iwHhYM6e

1
2****** Result for Image/Page 1 ******
3UNITED STATES DISTRICT COURT 
4SOUTHERN DISTRICT OF NEW YORK 
5In the Matter of a Warrant for All 
6Content and Other Information 
7Associated with the Email Accounts 
8fi)omnil 
9Maintained at 
10Premises Controlled by Google, Inc., 
11the Email Account 
12Maintained at Premises Controlled by 
13Oath, Inc., and the Email Account 
14maintained at 
15Premises Controlled by 1 & 1 Intemet, 
16Inc., USAO Reference No. 
172018R00127 
18TO BE FILED UNDER SEAL 
19AGENT AFFIDAVIT 
2018 MAG 169 6 
21I 
22Agent Affidavit in Support of Application for a Search Warrant 
23for Stored Electronic Communications 
24STATE OF NEW YORK ) 
25) ss. 
26COUNTY OF NEW YORK ) 
27Special Agent 
28of the United States Attorney's Office for the Southem 
29District of New York, being duly sworn, deposes and states: 
30I. Introduction 
31A. Affiant 
321. Iam a Special Agent with the United States Attorney's Office for the Southem District 
33of New York (the "USAO"). I have been a Special Agent with the USAO since August 2016. I 
34previously served as a Special Agent with the United States Department of Labor Inspector 
35General from May 2011 to August 2016. In the course of my experience and training in these 
36positions, I have participated in criminal investigations into federal offenses involving a wide array 
37
38****** Result for Image/Page 2 ******
39of financial crimes, including frauds on financial institutions. I also have training and experience 
40executing search warrants, including those authorizing the search of email accounts. 
41B. The Provider, the Subject Account and the Subject Offenses 
422. I make this affidavit in support of an application for a search warrant pursuant to 18 
43U.S.C. 2703 for all content and other information associated with the email accounts 
44@gmail.com (the "Cohen Account"), "1vDCPC 
45(the 
46Account")' and @aol.com (the ' ÄAccount") (collectively, the 
47—Account, and 
48"Subject Accounts"). The Cohen Account, 
49Account are maintained and controlled by Google, Inc., headquartered at 1600 Amphitheatre 
50Parkway, Mountain View, California 94043 ("Google"), the MDCPC Account is maintained and 
51controlled by 1 & 1 Internet, Inc., headquartered at 701 Lee Road, Suite 300, Chesterbrook, 
52Pennsylvania 19087 ("1 & 1"), and th— 
53Account is maintained and controlled by Oath, Inc., 
5422000 AOL Way, Dulles, Virginia 20166 ("Oath") (together, the "Providers"). The information 
55to be searched is described in the following paragraphs and in Attachments A, B, C and D to the 
56proposed warrants. 
573. As detailed below, there is probable cause to believe that the Subject Accounts contain 
58evidence, fruits, and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to defraud the 
59United States), 1005 (false bank entries), 1014 (false statements to a financial institution), 1343 
60(wire fraud), and 1344 (bank fraud) (collectively, the "Subject Offenses"). The Target Subjects of 
61this investigation are MICHAEL COHEN ("Cohen") and others known and unknown. This 
62affidavit is based upon my personal knowledge, my review of documents produced pursuant to 
63grand jury subpoenas and prior search warrants, my review of interview reports prepared by other 
64law enforcement officers, and my conversations with other law enforcement officers, as well as 
652 
6602.28.2018 
67
68****** Result for Image/Page 3 ******
69my training and experience concerning the use of email in criminal activity. Because this affidavit 
70is being submitted for the limited purpose of establishing probable cause, it does not include all 
71the facts I have learned during my investigation. Where the contents of documents and the actions, 
72statements, and conversations of others are reported herein, they are reported in substance and in 
73part, except where otherwise indicated. 
74C. Services and Records of the Provider 
754. I have learned the following about the Providers: 
76a. The Providers offer email services to the public. In particular, Google permits 
77subscribers to maintain email accounts under the domain name gmail.com. Google also allows a 
78subscriber to maintain email accounts under any domain name under the subscriber's control. For 
79example, if a subscriber controls the domain name ' 
80' Google enables the subscriber 
81to host any email address under this domain name on servers operated by Google. Oath permits 
82subscribers to maintain email accounts under the domain name aol.com. 1 & 1 permits subscribers 
83to maintain email accounts under any domain name under the subscriber's control. For example, 
84if a subscriber controls the domain nam€ 
85' 1 & 1 enables the subscriber to host any 
86email address under this domain name on servers operated by •1 & 1. A subscriber using the 
87Providers' services can access his or her email account from any computer connected to the 
88Internet. 
89b. The Providers maintain the following records and information with respect to every 
90subscriber account: 
91i. Email contents. In general, any email (which can include attachments such 
92as documents, images, and videos) sent to or from a subscriber's account, or stored in draft form 
93in the account, is maintained on the Providers' servers unless and until the subscriber deletes the 
94email. If the subscriber does not delete the email, it can remain on the Providers' computers 
953 
9602.282018 
97
98****** Result for Image/Page 4 ******
99indefinitely. Even if the subscriber deletes the email, it may continue to be available on the 
100Provider's servers for a certain period of time. 
101ii. Address book. The Providers also allow subscribers to maintain the 
102equivalent of an address book, comprising email addresses and other contact information of other 
103email users. 
104iii. Subscriber and billing information. The Providers collect and maintain 
105(typically unverified) identifying information about each subscriber, including, for example, name, 
106username, address, telephone number, and alternate email addresses. The Providers also maintain 
107records concerning the date on which the account was created, the Internet protocol ("IP") address 
108of the user at the time of account creation, the current status of the account (e.g., active or closed), 
109the length of service, and the types of services utilized by the subscriber. Additionally, for paying 
110subscribers, the Providers maintain records of the subscriber's means and source of payment, 
111including any credit card or bank account number. 
112iv. Transactional information. The Providers also typically retain certain 
113transactional information about the use of each account on its system. This information can include 
114records of login (i.e., session) times and durations and the methods used to connect to the account 
115(such as logging into the account through the Providers' website). 
116v. Customer correspondence. The Providers also typically maintain records 
117of any customer service contacts with or about the subscriber, including any inquiries or 
118complaints concerning the subscriber's account. 
119vi. Search history. Google and Oath also typically maintain records of any 
120search history or web history associated with the subscriber's account. 
1214 
12202.282018 
123
124****** Result for Image/Page 5 ******
125vii. Associated content. Google also typically maintains content and records 
126relating to the following applications that are associated with its e-mail accounts: (A) "Google 
127Docs," which providés document-editing software that can be used to create, share, store, and 
128manage documents online; (B) "Google Drive," which enables users to store files on Google 
129servers, where they can be accessed remotely by the user and others; and (C) "Gchat" or "Instant 
130Messenger," which provides a chat interface through which users can communicate with each 
131other in real time. Oath also typically maintains content and records relating to AOL instant 
132message, which provides a chat interface through which users can communicate with each other 
133in real time. 
134viii. Preserved and backup records. The Providers also maintain preserved 
135copies of the foregoing categories ofrecords with respect to an account, for at least 90 days, upon 
136receiving a preservation request from the Government pursuant to 18 U.S.C. 2703(f). The 
137Providers may also maintain backup copies of the foregoing categories of records pursuant to its 
138own data retention policy. 
139D. Jurisdiction and Authority to Issue Warrant 
1405. Pursuant to 18 U.S.C. 2703(a), (b)(1)(A) & (c)(1)(A), the Government may require 
141a provider of an electronic communications service or a remote computing service, such as the 
142Providers, to disclose all stored content and all non-content records or other information pertaining 
143to a subscriber, by obtaining a warrant issued using the procedures described in the Federal Rules 
144of Criminal Procedure. 
1456. A search warrantunder 2703 maybe issued by "any district court of the United States 
146(including a magistrate judge of such a court)" that "has jurisdiction over the offense being 
147investigated." 18 U.S.C. 
1485 
1490228.2018 
150
151****** Result for Image/Page 6 ******
1527. When the Government obtains records under 2703 pursuant to a search warrant, the 
153Government is not required to notify the subscriber of the existence of the warrant. 18 U.S.C. 
1542703(a), (b)(1)(A), (c)(2) & (3). Additionally, the Government may obtain an order precluding 
155the Provider from notifying the subscriber or any other person of the warrant, for such period as 
156the Coutt deems appropriate, where there is reason to believe that such notification will seriously 
157jeopardize an investigation. 18 U.S.C. 2705(b). 
158E. Prior Applications 
1598. On or about July 18, 2017, in connection with an investigation being conducted by the 
160Office of the Special Counsel ("SCO"), the Federal Bureau of Investigation ("FBI") sought and 
161obtained from the Honorable Beryl A. Howell, Chief United States District Judge for the District 
162of Columbia, a search warrant for emails in the Cohen Account sent or received between January 
163I, 2016 and July 18, 2017. On or about November 13, 2017, the FBI sought and obtained from 
164Judge Howell search warrants for emails in the Cohen Account sent or received between June 1, 
1652015 and November 13, 2017, and emails in the MDCPC Account sent or received between the 
166opening of the account and November 13, 2017. The SCO has since referred certain aspects of 
167their investigation into Cohen to the USAO, which is working with the FBI's New York Field 
168Office. As patt of that referral, the SCO provided the USAO with emails and other content 
169information obtained pursuant to the search warrants executed by the SCO, which had already 
170been reviewed for privilege. As discussed below, this affidavit is based in part on my review of 
1711 
172In an abundance of caution, in a separate application the USAO has sought authorization, 
173pursuant to Fed. R. Crim. P. 41, to review the emails obtained pursuant to the Prior Cohen Account 
174Warrants for evidence related to certain additional conduct that was not the focus of the Prior 
175Cohen Account Warrants. The emails obtained from the Prior Cohen Account Warrants that relate 
176to that additional conduct do not form a basis for the instant application. 
1776 
17802.28.2018 
179I 
180
181****** Result for Image/Page 7 ******
182responsive materials produced pursuant to the July 18 and November 13, 2017 warrants (the "Prior 
183Cohen Account Warrants"). 
1849. On or about November 7, 2017, and January 4, 2018, as well as certain prior dates, the 
185SCO sought and obtained from Judge Howell orders authorizing and extending the installation and 
186use of pen registers and trap and trace devices to record communications sent to or from the Cohen 
187Account. The SCO has provided pen register data obtained pursuant to those orders to the USAO. 
188This affidavit, as discussed below, is based in part on my review of the pen register data obtained 
189pursuant to the November 7, 2017 and January 4, 2018 orders (the "Pen Register Data"). 
19010. On or about February 16, 2018, the USAO sought and obtained from the Honorable 
191Debra Freeman, United States Magistrate Judge for the Southern District of New York, an order 
192pursuant to 18 U.S.C. 2703(d) for email header information associated with the MDCPC 
193Account. This affidavit, as discussed below, is based in part on my review of email header 
194information produced by 1 & 1 in response to that order (the "MDCPC Header Information"). 
