There Are 5,000 More Like Ricky Shiffer

In the last week, the serial revelations that DOJ had interviewed high level Trump associates, served at least two overt subpoenas, and searched the former President’s golf resort have demonstrated that the army of TV lawyers insisting that “we would know” if Merrick Garland’s DOJ was aggressively investigating Trump were utterly wrong, and wrong for reasons that every single one of them is competent to have known.

Even with your garden-variety alleged white collar criminal (like former Congressman TJ Cox, who was indicted yesterday), DOJ prefers to conduct its investigations secretly, because such investigations are more likely to succeed.

All the more so for a guy with an army of heavily-armed supporters and a history of witness tampering. As the motion to continue sealing the Trump search warrant affidavit states explicitly, many Trump associates will only cooperate so long as they can avoid the backlash and real physical peril that testifying overtly will bring.

[I]nformation about witnesses is particularly sensitive given the high-profile nature of this matter and the risk that the revelation of witness identities would impact their willingness to cooperate with the investigation. 5 Disclosure of the government’s affidavit at this stage would also likely chill future cooperation by witnesses whose assistance may be sought as this investigation progresses, as well as in other high-profile investigations.

5 This is not merely a hypothetical concern, given the widely reported threats made against
law enforcement personnel in the wake of the August 8 search. See, e.g., Alan Feuer et al.,
“Armed Man Is Killed After Trying to Breach FBI’s Cincinnati Office,” N.Y. Times (Aug. 11,
2022), available at https://www.nytimes.com/live/2022/08/11/us/fbi-cincinnati-shootingnews; Josh Margolin, “Authorities Monitoring Online Threats Following FBI’s Mar-a-Lago
Raid,” ABC News (Aug. 11, 2022), available at https://abcnews.go.com/US/authoritiesmonitoring-online-threats-fbis-mar-lago-raid/story?id=88199587.

The risk of political violence in response to investigations of Trump has come to a head in the last week. In the Kyle Fitzsimons bench trial yesterday, for example, witnesses leaving the DC courtroom were harassed by supporters of even this low profile assault defendant. And, as the government noted in their motion to oppose unsealing, last week an armed Trump supporter responded to Trump’s incitement by attempting to breach the Cincinnati FBI office, before being killed in a confrontation with cops later that day.

The guy who tried to breach the FBI office was not just any Trump supporter. He’s a Navy veteran who was at the Capitol on January 6.

A man identified by two law enforcement sources as Ricky Shiffer, who died in a confrontation with police after he fired a nail gun at a Cincinnati FBI building, appeared to post online in recent days about his desire to kill FBI agents shortly after former President Donald Trump’s Mar-a-Lago residence was searched.

Two law enforcement officials confirmed Shiffer’s name. Shiffer was at the Capitol riot on Jan. 6, 2021, according to three people aiding law enforcement who saw him in photos taken from the day of the attack; however, it’s unclear whether he went inside the building. Shiffer frequently posted about his attendance at the Capitol on social media.

On Truth Social, a social media platform founded by Trump’s media company, Trump Media & Technology Group, Shiffer appeared to have posted a message detailing his failed attempt to gain entry to the FBI building.

“Well, I thought I had a way through bullet proof glass, and I didn’t. If you don’t hear from me, it is true I tried attacking the F.B.I., and it’ll mean either I was taken off the internet, the F.B.I. got me, or they sent the regular cops while,” the account @RickyWShifferJr wrote at 9:29 a.m. ET, shortly after police allege the shooting occurred.

In fact, the FBI was already investigating him before he launched his attack.

The officials said federal investigators had been looking into whether the man, Ricky Shiffer, 42, of Columbus, had been involved in the Jan. 6 attack on the U.S. Capitol. They also said the F.B.I. had received a tip about Mr. Shiffer in May that was unrelated to Jan. 6, and agents opened a separate inquiry that included conducting interviews in Florida and Ohio.

