As noted, the search warrants leading up to and used in the April 9 search of Michael Cohen have been partly unsealed. In this post, I want to lay out what we know about how the investigation into Cohen developed.

On July 18, 2017, Mueller’s team got a warrant on Michael Cohen’s Google activity from January 1, 2016 to July 18, 2017, for which they would already have obtained the call records showing whom he was emailing when using it and a preservation order. At the time, they were investigating:

• False statements to a financial institution
• Money laundering
• Acting as an unregistered foreign agent
• FARA violations

On August 8, 2017, Mueller’s team got a warrant for Cohen’s iCloud account.

On November 13, 2017, they got a warrant for activity associated with a business account, MCDPC, which was hosted by 1&1, as well as for Cohen’s Gmail account going back to June 1, 2015. On November 7, 2017 and January 4, 2018, Mueller got pen registers to obtain records of everyone Cohen was talking to in real time.

While sorting through that evidence, they appear to have discovered more of the bank fraud associated with his taxi medallions.

On February 2, 2018, Mueller provided SDNY a subset of content from Cohen’s iCloud. On February 8, 2018, Mueller referred some of the crimes they were investigating to SDNY, including the taxi medallion payments and other money laundering, and handed them a USB drive with the stuff obtained in those earlier email warrants (but not yet the iCloud one). That month, SDNY got some of the emails turned over as hard copies from third parties using a subpoena, and accessed the toll records for the emails. Before accessing the content, on February 16, 2018, SDNY got a d-order for header information for the two accounts handed over by Mueller. They also interviewed and acquired emails from a number of employees at Sterling, from whom Cohen was getting a loan. Then, on February 28, 2018, SDNY submitted affidavits to access the content handed over from Mueller and to obtain everything in the accounts from the interim period (that is, since November 14), as well as another Gmail and AOL account associated with the taxi medallion related bank fraud.

This suggests that while they had found his Essential Consultants bank account and recognized that he was using it for things he hadn’t informed the bank about, they were not yet focusing on hush payments as an illegal campaign donation.

On March 7, 2018, Mueller handed over the iCloud material to SDNY.

In early April, SDNY started a slew of legal process leading up to its search of Cohen’s properties.

According to the letter associated with this release, they got a warrant for out of jurisdiction materials on April 5 (reportedly for stuff held overseas). I’m still trying to find that in the attachments.

Then, on April 7, 2018, it obtained a warrant to search the existing collection for material related to illegal campaign finance.

Also on April 7, SDNY got a warrant for prospective and historical location data associated with Cohen’s AT&T phones for the periods from October 1, 2016 to November 8, 2016 and January 1, 2018 to present. The campaign finance crimes were the only ones specified in this warrant.

On April 8, SDNY got a warrant for Cohen’s condo, office, safe deposit box, and hotel, as well as two iPhones. This covered all the crimes to which Cohen pled guilty in SDNY, as well as his sleazy influence peddling with BTA, KAI, AT&T, and Novartis, but not Columbus Nova (I’ll return to this). They also got a warrant to use a Stingray to figure out which room he was in at the hotel (like the location searches on his phone, this was just for his campaign finance crimes). Then, on April 9, they went back and got another warrant for the specific room at Loews hotel.

In the materials from SDNY, some names are redacted. The biggest redactions (suggesting ongoing investigation) pertain to the campaign finance crimes, meaning Trump and Trump Organization are in trouble. There may also be redacted material associated with Cohen’s sleazy influence peddling.

As I disclosed last July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post.