195II. Probable Cause 
196A. Overview 
19711. The United States Attorney' s Office for the Southern District ofNew York and FBI are 
198investigating, among other things, a scheme by Target Subject Michael Cohen to defraud multiple 
199banks. Cohen is an attorney who currently holds himself out as the personal attorney for President 
200Donald Trump, and who previously served for over a decade as an executive in the Trump 
201Organization, an international conglomerate with real estate and other holdings. 
20212. The investigation has revealed that Cohen has made affirmative misrepresentations in 
203and omitted material information from financial statements and other disclosures that Cohen 
204provided to multiple banks in connection with a transaction intended to relieve Cohen of 
205approximately $22 million in debt he owed on taxi medallion loans from the banks. As set forth 
2067 
20702.282018 
208I 
209
210****** Result for Image/Page 8 ******
211in detail below, in these financial statements, and in his oral and other written statements to these 
212banks, Cohen appears to have (i) intentionally omitted cash assets that he began receiving in 2017 
213from new consulting work; (ii) significantly understated his total holdings of cash and cash 
214equivalents; and (iii) failed to inform the banks from which he was seeking debt relief that he had 
215agreed to make a $3.8 million cash payment to a third party, 
216in connection with 
217acquisition of the taxi medallions securing Cohen's debt. By making these 
218misrepresentations and material omissions, Cohen avoided making monthly payments on his 
219loans, and attempted to and had secured proposed agreements from the banks to relieve him of 
220certain repayment obligations worth millions of dollars. 
22113. Based on my review of emails obtained from the Prior Cohen Account Warrants, 
222MDCPC Header Information, and documents produced pursuant to subpoenas, I have learned that 
223Cohen has used the Cohen Account and/or N'IDCPC Account to, among other things, (i) 
224communicate with 
225and their attomey= 
226about the proposed transfer of Cohen's medallions and associated debts; (ii) negotiate a pay-down 
227of the principal amount of the taxi medallion loans; (iii) communicate with his accountant about 
228the contents of the false financial statements at issue; and (iv) send those false financial statements 
229to banks. Additionally, the 
230Account, respectively, to communicate with Cohen 
231Account, 
232about the status of the taxi medallion transaction, and to send relevant financial statements to 
233banks. Accordingly, and as set forth in more detail below, there is probable cause to believe that 
234the Subject Accounts will include evidence of the Subject Offenses. 
235B. Cohen's Statements to Sterling National Bank 
23614. As set forth in detail below, in 2014, Cohen, through limited liability corporations 
237("LLCs") controlled by him and his wife, Laura Cohen, entered into a series of loans from Sterling 
2388 
23902282018 
240
241****** Result for Image/Page 9 ******
242National Bank ("Sterling") and the Melrose Credit Union ("Melrose"), secured by taxi medallions, 
243for approximately $20 million. Though entered into by LLCs, the loans were also secured by 
244personal guarantees in the names of both Cohen and his wife. Over time, as the taxi industry 
245weakened and the medallions were devalued, Cohen sought to renegotiate the terms of those loans 
246and/or relieve himself from their obligations, including the personal guarantees. As part of that 
247effort, Cohen made a series of representations to Sterling and Melrose about his net worth, assets, 
248available cash, and financial outlook. Specifically, based on my review of records maintained by 
249Sterling and Melrose, and public sources concerning the taxi industry and the value of taxi 
250medallions, as well as my review of reports prepared by law enforcement officers of interviews 
251with a Sterling executive vice-president (the "Sterling Employee-I") and my participation in an 
252interview with a Sterling employee (the "Sterling Employee-2"), I have learned, among other 
253things, the following: 
254a. Taxi medallions are small metal plaques affixed to taxis. Without a medallion, it 
255is illegal to operate a taxi in cities with medallion systems, such as New York City. Cohen and his 
256wife own multiple LLCs that collectively own 32 taxi medallions (each LLC owns two 
257medallions).2 Cohen's purchase of these New York taxi medallions was originally financed by 
258loans from Capital One Bank, for which the medallions served as collateral. Cohen was not a taxi 
259operator, and leased his medallions to a third party. That third party made monthly payments to 
260Cohen, who in turn used some of those proceeds to pay his monthly loan payments. 
261b. In early 2014, Cohen became a customer of Sterling when he sought to refinance a 
262mortgage on a rental property that he owned. In or around April 2014, Cohen raised with Sterling 
2632 One of these companies, Mad Dog Cab Corp., was jointly owned by Sondra Cohen, who I 
264believe is Cohen's mother. 
2659 
2660228.2018 
267
268****** Result for Image/Page 10 ******
269the prospect of refinancing his taxi medallion loans, which were then at Capital One Bank. By in 
270or about September 2014, Cohen began negotiating a lending transaction with Sterling that would 
271allow Cohen to pay off his loans at Capital One and borrow more money from the then-increase in 
272value of the medallions. According to Sterling Employee-I, in 2014, prior to the recent upheaval 
273in the taxi industry—as a result of the emergence of ride-sharing services, such as Uber—taxi 
274medallion loans were viewed by banks and investors as safe, short term credits, as the market value 
275of taxi medallions was consistently rising. Consequently, taxi medallion loans—like the loans held 
276by Cohen—were frequently refinanced at increasing amounts as the value of the medallions rose. 
277According to Sterling Employee-I , borrowers typically cashed out the increase in the loan amount 
278and used the additional funds for other purposes. Cohen appears to have followed this approach in 
2792014, when he agreed to refinance his medallion loans for approximately $22 million, which— 
280according to letters from Capital One Bank in Sterling's files—was greater than his previous debt 
281at Capital One Bank ($21 million, of which $14.6 million was a line of credit to Cohen). This 
282allowed Cohen to cash out the proceeds from the transaction. 
283c. Based on my review of records maintained by Sterling, I have learned that on or 
284about December 8, 2014, each of Cohen's sixteen taxi medallion corporations entered into loan 
285agreements and promissory notes with Sterling for the principal sum of $ 1,375,000, with repayment 
286due on December 8, 2016. Each loan was signed by Michael or Laura Cohen, depending on who 
287was the sole shareholder of the corporation. The loans were also each secured by a security 
288agreement, dated the same day, making the medallions collateral for the notes. To give Sterling 
289additional security, Michael and Laura Cohen signed personal guarantees and confessions of 
290judgment, giving Sterling the right to pursue collection against the Cohens' personal assets were 
291their corporations to default under the loan agreements. In total, Sterling agreed to lend 
29210 
29302.282018 
294
295****** Result for Image/Page 11 ******
296approximately $22 million to the Cohens' companies. Pursuant to participation agreements, 
297Sterling transferred 45 percent of that debt to Melrose.3 Under the terms of Sterling's participation 
298agreements with Melrose, Sterling was precluded from amending or modifying the loans without 
299the consent of Melrose. 
300d. In evaluating Cohen's requested refinancing of the taxi medallions, Sterling (and 
301Melrose, consistent with its participation in the deal) conducted due diligence. At Sterling's 
302request, Cohen provided Sterling with a statement of financial condition, dated August 1, 2014 
303(the "August 2014 Financial Statement"), which indicated that Cohen had $100,740,000 in total 
304assets, $23,550,000 in total liabilities, and a net worth of From my review of a 
305Sterling credit memorandum, dated September 29, 2014, I know that Sterling viewed the 
306transaction favorably because, accounting for loan payments, cash flows from the medallions were 
307projected to be positive, the value of the collateral (as estimated by Sterling) exceeded $42 million, 
308and the net worth of Cohen—who was the direct obligor under the guarantee agreements—was 
309over $77 million. An internal Sterling credit and risk rating analysis report, dated October 20, 
3102014, recommended approval of the loans for substantially the same reasons. 
311e. Based on my review of records maintained by Sterling and public sources, I have 
312learned that over time, the collateral backing Cohen's loans (taxi medallions) lessened in value due 
313to the rise in ride-sharing companies and significant devaluation oftaxi medallions. Additionally, 
314Cohen began falling behind on loan payments to Sterling and Melrose. I know from records 
315maintained by Sterling and an interview with Sterling Employee-2 that, beginning in or around 
3163 Melrose, which had a business principally focused on taxi medallion loans, is now in 
317conservatorship by the National Credit Union Administration ("NCUA"). 
3184 Cohen subsequently provided Sterling with a revised statement of financial condition, also 
319dated August 1, 2014, which reported assets of $99,420,000, total liabilities of $23,550,000, and a 
320net worth of $75,870,000. 
32111 
32202.28.2018 
323
324****** Result for Image/Page 12 ******
325September 2015, Cohen told Sterling, in sum and substance, that the individual leasing Cohen's 
326medallions had fallen behind in making payments to Cohen, and that as a result, the monthly cash 
327flow from his taxi medallions had been reduced, leaving him with a shortfall of approximately 
328$16,000 each month. For instance, I have reviewed an email from Sterling Employee-2, dated 
329September 9, 2015, summarizing a call with Cohen—which according to the email and toll records 
330for Cohen's cellphone occurred on September 8, 2015—during which Cohen told Sterling 
331Employee-2, in sum and substance, about his cash flow problems and a monthly shortfall of 
332approximately $16,000. In that same email, Sterling Employee-2 commented that despite Cohen's 
333statements, his personal financial information "indicate[dl a strong ability to make up the difference 
334in payments." Cohen, however, according to Sterling Employee-2, pushed the bank for a reduction 
335in Cohen's monthly payments. 
336f. From my review of records maintained by Sterling and my participation in an 
337interview with Sterling Employee-2, I have learned that Cohen and Sterling Employee-2 spoke 
338again on September 28, 2015, and that during the call Cohen stated, in sum and substance, that the 
339individual to whom Cohen leases the medallions had again reduced monthly payments to Cohen. I 
340know from my review of records maintained by Sterling that between in or about September 2015 
341and November 2015, Sterling raised the possibility—both internally and with Cohen—-of Cohen 
342posting his real estate holdings, personal residence, or some other collateral as additional security 
343for the banks. According to these records, however, Cohen resisted these requests. From my review 
344of loan documents and records maintained by Sterling, I know that in or about November 2015, as 
345a result of Cohen's representation that he was not earning sufficient returns on his medallions to 
346cover monthly interest payments, Sterling and Melrose agreed to amend their loans with Cohen by, 
34712 
34802.28.2018 
349
350****** Result for Image/Page 13 ******
351among other things, reducing the interest rate Cohen paid to Melrose and extending the loan 
352maturity date to December 8, 2017. 
353g. I know from interviews with Sterling Employee-I and Sterling Employee-2, as well 
354as emails 1 have reviewed, that in or about October 2016, Cohen told Sterling Employee-I that 
355Cohen had a potential buyer of his taxi medallions, named 
356who would agree to 
357assume Cohen's debt with Sterling and Melrose. Based on my review of records maintained by 
358Sterling, as well as the interviews with Sterling Employee-I and Sterling Employee-2 referenced 
359above, I know that by or before October 2016, Cohen had entered into negotiations to sell his sixteen 
360corporate taxi medallions to who is a medallion owner and taxi operator, for the 
361balance of the loans, which at the time was $21,376,000. 1 know from my review of records 
362maintained by Sterling, and my participation in an interview with Sterling Employee-2, that as a 
363condition of the transfer of the medallion loans—and because Sterling was unfamiliar withÄ 
364——Sterling requested that Cohen make a substantial principal payment on the loan, of 
365approximately one million dollars, prior to the transfer. Cohen rejected this request initially. But 
366on or about January 31, 2017, Cohen told Sterling Employee-I, in sum and substance, that he would 
367make a one million dollar principal reduction payment in order to move forward with the medallion 
368transfer deal with 
369Indeed, in an email sent from the Cohen Account to Sterling 
370Employee-2 on or about February 22, 2017, Cohen confirmed that he "agreed to pay down 1 million 
371from the loan amount." 
