11 14 17 Cohen Search Warrant II

Case 1:19-mc-00044-BAH Document 16 Filed 05/22/19 Page 1 of 48
AO 106 (Rev. 04/ 10) Application for a Search Warrant
UNITED STATES DISTRICT COURT NOV ·1 3 2017

for the
Clerk, U.S. District & Bankruptcy
District of Colum bia Courts for the District of Columbia
In the Matter of the Search of )

(Briefly describe the property to be searched ) Case: 1:17-mj-00855
or identify the person by name and address) ) Assigned To : Chief Judge Howell, Beryl A.
INFORMATION ASSOC IATED WITH THE EMAIL
ACCOUNT @GMAIL.COM
) Assign. Date : 11/13/2017
)
)
Description: Search and Seizure Warrant
APPLICATION FOR A SEARCH WARRANT

I, a federal law enforcement officer or an attorney for the government, request a search warrant and state under
penalty of perjury that I have reason to beli eve that on the following person or property (identify the person or describe the
property to be searched and give its location):
See Attachment A2.

located in the Northern District of California , there is now concealed (identify the
----..:....:....'------'----
person or describe the property to be seized):
See Attachment B2.
This warrant is sought purs uant to 18 U.S.C. §§ 2703(a), 2703(b)(1 )(A), and 2703(c)(1 )(A).
The basis for the search under Fed. R. Crim. P. 4 l(c) is (check one or more):
~ evidence of a crime;
~ contraband, fruits of crime, or other items illegally possessed;
r.J property designed for use, intended for use, or used in committing a crime;
0 a person to be arrested or a person who is unlawfully restrained.
The search is related to a violation of:

Code Section Offense Description
18 U.S.C. § 951; Acting as i:I foreign agent without notice to the Attorney General;
18 U.S.C. § 1014 False Statements to a financial institution;
18 U.S.C. § 1344 Bank Fraud
The application is based on these facts:
See attached Affidavit.
b/ Continued on the attached sheet.

O Delayed notice of _ _ days (give exact ending date if more than 30 days: _ _ _ _ _ ) is requested
under 18 U.S.C. § 3103a, the basis of which is set forth on the attached sheet.
ignature
pecial Agent, FBI

Printed name and title
Sworn to before me and.sigoed in my presence.
Date: 11/14/2017
Judge's signature
C ity and state: Washington, D.C. Hon. Be ryl A. Howell, Chief U.S. District Judge
IN THE UNITED STATES DISTRICT COURT