The F.B.I. acknowledged in a statement that it had received information about Mr. Shiffer before Thursday, but said that the information “did not contain a specific and credible threat.” The bureau said agents from multiple offices had tried to find and interview him, but had not been successful. A neighbor at an apartment complex in Columbus where Mr. Shiffer lived, who declined to give his name, said federal agents had visited the property a few weeks ago and had asked him questions about Mr. Shiffer, including what time he left home most days and when he returned.

Law enforcement officials separately said they were investigating whether Mr. Shiffer appeared in a video posted on Facebook on Jan. 5, 2021, showing him attending a pro-Trump rally at Black Lives Matter Plaza in Washington the night before the Capitol was stormed.

This time around, as people start to ask, “if they FBI knew about this guy why didn’t they do something?” the FBI could (and should, but won’t) simply respond, “because everyone, from Trump opponents, law and order judges, Republicans in Congress, to TV lawyers told us to stop pursuing January 6 trespassers.” While Trevor McFadden and GOP Congresspeople have told DOJ to stop pursuing January 6 trespassers for different reasons, purportedly to protect political speech, Trump’s critics have said, explicitly, repeatedly, ignorantly, that suspected January 6 trespassers like Shiffer are low-level foot soldiers of little import to the country or to holding Trump accountable.

At this point (and, seemingly, for quite some time), DOJ really doesn’t seem to be arresting random trespassers. While the reasons for FBI’s heightened interest in a particular trespasser isn’t always clear (sometimes it is), most misdemeanor arrests these days seem to fit one or another investigative priority. In response to a recent claim DOJ was wasting its time with ongoing arrests of those who breached the Capitol, for example, I noted that recent arrests consisted of:

Compared to those arrests, Shiffer probably looked to the FBI just like another rabid Trump supporters whose uncertain movements around January 6 and transient recent history made him especially difficult to arrest, but whose military background and that recent tip generated active investigative interest. Yes, he was a rabid Trump supporter who, any moment, could turn — could be turned — into an imminent threat.

But at least given what we know thus far, the FBI likely had few clues that he was going to be the one whose online calls for war would turn to action.

That’s because there are 5,000 more like him out there.

I don’t mean, there’s a shit-ton of Trump supporters who could go postal at any moment. There are far more than 5,000 of them.

I mean, there are 5,000 people who participated in January 6 that the FBI might have predicated investigative interest in, but has not yet arrested.

That’s a fairly conservative number. In recent days, DOJ passed the 850 arrest mark for January 6 defendants. There are probably 1,500 to 2,000 more people who entered the Capitol on January 6 whose arrest would be comparatively easy (because their trespass is fairly easy to prove) who have not yet been arrested. There are probably 250 identified suspected assailants still at large (over 530 people, including those who’ve been arrested, are listed on the FBI site). And there were probably 10,000 people who breached the external barricades but did not enter the building that DOJ would only arrest if there were something extra — the political profile of Ryan Kelley or Couy Griffin, the pre-existing Deferred Prosecution Agreement of Owen Shroyer, conspiracy ties like Stewart Rhodes — to justify the arrest. Sure, the people who attended the January 5 rally, as Shiffer did, were more likely to participate in more radicalized online networks; those people weren’t in DC just to hear the loser of an election speak.

But at every moment that DOJ has been investigating the leaders that orchestrated January 6 (which provably started within weeks of the attack) and at every moment that DOJ has been investigating Trump’s other criminal acts, DOJ and FBI have been trying to deal with the growth of political violence that Trump has deliberately fostered. DOJ spent the weeks after January 6 doing triage, trying to arrest enough people to get visibility on the very real plans for follow-on attacks before or at the Inauguration. DOJ spent the year after January 6 trying to incapacitate the militia networks that served as an organizing structure for the attack. And DOJ has spent the last six months, as it turned more overtly to investigate several sets of crimes by the former President, trying to anticipate which of those 5,000 veterans of January 6 would, alone or in concert, attempt to reignite a civil war.