372h. Pursuant to the participation agreements between Sterling and Melrose, Sterling 
373was required to secure Melrose's agreement to participate in the transfer of the taxi medallion debt 
374from Cohen to 
375On or about April 17, 2017, Sterling sent a memorandum to 
376Melrose summarizing the terms of the proposed transaction, and noting the requirement that 
37713 
3780228.2018 
379
380****** Result for Image/Page 14 ******
381Melrose agree to the terms. On or about May 2, 2017, 
382emailed Sterling 
383Employee-I from the 
384Account to inquire about the status of the transaction. 
385at the 
386Account that 
387Sterling Employee-I responded to 
388a sheet 
389Melrose had agreed to the deal, and that Sterling would be sending 
390shortly. 
391i. In order for the banks to evaluate the proposed transaction fully, they requested 
392financial information from the parties. On or about October 26, 2016, a Sterling employee emailed 
393the 
394Account about the "Cohen Medallion Purchase," and stated "[i]n order to 
395proceed with the assumption of Michael's loans," Sterling needed certain financial information 
396from 
397responded from the 
398Account, copying 
399t the 
400Account, that he would send a financial statement and tax 
401returns shortly. Additionally, on or about June 7, 2017, Sterling Employee-I emailed Cohen to 
402request an "updated personal financial statement," completed jointly with Cohen's wife, and 
403Cohen's most recent federal income tax return. On or about June 8, 2017, Cohen emailed Sterling 
404Employee-I from the Cohen Account, attaching a Sterling personal financial statement form that 
405had been filled out by hand, which referenced a statement of financial condition, dated May I, 
4062017 (the "May 2017 Financial Statement'), that was also attached. The May 2017 Financial 
407Statement included a cover letter from Cohen's accountant, Jeffrey Getzel, stating, in sum and 
408substance, that the information in the statement came from Cohen and that Getzel had not 
409confirmed its accuracy or completeness. The May 2017 Financial Statement stated that Cohen had 
410total assets of $41,955,000, total liabilities of $39,130,000, and a net worth of $2,825,000. The 
411May 2017 Financial Statement indicated that Cohen's assets were comprised of $1,250,000 in 
41214 
41302282018 
414
415****** Result for Image/Page 15 ******
416cash, $26,155,000 in closely held companies (such as the taxi medallion entities and his real estate 
417holdings), $3,200,000 in real estate investments, and his $11,000,000 personal residence. 
418j. Based on my review of reports of law enforcement interviews of Sterling 
419Employee-I, I have learned that Sterling Employee-I reviewed each line ofthe May 2017 Financial 
420Statement with Cohen to, among other things, verify its accuracy, and Sterling Employee-I asked 
421Cohen about the cash amount listed on the May 2017 Financial Statement. Cohen stated to Sterling 
422Employee-I, in sum and substance, that the May 2017 Financial Statement was accurate. 
423k. On or about August 16, 2017, Sterling Employee-I emailed Cohen at the Cohen 
424Account and 
425at the 
426Account, attaching a non-binding term 
427sheet memorializing the potential transaction between Sterling, Melrose, Cohen, and 
428:mailed Sterling Employee-I from the 
429On or about August 29, 2017, 
430Account, requesting that he be included on "all future e-mails to 
431concerning this matter," and providing propoSed edits to the term sheet. On or about 
432August 30, 2017, Sterling Employee-I emailed 
433Account, Cohen at the Cohen Account, and —at the —Account, and provided them with a 
434revised tenn sheet. On or about September 5, 2017, Sterling Employee-I sent 
435at the 
436\ccount, Cohen at the Cohen Account, and 
437copy of the executed term sheet. According to the term sheet, 
438$20,000,000 from Sterling and Melrose, to be secured by the medallions that 
439acquire from Cohen. 
440Xccount a 
441would borow 
442was to 
443l. Aspart of the agreement, accordingto the term sheet, $1,265,913 inprincipal(which 
444is what would remain after the $20,000,000 payment on the outstanding loan balance) would be 
445repaid by Cohen and the two banks, with Cohen paying fifty percent and the banks dividing the 
44615 
44702282018 
448
449****** Result for Image/Page 16 ******
450remaining half of the balance. Based on my review of an internal Sterling credit memorandum, 
451dated October 4, 2017, the parties reached a preliminary agreement that Cohen would pay $632,956 
452of the remaining $1,265,912 principal loan balance, and Sterling and Melrose would absorb 
453$357,167 and $275,789 respectively in the form of charge-offs. According to Sterling Employee- 
4541, Sterling was willing to divide the repayment of the outstanding principal balance—despite its 
455prior insistence that Cohen make a principal pay-down of at least one million dollars because 
456Cohen represented on a telephone call with Sterling Employee-I, in sum and substance, that he had 
457insufficient liquidity to pay the full outstanding principal balance. As part of the agreement, Sterling 
458and Melrose also agreed to relieve Cohen and his wife of the personal guarantees that they made 
459on behalf of the LLCs. Thus, after completing the 
460transaction, Cohen would no longer 
461have had any outstanding obligations to Sterling or Melrose. 
462m. Based on my review of emails sent by Sterling employees, I have learned that 
463because the transaction between the parties was subject to full credit underwriting by Sterling and 
464Melrose (as well as Melrose's regulators at NCUA), in August and September 2017, Sterling 
465required and requested additional financial statements for Cohen and 
466for its credit 
467underwriting process. In response to Sterling's requests, on or about October 5, 2017, 
468Account to a Sterling employee a copy of 
469personal financial statement. The financial statement lists the 
470Account as the email contact for 
471Additionally, on or about October 5, 2017, 
472Cohen, using the Cohen Account, re-sent Sterling Employee-2 a copy of his May 2017 Financial 
473Statement. A day later, on October 6, 2017, Cohen, using the Cohen Account, emailed Sterling 
474Employee-2 a statement of financial condition, dated September 30, 2017 (the "September 2017 
475Financial Statement"). 
47616 
47702.28.2018 
478
479****** Result for Image/Page 17 ******
480n. Like the May 2017 Financial Statement, the September 2017 Financial Statement 
481included a cover letter from Jeffrey Getzel, Cohen's accountant, stating, in sum and substance, that 
482the information in the statement came from Cohen, and that Getzel had not confirmed its accuracy 
483or completeness. The September 2017 Financial Statement stated that Cohen had total assets of 
484$33,430,000, total liabilities of $45,630,000, and a negative net worth of $12,200,000. Notably, 
485unlike Cohen's May 2017 Financial Statement, the September 2017 Financial Statement 
486represented to Sterling that Cohen had a negative net worth. The September 2017 Financial 
487Statement indicated that Cohen's assets were comprised of $1,250,000 in cash, $17,630,000 in 
488closely held companies (such as the taxi medallion entities and his real estate holdings), 5 
489$3,200,000 in real estate investments, and his $11,000,000 personal residence (which, for the first 
490time, he indicated was held in trust). The September 2017 Financial Statement included assets and 
491liabilities not held in Cohen's name, such as various entities associated with his taxi medallions and 
492some-of his real estate investment entities. 
493o. From my participation in an interview with Sterling Employee-2, and my review of 
494records maintained by Sterling, I have also learned that at or around the time Cohen pi•ovided 
495Sterling with these financial statements—in or around September 2017—Cohen stopped paying 
496monthly loan payments on his taxi medallion loans altogether. According to Sterling Employee- 
4972, Cohen informed Sterling, in sum and substance, that he had insufficient funds to pay the monthly 
498principal and interest payments on his medallion loans. By in or about December 2017, Sterling 
499and Melrose had not been paid approximately $276,937.92 in monthly principal and interest 
500payments on the medallion loans. Based on Cohen's financial condition as conveyed in the 
5015 Notably, the September 2017 Financial Statement valued each of Cohen's thirty-two New 
502York taxi medallions at approximately $180,187.50, which was considerably less than the 
503$650,000 valuation ascribed to each medallion in the Cohen-—term sheet. 
50417 
50502.28.2018 
506
507****** Result for Image/Page 18 ******
508September 2017 Financial Statement, and his delinquency in making payments to Sterling, among 
509other things, the bank's credit underwriting committee determined (and memorialized in a 
510December 2017 memorandum) that the Cohen-' 
511transaction was favorable for the bank 
512— that is, that 
513would be a better borrower than Cohen. 
514p. On or about December 26, 2017, Sterling sent Cohen a demand letter requesting 
515the immediate receipt of past-due loan payments. On December 29, 2017, Sterling sent Cohen a 
516letter stating that he was in default under the loans between Sterling and Cohen's medallion 
517corporations. Cohen did not make an immediate payment on the loans, but instead sent an e-mail 
518to Sterling Employee-I on or about January 24, 2018, from the Cohen Account, stating that during 
519the closing Of the Cohen-— 
520transaction, Cohen would "bring all payments up to date as 
521well as deposit the payoff differential." Cohen also requested by email sent from the Cohen 
522Account on January 24, 2018, that at the closing of the Cohen- 
523transaction, Sterling 
524provide a letter stating that all of Cohen's debts have been satisfied and that Cohen's personal 
525guarantees of the medallion loans had been terminated. 
52629, 2018, 
527q. The Cohen2 
528the 
529transaction, however, did not close. On or about January 
530attorney, emailed attorneys for Sterling from the 
531Kccount 
532and stated that "at this time there is no deal with Michael Cohen. Some of the numbers have 
533changed and we are not prepared to go forward." 
534r. Based on my participation in the interview with Sterling Employee-2 and my 
535review of records maintained by Sterling, I know that after the Cohen- 
536deal fell apart, 
537Sterling assigned Cohen's loans to an employee at Sterling who specializes in collecting on 
538defaulting loans ("Sterling Employee-3"). From my review of telephone call notes, I know that 
539Sterling Employee-3 spoke to Cohen on or about January 30, 2018 about paying down and/or 
54018 
54102.28:2018 
542
543****** Result for Image/Page 19 ******
544restructuring Cohen's outstanding taxi medallion loans. Based on my review of an email between 
545Sterling Employee-3 and Cohen, I know that on the January 30, 2018 call, Cohen stated that he 
546would send a "corrected current' version of his personal financial statement. Following that call, 
547on or about January 31, 2018, Cohen emailed Sterling Employee-3 from the Cohen Account a 
548copy of the September 2017 Financial Statement. Later that day, Cohen again emailed Sterling 
549Employee-3 from the Cohen Account and proposed paying $500,000 to bring the loans current 
550and $750,000 to bring the principal balance to $20,500,000. Cohen also suggested revised monthly 
551interest payment amounts. On or about January 31, 2018, Sterling Employee-3 responded to 
552Cohen at the Cohen Account and stated, in sum and substance, that Cohen would need to pay the 
553entirety ofthe overdue payments and pay down the principal balance of the loan to $20,000,000 
554(in total, a payment of approximately $ 1,750,000), and would need to make larger monthly interest 
555payments. 