FOR THE DISTRICT OF COLUMBIA
IN THE MATTER OF THE SEARCH OF UNDER SEAL

INFORMATION AS SOCIATED WITH THE
EMAIL ACCOUNT
Case: 1:1 7-mj-00855
@GMAIL.COM
Assigned To : Chief Judge Howell, Beryl A.
/\ssign. Date : 11/13/201 7
AFFIDAVIT IN SUPPORT OF AN
APPLICATION FOR A SEARCH WARRANT
I, eing first duly sworn, hereby depose and state as follows:
INTRODUCTION AND AGENT BACKGROUND
1. I make this affidavit in support of an application for a search warrant for
information associated with the email address provided for the Google Mail ("Gmail") Account
@gmail.com (hereinafter the "Target Account"), that is stored at premises owned,
maintained, controlled, or operated by Google, an email provider headquartered at 1600
Amphitheatre Parkway, Mountain View, CA 94043 (hereinafter "Google"). The information to
be searched is described in the following paragraphs and in Attachment A. This affidavit is made
in support of an application for a search warrant under 18 U.S.C. §§ 2703(a), 2703(b)(l)(A) and
2703(c)(l)(A) to require Google to disclose to the government copies of the information (including
the content of communications) further described in Attachment A. Upon receipt of the
information described in Attachment A, government-authorized persons will review that
information to locate the items described in Attachment B.
1
3. The facts in this affidavit come from my personal observations, my training and
experience, and information obtained from other agents and witnesses. This affidavit is intended
to show merely that there is sufficient probable cause for the requested warrant and does not set
forth all of my knowledge about this matter.
4. Based on my training and experience and the facts as set forth in this affidavit, there
is probable cause to believe that MICHAEL DEAN COHEN has committed violations of 18
U.S.C. § 1014 (false statements to a financial institution), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C.
§ 1344 (bank fraud), 18 U.S.C. § 1956 (money laundering), as well as 18 U.S.C. § 951 (acting as
an unregistered foreign agent) and the Foreign Agents Registration Act ("FARA"), 22 U.S.C.
§ 611 et seq. There is also probable cause to search the information described in Attachment A
for evidence, contraband, fruits, and/or instrumentalities of these crimes, further described in
Attachment B.
5. This Court has granted two prior search warrants for the Target Account, the first
on July 18, 2017 and the second on August 17, 2017; those search warrants limited the scope of
the search warrant to the period January 1, 2016 through the then-present. The present search
warrant seeks for broader authority to search the Target Account for the period June 1, 2015 to
the present.
JURISDICTION
6. This Court has jurisdiction to issue the requested warrant because it is "a court of
competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), &
2
(c)(l)(A). Specifically, the Court is "a district court of the United States (including a magistrate
judge of such a court) . .. that has jurisdiction over the offense being investigated." 18 U.S.C.
§ 2711(3)(A)(i).
PROBABLE CAUSE
7. As described below, the FBI is investigating COHEN in connection with, inter alia,
statements he made to a known financial institution (hereinafter "Bank 1") in the course of opening
a bank account held in the name of Essential Consultants, LLC and controlled by COHEN. The
FBI also is investigating COHEN in connection with funds he received from entities controlled by
foreign governments and/or foreign principals, and the activities he engaged in the United States
on their behalf without properly disclosing such relationships to the United States government.
A. Michael Cohen
8. According to press reports and bank records collected during the investigation,
COHEN served for over a decade as an executive in the Trump Organization, an international
conglomerate with real estate and other holdings controlled by President Donald Trump prior to his
presidency. Until approximately January 2017, COHEN was reported to have held various
positions within the Trump Organization. During an interview with The Wall Street Journal in or
around January 2017, COHEN described his role as being "the fix-it guy .... Anything that [then-
President-elect Trump] needs to be done, any issues that concern him, I handle." 1
9. In or around January 2017, COHEN made public statements that he would resign
from the Trump Organization to serve as the personal attorney for President Trump (serving as an
attorney to the President in his personal capacity, as opposed to as a member of the White House
1
"Intelligence Dossier Puts Longtime Trump Fixer in Spotlight," Wall Street Journal, Jan. 11,
2017.
3
Counsel' s Office). COHEN recently has identified himself publicly-including on his personal
Twitter account-as a personal attorney for the President. Similarly, based on emails recovered
from the Target Account, COHEN describes himself as a personal attorney for the President in his
signature block.
10. As described in more detail below, on or about March 23, 2017, COHEN submitted
paperwork to Bank 1, with whom he had a prior banking relationship and several existing accounts,
for the purpose of opening a new account. In the section for customers to provide contact
information, COHEN, by hand, struck out a previously provided e-mail address and in its place
wrote the Target Account as his current e-mail address.
B. Essential Consultants, LLC
11. In or around June 2017, federal agents reviewed information supplied by Bank 1
based on activity that Bank 1 had observed from a number of accounts related to COHEN.
According to information provided by Bank 1, COHEN has been a customer since approximately
June 2011 and controls several checking and loan accounts, some in his personal name and others
in the names of corporate entities. Agents have subsequently reviewed documents and records
provided by Bank 1 related to COHEN and these various accounts.
12. Records provided by Bank 1 show that on or about October 26, 2016, COHEN
opened a new checking account in the name of Essential Consultants, LLC ("Essential
Consultants"); COHEN was the only authorized signatory on the account. On the paperwork
associated with opening the account, COHEN listed his Trump Organization Account for contact
purposes. Corporate records show that Essential Consultants is a Delaware entity formed by
COHEN on or about October 17, 2016.
13. According to information provided by Bank 1, when COHEN opened the Essential
4
Consultants account, he made the following representations during the course of Bank l ' s know
your customer ("KYC") procedures:
a. He was opening Essential Consultants as a real estate consulting company to collect
fees for investment consulting work;
b. Ile intended to use his 1::xp1::rii;;m.;e;: in n:al estate to consult on commercial and
residential real estate deals;
c. His typical clients were expected to be high net-worth domestic individuals; and
d. His purpose in setting up the account was to keep the revenue from his consulting-
which he said was not his main source of income-separate from his personal
finances.
5
6
7
8
D. Representations about Net Worth to Financial Institutions
21. In connection with the ongoing investigation, the government has reviewed other
representations COHEN has made to Bank I and other financial institutions, including
representations regarding his net worth and financial position. A review to date has identified
substantial inconsistencies in COHEN's stated assets, liabilities, and net worth in separate
submissions between 2014 and 201 7.
22. For example, in or around October 2014, COHEN submitted a "Statement of
Financial Condition" as of August 1, 2014 to Bank 1. The document purported to depict COHEN' s
various assets and liabilities, as well as his net worth. On the document, COHEN claimed to have
assets totaling approximately $99,420,000 and liabilities of approximately $23,550,000. On the
same document, COHEN claimed to have a net worth of approximately $75,870,000.
23. In or around February 2016, in connection with obtaining the $500,000 HELOC
described above, COHEN submitted a summary of his assets, liabilities, and net worth to Bank 1.
COHEN claimed to have assets totaling approximately $63,435,315 and liabilities of approximately
$10,419,209. On the same document, COHEN claimed to have a net worth of approximately
$53,016,106.
a. In addition, documents collected from Bank 1 show that COHEN made
representations to Bank 1 that he had no contingent liabilities, when in fact, based
on documents COHEN submitted to another FDIC-insured financial institution
("Bank 5," described below), COHEN and his wife had personally guaranteed over
$20 million in loans associated with taxi medallions. In or around August 2017, an
employee of Bank 1 who served as COHEN's main point of contact at the bank
9
confirmed that COHEN did not disclose any contingent liabilities, despite that being
a standard question that he had to answer whenever seeking monies.
24. In or around May 2017, COHEN was part of a group of real estate investors that
sought a $2 million line of credit from an FDIC-insured financial institution ("Bank 4"), which
already held a $17 million loan on a property owned by the real estate group. In connection with
the loan request, Bank 4 requested COHEN submit a "net worth letter" in order to assess his
financial condition. On or about May 17, 2017, in response to the request, COHEN submitted a
letter to Bank 4 from an accountant. The letter stated that based on representations by COHEN to
the accountant, it was the accountant's understanding that as of May 1, 2017 "his [COHEN's]
current cash position and his various real estate investments holdings .. . [are] currently in excess
of $20.0 million." The letter did not disclose any liabilities.
a. In November 2017, the government interviewed the accountant who signed the
May 2017 letter sent to Bank 4 ("Accountant 1"). The accountant explained that
COHEN had directed him to write the letter and specifically only to identify the
cash and real estate investment holdings, without identifying any other liabilities
that would offset those holdings.
25. Bank records show that COHEN has a lending relationship with a known FDIC-
insured financial institution ("Bank 5") collateralized by New York taxi medallions. Records show
that entities controlled by COHEN have approximately $20,000,000 in notes payable to Bank 5.7
According to interviews with Bank 5 employees, throughout 2017 COHEN repeatedly has sought
7
The value of the collateral backing these loans (the taxi medallions) currently is worth
substantially less than the loans. In May 2017, COHEN himself estimated the medallions to be
worth only $13,950,000. Based on recent medallion sales, the collateral is potentially worth much
less. Documents collected from Bank 5 show that COHEN and his wife also signed agreements
making them personal guarantors of the $20,000,000 in loans.
10
to renegotiate the terms of the loans and sought some debt relief from Bank 5 on these loans. During
the course of these negotiations, on or about June 8, 2017, COHEN sent Bank 5 a "Statement of
Financial Condition" as of May 1, 2017. The document submitted by COHEN was prepared by the
same accountant as the letter submitted to Bank 4 on or about May 17, 2017 (which said that
COHEN' s "current cash position and his various real estate investments holdings ... [as of May 1,
2017 are] currently in excess of $20.0 million" and did not disclose any liabilities). In contrast to
the document submitted to Bank 4, on the document submitted to Bank 5, however, COHEN
claimed to have a net worth of approximately $2,825,000. 8
a. According to Accountant 1, at the time he prepared both the May 201 7 Statement of
Financial Condition and the letter sent to Bank 4, he had believed that COHEN was
going to give both documents to Bank 4 in order to give an accurate representation
of his financial condition. Accountant 1 stated that if he had been told the letter
would be submitted to Bank 4 as a stand-alone document, without the Statement of
Financial Condition disclosing the outstanding liabilities, he would not have
prepared the letter as directed.
E. Foreign Transactions in the Essential Consultants Account
26. As set forth above, in or around October 2016, COHEN made several
representations to Bank 1 in connection with the bank's KYC review process, including that he
expected funds deposited into the Essential Consultants account would constitute income from his
consulting work, that his consulting clients were expected to be domestic (that is, within the United
States), and that he expected his clients to be U.S.-based, high-net worth individuals.
8
COHEN claimed to have assets totaling approximately $41,955,000 and liabilities of
approximately $39,130,000.
11
27. Records obtained from Bank 1 show substantial transactional activity that appears
to be inconsistent with these KYC representations. Bank 1 records show that the account received
numerous deposits from foreign businesses and entities that do not reflect the stated client profile
for the residential and commercial real-estate consulting services ostensibly being provided by
Essential Consultants. 9 Moreover, public records, media reports, and other publicly available
sources, as well as emails obtained during the course of the investigation, indicate that some of
these companies have significant ties to foreign governments or are entities controlled by foreign
governments.
28. A search in or around July 2017 of the U.S. Department of Justice database of all
agents currently or previously registered under the Foreign Agent Registration Act ("FARA")
confirmed that neither COHEN nor Essential Consultants is or has been a registered agent of a
foreign government. 10 All FARA registration is handled by the U.S. Department of Justice's
National Security Division in Washington, D.C.
1. Deposits bv Columbus Nova, LLC
29. Telephone records related to COHEN' s cellplar telephone show that on or about
November 8, 2016, the day of the presidential election, a telephone registered to COHEN
exchanged the first in a series of text messages with the CEO of Columbus Nova, LLC ("Columbus
Nova"). Between approximately November 8, 2016 and November 6, 2017, telephone records
show over 1,000 contacts (calls and text messages) between COHEN's cellular telephones and the
9
By contrast, based on a r~eview oi emails o_btained from the Target Account and records obtained
from Bank 1, the Essential Consultants account has not received any funds from residential or
commercial real-estate consulting services.
10
The database is publicly available at https://www.fara.gov/.
12
CEO of Columbus Nova. Telephone records show no such text messages or telephone calls
between COHEN's cellular telephone and the CEO of Columbus Nova prior to November 8, 20 16.
30. Public records show that Columbus Nova, LLC is an investment management firm
controlled by Renova Group ("Renova"), an industrial holding company based in Zurich,
Switzerland. According to public news account::;, Reuu va is controlled by Viktor Vekselberg, a
wealthy Russian national. Public news accounts also report that Vekselberg is an oligarch with
various connections to Russian President Vladimir Putin who publicly met with Putin as recently
as in or around March 2017. 11 According to the news articles, Vekselberg and Renova currently
are involved in various infrastructure projects in Russia, such as the building of an airport in Rostov
in advance of the 2018 FIFA World Cup, which is to be held in Russia. Vekselberg has been
involved in various symbolic acts seen to be in the Russian national interest, such as the purchase
and repatriation of historic Faberge eggs. 12
31. On or about January 10, 2017, COHEN received an email from the CEO of
Columbus Nova with the subject "About us / Russian Union of Industrialists and Entrepreneurs."
The CEO told Cohen, "This is the organization that Victor was mentioning yesterday.... He is the
head of this international relations committee of this group. . . . Will follow up with more later."
Similarly, records obtained from the Target Account show that COHEN had a calendar entry
entitled "Meeting with Victor," scheduled for on or about March 7, 2017 at the location "Renova."
11
See, e.g., "Russia's Putin Meets Tycoon Vekselberg," Reuters, Mar. 14, 2017.
12
On or about September 5, 2016, media outlets reported that Russian authorities arrested two of
Vekselberg's closest associates in connection with allegations that a subsidiary had paid over $12
million in bribes to Russian government officials. Some media accounts speculated that the arrest
ofVekselberg's associates, as well as the commensurate searches of Renova's head office, were
intended as a warning from the Russian government that it wanted some form of cooperation or
value from Vekselberg. See, e.g., "Another Billionaire Incurs Putin's Wrath," Bloomberg, Sept.
6, 2016.
13
32. According to records obtained from Bank 1, since the beginning of 2017, the
Essential Consultants bank account received seven deposits, each in the amount of $83,333 (for a
running total of $583,332.96). The funds for all deposits- six of which were wire transfers and
one by check-came from an account at another bank held in the name of Columbus Nova, LLC.
The following table summarizes the funds transferred to date:

.,
APPROXIMATE DATE DEPOSIT
January 31, 2017 $83,333.00
March 2, 2017 $83,333.33
March 31, 2017 $83,333.33
April 28, 2017 $83,333.33
June 1, 2017 $83,333 .33
June 30, 2017 $83,333.33
August 1, 2017 $83,333.33
33. Records obtained from the financial institution ("Bank 2") where the Columbus
Nova account is maintained illustrate that the funds used to pay COHEN originated from a second
account in the name of Renova US Management LLC ("Renova US"). For example:
a. On or about January 27, 2017, the Columbus Nova account at Bank 2 received a
deposit of$83,333 from an account held in the name of Renova US. The same day,
a check for $83,333 drawn on the Columbus Nova account at Bank 2 was made out
to Essential Consultants LLC.
b. On or about March 2, 2017, the Columbus Nova account at Bank 2 received
$83,333 from the Renova US account. The same day, the Columbus Nova account
was used to $83,333 the Essential Consultants account at Bank 1.
14
c. On or about March 31 , 2017, the Columbus Nova account at Bank 2 received
$83,333 from the Renova US account. The same day, the Columbus Nova account
was used to wire $83,333 to the Essential Consultants account at Bank 1.
d. On or about April 28, 2017, the Columbus Nova account at Bank 2 received $83,333
from the Renova US account. The same day, the Columbus Nova account was used
to wire $83,333 to the Essential Consultants account at Bank 1.
u. Wire Transfers from a Kazakhstani Bank
34. On or about May 6, 2017, COHEN sent an email from the Target Account to an
individual believed to be Kenges Rakishev. Open-source records identify Kenges Rakishev as the
majority shareholder of Kazkommertsbank, another Kazakhstani bank that controls BTA Bank.
Rakishev is also the son-in-law of Kazakhstan's ambassador to Russia. According to press reports,
BTA Bank recently was implicated in a multi-billion dollar scandal in which a unit of BTA had
been used to issue billions of dollars' worth of credit for property development and other deals in
Russia, Ukraine, and Belarus that subsequently went bankrupt. 13
35. In the email sent from the Target Account on or about May 6, 2017, COHEN wrote
that it was an "honor to spend the evening with you" and that "[t]here are definitely a lot of mutual
relationships between the two of us that require our assistance." COHEN also proposed a meeting
the following week.
13
More specifically, according to a Forbes article published in or around February 201 7, BTA
Bank' s auditors PricewaterhouseCoopers identified a $10 billion discrepancy on the bank's
balance sheets. Subsequent investigation by forensic accountants revealed that a unit of BTA had
been used to issue billions of dollars' worth of credit for property development and other deals in
Russia, Ukraine, and Belarus. The investigation also indicated that funds illicitly had been
removed from the bank through shell companies set up in the names of executives' family
members. See "How To Get Back A Lost $1 OB: One Bank's Tale in Europe's Biggest Alleged
Fraud," Forbes, Feb. 6, 2017.
15
36. On or about May 10, 2017, COHEN sent an email to an individual believed to be a
BTA Bank executive with an attachment bearing the filename "BTA-1." The attachment contained
a purported invoice for $150,000 from Essential Consultants LLC to BTA Bank in the Republic of
Kazakhstan. The invoice, identified by invoice BTA-101 referred to a "monthly consulting fee"
pursuant to a "Services Agreemeul t:ult:rt::<.l in Lo on the 8th of May, 20 l 7." The invoice was directed
to the attention of Kenges Rakishev. COHEN also stated he the he would the Certificate of
Incorporation for Essential Consultants to the email (but appears not to have attached the
document).
37. On or about May 15, 2017, COHEN received an email through the Target Account
from an individual purporting to be Nurlan Abduov. According to open source information,
Abduov is a shareholder ofKazkommertsbank where between April 28, 2016 and July 31, 2017 he
held a position of Managing Director and member of the Board of Directors. In the email, Abduov
told COHEN that he was contacting him "on behalf ofKenes [sic] Rakishev." In the email, Abduov
also stated that the " [w] anted to check how we can start to work with you." In addition to COHEN,
Abduov's email was addressed to Kenges Rakishev at a different email address.
3 8. According to Bank I , on or about ~fay 22, 201 7, the Essential Consultants bank
account at Bank 1 received a $150,000 deposit from an account at Kazkommertsbank. According
to Bank 1, the listed account holder at Kazkommertsbank was a second Kazakhstani bank named
BTA Bank, AO. Bank 1 reported that a message accompanying the wire payment indicated that
the agreement was a "monthly consulting fee as per Inv BTA-101 DD May 10, 2017 consulting
agreement WIN DD 08 05 2017 CNTR W/NDD 08/05/2017."
39. Non-content information obtained pursuant to an 18 U.S.C. § 2703(d) court order
for a different email account used by COHEN com) shows that COHEN,
16
Rakishev, and others from BTA Bank remain in routine contact. Between approximately May 5,
2017 and October 9, 2017, COHEN, through the com account, exchanged over eighty emails
with email accounts controlled by Rakishev and other BTA employees or executives.
111. Deposits by Korea Aerospace Industries Ltd.
40. According to Bank 1, on or about May 10, 2017 and June 9, 2017, the Essential
Consultants bank account received two deposits in the amount $150,000 (totaling $300,000
between the two deposits) from a bank account in Seoul, South Korea. According to documents
obtained from Bank 1, the account holder from which the money was sent is Korea Aerospace
Industries Ltd. ("KAI"). According to its public website, KAI is a South-Korea-based company
that produces and sells fixed-wing aircraft, helicopter aircraft, and satellites.
a. Public news accounts report that KAI has numerous interests in the U.S. defense
industry. For example, press accounts from early 2017 indicate that KAI has
partnered with Lockheed Martin to bid later this year on a $16 billion U.S. Air
Force T-X Trainer Jet Replacement Program. Likewise, on or about October 31,
2017, public media reported that KAI had received an order worth $48.8 million
for the maintenance, repair, and overhaul of 90 F-16 fighter jets operated by the
U.S. Air Force.
41. On or about April 28, 2017, COHEN sent an email from the Target Account to
another individual with the subject "Re: K Project." In the email, COHEN attached a document
purporting to be a "Consulting Agreement" between KAI and Essential Consultants LLC that was
to enter into effect on May 1, 2017. The document indicates that Essential Consultants would
render "consulting and advisory services, as requested" by KAI; no further information was
provided regarding the nature of the consulting and advisory services to be provided. The
17
document also indicated that KAI would pay Essential Consultants "a consulting fee of One
Million Two Hundred Thousand ($1,200,000.00) US Dollars," disbursed through eight $150,000
installments between May 201 7 and December 2017.
42. According to publicly available materials and press accounts, as well as the
company's financial disclosures, the Republic of Korea (South Korea) government has significant
ties to KAI. KAI itself was formed in 1999 as part of a government-led effort to consolidate South
Korea' s aerospace industry manufacturers into a new single entity. KAI holds the exclusive rights
for all of the government's military logistics and aerospace projects.14 The South Korean
government, through the Korea Development Bank, is the largest shareholder in KAI and its
largest debt holder. 15 According to information provided by Bank 1, messages related to the
transfer of funds from KAI indicated that the purpose of these payments was "consulting services."
43 . Non-content information obtained pursuant to an 18 U.S.C. § 2703(d) court order
for the account com show that COHEN has stayed in touched with KAI
employees. Between approximately May 21,201 and October 23, 2017, COHEN has sent seven
emails from the com account to email addresses at KAI' s email domain (koreaaero.com)
and has received three emails from KAI email addresses through his com account.
F. Payments to Essential Consultants in Connection to Political Activities
44. In addition to the sources of money connected to foreign governments that were paid
into the Essential Consultants account as set forth above, the account also was used to receive funds
14
See, e. g., Andrew Tylecote & Francesca Visintin, Corporate Governance, Finance and the
Technological Advantage of_Nations (2008), at 165-66; Jnternational Business Publications,
Korea South: A "Spy " Guide (2016), at 229-31.
15
KAI, Annual Report 2014, available at https://www.koreaaero.com/upload_images/new_pdf/
annuaVPDF/ Annual_report_ eng_2014.pdf.
18
from U.S. and foreign corporations who appear to have approached COHEN in connection with
political objectives in the Trump administration.
1. AT&T Inc.
45 . Beginning in or around April 2017, records from Bank 1 show the Essential
Consultants account has received apvruximaldy $300,000 in wire payments from a bank account
associated with the telecommunications company AT&T Inc. ("AT&T"), as summarized below:
-
APPROXIMATE DATE DEPOSIT
April 14, 2017 $100,000