I hope that, given the Shiffer example, impatient people who’ve never bothered to understand the crime scene itself will remember that everyone they’ve dismissed for a year as low-level January 6 trespassers may be the next Ricky Shiffer. It’s easy to imagine that if you just arrest Trump all that political violence will dissipate. But that wouldn’t even have been true in 2019, if Mueller had indicted, and it sure as hell isn’t true now. And every step DOJ takes to get closer to arresting Trump, or even just hold the butchers like Fitzsimons who took up arms on January 6 accountable, the mob of people that Trump radicalized on January 6 remains an urgent threat.

How Trump’s Search Worked, with Nifty Graphic

 

I did a really rough, overly-simplified graphic explaining what we know about Trump’s search.

Round-edged boxes above are documents. Ovals are physical objects. Grey boxes are the boxes that documents were contained in. Turquoise represents documents that were not known to be classified or otherwise proof of any crime except (possibly, but not necessarily) a violation of the Presidential Records Act. The other colors for documents show various kinds of criminal evidence that a document might represent.

The search warrant authorizes the seizure of evidence that Trump:

  • Retained classified documents he’s not authorized to have
  • Took government documents he was obligated under the Presidential Records Act to turn over to the Archives
  • Obstructed investigations and government functions by destroying or concealing evidence

But the search method permits agents to take documents marked as classified, the boxes they’re in (with everything else in the boxes), and other boxes stored in the same place.

Any physical documents with classification markings, along with any containers/boxes (including any other contents) in which such documents are located, as well as any other containers/boxes that are collectively stored or found together with the aforementioned documents and containers/boxes;

Agents were allowed to search any part of Mar-a-Lago that Trump or his staff could access, but two locations we know they searched were his office and a storage closet (which I’ve indicated by two separate boxes, above).

Here are things that were seized that might have been found in Trump’s office (indicated above by the top horizontal black box):

  • A leatherbound box (that long horizontal grey box in the graphic)
    • Top Secret/SCI documents in that box
    • Everything else in that box
    • Trump’s diplomatic passport
  • Photo albums
  • An Executive Grant of clemency for Roger Stone
    • Information in that executive grant of clemency about the President of France
  • A handwritten note
  • Other documents that include privileged information which may be evidence of obstruction

Here are things that were seized that might have been in that storage closet (indicated above by the bottom horizontal black box):

  • Boxes with Top Secret documents and everything else in the boxes
  • Boxes with Secret documents and everything else in the boxes
  • Boxes with Confidential documents and everything else in the boxes
  • All the other boxes stored with the boxes with classified documents
  • Boxes that happen to include Trump’s expired passports
  • Boxes that include privileged documents which may be evidence of obstruction

At least some of the agents that did the search were a filter team, which means they’re agents who are not part of the primary investigative team. Before any agents from the primary investigative team looked at the materials, these filter agents sorted through the evidence and determined what documents were privileged or what boxes included privileged information. Everything that was deemed unprivileged seems to have been inventoried on what I’ve called the “CLASS receipt” signed by a Special Agent. (See these two posts for further discussions of the two receipts.) Those are marked by the lefthand green box above.

Then, it appears that someone else (possibly the Supervisory Special Agent) reviewed those privileged documents and identified any that could be seized anyway — either because they included classified documents, or because they were proof of obstruction. According to a Fox News report, those were all inventoried on what I’ve called the “SSA receipt.” That seems to indicate that anything privileged, regardless of where it was discovered (for example, if it was in the leatherbound box, as I showed above), was seized and inventoried separately. I’ve bolded those in my list above and marked them with the righthand green box.

So the process for Trump’s search likely looked like this:

  1. Is it classified, in a box w/classified, or a closet with classified?
  2. If yes, is it privileged?
  3. If no, then put in CLASS inventory
  4. If yes, is it proof of obstruction?
  5. If yes, then put it in the SSA inventory

Since the seizure, agents appear to have at least started the scope review — the process of sorting through which materials are proof that Trump stole classified information, documents otherwise covered by the Presidential Records Act, or proof of obstruction. The stuff that is not covered in the investigative scope, the FBI will return to Trump.