556s. On or about February 1, 2018, Cohen emailed Sterling Employee-3 from the Cohen 
557Account and proposed "[playment of $1.250m which ALL can be used to pay down principal, if 
558[Sterling] will waive past due amounts," but stated "I do NOT have more than the $1.250m." 
559(Emphasis in original.) Cohen also stated, in sum and substance, that he had insufficient financial 
560resources to post additional collateral or pre-fund monthly payments. Based on my participation 
561in an interview with Sterling Employee-2, I have learned that Sterling continues to renegotiate the 
562medallion loans with Cohen based on Cohen ' s representations about his current financial position. 
56319 
5640228.2018 
565
566****** Result for Image/Page 20 ******
567C. Cohen Made Material Misrepresentations About His Finances to Banks 
568Cohen Concealed from Sterling and Melrose Cash Derived from Consulting Work 
56915. As set forth in detail below, despite multiple representations by Cohen to Sterling (and, 
570by extension, Melrose6) that he had insufficient funds to pay down the principal balance of the 
571medallion loans, make monthly interest payments, or pay past-due amounts, it appears that 
572between 2016 and the present, Cohen opened and maintained bank accounts at First Republic Bank 
573("First Republic"), and then received millions of dollars in purported consulting payments in these 
574accounts, which he did not disclose to Sterling. Cohen set up these accounts and received these 
575funds during the very period in which he made disclosures to Sterling about his personal finances 
576(including his assets and liabilities) and his ability to make payments on the medallion loans. In 
577these disclosures to Sterling—and despite being asked about these bank accounts by his 
578accountant—Cohen withheld information about liquid financial assets at First Republic. 
57916. Specifically, based on my review of documents and bank records produced pursuant to 
580a subpoena by First Republic, and my participation in and review of reports of interviews with two 
581First Republic employees, I have learned, among other things, the following: 
582a. Cohen and his wife have been customers of First Republic since approximately 
583June 2011. Cohen controls several checking and loan accounts, some in his own name and others 
584in the names of corporate entities. 
5856 Based on my review of a report of an interview conducted with an employee of Melrose, I 
586have learned that, pursuant to the participation agreement between Sterling and Melrose, Cohen's 
587financial statements and other records in Sterling's possession were forwarded to Melrose so that 
588Melrose could make a determination as to whether to approve of the Cohen- 
589transaction. Based on my review of reports of interviews with employees, also Know 
590transaction. 
591that Cohen called employees at Melrose regarding the Cohen, 
59220 
59302.282018 
594
595****** Result for Image/Page 21 ******
596b. On or about October 26, 2016, in Manhattan, New York, Cohen opened a new 
597checking account at First Republic in the name of Essential Consultants LLC (the "Essential 
598Consultants Account"). Cohen was the only authorized signatory on the account. When Cohen 
599opened the Essential Consultants Account, a First Republic employee ("First Republic Employee- 
6001") conducted an in-person interview of Cohen. In response to a series of know-your-customer 
601questions7 about the purpose of the account—the answers to which First Republic Employee-I 
602entered into a form 8—-Cohen stated, in sum and substance, that he was opening Essential 
603Consultants as a real estate consulting company to collect fees for investment consulting work, 
604and all of his consulting clients would be domestic individuals based in the United States. Cohen 
605also stated, in sum and substance, that his purpose in setting up the account was to keep the revenue 
606from his consulting business—which he said was not his main source of income—separate from 
607his personal finances. As set forth below, there is probable cause to believe that Cohen's 
608statements about the intended purpose of the account and source of funds for the account were 
609false. Specifically, the account was not intended to receive—and does not appear to have 
610received—money in connection with real estate consulting work; in addition, the account has 
611received substantial payments from foreign sources. 
612c. First, on or about October 27, 2016—the day after he opened the Essential 
613Consultants Account, Cohen used the account to wire $130,000 to an account held in the name of 
614attorney Keith Davidson's law firm. Based on my review ofemails between Cohen and Davidson, 
615Certain financial institutions are required to conduct such procedures pursuant to the Bank 
6167 
617Secrecy Act and its implementing regulations. See 31 U.S.C. 5318; 31 C.F.R. 1020.220. 
6188 First Republic Employee-I first filled out the form on the day he interviewed Cohen, October 
61926, 2016. On or about December 19, 2016, at the request of bank compliance personnel, First 
620Republic Employee-I updated the form to add more detail about Cohen's statements. 
62121 
62202282018 
623
624****** Result for Image/Page 22 ******
625obtained pursuant to the Prior Cohen Account Warrants, I believe that this payment did not relate 
626to any real estate consulting work, but rather was a "settlement" payment made to Davidson's 
627client. 9 Based on my review of public sources, I have leamed that Davidson's client is alleged to 
628have had an extramarital affair with Donald Trump. On or about February 13, 2018, Cohen made 
629a public statement that "[i]n a private transaction in 2016, I used my own personal funds to 
630facilitate a payment of $130,000 to [Davidson's client]." 
631d. Second, I know from my review of First Republic bank records that were scheduled 
632by an FBI forensic accountant that after Cohen opened the Essential Consultants Account, Cohen 
633received payments into that account from foreign •businesses and entities that do not reflect the 
634stated client profile for the residential and commercial real-estate consulting services. Specifically, 
635from my review of the Essential Consultants Account schedule and public sources, I know the 
636following: 
637i. Beginning on or about January 31, 2017, Cohen began receiving monthly 
638payments of $83,333 from an entity called Columbus Nova LLC, which were deposited into the 
639Essential Consultants Account. According to public sources, Columbus Nova is an investment 
640management firm controlled by Renova Group, an industrial holding company based in Zurich, 
641Switzerland that is controlled by Russian national Viktor Vekselberg. From January 2017 to 
642August 2017, the Essential Consultants Account received seven payments totaling $583,332.98 
643from Columbus Nova LLC. 
6449 Specifically, I have learned from my review of bank records that on or about October 26, 
6452016, Cohen transferred $131,000 from a home equity line of credit account at First Republic to 
646the Essential Consultants Account; on or about October 27, 2016, Cohen transferred $130,000 
647from the Essential Consultant Account to an account held in the name of Davidson's law firm at a 
648bank based in Los Angeles; and on or about November 1, 2016, a wire transfer in the amount of 
649approximately $96,645 was made from Davidson's account to a bank account in the name of 
650Davidson's client. 
65122 
65202.28.2018 
653
654****** Result for Image/Page 23 ******
655ii. Beginning on or about April 5, 2017, Cohen beganreceivingpayments from 
656Novartis Investments, SARL, which I believe to be the in-house financial subsidiary of the Swiss 
657pharmaceutical company Novartis International AG ("Novartis"). Between April 2017 and January 
6582018, the Essential Consultants Account received ten wire payments from a Swiss bank account 
659held in the name ofNovartis, each in the amount of $99,980, for a total of $999,800. 
660iii. Beginning in or about April 2017, the Essential Consultants Account started 
661receiving wire payments from a bank account associated with the telecommunications company 
662AT&T Inc. ("AT&T"). Specifically, on or about April 14, 2017, AT&T wired $100,000 to the 
663Essential Consultants Account and, from in or about June 2017 to in or about January 2018, the 
664Essential Consultants Account received nine $50,000 payments from AT&T. In total, AT&T wired 
665$550,000 to the Essential Consultants Account. 
666iv. On or aboutMay 10, 2017, June 9, 2017, July 10, 2017, and November 27, 
6672017, the Essential Consultants Account received four deposits in the amount $150,000 (totaling 
668$600,000) from a bank account in South Korea. The account holder from which the money was 
669sent is Korea Aerospace Industries Ltd. ("KAI"). KAI is a South Korea-based company that 
670produces and sells fixed-wing aircraft, helicopter aircraft, and satellites to the United States 
671Department of Defense, among other customers. 
672v. On or about May 22, 2017, the Essential Consultants Account received a 
673$150,000 deposit from an account at Kazkommertsbank, a Kazakhstani bank. The listed account 
674holder at Kazkommertsbank was a second Kazakhstani bank named BTA Bank, AO. A message 
675accompanying the wire payment indicated that the payment was a ' 'monthly consulting fee as per 
676Inv BTA-IOI DD May 10, 2017 consulting agreement WIN DD 08 05 2017 CMR W/NDD 
67708/05/2017." 
67823 
6790228.2018 
680
681****** Result for Image/Page 24 ******
682vi. In total, from on or about January 31, 2017 toon or about January 10, 2018, 
683the Essential Consultants Account received approximately $2,883,132.98 in transfers and checks 
684from the aforementioned entities. As of on or about January 10, 2018, the balance in the Essential 
685Consultants Account was $1,369,474.23. 
686e. On or about April 4, 2017, Cohen opened another new checking account at First 
687Republic, this one in the name of Michael D. Cohen & Associates, P.C. (the "MDC&A Account"). 
688Cohen was the only authorized signatory on the account. Among other things, the MDC&A 
689Account received ten wire transfers and one check from an account in the name of Squire Patton 
690Boggs, a law firm. In total, from on or about April 5, 2017, to on or about January 2, 2018, the 
691MDC&A Account received $426,097.70 in deposits, and the balance in the account as of January 
6922, 2018, was $344,541.35. As discussed below, Cohen never disclosed any of the balance in the 
693Essential Consultants or VIDC&A accounts to Sterling during the negotiations with respect to the 
694transaction, including in his May 2017 Financial Statement and September 2017 
695Financial Statement. 
69617. Based on my review of emails from the Cohen Account that were seized pursuant to 
697the Prior Cohen Account Warrants, and my review of reports of interviews with employees of 
698AT&T and Novartis, it appears that the aforementioned payments to the Essential Consultants 
699Account and MDC&A Account ostensibly were for political consulting work, including consulting 
700for international clients on issues pending before the Trump administration. 10 Specifically, from 
701my review of emails from the Cohen Account and public sources, I have learned the following: 
70210 Based on my review of public sources, I have learned that Cohen is not registered as a 
703lobbyist or as a person acting as an agent of foreign principals, as may have been required by the 
704Foreign Agents Registration Act. 
70524 
7060228.2018 
707
708****** Result for Image/Page 25 ******
709a. On or about April 28, 2017, Cohen sent an email from the Cohen Account to an 
710individual whom I believe is affiliated with KAI. In the email, Cohen attached a document 
711purporting to be a "Consulting Agreement" between KAI and Essential Consultants dated as of 
712about May 1, 2017. The document indicates that Essential Consultants would render "consulting 
713and advisory services, as requested" by KAI, and that KAI would pay Essential Consultants "a 
714consulting fee of One Million Two Hundred Thousand ($1,200,000.00) US Dollars," disbursed 
715through eight $150,000 installments between May 2017 and December 2017. 