June 13, 2017 $50,000
July 17, 2017 $50,000
August 16, 2017 $50,000
September 6, 2017 $50,000
46. In or around October 2016, AT&T announced its intention to acquire media
conglomerate Time Warner Inc. ("Time Warner") for approximately $85 billion, creating one of
the largest integrated media-and-telecommunications companies in world. Given the size of both
companies and the potential antitrust implications, AT&T submitted the proposed deal to the U.S.
Department of Justice for review. As of early November 2017, public media reports indicate the
Department of Justice had not made a decision about the proposed acquisition and was, according
to one report, "preparing for litigation in case it decides to sue to block the deal." 16
4 7. While campaigning for president, President Trump made statements indicating he
disapproved of the proposed merger. For-example, on or about October 22, 2016, at a rally in
16
"U.S. Weighs Suit Against AT&T's Deal for Time Warner," Wall Street Journal, Nov. 2, 2017.
19
Pennsylvania, then-candidate Trump stated, "[a]s an example of the power structure I'm fighting,
AT&T is buying Time Warner and thus CNN, a deal we will not approve in my administration
because it's too much concentration of power in the hands of too few." After his election, the
president-elect continued to make similar statements. On or about January 17, 2017, president-
elect Trump stated "I have been on the record in the past of saying that [the proposed acquisition
is] too big and we have to keep competition." In the January 2017 statement, however, the
president-elect added the caveat, "I haven't seen any of the facts, yet."
48. Beginning in or around January 2017, telephone records show that that COHEN
began to have contact with executives at AT&T. For example, on or about January 20, 2017,
records show that a telephone number belonging to COHEN called a telephone registered to a senior
vice president of AT&T responsible for legislative affairs (the "AT&T Senior VP"). According to
public media reports, on or about January 12, 2017, the AT&T Senior VP and another high-ranking
AT&T executive had met with president-elect Trump in New York.
49. On or about February 3, 2017, records obtained from AT&T show that COHEN had
a seventeen-minute telephone call with a consultant for AT&T who handled global public affairs
for the company (the "AT&T Consultant"). Shortly before the call, the AT&T Consultant sent an
email to the AT&T Senior VP with the subject "Cohen backgrounder" and wrote, "I am meeting
with him at 10:30 this morning to finalize contract and talk w/ potential scope of work." Shortly
after the call, the AT&T Consultant 2 texted the AT&T Senior VP: "Just had Cohen call. Oh my.
All good. Eager to tell you about it."
50. On or about February 6, 2017, records obtained from AT&T show that the AT&T
Consultant emailed the AT&T Senior VP with the subject line "Michael_Cohen notes." The email,
which appears to recount a conversation with COHEN, stated that the AT&T Consultant believed
20
COHEN would be "in town tomorrow - meeting w/ POTUS," 17 and that COHEN "made the point
several times that he doesn't list clients, doesn't talk about clients and hopes we won't be
publicizing that he's working w/ us. I assured him. And I hope he means it."
51. On or about February 15, 2017, records obtained from AT&T show that COHEN
met with the AT&T Senior VP and the AT&T Consultant at the company' s office in Rockefeller
Plaza. Shortly after the meeting, COHEN used the Target Account to send an email to both
individuals, writing "[g]reat to finally meet you today. Lots to do ... Can you please send me the
executed agreement so that I might counter sign and return to you?" The AT&T Consultant
responded to COHEN at the Target Account, "(g]reat meeting you as well. I'll send contract over
tomorrow."
52. Records obtained from the Target Account reveal a drafted contract between
Essential Consultants and AT&T. The contract contemplates that Essential Consultants "shall
render consulting and advisory services to the Company [AT&T]," adding that AT&T would
"advise Consultant of those issues and matters with respect to which AT&T Services desires
Consultant's assistance and advice." The contract calls for AT&T "to pay the Consultant for his
services . .. a consulting fee of Fifty Thousand ($50,000.00) Dollars ... per month."
53 . According to records obtained from AT&T, on or about April 11, 2017, COHEN
and the AT&T Consultant had a call to discuss the first payments to COHEN. On or about April
12, 2017, the AT&T Consultant emailed the AT&T Senior VP with the subject "Cohen," writing:
"Wants the talkers we discussed < says he's going to be w/ potus this weekend. You want me to
work w/[REDACTED]?" The AT&T Consultant then forwarded his email to two other AT&T
employees and arranged for a conference call to discuss the "talkers" referred to in the first email.
17
The acronym "POTUS" stands for "President of the United States."
21
54. On or about May 12, 2017, the AT&T Consultant emailed COHEN at the Target
Account, asking "Hey Michael, Have you heard anything new re merger?" COHEN responded,
"Please call me on my private (client only) cell number," providing him with a cellular telephone
number. On or about May 16, 2017, the AT&T Consultant emailed the AT&T Senior VP with the
subject "Recess appointment," writing that "[REDACTED] is talking w/ T sometime in the next 2
days. Cohen is seeing him Thursday. I asked [REDACTED] to add a couple questions to the
Morning Consult poll we use - should give us some strong numbers to bolster the argument for
doing."
55. Communications between COHEN and employees of AT&T have continued
recently. For example, on or about September 11 , 2017, COHEN, using the Target Account, sent
the AT&T Consultant two emails, including one with the message "[s]peak to you tomorrow." The
other email was a news article entitled "Michael Cohen Would Take a Bullet for Donald Trump,"
which profiled COHEN and his relationship to President Trump.
11. Novartis Investments, SARL
56. Bank 1 records also show that since in or around April 2017, the Essential
Consultants account at Bank 1 has received deposits totaling $599,880 from a Swiss bank account
held in the name of Novartis Investments, SARL, as summarized below:
APPROXIMATE DA TE DEPOSIT
4/5/2017 $99,980
5/15/2017 $99,980
6/14/2017 $99,980
7/17/2017- - - $99;980
8/14/2017 $99,980
22
9/1/2017 $99,980
Novartis Investments, SARL is the in-house financial subsidiary of the Swiss pharmaceutical
company Novartis International AG ("Novartis").
57. While campaigning for president, then-candidate Trump made statements indicating
he disapproved of the prices of pharmaceutical drug prices. For example, on or about January 25,
2016, candidate Trump suggested that Medicare could save $300 billion a year through stronger
negotiation with major pharmaceutical companies but that the government did not do so "[b]ecause
of the drug companies." After his election, president-elect Trump made similar statements. On or
about January 11, 2017, president-elect Trump stated, "We've got to get our drug industry back.
Our drug industry has been disastrous.... We're going to start [competitive] bidding and we're
going to save billions of dollars over a period oftime."
58. On or about January 16, 2017, COHEN, using his Trump Organization email
address, sent a contact an email asking him to pass a message along to a senior executive of Novartis
("Novartis Executive 1"). The message was a link to an article suggesting that the Trump
Administration would consider loosening drug approval standards as a way to bring down costs of
pharmaceutical drugs. Emails obtained from Novartis show that COHEN's contact did in fact
forward the email to Novartis Executive 1, who in turn sent the article to an assistant with a request
to print out the article.
59. On or about January 31, 2017, Novartis Executive 1 met with President Trump as
part of a meeting between pharmaceutical drug company executives and the new White House
administration. According to public reports, during the meeting President Trump "vow[ed] to
speed the approval of new medicines and ease regulation."
23
60. On or about February 2, 2017, COHEN received an email from the above-
mentioned contact with Novartis Executive l's information. The information provided both
Novarti? Executive l 's official email address and a private email address. On or about February
3, 2017, Novartis Executive 1 emailed COHEN, "Hi Michael, I received your email. This is the
best way to reach me. Let's set up a phone call." COHEN subsequently received a calendar
invitation for a telephone call with Novartis Executive 1 on or about February 10, 2017.
61. On or about February 13, 2017, COHEN sent an email from the Target Account
to Novartis Executive 1 with the subject ''Novartis Consulting Arrangement," writing that he was
attaching "my pro forma consulting agreement." Over the subsequent days, emails indicate that
COHEN and different employees from Novartis negotiated the terms of a contract. On or about
February 15, 2017, another Novartis executive ("Novartis Executive 2") sent an internal email to
another Novartis executive ("Novartis Executive 3"):
I just spoke with Michael Cohen a few minutes ago. He is generally