The first such items — his current diplomatic passport and two expired ones — were returned yesterday. Those likely were seized because they were stored in a box that either contained classified documents or were stored in a closet with other boxes that contained classified documents. Above, I’ve suggested that Trump’s diplo passport may have been seized in that leatherbound box where he allegedly kept TS/SCI documents, and I’ve shown how the other passports may have been in a box of documents that were in the storage closet with other boxes which had classified documents.

emptywheel Trump Espionage coverage

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

18 USC 793e in the Time of Shadow Brokers and Donald Trump

[from Rayne] Other Possible Classified Materials in Trump’s Safe

Trump’s Stolen Documents

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

[from Peterr] Merrick Garland Preaches to an Overseas Audience

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

Merrick Garland Calls Trump’s Bluff

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

[from Rayne] Expected Response is Expected: Trump and Right-Wing DARVO

DOJ’s June Mar-a-Lago Trip Helps Prove 18 USC 793e

The Likely Content of a Trump Search Affidavit

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

Some Likely Exacerbating Factors that Would Contribute to a Trump Search

FBI Executes a Search Warrant at 1100 S Ocean Blvd, Palm Beach, FL 33480

The ABCs (and Provisions e, f, and g) of the Espionage Act

Trump’s Latest Tirade Proves Any Temporary Restraining Order May Come Too Late

How Trump’s Search Worked, with Nifty Graphic

Trump’s Latest Tirade Proves Any Temporary Restraining Order May Come Too Late

At 12:49ET yesterday, the head of DOJ’s espionage section, Jay Bratt, informed Trump’s lawyers that the Agents who conducted the search of Mar-a-Lago had seized two expired passports and his still-active diplomatic passport; he invited someone to come get them after 2.

Later in the day, the former President went on his shitty website and claimed that the FBI, which attempted to return the passports within a week, had “stole” them.

Not long after, Norah O’Donnell tweeted that DOJ was not in possession of Trump’s passports.

In response, Trump’s spox Taylor Budowich accused O’Donnell of Fake News. He screencapped the Bratt letter to Trump’s lawyers showing that when the FBI discovered the passport, they made efforts to return them, effectively confirming O’Donnell’s statement that by the time of Trump’s tweet, the passports had been retrieved.

Given the way the warrant was written, there’s an easy explanation for how the FBI could have seized the passports. As I laid out in more detail here, the search worked from classified documents outward. The FBI was permitted to take any box that had a classified document in it, and any boxes stored where boxes storing classified documents were stashed.

Any physical documents with classification markings, along with any containers/boxes (including any other contents) in which such documents are located, as well as any other containers/boxes that are collectively stored or found together with the aforementioned documents and containers/boxes;

So if Trump stored his diplo passport in the leather-bound box where he stored the TS/SCI documents he stole, the FBI would have taken it under the search protocols. The same would happen if his expired passports were in a box in the storage closet where he stored his other stolen classified documents.

As the FBI explained in a statement, this is how it works.

In executing search warrants, the FBI follows search and seizure procedures ordered by courts, then returns items that do not need to be retained for law enforcement purposes.

And because Trump is a privileged white collar criminal suspect, he was lucky enough to get things that are out of scope immediately, rather than months later.

Unsurprisingly, then, Trump took an example of the FBI being diligent and used it to gin up outrage.

Worse for him, he is wasting his time.

As I noted Sunday, in response to similar searches implicating Donald Trump, lawyers filed for a Temporary Restraining Order within days.

I have been waiting all week for a docket to spring up with a Trump motion for a Temporary Restraining Order stalling any access to these files.

For comparison, the docket on a similar challenge from Michael Cohen in 2018 was created just 4 days after the search of his residences, and the discussions about the search began that same day.