716b. On or about May 10, 2017, Cohen sent an email from an alternate email address, 
717copying the Cohen Account, to an employee of BTA Bank. To the email, Cohen attached an 
718invoice to BTA Bank in the name ofEssential Consultants. The invoice contemplated a $150,000 
719payment to Essential Consultants for a "monthly consulting fee." 
720c. On or about February 13, 2017, Cohen emailed an AT&T employee from the Cohen 
721Account what appears to be a consulting agreement, which contemplates that Essential Consultants 
722"shall render consulting and advisory services to [AT&T]" and that AT&T would "advise [Essential 
723Consultants] of those issues and matters with respect to which AT&T Services desires [Essential 
724Consultants]'s assistance and advice." The contract calls for AT&T "to pay the Consultant for his 
725. a consulting fee of Fifty Thousand ($50,000) Dollars ... per month." Based on my 
726services .. 
727review of reports of interviews with AT&T employees, I have learned that AT&T retained Cohen 
728to consult on political issues, including net neutrality, the merger between AT&T and Time Warner, 
729and tax reform. 
730d. On or about January 17, 2017, Cohen emailed to a representative of Novartis from 
731the Cohen Account a contract between Novartis and Essential Consultants, which provides that 
732Essential Consultants will consulting and advisory services to Novartis on matters that 
73325 
73402.282018 
735
736****** Result for Image/Page 26 ******
737relate to the repeal and replacement of the Affordable Care Act in the US and any other issues 
738mutually agreeable to [Essential Consultants] and Novartis." The contract provides for a 
739"consulting fee of One Million Two Hundred Thousand ($1,200,000) US dollars," to be paid to 
740Essential Consultants in even monthly installments over the course ofa year. Based on my review 
741of reports of interviews with Novartis employees, I have learned that Novartis retained Cohen to 
742provide political consulting services and to gain access to relevant policymakers in the Trump 
743Administration. 
744e. On or about April 3, 2017, Squire Patton Boggs, a law firm, announced on its 
745website that is had formed a "strategic alliance" with Michael D. Cohen & Associates and would 
746"jointly represent clients." 
74718. Despite the significant amount of money that Cohen received into the Essential 
748Consultants Account and the N'DC&A Account, and the cash balance in both accounts, Cohen did 
749not disclose that infoi•mation to Sterling or Melrose. Specifically, based on my review ofdocuments 
750provided by Getzel, and my review of notes and a 
751have leamed the following: 
7521 
753a. In or about May 2017, Getzel met with Cohen at a law firm in Manhattan, New 
754York. At the meeting, Cohen told Getzel, in sum and substance, that he had set up a law practice 
755called Michael D. Cohen & Associates P.C., and a consulting company called Essential Consultants 
756LLC. Cohen told Getzel, in sum and substance, that he expected to earn $75,000 per month in 
757connection with his law practice, and that he expected gross revenues for the consulting business to 
758be between five and six million dollars annually. 
759b. In or about October 2017, ifnot earlier, Getzel was preparing a personal financial 
760statement for Cohen. On or about October 6, 2017, Getzel sent an email to Cohen at the Cohen 
76126 
76202.282018 
763
764****** Result for Image/Page 27 ******
765Account in which Getzel wrote that "[a]ttached is a draft of the new PFS as of September 30, 2017" 
766and attached a draft of the September 2()17 Financial Statement. The draft statement reflected that 
767as of September 30, 2017, Cohen had only $1,250,000 in cash, total assets of approximately 
768$33,430,000 (comprised oftaxi medallion interests, real estate interests, and his personal residence 
769and property), and liabilities of approximately $45,630,000, leaving him purportedly over $12 
770million in debt. In the same email, Getzel questioned Cohen, in sum and substance, about the fact 
771that the financial statement did not list any assets associated with either the Essential Consultants 
772Account or the MDC&A Account: "[w]e did not add any value for you[r] two operating entities — 
773Michael D. Cohen & Associates POC [sic] and Essential Consultants LLC. Please advise whether 
774or not these should be disclosed and what value." 
775c. On or about October 6, 2017, Cohen called Getzel by telephone—which is reflected 
776on toll records for Cohen's cellphone—and told Getzel, in sum and substance, not to include 
777Essential Consultants or MDC&A in the September 2017 Financial Statement because they had no 
778value. 
779d. On or about October 6, 2017, following the call with Getzel, Cohen, using the Cohen 
780Account, responded to Getzel's email with the answer "[l]ooks good to me." Cohen never directed 
781Getzel to make any changes to his cash position as listed in the September 2017 Financial 
782Statement. Neither Essential Consultants nor lvDC&A was listed on the September 2017 Financial 
783Statement that was provided to Sterling. 
78419. Based on the foregoing, and from my review of bank records and emails sent by Cohen 
785to Sterling, I know that the September 2017 Financial Statement made no mention whatsoever of 
786assets that Cohen held in the Essential Consultants Account or the MDC&A Account. As of 
787September 30, 2017—the date of the September 2017 Financial Statement—Cohen had 
78827 
78902.282018 
790
791****** Result for Image/Page 28 ******
792approximately $673,729.95 in the Essential Consultants Account and $248,619.28 in the MDC&A 
793Account. As of October 6, 2017, the date when Getzel asked Cohen about the two accounts, Cohen 
794had approximately $823,709.95 in the Essential Consultants Account and $248,619.28 in the 
795MDC&A Account. 
796Cohen Understated His Available Cash 
79720. In addition to withholding the existence of the Essential Consultants Account and the 
798MDC&A Account from Sterling and Melrose, it appears that Cohen also substantially understated 
799his available cash and cash equivalents in his financial disclosures. Specifically, I know from my 
800review of the September 2017 Financial Statement that Cohen provided to Sterling that Cohen 
801represented that he had $1,250,000 in cash as of September 30, 2017. But, from my review ofa 
802summary of bank records that were scheduled by an FBI forensic accountant, I have learned that 
803Cohen had over $5,000,000 in cash and cash equivalents as of September 30, 2017. Specifically, 
804from my review of the account schedule and bank records, I have learned the following: 
805a. Cohen has three checking and/or savings accounts at Capital One Bank, one of 
806which is in his wife's name. As of September 30, 2017, Cohen had $1,105,680.35 in his savings 
807account, and $1,262,982.29 in total in the three accounts at Capital One Bank. 
808b. Cohen has three accounts at Morgan Stanley in his name. As of September 30, 
8092017, the combined total in cash and cash equivalents in those three accounts was $1,270,600.41. 
810c. As of September 30, 2017, Cohen had $260,689.18 inan accountat Signature Bank. 
811d. In addition to the Essential Consultants Account and MDC&A Account at First 
812Republic, Cohen also had two joint checking accounts with Laura Cohen at First Republic. In total, 
813as of September 30, 2017, Cohen had at least $1,876,209.27 in total in his four accounts at First 
814Republic. 
81528 
81602.28.2018 
817
818****** Result for Image/Page 29 ******
819e. Cohen has an account at Bethpage Credit Union with $25,931.39 in it as of 
820September 30, 2017. 
821f. As of September 30, 2017, Cohen had $17,542.54 in accounts at Sterling. 
822g. Cohen has two accounts at TD Bank—one in his name and one heldjointly with his 
823wife—and the total balance across the two accounts as of September 30, 2017 was $300,096.72. 
824h. In total, as ofSeptember 30, 2017, Cohen had at least $5,014,051.80 in his accounts 
825at Capital One Bank, Signature Bank, TD Bank, Bethpage Credit Union, First Republic, and 
826Morgan Stanley. 
82721. Accordingly, based on the foregoing, it appears that Cohen' s representations to Sterling 
828and Melrose that he did not have more than $1,250,000 were false, and that Cohen withheld 
829information regarding approximately $5 million in funds from Sterling and Melrose in order to 
830secure favorable terms in his renegotiation of his medallion loan. Based on my participation in an 
831interview with Sterling Employee-2, and my review of reports of interviews with Sterling 
832Employee-I and two Melrose employees, it is my understanding that that Sterling and Melrose 
833would view Cohen's understating of his assets as material to its decision whether to renegotiate 
834Cohen's medallion loans and on what terms, or approve of the transfer of those loans to 
835Cohen Had a Side Agreement With 
83622. As set forth in detail below, it appears that during the course of Cohen's negotiations to 
837sell his interest in taxi medallions and the associated debt to 
838, Cohen not only 
839misrepresented his financial position to Sterling, but also failed to disclose a side deal he had 
840that 
841Agreed to pay an above-market price for 
842negotiated with 
843Cohen's taxi cab medallions, and in exchange, Cohen agreed to pay 
84429 
84502.28.2018 
846approximately 
847
848****** Result for Image/Page 30 ******
849$3.8 million in cash. Specifically, from my review ofdocuments produced pursuant to a subpoena 
850by Sterling, and reports prepared by law enforcement officers of interviews with Sterling 
851Employee-I, as well as my participation in an interview with Sterling Employee-2, I have learned, 
852among other things, the following: 
853a. On or about September 5, 2017, an executed term sheet was circulated by Sterling 
854See supra 14(k). According to the term sheet, 
855Employee-I to Cohen and 
856that 
857would borrow $20,000,000 from Sterling and Melrose, to be secured by the medallions 
858was to acquire from Cohen. At a price of$20 million for thirty-two taxi medallions, 
859the proposed transaction valued each medallion as worth $625,000. The term sheet also 
860contemplated a $1,265,913 pay-down of the principal balance of the loan. The term sheet made no 
861mention of a $3.8 million payment from Cohen to 
862financial transaction between the parties. 
863or any other form of payment or 
864b. Additionally, an internal Sterling credit memorandum, dated October 4, 2017, 
865describing the terms of the Cohen. 
866transaction and the new loan tc 
867did 
868including a $3.8 million payment. The 
869not mention any payments from Cohen to 
870memorandum also noted that the "loan amount of $20MM indicates a $625M purchase price per 
871medallion" but "it is recognized that this is not in line with current market values." Indeed, 
872according to an internal Sterling memorandum dated February 5, 2018, in the month of January 
8732018, taxi medallions sold for amounts ranging from $120,000 to $372,000. Accordingto Sterling 
874Employee-I and Sterling Employee-2, they were never told that 
875agreed to a purchase 
876price of $625,000 in exchange for a lump sum payment from Cohen, or that Cohen would make 
877any payment to 
87830 
87902.282018 
880
881****** Result for Image/Page 31 ******
88223. While Cohen and 
883did not disclose any payment from Cohen to 
884n communications with Sterling, it appears that such a payment was contemplated. 
885Indeed, based on my review of records maintained by Getzel, and a report prepared by law 
886enforcement agents of an interview with Getzel, I have learned the following, in substance and in 
887part, regarding the proposed side-payment from Cohen to— 
888a. On or about September 19, 2017, Getzel prepared a memorandum for Cohen 
889entitled, "Sale of NYC Medallion Entities and Debt Assumption" (the "Getzel Memorandum"). 