fine with the contract, but want some changesto [sic] the Statement
of Work, which he wanted to be more consulting/advisory and less
lobbying. He made clear that he would not be lobbying for us (or
others) and that he would not be registering as a lobbyist.
On or about February 16, 2017, Novartis Executive 2 sent another email to Novartis Executive 3:
I just spoke with Michael Cohen and received mark-ups of the

Agreement and SOW [Statement of Work] from him . ...
Regarding the SOW, he has pared it back substantially so that it no
longer provides details as to precisely what he will do for us. I
pushed him on this, but in his view it would be safer for both of us
to say less.
62. On or about February 17, 2017, COHEN through the Target Account received an
email from Novartis Executive 2 with the subject "Re: Consulting Agreement" and the message
"Michael- Attached is our agreement, signed on behalf of Novartis International AG. This
version accepted all of the changes that you had sent to me ...." The attachment was a services
24
agreement between Novartis and Essential Consultants. The agreement anticipates that Essential
Consultants will "provide consulting and advisory services to Novartis on matters that relate to the
repeal and replacement of the Affordable Care Act in the US and any other issues mutually
agreeable to [Essential Consultants] and Novartis." The contract also anticipates a "consulting fee
of One Million Two Hundred Thousand ($1,200,000) US dollars," to be paid to Essential
Consultants in even monthly installments over the course of a year.
63. On or about February 18, 2017, Novartis Executive 1 emailed another executive at
Novartis:
Confidentially I have put Michael Cohen on retainer to Novartis. He

is the former personal attorney 18 to the President, and was influential
in the selections of most of the administration. He will provide
access and advice for us, but will not lobby.... I want to use him to
set up meetings when I am in Washington in May . . . . Please think
through who we should meet and let me know. I will contact Michael
and ask him to set up meetings.
64. On or about April 2, 2017, Novartis Executive 2 emailed Novartis Executive 1 and
stated that they wanted to assess COHEN's ability "to secure high-level government meetings"
within the Administration, and that there was "no need to divulge our relationship with [COHEN]."
G. Michael D. Cohen & Associates P.C.
65 . In addition to monies received through Essential Consultants, banking records
obtained through the course of the investigation show that during 2017 COHEN has received
significant payments through another corporation with the name "Michael D. Cohen & Associates
P.C." ("MDC&A"). Records from the New York State Department of State, Division of
Corporations show that on or about March 21, 2017, COHEN registered the new corporation
18At the time, COHEN still represented himself to be a personal attorney to the President. As of
November 2017, he continues to make such representations.
25
"Michael D. Cohen & Associates, P.C." Bank 1 records also show that in or around March 2017,
COHEN opened a new bank account in the name of MDC&A. According to records obtained from
Bank 1, COHEN is the sole signatory on the bank account.
66. Records from Bank l that since approximately April 2017, approximately $291,666
has been maJe inlu lhe MDC&A account at Bank 1 from a bank account in the name of the law
firm Squire Patton Boggs, as summarized below:
DATE AMOUNT
April5,2017 $41,666.67
April 28, 2017 $4 1,666.67
May 31, 2017 $41 ,666.67
June 30, 2017 $41 ,666.67
July31,2017 $41,666.67
August 31, 20 17 $41,666.67
Open-source records show that, on or about April 3, 2017, a press release from Squire Patton Boggs
announced that the law firm and MDC&A have entered into a "strategic alliance" that "will enable
the two firms to work together to advance the interests of their clients." A search of open-source
records has revealed no indication that this relationship has been terminated since April 2017.
67. Records obtained from another FDIC-insured financial institution ("Bank 6") show
that in or around March 2017, a new account was opened in the name of COHEN's wife (COHEN
is not identified as an account holder or signatory). Records from Bank 6 and another FDIC-insured
financial institution ("Bank 7") show that since February 2017, COHEN has received.over $280,000
through checks from President Trump, as summarized below:
26
APPROXIMATE DATE OF CHECK AMOUNT
February 14, 2017 $70,000
March 17, 2017 $35,000
May 23, 2017 $35,000
June 19, 2017 $35,000
June 19, 2017 $35,000
July 11, 2017 $35,000
August I, 2017 $35,000
In most cases, COHEN endorsed the check over to his wife, who deposited the check into the
account the account opened at Bank 6 in her sole name.
H. Recent Representations to Financial Institutions
68. According to Accountant 1, in or around early October 2017, COHEN directed
Accountant 1 to prepare another "Statement of Financial Condition" for Bank 5.19 On or about
October 6, 2017, Accountant 1 sent an email to COHEN at the Target Account. In the email,
Accountant 1 wrote that"[a]ttachedis a draft of the newPFS as at September 30, 2017" and attached
a draft of the personal financial statement. According to this statement, COHEN claimed that as of
September 30, 2017, he had assets of only $33,430,000 and liabilities of approximately
$45,630,000, leaving him purportedly over $12 million in debt.
69. In the October 6, 2017 email sent to COHEN at the Target Account, Accountant 1
warned COHEN that the financial statement did not list any assets associated with either Essential
19
Records obtained from Bank 5 indicate that COHEN continues to negotiate over his $2 1 million
in medallion loans, which he and his wife have personally guaranteed. Information obtained from
Bank 5 indicates that COHEN has sought hundreds of thousands of debt relief from Bank 5 as part
of negotiation.
27
Consultants or MDC&A: "[w]e did not add any value for you[r] two operating entities - Michael
D. Cohen & Associates POC [sic] and Essential Consultants LLC. Please advise whether or not
these should be disclosed and what value." According to Accountant I, in an earlier conversation
COHEN had stated generally that he expected to earn approximately $5-6 million a year through
Essential Cou:sullanl:s aml an additional $70,000 per month through MUC&A; however, COHEN
never provided Accountant 1 with any details.
70. On or about October 6, 2017, COHEN, using the Target Account, responded to
Accountant 1's email with the answer "[l]ooks good to me." COHEN never provided Accountant
1 with any instructions to list any assets associated with Essential Consultants or MDC&A.
Accountant 1 confirmed that neither entity was ever listed on the finalized Personal Financial
Statement, and that COHEN has not made any estimated tax payments on behalf of Essential
Consultants.
BACKGROUND CONCERNING GOOGLE MAIL
71. In my training and experience, I have learned that Google provides a variety of on-
line services, including electronic mail ("email") access, to the public. Google allows subscribers
to obtain email accounts at the domain name gmail.com, like the Target Account. Subscribers
obtain an account by registering with Google Mail. During the registration process, Google Mail
asks subscribers to provide basic personal information. Therefore, the computers of Google are
likely to contain stored electronic communications (including retrieved and unretrieved email for
Google Mail subscribers and information concerning subscribers and their use of Google Mail
services, such as account access information, email transaction information, and account
application information. In my training and experience, such information may constitute evidence
28
of the crimes under investigation because the information can be used to identify the account's
user or users.
72. In my training and experience, email providers generally ask their subscribers to
provide certain personal identifying information when registering for an email account. Such
information can include the subscriber's full name, physical address, telephone numbers and other
identifiers, alternative email addresses, and, for paying subscribers, means and source of payment
(including any credit or bank account number). In my training and experience, such information
may constitute evidence of the crimes under investigation because the information can be used to
identify the account's user or users. Based on my training and my experience, I know that, even
if subscribers insert false information to conceal their identity, this information often provides
clues to their identity, location, or illicit activities.
73. In my training and experience, email providers typically retain certain transactional .
information about the creation and use of each account on their systems. This information can
include the date on which the account was created, the length of service, records of log-in (i.e.,
session) times and durations, the types of service utilized, the status of the account (including
whether the account is inactive or closed), the methods used to connect to the account (such as
logging into the account via the provider's website), and other log files that reflect usage of the
account. In addition, email providers often have records of the Internet Protocol address ("IP
address") used to register the account and the IP addresses associated with particular logins to the
account. Because every device that connects to the Internet must use an IP address, IP address
information can help to identify which computers or other devices were used to access the email
account.
29
with professional responsibility requirements concerning the maintenance of attorney-client and
other operative privileges. The procedures include use of a designated "filter team," separate and
apart from the investigative team, in order to address potential privileges.
CONCLUSION
79. I3ased on the forgoing, I rt:quest that the Court issue the proposed search warrant.
REQUEST FOR SEALING
80. I further request that the Court order that all papers in support of this application,
including the application, affidavit and search warrant, be sealed until further order of the Court.
These documents discuss an ongoing criminal investigation that is neither public nor known to
all of the targets of the investigation. Accordingly, there is good cause to seal these documents
because their premature disclosure may give targets an opportunity to flee/continue flight from
prosecution, destroy or tamper with evidence, change patterns of behavior, notify confederates,
or otherwise seriously jeopardize the investigation.
Respectfully submitted,
Special Agent
Federal Bureau of Investigation
Subscribed and sworn to before me on this 11.!day ofNovember, 20 17.
/~r(t- . d ~
The Honorable Beryl A. Howell
Chief United States District Judge
32
ATTACHMENT A
This warrant applies to information associated with the Google Mail Account
gmail.com that is stored at premises owned, maintained, controlled, or operated
by Google, a company headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043.
33
ATTACHMENT B
I. Information to be disclosed by Google

