including leading to the location of the Target Cellular Devices, on which there is . probable cause to believe evidence of these offenses eXist, as detailed below. 2. Pursuant to 18 U.S.C. 3123(b)(1), the Government has certi?ed that the pen register information for the Target Cellular Devices is relevant to an ongoing investigation by the Case Document 48-8 Filed 07/18/19 Page 59 of 62 Investigating Agency of the Target Subject and others unknown in connection with suspected violations of the Subject Offense. NOW, THEREFORE, pursuant to Fed. R. Crim. P. 41, 18 U.S.C. 3121 et seq, and 18 U.S.C. 3103a, IT IS HEREBY ORDERED: II. Warrant and Order of Authorization 3. - Warrant. Law enforcement agents and other authorized law enforcement which is described in Attachment B, to the determine the lo cation of the Target Cellular Devices, which are described in Attachment A. I 4. - Data Collection and Retention. In the course of employing the technique, law enforcement agents and other authorized law enforcement officials must make reasonable efforts to limit interference with cellular devices other than the Target Cellular Devices, must delete information collected from cellular devices other than the Target Cellular Devices once the Target Cellular Devices is located, and are prohibited from using data acquired beyond that necessary to locate the Target Cellular Devices, absent further order of the Court. 5. Delayed Notice. I Pursuant to 18 U.S.C. 3103a(b) and Federal Rule of Criminal Procedure 41tf)(3), the Court authorizes the officer executing the warrant to delay in notice until WW 30 days there is. reasonable cause to believe that providing immediate notification of the warrant may have an adverse result, as defined in .18 U.S.C. 2705. Providing immediate notice to the subscriber or user of the Target Cellular Devices would seriously jeopardize the ongoing investigation, as such a disclosure would give that person an opportunity to destroy evidence, change patterns of behavior, and notify confederates. See 18 U.S.C. 3103a(b)(1). There is reasonable necessity 2 Case Document 48-8 Filed 07/18/19 Page the technique described above,'for the reasons set forth above. See 18 U.S.C. 3103a(b)(2). 6. Time of Execution. The Court authorizes execution of this Warrant at any time of day or night, ovving to the potential need to locate the Target Cellular Devices outside of daytime hours. . 7. Sealing, This Warrant and Order, and the supporting Agent Af?davit, shall be .o ftheCourtzpenceptithatitheiGo this Court: provide copies of the Warrant and Order or the supporting Application and Agent Af?davit as need be to personnel assisting the Covernrhent in the investigation and prosecution of this'matter; and disclose these materials as necessary to comply with discovery and disclosure obligations in any prosecutions related to this matter. Dated: New York, New York Date Issued Time Issued 8/ HENEH Pant/mm) UNITED STATES MAGISTRATE IUDGE Southern District of New York Case Document 48-8 Filed 07/18/19 Page 61 of 62 ATTACHMENT A This warrant authorizes the use of the electronic investigative technique described in Attachment to identify the location of the cellular devices assigned phone numbers ?Whose wireless provider is and Whose listed subscriber is Michael Cohen. Case Document 48-8 Filed 07/18/19 Page 62 of 62 ATTACHMENT . Pursuant to an investigation of Michael Cohen for a violation of 52 U.S.C. 30ll6(a)(l)(A) and 30109(d)(1)(A)(1) (illegal campaign contributions) (the ?Subject Offense?), this Warrant authorizes the of?cers to whom it is directed to determine the location of the cellular devices identi?ed in Attachinent A. by collecting and examining: 1. radio cellular and wi? signals emitted by the target. cellular device for-the purpose of individual communications; and 2. radio cellular and Wi? signals emitted by the target cellular device in response to radio cellular and Wi? signals sent to the cellular device by the of?cers; for a period of thirty days, during all times of day and night. This virarrant does not authorize the interception of any telephone calls, text messages, other electronic communications, and this Iwarrant prohibits the seizure of any tangible property. The Court ?nds reasonable necessity for the use of the technique authorized above.? See 18 U.S.C. 3103a(b)(2). U.S. Department of Justice [Type text] United States Attorney Southern District of New York The Silvio J. Mollo Building One Saint Andrew’s Plaza New York, New York 10007 July 15, 2019 EX PARTE and UNDER SEAL BY EMAIL and HAND The Honorable William H. Pauley III United States District Judge Southern District of New York 500 Pearl Street New York, NY 10007 Re: United States v. Michael Cohen, 18 Cr. 602 (WHP) Dear Judge Pauley: Pursuant to the Court’s February 7, 2019 opinion and order (the “Order”) and May 21, 2019 order, the Government respectfully submits this sealed, ex parte status report explaining the need for continued redaction of the materials subject to the Order. (See Order at 30). By way of background, several media organizations filed a request to unseal the affidavits, warrants, and riders associated with several different searches that were conducted in connection with a grand jury investigation into Michael Cohen and others (the “Materials”). The Government opposed that request, citing the need to protect an ongoing investigation and the personal privacy of certain individuals named in the Materials. On February 7, 2019, this Court granted the motion in part and denied it in part. Although the Court directed that certain parts of the Materials be unsealed (with limited redactions to protect privacy interests), the Court denied the motion to unseal all of the Materials. Relevant here, the Court held that “the portions of the Materials relating to Cohen’s campaign finance crimes shall be redacted” to protect the ongoing law enforcement investigation. (Order at 11). On May 21, 2019, after receiving a status update from the Government on the need for continued sealing, the Court issued an order permitting continued sealing of the campaign finance portions of the Materials to protect an ongoing investigation, and directed that the Government provide another update by this date. The Government is no longer seeking to maintain the campaign finance portions of the Materials under seal in order to protect an ongoing investigation.1 However, while the majority of 1 The Government has effectively concluded its investigations of (1) who, besides Michael Cohen, was involved in and may be criminally liable for the two campaign finance violations to which Cohen pled guilty ; and (2) whether certain individuals, , made false statements, gave false testimony or otherwise obstructed justice in connection with this investigation Page 2 the campaign finance portions of the Materials can now be unsealed, the Government respectfully submits that some redactions should be maintained in order to protect the personal privacy of certain individuals. In particular, consistent with the Court’s prior Order, the Government seeks to redact references to individuals who are either (1) “‘peripheral characters’ for whom the Materials raise little discernable inference of criminal conduct” but who “may nonetheless be ‘stigmatized’” by their inclusion in the Materials; or (2) people “around Cohen from which the public might infer criminal complicity.” (Order at 14). However, while most references to such individuals are redacted, the Government does not seek to redact references to those individuals that are either (a) facts that have been publicly confirmed, either by the individual in public statements or the Government in public filings; or (b) facts sourced from publicly available materials. (See Order at 15 (“Shielding third parties from unwanted attention arising from an issue that is already public knowledge is not a sufficiently compelling reason to justify withholding judicial documents from public scrutiny.”)). Together with this letter, the Government has transmitted a copy of one of the search warrant affidavits with the proposed redactions marked. See Ex. A, at 38-57, 66-67, 71, 73-74, 83-101. (The proposed redactions also include the privacy-based redactions previously authorized in the bank and tax portions of the Materials.) The Government respectfully requests that the Court approve these redactions, and will submit corresponding redactions to the other affidavits (which are substantially similar to the attached affidavit) once the Court has ruled on these proposed redactions. Respectfully submitted, AUDREY STRAUSS Attorney for the United States, Acting Under Authority Conferred by 28 U.S.C. § 515 By: __________________________ Thomas McKay / Nicolas Roos Assistant United States Attorneys (212) 637-2200 cc: Counsel of Record (by ECF)