890The Getzel Memorandum summarized the proposed transaction between Cohen and 
891in pan, as follows: "Michael and Laura Cohen will transfer ownership of their 13 NYC medallion 
892entities to a Buyer who will assume their bank indebtedness, upon the [Cohens'] paying down the 
893debt portfolio of the 13 entities by $500,000 and a cash payment to the Buyer of $3,800,000. 
894b. According to Getzel, Cohen told him the parameters of the deal, including the 
895payment of $3,800,000 to 
896to pay 
897but Getzel did not know where Cohen was going to obtain 
898As noted above, Cohen had more than $5,000,000 in cash and 
899cash equivalents as of September 2017, but had only disclosed in his September 2017 Financial 
900Statement that he had $1.25 million in cash. 
90124. Based on my review of records maintained by Sterling (as well as Melrose, the bank 
902with the participating interest in the loans) and reports of interviews of representatives of Sterling 
903(and Melrose), I have seen no evidence that Sterling, Melrose, or any other financial institution 
904involved in the potential deal with Cohen and 
905side payment from Cohen to 
906was aware of the planned $3.8 million 
90711 
908'Ihe reference to thineen medallions appears to be an error by Getzel. Cohen and his wife 
909together owned sixteen corporations, which in turn owned 32 taxi medallions. 
91031 
91102.282018 
912
913****** Result for Image/Page 32 ******
914D. Probable Cause Regarding the Subject Accounts 
91525. As set forth above, since at least September 2015, if not earlier, Cohen has told Sterling 
916that he has diffculty making payments on his medallion loans and, since at least October 2016, 
917Cohen has been actively engaged in an attempt to sell his taxi medallions and the associated debts 
918to 
919In the course of doing so, Cohen has used the Cohen Account and/or MDCPC 
920Account to engage in email communications regarding the terms of the transactions and the 
921undisclosed side-payment with 
922=atth and —atthÄAccount. Specifically, 
923as described above, there is probable cause to believe that the Subject Accounts have been used 
924regarding the proposed Cohen- 
925transaction with Sterling: 
926a. Cohen has used the Cohen Account to, among other things, negotiate a pay-down 
927of the principal amount of the loan, see supra 14(g), to send term sheets to Sterling, see supra 
92814(j), to communicate with his accountant about the contents of financial statements, see supra 
92916, to send financial statements to Sterling, see supra 14(i), (l), to check on the status of the 
930transaction as of January 24, 2018, see supra 14(n), to negotiate a reduction of his debt with 
931Sterling on or around January 31, 2018, see supra 14(0), to tell Sterling on February 1, 2018, he 
932does not have the ability to pay more than $1 see supra 14(p), and to communicate with 
933individuals responsible for sources of payments to the Essential Consultants Account, see supra 
93415. In other words, from the communications described above, it appears likely that the Cohen 
935Account will contain recent evidence of the Subject Offenses, including communications and 
936potential misrepresentations to Sterling, and evidence indicating that statements made to Sterling 
937are false or misleading. 
938b. 
939Account to communicate about 
940the proposed taxi medallion transaction with Cohen, which appears to have been discussed as early 
94132 
94202.282018 
943
944****** Result for Image/Page 33 ******
945as October 2016. See supra Specifically, as described above, as early as May 2, 2017, 
946Account to inquire about the status of the transaction, 
947see supra 14(h). He used the—Account to exchange drafts of the proposed tenn 
948Sterling, see supra 140). The 
949Account was also 
950sheet with Cohen, 
951used by 
952to send a personal financial statement for 
953to Sterling, 
954see supra 14(1). The 
955Account was copied on emails from the. 
956Account about the transaction, see supra 14(i), and was listed on = financial 
957see supra 14(m). Additionally, based on my 
958statement as the contact email for 
959review of IVDCPC Header Information, I know that on or about September 1 , 2017—at or around 
960the time the 
961Ind Cohen were negotiating a term sheet— 
962xsed the 
963and 
964Account to send and receive eight emails from Cohen at the MDCPC Account. 
965—has used the 
966iccount to communicate with Sterling employees, Cohen, 
967c. 
968about the proposed taxi medallion transaction since at least December 2016. 
969told Sterling that he 
970See supra 14(g), 24(c). Specifically, on or about August 29, 2017, 
971should be included on "all future e-mails" involving the proposed transaction, see supra 146). 
972was involved in making revisions to the parties' term sheets, and he told 
973Additionally, 
974Sterling on January 29, 2018 that 
975would not go forward with the planned transaction, 
976see supra 140), (n). Accordingly, there is probable cause to believe that the—Account will 
977contain evidence of the negotiations between Sterling and the parties, evidence of a payment from 
978Cohen to 
979Ind the reasons for the collapse of the Cohen-' 
980transaction. 
98112 For instance, from records provided by Sterling, I know that on or about December 2, 
982an email to a Sterling employee using 
983Account. The email forwarded correspondence between—who was using the— 
984Account, and an employee of Capital One regarding extending loan with 
985Capital One. 
98633 
98702.282018 
988
989****** Result for Image/Page 34 ******
99026. Additionally, it appears that Cohen set up the MDCPC Account to receive emails he 
991was previously receiving at the Cohen Account. Specifically, based on my review of records 
992maintained by AT&T, I have learned that on or about May 5, 2017, Cohen sent an email from the 
993MDCPC Account to a blind copy list of recipients stating that "[d]ue to the overwhelming volume 
994of phone calls and emails coming into my previous cellular number and e-mail address, I have 
995elected to create for Clients Only the following. Kindly use this new information for all future 
996contact and communications." The signature line on the email listed "Essential Consultants LLC" 
997and "Michael D. Cohen & Associates, PC," as well as the MDCPC Account as the email address. 13 
99827. In addition, based on my review of emails from the MDCPC Account produced 
999pursuant to the Prior Cohen Account Warrants and the MDCPC Header Information, I have learned 
1000that Cohen has used the MDCPC Account to send and receive emails from the Cohen Account, to 
1001communicate with 
1002Xccount, and to send and receive emails from other email accounts 
1003about his political consulting business. Additionally, from my review of the MDCPC Header 
1004Information, it appears that since the November 13, 2017 search warrant on the MDCPC Account, 
1005Cohen has continued to send and receive emails at the lv1DCPC Account that appear likely to be 
1006relevant to the commission of the Subject Offenses. For example, emails obtained pursuant to the 
1007Prior Cohen Account Warrants, as well as the MDCPC Header Information have revealed the 
1008following: 
1009a. On approximately eight occasions in August and September 2017, while Cohen, 
1010were communicating about a term sheet for the Cohen- 
1011taxi 
101213 Based on my review of emails from the MDCPC Account obtained pursuant to subpoena, I 
1013have learned that Cohen has used the account to communicate with numerous individuals with 
1014whom he does not enjoy an attorney-client privilege, including some of the individuals described 
1015below. See infraff27. 
101634 
101702.282018 
1018
1019****** Result for Image/Page 35 ******
1020medallion transaction, see supra 14(k), Cohen used the MDCPC Account to send or receive 
1021Kccount. For instance, on or about August 22, 2017, 
1022emails from 
1023Account to send an email to Sterling Employee-I and copied Cohen on the email at the 
1024the 
1025MDCPC Account. On the same day, Sterling Employee-I responded to 
1026Vccount 
1027and Cohen at the MDCPC Account. On or about August 22, 2017, Cohen also used the MDCPC 
1028Account to send an email to Sterling Employee-I. 
1029b. As noted above, on or about September 1, 2017, Cohen used the MDCPC Account 
1030to send or receive eight emails with the 
1031Account. 
1032c. Cohen used the MDCPC Account to send and receive emails from individuals who 
1033work at companies with whom it appears Cohen has a political consulting agreement. For 
1034example, beginning in April 2017—the same month when Cohen began receiving payments from 
1035AT&T, see supra 16(d), 17(c)—-Cohen used the YIDCPC Account to send and receive emails 
1036from AT&T employees. These emails contain, among other things, invoices from Cohen to AT&T 
1037for consulting work by Cohen. Similarly, beginning in April 2017—which is also the month 
1038Cohen began receiving payments from Novartis for consulting work, see supra 16(d), 17(d)— 
1039Cohen used the MDCPC Account to send and receive emails from employees of Novanis. These 
1040emails concern, among other things, invoices from Cohen and requests for Novartis for Cohen's 
1041assistance on an initiative relating to drug pricing. 
1042d. From my review of the MDCPC Header Information, I have learned that Cohen has 
1043continued to use the MDCPC Account to send and receive emails from individuals who work at 
1044companies with whom it appears Cohen had a political consulting agreement, such as Novartis and 
1045AT&T. For instance, on approximately six occasions between November 28, 2017 and January 
104630, 2018, the lv1DCPC Account was used to send and receive emails from accounts belonging to 
104735 
104802.28.2018 
1049
1050****** Result for Image/Page 36 ******
1051individuals using @att.com email addresses. Similarly, on approximately seventeen occasions 
1052between December 1, 2017 and February 20, 2018, the MDCPC Account was used to send and 
1053receive emails from accounts belonging to individuals using @novartis.com email addresses. 
1054Since November 15, 2017 , the MDCPC Account has also sent and received emails with individuals 
1055using the email domains @bta.kz, which I believe is the email domain used by employees ofBTA 
1056employees of the law firm Squire Patton Boggs—both of which Cohen appears to have a 
1057consulting relationship with, see supra 16(e), 17(e). Accordingly, it appears that Cohen 
1058continues to use the MDCPC Account to send and receive emails that will be relevant to whether 
1059he is maintaining a consulting business, what type of consulting work he is doing, and whether he 
1060is receiving money for that consulting work. 
106128. In addition to the foregoing, based on my review of the Pen Register Data, see supra 'l 
10629, it appears that since the date of the last search warrant on the Cohen Account (i.e., November 
106313, 2017), Cohen has continued to use the Cohen Account to communicate with the 
1064Account, and other email accounts that appear likely to be relevant 
1065to the commission of the Subject Offenses described above. For example, the Pen Register Data 
1066has revealed the following: 
1067a. Emails sent by the Cohen Account to the 
1068Xccount on or about December 18, 
10692017 at 8:26 p.m., December 21, 2017 at 9:35 p.m., December 22, 2017 at 4:32 p.m., January 3, 
10702018 at 8:01 a.m., January 3, 2018 at 2:56 p.m., and January 4, 2018 at 3:31 p.m. 
1071b. An email sent by the Cohen Account to the 
1072January 25, 2018 at 8:55 p.m. 
107336 
107402.28.2018 
1075Account on or about 
1076
1077****** Result for Image/Page 37 ******
1078c. Emails from the Cohen Account to the email account 
1079on or 
1080about December 1, 2017 at 2:14 p.m., December 29, 2017 at 10:20 p.m., January 2, 2018 at 3:52 
1081p.m., January 2, 2018 at 5:44 p.m., and January 8, 2018 at 6:38 p.m. Based upon my review of 
1082emails contained in the Cohen Account, I have learned that the 
1083email account 
1084belongs to Jeffrey Getzel, Cohen's accountant, through whom Cohen made misrepresentations to 
1085financial institutions, as discussed above. 