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Google (hereinafter "the Provider"), regardless of whether such
information is stored, held or maintained inside or outside of the United States, and including any
emails, records, files, logs, or information that have been deleted but are still available to the
Provider, the Provider is required to disclose the following information to the government for each
account or identifier listed in Attachment A:
a. The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;
b. All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number);
c. The types of service utilized;
d. All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;
e. All records pertaining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken; and other identifiers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized,
the IP address used to register the account, log-in IP addresses associated with
session times and dates, account status, a1temative e-mail -addresses provided
during registration, all other user names associated with the account, all account
names associated with the subscriber, methods of connecting;
34
f. All search history or web history;

g. All records indicating the services available to subscribers of the accounts;
h. All usernames associated with or sharing a login IP address or browser cookie with
the accounts;
1. All cookies, including third-party cookies, associated with the user;
J. All records that are associated with the machine cookies associated with the user;
and
k. All telephone or instrument numbers associated with the Account (including MAC
addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity
Numbers ("MEIN"), Mobile Equipment Identifier ("MEID"), Mobile Identification
Numbers ("MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber
Integrated Services Digital Network Number ("MSISDN"), International Mobile
Subscriber Identifiers ("IMSI"), or International Mobile Equipment Identities
("IMEI").
II. Information to be Seized by the Government
All information described above in Section I that constitutes evidence, contraband, fruits,
and/or instrumentalities of violations of 18 U.S.C. § 1014 (false statements to a financial
institution), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1344 (bank fraud), and 18 U.S .C. § 1956
(money laundering), as well as 18 U.S.C . § 951 (acting as an unregistered foreign agent) and the
Foreign Agents Registration Act ("FARA"), 22 U.S.C. § 611 et seq., involving Michael Dean
Cohen and occurring on or after June 1, 2015, including, for each account or identifier listed on
Attachment A, information pertaining to the following matters:
a. Communications, records, documents, and other files involving Essential
Consultants, LLC;
b. Communications, records, documents, and other files that false representations to a
financial institution with relation to intended the purpose of an account or loan at
that financial institution; the nature of any business or entity associated with an
account a financial institution; the source of funds flowing into an account; or the
purpose or nature of any financial transactions involving that financial institution;
35
c. Records of any funds or benefits received by or offered to Michael Dean Cohen by,
or on behalf of, any foreign government, foreign officials, foreign entities, foreign
persons, or foreign principals;
d. Communications, records, documents, and other files that reveal efforts by Michael
Dean Cohen to conduct activities on behalf of, for the benefit of, or at the direction
of any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;
e. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;
f. Evidence indicating the account owner' s state of mind as it relates to the crimes
under investigation;
g. The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s); and
h. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by Michael Dean Cohen on behalf of, for the benefit of, or
at the direction of any foreign government, foreign officials, foreign entities,
foreign persons, or foreign principals.
III. Review Protocols
Review of the items described in Attachment A and Attachment B shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
36
AO 93 (Rev. 11/13) Search and Seizure Warrant
UNITED STATES DISTRICT COURT

for the
District of Columbia
In the Matter of the Search of )

(Briefly describe the property to be searched ) Case: 1: 17-mj-00855
or identify the person by name and address) )
Assigned To : Chief Judge Howell, Beryl A.
INFORMATION ASSOCIATED WITH THE EMAIL )
Assign. Date : 11/13/2017
ACCOUNT GMAIL.COM )
) Description: Search and Seizure Warrant
SEARCH AND SEIZURE WARRANT

To: Any authorized law enforcement officer
An application by a federal law enforcement officer or an attorney for the government requests the search
of the following person or property located in the Northern District of California
(idenrify the person or describe the property to be searched and give its location):
See Attachment A.
I find that the affidavit(s), or any recorded testimony, establish probable cause to search and seize the person or property
described above, and that such search will reveal (identify the person or describe the property to be seized) :
See Attachment B.
YOU ARE COMMANDED to execute this warrant on or before November 20, 2017 (not to exceed 14 days)
~ in the daytime 6:00 a.m. to 10:00 p.m. 0 at any time in the day or night because good cause has been established.
Unless delayed notice is authorized below, you must give a copy of the warrant and a receipt for the property taken to the
person from whom, or from whose premises, the property was taken, or leave the copy and receipt at the place where the
property was taken.
The officer executing this warrant, or an officer present during the execution of the warrant, must prepare an inventory
as required by law and promptly return this warrant and inventory to Hon. Beryl A. Howell
(United States Magistrate Judge)
D Pursuant to 18 U.S.C. § 3103a(b ), I find that immediate notification may have an adverse result listed in 18 U.S.C.
§ 2705 (except for delay of trial), and authorize the officer executing this warrant to delay notice to the person who, or whose
property, will be searched or seized (check the appropriate box)
0 for days (not to exceed 30) 0 until, the facts justifying, the later specific date of
Date and time issued:

Judge 's signature
City and state: Washington , DC Hon . Beryl A. Howell, Chief U.S. District Judge
AO 93 (Rev. 11 / 13) Search and Seizure Warrant (Page 2)
Return
Case No.: Date and time warrant executed: Copy of warrant and inventory left with:
Inventory made in the presence of:
Inventory of the property taken and name of any person(s) seized:
Certification
I declare under penalty of perjury that this inventory is correct and was returned along with the original warrant to the
designated judge.
Date:
Executing officer 's signature

ATTACHMENT A
This warrant applies to information associated with the Google Mail Account
@gmail.com that is stored at premises owned, maintained, controlled, or operated
by Google, a company headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043.