On the same day as the seizures (April 9, 2018), the undersigned counsel requested in writing that the U.S. Attorney’s Office for the SDNY return all of the seized property and allow Mr. Cohen and his attorneys the opportunity to screen the materials for privilege, produce any relevant, non-privileged documents to the government, and provide a log of any documents withheld on privilege grounds. Id., ¶ 32, Ex. A. On Wednesday, April 11, 2018, the government responded by letter, rejecting defense counsel’s proposal and informing defense counsel that the government would begin to review the materials at noon on Friday, April 13, 2018. Id. ¶ 33, Ex. B. Accordingly, Mr. Cohen hereby moves for immediate injunctive and equitable relief seeking the opportunity to have his counsel review the seized documents in the first instance, before any review by any law enforcement personnel, for privilege and responsiveness, and, if the Court believes it necessary, for the appointment of a Special Master to supervise that review process.

Trump moved to intervene that same day, April 13, just four days after the seizures.

In the case of the search on Rudy’s phones, SDNY itself asked for a Special Master the next day (though Trump never intervened).

There have to be similar discussions going on now. There just have to be. Trump’s paucity of lawyers — and the conflict posed by the possibility that Evan Corcoran, his most competent current defense attorney, may be conflicted out by dint of having signed an affirmation that Trump turned over all his classified documents in June — cannot explain a full week delay.

But thus far, in spite of every media outlet and their mother filing motions to unseal the search affidavit itself, no one has started pushing to unseal an inevitable fight over access to the seized material. (Again, by comparison, the NYT filed to intervene the day the Cohen warrant docket was made public.)

There’s no sign of that happening here yet.

As of now, there are at most two unexplained sealed filings on the warrant docket.

Except they’re probably all accounted for: According to the government’s opposition to unsealing the warrant affidavit, Docket 57 contains all the other releasable materials (such DOJ’s own motion to seal), and the two prior entries are likely a motion to seal that filing and permission to do so. Each initially sealed docket entry in this docket has included two other sealed entries before it.

And time is running out for the Donald.

Contrary to what certain journalists have concluded from an email from Bratt that said, “the filter agents seized three passports belonging to President Trump,” that doesn’t mean a filter team currently working found the passports (though I assume a filter team may review materials seized under the SSA receipt a second time). It means that filter agents were used to do the search, as was reported contemporaneously. And now case agents — the people who determine which items are within scope of the investigation and which “items [] do not need to be retained for law enforcement purposes” — appear to be making scope determinations.

DOJ only needs to identify a single classified document to charge the former President under the Espionage Act. And given the way that Trump is ginning up outrage and attacks on FBI agents (which the government cited in explaining the need to keep the affidavit sealed), charging him with a single count indictment describing (hypothetically) the nuclear codes might be a good way to shut everyone up. They could use that to offer Trump a plea deal to lesser charges while they catalog other documents that each could bear a separate 10-year sentence.

If they’ve already singled out Trump’s passports, they surely are processing the stolen classified documents that could expose Trump to years in prison.

And Trump’s still at the manufactured outrage stage of his defense.

Update: Corrected time of Bratt’s email, which was shown with MDT.