1086d. Emails from the Cohen Account to email accounts belonging to Sterling employees, 
1087including Sterling Employee-I, on or about January 25, 2018 at 10:23 p.m., January 26, 2018 at 
108812:55 a.m., January 29, 2018 at 5:30 p.m., January 29, 2018 at 8:29 p.m., January 30, 2018 at 6:44 
1089p.m. 
1090e. An email sent from the Cohen Account to the email account 
1091clientserviceny@firstrepublic.com on or about January 25, 2018 at 5:29 p.m. As stated above, 
1092First Republic is the bank at which the Essential Consultants Account is held. 
1093f. Numerous emails sent from the Cohen Account to the email account 
1094including emails on or about December 4, 2017 at 2: 17 p.m. and January 29, 
10952018 at 5:43 p.m. Based upon the email address and domain name, as well as my review ofreports 
1096of interviews and documents reflecting that Cohen's taxi medallions were leased and operated by 
1097I believe that the 
1098email address belongs to 
109929. Based on my review of records maintained by Sterling, I know that Cohen used the 
1100Cohen Account to send and receive documents related to the Cohen- 
1101ransaction. 
1102Based on my training and experience, I know that Google allows users of e-mail accounts to easily 
1103save documents to file sharing and retention platforms such as Google Docs and Google Drive. I 
110437 
110502.281018 
1106
1107****** Result for Image/Page 38 ******
1108also know, from my training and experience, that users of e-mail accounts often use instant 
1109messaging interfaces linked to their email accounts. Further, I have learned that the Providers 
1110maintain records of search and web histories associated with email accounts and, based on my 
1111training and experience, users of e-mail accounts use associated web search browsers associated 
1112with a subscriber's account to research topics they are e-mailing about. Accordingly, there is 
1113probable cause to believe that content infonnation associated with the Subject Accounts will also 
1114contain evidence related to the Subject Offenses. 
111530. Thus, I respectfully submit that there is probable cause to believe that emails and other 
1116content information from the Subject Accounts will contain evidence of Cohen' s eff01ts to sell his 
1117taxi medallions and the associated debt, and his misrepresentations and omissions to Sterling and 
1118Melrose in connection with these negotiations. Although Cohen appears to have communicated 
1119an aprimarily through the Cohen Account and 
1120with 
1121MDCPC Account, I know, based on my involvement in the investigation, that Cohen also used at 
1122least one other email account associated with his position at the Trump Organization. 'Ihus, I 
1123respectfully submit that there is probable cause to believe that emails and other content information 
1124from the 
1125Account since on or 
1126about October 1, 2016—the approximate date of when Cohen's efforts to sell his taxi medallions 
1127and the associated debt began—will reflect communications with the Cohen Account, MDCPC 
1128Account, and possibly one or more additional accounts used by Cohen, and probable cause to 
1129believe that such emails will constitute evidence of Cohen's commission of the Subject Offenses, 
1130including the extent to which Cohen did or did not inform other individuals involved in the conduct 
1131described above—such as 
1132omissions to financial institutions. 
113338 
11340228.2018 
1135f his misstatements and 
1136
1137****** Result for Image/Page 39 ******
113831. Temporal Limitation. This application seeks all emails and other requested content 
1139information specified in Attachments A, B, C, and D for the following periods: 
1140a. For the Cohen Account, this application seeks all emails sent, created, or received 
1141between November 14, 2017, and the date ofthe proposed warrant, inclusive. As described above, 
1142pursuant to the Prior Cohen Account Warrants, the SCO obtained and provided to the USAO 
1143emails from the Cohen Account that were sent, created, or received before November 14, 2017. 
1144This application also seeks other information specified above associated with the Cohen Account 
1145that was created between December 1, 2014 (the month when Cohen entered into the medallion 
1146loans with Sterling), and the date of the proposed warrant, inclusive. 
1147b. For the MDCPC Account, this application seeks all emails sent, created, or received 
1148between November 14, 2017, and the date ofthe proposed warrant, inclusive. As described above, 
1149pursuant to a prior warrant, the SCO obtained and provided to the USAO emails from the MDCPC 
1150Account that were sent, created, or received before November 14, 2017. 
1151—Account and 
1152Account, this application 
1153c. For the 
1154seeks emails and all other content information specified above sent, created, or received between 
1155October 1, 2016, and the date of the proposed warrant, inclusive. As described above, October 
11562016 is the month in which Cohen began negotiating the taxi medallion sale with the= 
1157Account, this application seeks emails and all other content 
1158d. For the 
1159information specified above sent, created, or received between December 1, 2016, and the date of 
1160the proposed warrant, inclusive. As described above, December 2016 is the month in which 
1161began representing the 
1162n relation to the taxi medallion transaction. 
1163E. Evidence, Fruits and Instrumentalities 
116432. Based upon the foregoing, I respectfully submit there is probable cause to believe that 
1165information stored on Google's servers associated with the Cohen Account will contain evidence, 
116639 
116702282018 
1168
1169****** Result for Image/Page 40 ******
1170fruits, and instrumentalities of violations of the Subject Offenses, as more fully described in 
1171Section II of Attachment A to the proposed warrant for the Cohen Account and MDCPC Account, 
1172including the following: 
1173a. Communications, records, documents, and other files necessary to establish the 
1174identity of the person(s) who created or used the Cohen Account or MDCPC Account. 
1175b. Communications, records, documents, and other files involving Sterling, Melrose, 
1176and/or taxi medallions; 
1177c. Communications, records, documents, and other files involving a plan, proposal, or 
1178agreement for Cohen and/or entities associated with him to transfer any interest in taxi medallions, 
1179and any associated debts or liabilities, to others, including to 
1180associated with him; 
1181and/or entities 
1182d. Communications, records, documents, and other files involving Essential 
1183Consultants, LLC or Michael D. Cohen & Associates, including those which indicate the nature 
1184and purpose of payments made to or from Essential Consultants or Michael D. Cohen & 
1185Associates; 
1186e. Communications, records, documents, and other files necessary to establish the 
1187identity of any person(s) — including records that reveal the whereabouts of the person(s) — who 
1188communicated with the Cohen Account and/or MDCPC Account about any matters relating to 
1189Essential Consultants, LLC, or about any plan or proposal or agreement for Cohen and/or entities 
1190associated with him to transfer any interest in taxi medallions, and any associated debts or 
1191liabilities, to others, including to 
1192and/or entities associated with him; 
1193f. Communications between the Cohen Account and/or MDCPC Account and Jeffrey 
1194Getzel relating to Cohen's bank accounts, taxes, debts, and/or finances; 
119540 
119602.28.2018 
1197
1198****** Result for Image/Page 41 ******
1199g. Communications, records, documents, and other files reflecting false 
1200representations to a financial institution with relation to the intended purpose of an account or loan 
1201at that financial institution; the nature of any business or entity associated with an account at a 
1202financial institution; the source of funds flowing into an account; or the purpose or nature of any 
1203financial transactions involving that financial institution; 
1204h. Evidence indicating how and when the Cohen Account and MDCPC Account was 
1205accessed or used, to determine the geographic and chronological context of account access, use, 
1206and events relating to the crimes under investigation and to the account owner; and 
1207i. Evidence indicating the Cohen Account and tvfDCPC Account owner's intent as it 
1208relates to the Subject Offenses under investigation. 
120933. Based upon the foregoing, I further submit there is probable cause to believe that 
1210information stored on Google's servers associated with thk 
1211Xccount will contain evidence, fruits, and instrumentalities of violations ofthe Subject 
1212Offenses, including the following: 
1213a. Communications, records, documents, and other files necessary to establish the 
1214identity of the person(s) who created or used 
1215Account; 
1216b. Communications, records, documents, and other files involving a plan or proposal 
1217or agreement for Cohen and/or entities associated with him to transfer any interest in taxi 
1218medallions, and any associated debts or liabilities, to 
1219with him; 
1220and/or entities associated 
1221c. Communications, records, documents, and other files necessary to establish the 
1222identity of any person(s) — including records that reveal the whereabouts of the person(s) — who 
122341 
122402.282018 
1225
1226****** Result for Image/Page 42 ******
1227communicated with the 
1228Account about any 
1229matters relating to any plan or proposal or agreement for Cohen and/or entities associated with him 
1230to transfer any interest in taxi medallions, and any associated debts or liabilities, to 
1231md/or entities associated with him; 
1232d. Communications between the 
1233Account and others, including employees or representatives of Sterling, Melrose, or other financial 
1234institution(s), regarding Cohen's finances; 
1235e. Communications, records, documents, and other files reflecting false 
1236representations to a financial institution with relation to the intended purpose of an account or loan 
1237at that financial institution; the nature of any business or entity associated with an account at a 
1238financial institution; the source of funds flowing into an account; or the purpose or nature of any 
1239financial transactions involving that financial institution; 
1240f. Evidence indicating how and when the 
1241Account were accessed or used, to determine the geographic and chronological context 
1242of account access, use, and events relating to the crimes under investigation and to the account 
1243owner; 
1244g. Evidence indicating the 
1245Account 
1246owners' intent as it relates to the Subject Offenses under investigation. 
124734. Based upon the foregoing, I further submit there is probable cause to believe that 
1248information stored on Oath's servers associated with the 
1249Account will contain evidence, 
1250fruits, and instrumentalities of violations of the Subject Offenses, including the following: 
1251a. Communications, records, documents, and other files necessary to establish the 
1252identity of the person(s) who created or used the 
1253Account; 
125442 
125502.28.2018 
1256
1257****** Result for Image/Page 43 ******
1258b. Communications, records, documents, and other files involving a plan or proposal 
1259or agreement for Cohen and/or entities associated with him to transfer any interest in taxi 
1260medallions, and any associated debts or liabilities, to 
1261with him; 
1262nd/or entities associated 
1263c. Communications, records, documents, and other files necessary to establish the 
1264identity of any person(s) — including records that reveal the whereabouts of the person(s) — who 
1265about any matters relating to any plan or proposal or 
1266communicated with the 
1267agreement for Cohen and/or entities associated with him to transfer any interest in taxi medallions, 
1268and any associated debts or liabilities, to 
1269d. Communications between the 
1270and/or entities associated with him; 
1271ssccount and others, including employees or 
1272representatives of Sterling, Melrose, or other financial institution(s), regarding Cohen's finances; 
1273and 
1274e. Communications, records, documents, and other files reflecting false representations 
1275to a financial institution with relation to the intended purpose of an account or loan at that financial 
1276institution; the nature of any business or entity associated with an account at a financial institution; 
1277the source of funds flowing into an account; or the purpose or nature of any financial transactions 
1278involving that financial institution. 
1279Ill. Review of the Information Obtained Pursuant to the Warrant 
128035. Pursuant to 18 U.S.C. 2703(g), the presence of a law enforcement officer is not 
1281required for service of a search warrant issued under 2703, or for the collection or production of 
1282responsive records. Accordingly, the warrant requested herein will be transmitted to the Providers, 
1283which shall be directed to produce a digital copy of any responsive records to law enforcement 
1284personnel within 30 days from the date of service. Law enforcement personnel (including, in 
1285addition to law enforcement officers and agents, and depending on the nature of the ESI and the 
128643 
128702.282018 
1288I 
1289
1290****** Result for Image/Page 44 ******
1291status of the investigation and related proceedings, attorneys for the government, attorney support 
1292staff, agency personnel assisting the government in this investigation, and outside technical experts 
1293under government control) will retain the records and review them for evidence, fruits, and 
1294instrumentalities of the Subject Offenses as specified in Section Ill of Attachments A, B and C to 
1295the proposed warant. 