ATTACHMENT B
I. Information to be disclosed by Google

To the extent that the information described in Attachment A is within the possession,
custody, or control of the Google (hereinafter "the Provider"), regardless of whether such
information is stored, held or maintained inside or outside of the United States, and including any
emails, records, files, logs, or information that have been deleted but are still available to the
Provider, the Provider is required to disclose the following information to the government for each
account or identifier listed in Attachment A:
a. The contents of all emails associated with the account, including stored or preserved
copies of emails sent to and from the account, draft emails, the source and
destination addresses associated with each email, the date and time at which each
email was sent, and the size and length of each email;
b. All records or other information regarding the identification of the account, to
include full name, physical address, telephone numbers and other identifiers,
records of session times and durations, the date on which the account was created,
the length of service, the IP address used to register the account, log-in IP addresses
associated with session times and dates, account status, alternative email addresses
provided during registration, methods of connecting, log files, and means and
source of payment (including any credit or bank account number);
C. The types of service utilized;
d. All records or other information stored at any time by an individual using the
account, including address books, contact and buddy lists, calendar data, pictures,
and files;
e. All records pe1taining to communications between the Provider and any person
regarding the account, including contacts with support services and records of
actions taken; and other identifiers, records of session times and durations, the date
on which the account was created, the length of service, the types of service utilized,
the IP address used to register the account, log-in IP addresses associated with
session times and dates, account status, alternative e-mail addresses provided
during registration, all other user names associated with the account, all account
names associated with the subscriber, methods of connecting;
2
f. All search history or web history;

g. All records indicating the services available to subscribers of the accounts;
h. All usernames associated with or sharing a login IP address or browser cookie with
the accounts;
1. All cookies, including third-party cookies, associated with the user;
J. All records that are associated with the machine cookies associated with the user;
and
k. All telephone or instrument numbers associated with the Account (including MAC
addresses, Electronic Serial Numbers ("ESN"), Mobile Electronic Identity
Numbers ("MEIN"), Mobile Equipment Identifier ("MEID"), Mobile Identification
Numbers (" MIN"), Subscriber Identity Modules ("SIM"), Mobile Subscriber
Integrated Services Digital Network Number ("MSISDN"), International Mobile
Subscriber Identifiers ("IMSI"), or International Mobile Equipment Identities
("IMEi").
II. Information to be Seized by the Government
All infonnation described above in Section I that constitutes evidence, contraband, fruits,
and/or instrumentalities of violations of 18 U.S.C. § 1014 (false statements to a financial
institution), 18 U.S.C. § 1343 (wire fraud), 18 U.S.C. § 1344 (bank fraud), and 18 U.S.C. § 1956
(money laundering), as well as 18 U.S.C. § 951 (acting as an unregistered foreign agent) and the
Foreign Agents Registration Act ("FARA"), 22 U.S.C. § 611 et seq., involving Michael Dean
Cohen and occurring on or after June 1, 2015, including, for each account or identifier listed on
Attachment A, information pertaining to the fo llowing matters:
a. Communications, records, documents, and other files involving Essential
Consultants, LLC;
b. Communications, records, documents, and other files that false representations to a
financial institution with relation to intended the purpose of an account or loan at
that financial institution; the nature of any business or entity associated with an
account a financial institution ; the source of funds flowing into an account; or the
purpose or nature of any financial transactions involving that financial institution;
3
c. Records of any funds or benefits received by or offered to Michael Dean Cohen by,
or on behalf of, any foreign government, foreign officials, foreign entities, foreign
persons, or foreign principals;
d. Communications, records, documents, and other files that reveal efforts by Michael
Dean Cohen to conduct activities on behalf of, for the benefit of, or at the direction
of any foreign government, foreign officials, foreign entities, foreign persons, or
foreign principals;
e. Evidence indicating how and when the account was accessed or used, to determine
the geographic and chronological context of account access, use, and events relating
to the crimes under investigation and to the account owner;
f. Evidence indicating the account owner's state of mind as it relates to the crimes
under investigation;
g. The identity of the person(s) who created or used the account, including records
that help reveal the whereabouts of such person(s); and
h. The identity of any person(s)-including records that help reveal the whereabouts
of the person(s)-who communicated with the account about any matters relating
to activities conducted by Michael Dean Cohen on behalf of, for the benefit of, or
at the direction of any foreign government, foreign officials, foreign entities,
foreign persons, or foreign principals.
III. Review Protocols
Review of the items described in Attachment A and Attachment B shall be conducted
pursuant to established procedures designed to collect evidence in a manner consistent with
professional responsibility requirements concerning the maintenance of attorney-client and other
operative privileges. When appropriate, the procedures shall include use of a designated "filter
team," separate and apart from the investigative team, in order to address potential privileges.
4
IN THE UNITED STATES DISTRICT COURT

IN THE MA TIER OF THE SEARCH OF Case: 1:17-mj-00855

INFORMATION ASSOCIATED WITH THE Assigned To : Chief Judge Howell, Beryl A
EMAIL ACCOUNT Assign. Date : 11/13/2017
@GMAIL.COM Description: Search and Seizure Warrant
MOTION TO SEAL WARRANT AND RELATED DOCUMENTS AND