emptywheel Trump Espionage coverage

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

18 USC 793e in the Time of Shadow Brokers and Donald Trump

[from Rayne] Other Possible Classified Materials in Trump’s Safe

Trump’s Stolen Documents

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

[from Peterr] Merrick Garland Preaches to an Overseas Audience

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

Merrick Garland Calls Trump’s Bluff

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

[from Rayne] Expected Response is Expected: Trump and Right-Wing DARVO

DOJ’s June Mar-a-Lago Trip Helps Prove 18 USC 793e

The Likely Content of a Trump Search Affidavit

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

Some Likely Exacerbating Factors that Would Contribute to a Trump Search

FBI Executes a Search Warrant at 1100 S Ocean Blvd, Palm Beach, FL 33480

The ABCs (and Provisions e, f, and g) of the Espionage Act

Trump’s Latest Tirade Proves Any Temporary Restraining Order May Come Too Late

The ABCs (and Provisions e, f, and g) of the Espionage Act

When Donald Trump wrote the Acting Archivist to give Kash Patel and John Solomon access to what they have since claimed were his Presidential Archives, he made a point of emphasizing that neither had been convicted of the crime that would disqualify them from accessing the records archived in official government archives at 700 Pennsylvania Avenue and elsewhere: “a crime that involves reviewing, retaining, removing, or destroying NARA records.”

Both individuals meet the requirements for access to records under 36 C.F.R. § 1270.44(a)(4).

That is, as far as we know, true. Neither has been convicted of a crime specifically involving access to the Archives.

But Solomon has long been publicly implicated in an investigation into a Dmitry Firtash-linked attempt to funnel Trump Russian-provided dirt. And The Hill’s review of his work included many details that might allow DOJ to treat him as something other than a journalist in that investigation.

As for Kash, at least in April 2021, he was reportedly under investigation for leaking classified information, something that might have led the government to strip his clearance if they hadn’t already.

Both would be wildly inappropriate people to give preferential access to Trump’s Presidential archives. But they nevertheless would qualify under statute.

But Trump wasn’t writing to give Kash and Solomon access to his Archives. His letter explicitly stated he was giving them access to, “Presidential records of my administration.” A week ago, the FBI carted away 27 boxes of “Presidential records of [Trump’s] administration” that had not been properly turned over to the custody of the Archives for safe keeping.

Those details from Trump’s letter, plus new reporting on the events of June, adds to the possibly that this letter was an attempt to retroactively justify access to classified records that, in addition to documents pertaining to the Russian investigation, also likely included even more sensitive documents.

In a largely insipid storyline of the search, Christina Bobb described the WaPo about DOJ’s request after touring the storage closet in which Trump was hoarding classified documents differently than previous, anonymous explanations that likely also come from her.

Bobb told The Post that the group toured the storage facility, opening boxes and flipping through the records inside. She said Justice Department officials indicated they did not believe the storage unit was properly secured, so Trump officials added a lock to the facility.

By description, that’s not (as earlier reported) a request that Trump buy a bigger lock. It almost certainly was a reminder that classified information must be stored according to certain guidelines. DOJ’s letter probably even included a citation to 20 CFR § 2001.43, which describes (among other things) the standard of lock that must be used to store classified documents (italicized below).

(a) General. Classified information shall be stored only under conditions designed to deter and detect unauthorized access to the information. Storage at overseas locations shall be at U.S. Government-controlled facilities unless otherwise stipulated in treaties or international agreements. Overseas storage standards for facilities under a Chief of Mission are promulgated under the authority of the Overseas Security Policy Board.

(b) Requirements for physical protection–

(1) Top Secret. Top Secret information shall be stored in a GSA-approved security container, a vault built to Federal Standard (FED STD) 832, or an open storage area constructed in accordance with Sec. 2001.53. In addition, supplemental controls are required as follows:

(i) For GSA-approved containers, one of the following supplemental controls:

(A) Inspection of the container every two hours by an employee cleared at least to the Secret level;

(B) An Intrusion Detection System (IDS) with the personnel responding to the alarm arriving within 15 minutes of the alarm annunciation. Acceptability of Intrusion Detection Equipment (IDE): All IDE must be in accordance with standards approved by ISOO. Government and proprietary installed, maintained, or furnished systems are subject to approval only by the agency head; or

(C) Security-In-Depth coverage of the area in which the container is located, provided the container is equipped with a lock meeting Federal Specification FF-L-2740.

(ii) For open storage areas covered by Security-In-Depth, an IDS with the personnel responding to the alarm arriving within 15 minutes of the alarm annunciation.