129636. In conducting this review, law enforcement personnel may use various methods to 
1297locate evidence, fruits, and instrumentalities of the Subject Offenses, including but not limited to 
1298undertaking a cursory inspection of all emails within the Subject Account. This method is 
1299analogous to cursorily inspecting all the files in a file cabinet in an office to determine which paper 
1300evidence is subject to seizure. Although law enforcement personnel may use other methods as 
1301well, particularly including keyword searches, I know that keyword searches and similar methods 
1302are typically inadequate to detect all information subject to seizure. As an initial matter, keyword 
1303searches work only for text data, yet many types of files commonly associated with emails, 
1304including attachments such as scanned documents, pictures, and videos, do not store data as 
1305searchable text. Moreover, even as to text data, keyword searches cannot be relied upon to capture 
1306all relevant communications in an account, as it is impossible to know in advance all of the unique 
1307words or phrases that investigative subjects will use in their communications, and consequently 
1308there are often many communications in an account that are relevant to an investigation but that 
1309do not contain any keywords that an agent is likely to search for. 
1310re attorneys, the review of the content within the Subject 
131137. Because Cohen and 
1312Accounts will be conducted pursuant to established screening procedures to ensure that the law 
1313enforcement personnel involved in the investigation, including attorneys for the Government, 
1314collect evidence in a manner reasonably designed to protect any attorney-client or other applicable 
131544 
131602.28.2018 
1317
1318****** Result for Image/Page 45 ******
1319privilege. When appropriate, the procedures will include use ofa designated "filter team," separate 
1320and apart from the investigative team, in order to review potentially privileged communications 
1321and determine which communications to release to the investigation and prosecution team. 
1322IV. Request for Non-Disclosure and Sealing Order 
132338. The existence and scope ofthis ongoing criminal investigation are not publicly known. 
1324As a result, premature public disclosure of this affidavit or the requested warrants could alert 
1325Cohen that he is under investigation, causing him to destroy evidence, flee from prosecution, or 
1326otherwise seriously jeopardize the investigation. Ifi particular, based on my experience 
1327investigating white collar cases, including cases featuring documents such as agreements, drafts 
1328of agreements, notes of conversations, and other documentary evidence, premature disclosure of 
1329an investigation may cause the target of the investigation to attempt to destroy or conceal such 
1330evidence. In addition, as also set forth above, Cohen uses computers and electronic 
1331communications in furtherance of his activity and thus could easily delete, encrypt, or otherwise 
1332conceal such digital evidence from law enforcement were he to leam of the Government's 
1333investigation. See 18 U.S.C. 2705(b)(3). Cohen also appears to have the financial means that 
1334would facilitate his flight from prosecution. See 18 U.S.C. 2705(b)(2), (5). 
133539. Accordingly, there is reason to believe that, were the Providers to notify the subscriber 
1336or others of the existence of the warrant, the investigation would be seriously jeopardized. 
1337Pursuant to 18 U.S.C. 2705(b), I therefore respectfully request that the Court direct the Providers 
1338not to notify any person of the existence of the warrant for a period of 180 days from issuance, 
1339subject to extension upon application to the Court, if necessary. 
134040. For similar reasons, I respectfully request that this affidavit and all papers submitted 
1341herewith be maintained under seal until the Court orders otherwise, except that the Govemment 
1342be permitted without further order of this Court to provide copies of the warrant and affidavit as 
134345 
134402.28.2018 
1345
1346****** Result for Image/Page 46 ******
1347need be to personnel assisting it in the investigation and prosecution of this matter, and to disclose 
1348those materials as necessary to comply with discovery and disclosure obligations in any 
1349prosecutions related to this matter. 
1350Conclusion 
135141. Based on the foregoing, I respectfully request that the Court issue the warrants sought 
1352herein pursuant to the applicable provisions of the Stored Communications Act, 18 U.S.C. 
13532703(b)(1)(A) (for contents) and 2703(c)(1)(A) (for records and other information), and the 
1354relevant provisions of Federal Rule of Criminal Procedure 41. 
1355Sworn to before me this 
135628th day of February, 2018 
1357HONO SLEGABRIELW. 
1358Chief vited States Magistrate J -ge 
1359them District Of N or 
136002.282018 
1361United States Attorney's Office 
1362Southern District of New York 
1363STEIN 
136446 
1365
1366****** Result for Image/Page 47 ******
13671 8 MAG 
1368UNITED STATES DISTRICT COURT 
1369SOUTHERN DISTRICT OF NEW YORK 
1370In the Matter of a Warrant for All 
1371Content and Other Information 
1372Associated with the Email Account 
1373at 
1374Prenuses Controlled by 1 & 1 Internet, 
1375Inc., USAO Reference No. 
13762018R00127 
1377169 6 
1378TO: 
1379SEARCH WARRANT AND NON-DISCLOSURE ORDER 
13801 & 1 Internet, Inc. ("Provider") 
1381United States Attorney's Office for the Southern District of New York and the Federal 
1382Bureau of Investigation (collectively, the "Investigative Agencies") 
13831. Warrant. Upon an affidavit of Special Agent 
1384of the United States 
1385Attorney's Offce for the Southern District of New York, and pursuant to the provisions of the 
1386Stored Communications Act, 18 U.S.C. 2703(b)(1)(A) and 2703(c)(1)(A), and the relevant 
1387provisions of Federal Rule of Criminal Procedure 41, the Court hereby finds there is probable 
1388cause to believe the email account 
1389maintained at premises controlled by 1 
1390& 1 Internet, Inc., contains evidence, fruits, and instrumentalities of crime, all as specified in 
1391Attachment D hereto. Accordingly, the Provider is hereby directed to provide to the Investigative 
1392Agencies, within 7 days of the date of service of this Warrant and Order, the records specified in 
1393Section II of Attachment D hereto, for subsequent review by law enforcement personnel as 
1394authorized in Sections Ill and IV of Attachment D. The Government is required to serve a copy 
1395of this Warrant and Order on the Provider within 14 days of the date of issuance. The Warrant 
1396and Order may be served via electronic transmission or any other means through which the 
1397Provider is capable of accepting service. 
1398
1399****** Result for Image/Page 48 ******
14002. Non-Disclosure Order. Pursuant to 18 U.S.C. 2705(b), the Court finds that there is 
1401reason to believe that notification of the existence of this warrant will result in destruction of or 
1402tampering with evidence or flight from prosecution, or otherwise will seriously jeopardize an 
1403ongoing investigation. Accordingly, it is hereby ordered that the Provider shall not disclose the 
1404existence of this Warrant and Order to the listed subscriber or to any other person for a period of 
1405180 days from the date of this Order, subject to extension upon application to the Court if 
1406necessary, except that Provider may disclose this Warrant and Order to an attomey for Provider 
1407for the purpose of receiving legal advice. 
14083. Sealing. It is further ordered that this Warrant and Order, and the Affidavit upon which 
1409it was issued, be filed under seal, except that the Government may without further order of this 
1410Court serve the Warrant and Order on the Provider; provide copies ofthe Affidavit or Warrant and 
1411Order as need be to personnel assisting the Government in the investigation and prosecution of 
1412this matter; and disclose these materials as necessary to comply with discovery and disclosure 
1413obligations in any prosecutions related to this matter. 
1414Dated: New York, New York 
1415teC 
1416Date Issued 
141702.282018 
1418ID!qrt.m. 
1419Time Issued 
1420HO ORABLE GAB 
1421•efUnited States 
1422Southern District of New York 
14232 
1424GOREN$TEIN 
1425Judge 
1426
1427****** Result for Image/Page 49 ******
14281. 
1429Email Search Attachment D 
1430Subject Account and Execution of Warrant 
1431This warrant is directed to 1 & 1 Intemet, Inc. (the "Provider"), headquartered at 701 Lee 
1432Road, Suite 300, Chesterbrook, Pennsylvania 19087, and applies to all content and other 
1433information within the Provider's possession, custody, or control associated with the email account 
1434the "Subject Account") for the time period between November 14, 2017 
1435and the date of this warrant, inclusive. 
1436A law enforcement officer will serve this warrant by transmitting it via email or another 
1437appropriate manner to the Provider. The Provider is directed to produce to the law enforcement 
1438officer an electronic copy of the information specified in Section II below. Upon receipt of the 
1439production, law enforcement personnel will review the information for items falling within the 
1440categories specified in Section Ill below. 
1441II. Information to be Produced by the Provider 
1442To the extent within the Provider's possession, custody, or control, the Provider is directed 
1443to produce the following information associated with the Subject Account: 
1444a. Email content. All emails sent to or from, stored in draft form in, or otherwise 
1445associated with the Subject Account, including all message content, attachments, and header 
1446information (specifically including the source and destination addresses associated with each 
1447email, the date and time at which each email was sent, and the size and length of each email). 
1448b. Address book information. All address book, contact list, or similar infonnation 
1449associated with the Subject Account. 
1450c. Subscriber and payment information. All subscriber and payment information 
1451regarding the Subject Account, including but not limited to name, username, address, telephone 
1452
1453****** Result for Image/Page 50 ******
1454number, alternate email addresses, registration IP address, account creation date, account status, 
1455length of service, types of services utilized, means and source of payment, and payment history. 
1456d. Transactional records. All transactional records associated with the Subject Account, 
1457including any IP logs or other records of session times and durations. 
1458e. Customer correspondence. All correspondence with the subscriber or others associated 
1459with the Subject Account, including complaints, inquiries, or other contacts with suppolt services 
1460and records of actions taken. 
1461f. Preserved or backup records. Any preserved or backup copies of any of the foregoing 
1462categories of records, whether created in response to a preservation request issued pursuant to 18 
1463U.S.C. 2703(f) or otherwise. 
1464Ill. Review of Information by the Government 
1465Law enforcement personnel (who may include, in addition to law enforcement officers and 
1466agents, attorneys for the government, attorney support staff, agency personnel assisting the 
1467government in this investigation, and outside technical experts under government control) are 
1468authorized to review the records produced by the Provider in order to locate any evidence, fruits, 
1469and instrumentalities of violations of 18 U.S.C. 371 (conspiracy to commit offense or to defraud 
1470the United States), 1005 (false bank entries); 1014 (false statements to a financial institution), 1343 
1471(wire fraud), and 1344 (bank fraud), including the following: 
1472a. Communications, records, documents, and other files necessary to establish the identity 
1473of the person(s) who created or used the Subject Account; 
1474b. Communications, records, documents, and other files involving Sterling National 
1475Bank, Melrose Credit Union, and/or taxi medallions; 
1476c. Communications, records, documents, and other files involving a plan, proposal, or 
1477agreement for Michael D. Cohen and/or entities associated with him to transfer any interest in taxi 
14782 
147902.282018