TO REQUIRE NON-DISCLOSURE UNDER 18 U.S.C. § 2705(b)
The United States of America, moving by and through its undersigned counsel, respectfully
moves the Court for an Order placing the above-captioned warrant and the application and affidavit
in support thereof (collectively herein the "Warrant") under seal, and precluding the provider from
notifying any person of the Warrant pursuant to 18 U.S.C. § 2705(b). In regard to the non-
disclosure, the proposed Order would direct Google, an electronic communication and/or remote
computing services provider headquartered at 1600 Amphitheatre Parkway, Mountain View, CA
94043, not to notify any other person (except attorneys for Google for the purpose of receiving
legal advice) of the existence or content of the Warrant for a period of o~e year unless otherwise
ordered of the Court.
JURISDICTION AND LEGAL BACKGROUND
1. The Court has the inherent power to seal court filings when appropriate,
including the Warrant. United States v. Hubbard, 650 F.2d 293, 315-16 (D.C. Cir. 1980) (citing
Nixon v. Warner Communications, Inc., 435 U.S. 589, 598 (1978)). The Court may also seal the
Warrant to prevent serious jeopardy to an ongoing criminal investigation when, as in the present
case, such jeopardy creates a compelling governmental interest in preserving the confidentiality of
the Warra.!_lt. See Washi71gton Post v. R_gbinsol'b 935 F.2d 282, 28]-89 (D.C. Cir. 1991).
deems appropriate, not to notify any other person of the existence of the warrant,
subpoena, or court order. The court shall enter such an order if it determines that
there is reason to believe that notification of the existence of the warrant, subpoena,
or court order will result in-
(1) endangering the life or physical safety of an individual;
(2) flight from prosecution;
(3) destruction of or tampering with evidence;
(4) intimidation of potential witnesses; or
(5) otherwise seriously jeopardizing an investigation or unduly delaying a trial.
18 U.S.C. § 2705(b). The United States District Court for the District of Columbia has made clear
that a nondisclosure order under Section 2705(b) must be issued once the Government makes the
requisite showing about potential consequences of notification:
The explicit terms of section 2705(b) make clear that if a courts [sic] finds that there
is reason to believe that notifying the customer or subscriber of the court order or
subpoena may lead to one of the deleterious outcomes listed under § 2705(b), the
court must enter an order commanding a service provider to delay notice to a
customer for a period of time that the court determines is appropriate. Once the
government makes the required showing under § 2705(b), the court is required to
issue the non-disclosure order.
In re Application for Order of Nondisclosure Pursuant to 18 USC. § 2705(b) for Grand Jury
Subpoena #GJ2014031422765, 41 F. Supp. 3d 1, 5 (D.D.C. 2014).
5. Accordingly, this motion to seal sets forth facts showing reasonable grounds to
command Google not to notify any other person (except attorneys for Google for the purpose of
receiving legal advice) of the existence of the Subpoena for a period of one year or until further
order of the Court.
FACTS SUPPORTING SEALING AND NON-DISCLOSURE
6. At the present time, law enforcement officers of the FBI are conducting an
investigation into violations related to 18 U.S.C. § 1014 (false statements to a financial institution),
18 U.S.C. § 1344 (bank fraud), 18 U.S.C. § 1956 (money laundering), as well as 18 U.S.C. § 951
(acting as an unregistered foreign agent) and the Foreign Agents Registration Act ("FARA"), 22
3
U.S.C. § 611 et seq. arising out of the conduct of Michael D. Cohen. It does not appear that Cohen
is currently aware of the nature and scope of the ongoing FBI investigation into him.
REQUEST FOR SEALING AND NON-DISCLOSURE
7. In this matter, the government requests that the Warrant be sealed until further order
of the Court and that Google and its employees be directed not to notify any other person of the
existence or content of the Warrant (except attorneys for Google for the purpose of receiving legal
advice) for a period of one year or until further order of the Court. Such an order is appropriate
because the Warrant relates to an ongoing criminal investigation, the full scope of which is neither
public nor known to the targets of the investigation, and its disclosure may alert these targets to
the ongoing investigation and its scope. Once alerted to this investigation, potential targets would
be immediately prompted to destroy or conceal incriminating evidence, alter their operational
tactics to avoid future detection, and otherwise take steps to undermine the investigation and avoid
future prosecution. In particular, given that they are known to use electronic communication and
remote computing services, the potential target could quickly and easily destroy or encrypt digital
evidence relating to their criminal activity.
8. Given the complex and sensitive nature of the criminal activity under investigation,
and also given that the criminal scheme may be ongoing, the Government anticipates that this
confidential investigation will continue for the next year or longer. However, should
circumstances change such that court-ordered nondisclosure under Section 2705(b) becomes no
longer needed, the Government will notify the Court and seek appropriate relief.
9. There is, therefore, reason to believe that notification of the existence of the
Warrant will seriously jeopardize the investigation, including by giving the targets an opportunity
to flee from prosecution, destroy or tamper with evidence, and intimidate witnesses. See 18 U.S.C.
4
§ 2705(b)(2)-(5). Because of such potential jeopardy to the investigation, there also exists a
compelling governmental interest in confidentiality to justify the government' s sealing request.
See Robinson, 935 F.2d at 287-89.
10. Based on prior dealings with Google the United States is aware that, absent a court
order under Section 2705(b) commanding Google not to notify anyone about a legal request, it is
Google's policy and practice, upon receipt of a warrant seeking the contents of electronically
stored wire or electronic communications for a certain account, to notify the subscriber or customer
of the existence of the warrant prior to producing the material sought.
WHEREFORE, for all the foregoing reasons, the government respectfully requests that the
above-captioned warrant, the application and affidavit in support thereof, and all attachments
thereto and other related materials be placed under seal, and furthermore, that the Court command
Google not to notify any other person of the existence or contents of the above-captioned warrant
(except attorneys for Google for the purpose of receiving legal advice) for a period of one year
unless otherwise ordered by the Court.
Respectfully submitted,
21
ROBERTS. MUELLER, III
Dated:
5
ED
TN THE UNITED STATES DISTRICT COURT NOV l 3 2017
Clerk, U.S. -Distrtcr& ·sankrupto
Courts for the Dlstrlrt~! CDJumbra
IN THE MATTER OF THE SEARCH OF
rNFORMA TfON ASSOC IATED WITH THE Case: 1: 17-mj-00855
EMAIL ACCOUNT Assigned To : Chief Judge Howell, Beryl A.
@GMAIL.COM Assign. Date: 11/13/2017
ORDER
The United States has filed a motion to seal the above-captioned warrant and related
documents, including the application and affidavit in support thereof ( collectively the "Warrant"),
and to require Google, an electronic communication and/or remote computing services
headquartered at 1600 Amphitheatre Parkway, Mountain View, CA 94043 nofto disclose the
existence or contents of the Warrant pursuant to 18 U.S.C. § 2705(b).
The Court finds that the United States has established that a compelling governmental
interest exists to justify the requested sealing, and that there is reason to believe that notification
of the existence of the Warrant will seriously jeopardize the investigation, including by giving.the
targets an opportunity to flee from prosecution, destroy or tamper with evidence, _and intimidate
witnesses. See 18 U.S.C. § 2705(b)(2)-(5).
IT IS THEREFORE ORDERED that the motion is hereby GRANTED, and that the
warrant, the application and affidavit in support thereof, all attachments thereto and other related
materials, the instant motion to seal, and this Order be SEALED until further order of the Court;
and
IT IS FURTHER ORDERED that, pursuant to 18 U.S.C. § 2705(b), Google and its
em ployees shall not disclose the existence or content of the Warrant to any other person (except
attorneys for Google for the purpose of receiving legal adv ice) for a period of one year unless
otherwise ordered by the Court.
THE HON0BLEBERYLA. HOWELL

CHIEF UNITED STA TES DISTRICT JUDGE

11 14 17 Cohen Search Warrant II

Uploaded by

Copyright:

Available Formats

11 14 17 Cohen Search Warrant II

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

11 14 17 Cohen Search Warrant II

Uploaded by

Copyright:

Available Formats

Case 1:19-mc-00044-BAH Document 16 Filed 05/22/19 Page 1 of 48

AO 106 (Rev. 04/ 10) Application for a Search Warrant

UNITED STATES DISTRICT COURT NOV ·1 3 2017

In the Matter of the Search of )

APPLICATION FOR A SEARCH WARRANT

See Attachment A2.

The search is related to a violation of:

See attached Affidavit.

b/ Continued on the attached sheet.

pecial Agent, FBI

Sworn to before me and.sigoed in my presence.

IN THE UNITED STATES DISTRICT COURT

IN THE MATTER OF THE SEARCH OF UNDER SEAL

I, eing first duly sworn, hereby depose and state as follows:

INTRODUCTION AND AGENT BACKGROUND

1. I make this affidavit in support of an application for a search warrant for

@gmail.com (hereinafter the "Target Account"), that is stored at premises owned,

maintained, controlled, or operated by Google, an email provider headquartered at 1600

Amphitheatre Parkway, Mountain View, CA 94043 (hereinafter "Google"). The information to

the content of communications) further described in Attachment A. Upon receipt of the

information described in Attachment A, government-authorized persons will review that

information to locate the items described in Attachment B.

forth all of my knowledge about this matter.

competent jurisdiction" as defined by 18 U.S.C. § 2711. Id. §§ 2703(a), (b)(l)(A), &

wrote the Target Account as his current e-mail address.

B. Essential Consultants, LLC

provided by Bank 1 related to COHEN and these various accounts.

COHEN on or about October 17, 2016.

your customer ("KYC") procedures:

a. He was opening Essential Consultants as a real estate consulting company to collect

fees for investment consulting work;

residential real estate deals;

D. Representations about Net Worth to Financial Institutions

submissions between 2014 and 201 7.

22. For example, in or around October 2014, COHEN submitted a "Statement of

assets totaling approximately $99,420,000 and liabilities of approximately $23,550,000. On the

same document, COHEN claimed to have a net worth of approximately $75,870,000.

a. In addition, documents collected from Bank 1 show that COHEN made

representations to Bank 1 that he had no contingent liabilities, when in fact, based

on documents COHEN submitted to another FDIC-insured financial institution

a standard question that he had to answer whenever seeking monies.

of $20.0 million." The letter did not disclose any liabilities.

that would offset those holdings.

claimed to have a net worth of approximately $2,825,000. 8

going to give both documents to Bank 4 in order to give an accurate representation

would be submitted to Bank 4 as a stand-alone document, without the Statement of

Financial Condition disclosing the outstanding liabilities, he would not have

prepared the letter as directed.

E. Foreign Transactions in the Essential Consultants Account

National Security Division in Washington, D.C.

1. Deposits bv Columbus Nova, LLC

controlled by Renova Group ("Renova"), an industrial holding company based in Zurich,

Switzerland. According to public news account::;, Reuu va is controlled by Viktor Vekselberg, a

and repatriation of historic Faberge eggs. 12

The following table summarizes the funds transferred to date:

January 31, 2017 $83,333.00

March 2, 2017 $83,333.33

March 31, 2017 $83,333.33

April 28, 2017 $83,333.33