(iii) For open storage areas not covered by Security-In-Depth, personnel responding to the alarm shall arrive within five minutes of the alarm annunciation.

(2) Secret. Secret information shall be stored in the same manner as Top Secret information or, until October 1, 2012, in a non-GSA-approved container having a built-in combination lock or in a non-GSA-approved container secured with a rigid metal lockbar and an agency head approved padlock. Security-In-Depth is required in areas in which a non-GSA-approved container or open storage area is located. Except for storage in a GSA-approved container or a vault built to FED STD 832, one of the following supplemental controls is required:

(i) Inspection of the container or open storage area every four hours by an employee cleared at least to the Secret level; or

(ii) An IDS with the personnel responding to the alarm arriving within 30 minutes of the alarm annunciation.

(3) Confidential. Confidential information shall be stored in the same manner as prescribed for Top Secret or Secret information except that supplemental controls are not required.

(c) Combinations. Use and maintenance of dial-type locks and other changeable combination locks.

(1) Equipment in service. Combinations to dial-type locks shall be changed only by persons authorized access to the level of information protected unless other sufficient controls exist to prevent access to the lock or knowledge of the combination. Combinations shall be changed
under the following conditions:

(i) Whenever such equipment is placed into use;

(ii) Whenever a person knowing the combination no longer requires access to it unless other sufficient controls exist to prevent access to the lock; or

(iii) Whenever a combination has been subject to possible unauthorized disclosure.

(2) Equipment out of service. When security equipment is taken out of service, it shall be inspected to ensure that no classified information remains and the combination lock should be reset to a standard combination of 50-25-50 for built-in combination locks or 10- 20-30 for combination padlocks.

(d) Key operated locks. When special circumstances exist, an agency head may approve the use of key operated locks for the storage of Secret and Confidential information. Whenever such locks are used, administrative procedures for the control and accounting of keys and locks shall be included in implementing regulations required under section 5.4(d)(2) of the Order. [my emphasis]

This section of 32 CFR Parts 2001 and 2003 gets cited in search warrant affidavits for 18 USC 793e; here’s how it appeared, for example, in Reality Winner’s search warrant:

32 C.F.R. Parts 2001 and 2003 regulate the handling of classified information. Specifically, 32 C.F.R. § 2001.43, titled “Storage,” regulates the physical protection of classified information. This section prescribes that Secret and Top Secret information “shall be stored in a GSA-approved security container, a vault built to Federal Standard (FMD STD) 832, or an open storage area constructed in accordance with § 2001.53.” It also requires periodic inspection of the container and the use of an Intrusion Detection System, among other things.

In Trump’s search warrant, a similar paragraph or one following it would include language about how, when the head of DOJ’s Espionage division, Jay Bratt, went and inspected Trump’s storage facility storing documents classified at least at the Secret level on June 3, he found some easily picked lock from WalMart or whatever it was on the door.

Given that the email Bratt sent Trump on June 8 did not say, buy a new lock but instead said, you’re not complying with the requirements for storing classified information, it may also have made a request for proof that someone with clearance at the Secret level was coming to check his stash of documents every 4 hours (see the language bolded above). A refusal to provide that proof voluntarily (because Trump wasn’t complying) may explain why DOJ subpoenaed Trump for such information, reportedly on June 22. Or they may have had other reason to worry, such as Kash Patel’s claims, made on May 4, to have specific knowledge of which documents Trump had returned (which, if Kash’s clearance got stripped when he was under investigation for leaking, he would have no legal basis to know).

But DOJ did subpoena Trump for two months of security footage. And it turned out to show people moving documents in and out of the closet seemingly in conjunction of requests for DOJ.

The Justice Department also subpoenaed surveillance footage from Mar-a-Lago recorded over a 60-day period, including views from outside the storage room. According to a person briefed on the matter, the footage showed that, after one instance in which Justice Department officials were in contact with Mr. Trump’s team, boxes were moved in and out of the room.

That activity prompted concern among investigators about the handling of the material. It is not clear when precisely the footage was from during the lengthy back-and-forth between Justice Department officials and Mr. Trump’s advisers, or whether the subpoena to Mr. Trump seeking additional documents had already been issued.

Given that Trump had no reason to expect that DOJ would ask to see this storage closet on June 3, the moving of boxes may reflect an effort to hide the classified documents from the lawyer who affirmed there were no classified documents there, rather than an effort to hide them from DOJ (in which case the lawyer in question, possibly the suddenly-silent Evan Corcoran, would be in a legal conflict with Trump and might be forced to testify against him).

Which brings us to what is still a chicken-and-egg moment, which might be any of the following:

  • Trump refused to provide surveillance video voluntarily knowing it wouldn’t show compliance with the CFR but would show damning information, which led DOJ to subpoena it, which led to the discovery of uncleared people accessing classified materials (a violation of 18 USC 793f or g, in addition to the violation of 793e)
  • A Trump lawyer realizing the email about CFR compliance meant Trump was in trouble and needed to cover his tracks
  • DOJ finding other reason to be concerned, such as the Kash comments from May seeming to reflect personal knowledge of Trump’s classified documents or Trump’s letter to the Archives reflecting plans to give two people about whom DOJ would have particularized security concerns access to “Presidential records of my administration”

Like I said, thus far it’s a chicken-and-egg thing, but all these things came to a head in late June.

Ultimately, on June 19, Trump filed paperwork that provides the appearance of official access for Kash and Solomon, and (reportedly on June 22), DOJ served a subpoena asking for records showing who had entered and exited the closet. On June 22, so by reports, the same day that Trump got the subpoena but three days after Trump gave Kash the access, Kash went public with his claim to be accessing Trump’s records at the Archive, which is not what the letter asks for.

The problem, though, is that Trump was no longer an original classification authority after January 20 — even his own clearance would be limited! So while he could give Kash and Solomon monitored, privileged access at the Archives (because, while they were both security concerns, they had never been convicted of stealing records from the Archives), Trump had no authority to give them access to the Presidential records at his golf resort, because they included classified records that neither had clearance to access much less a need to know.

Here are all the ways that 18 USC 793 of the Espionage Act add to someone’s liability if they share classified information with people not entitled to receive it,

(d)Whoever, lawfully having possession of, access to, control over, or being entrusted with any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, or note relating to the national defense, or information relating to the national defense which information the possessor has reason to believe could be used to the injury of the United States or to the advantage of any foreign nation, willfully communicates, delivers, transmits or causes to be communicated, delivered, or transmitted or attempts to communicate, deliver, transmit or cause to be communicated, delivered or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it on demand to the officer or employee of the United States entitled to receive it; or

(e)Whoever having unauthorized possession of, access to, or control over any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, or note relating to the national defense, or information relating to the national defense which information the possessor has reason to believe could be used to the injury of the United States or to the advantage of any foreign nation, willfully communicates, delivers, transmits or causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee of the United States entitled to receive it; or

(f)Whoever, being entrusted with or having lawful possession or control of any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, note, or information, relating to the national defense, (1) through gross negligence permits the same to be removed from its proper place of custody or delivered to anyone in violation of his trust, or to be lost, stolen, abstracted, or destroyed, or (2) having knowledge that the same has been illegally removed from its proper place of custody or delivered to anyone in violation of its trust, or lost, or stolen, abstracted, or destroyed, and fails to make prompt report of such loss, theft, abstraction, or destruction to his superior officer—

Shall be fined under this title or imprisoned not more than ten years, or both.

(g) If two or more persons conspire to violate any of the foregoing provisions of this section, and one or more of such persons do any act to effect the object of the conspiracy, each of the parties to such conspiracy shall be subject to the punishment provided for the offense which is the object of such conspiracy. [my emphasis]

Note, I included 18 USC 793d, but I think that under the Presidential Records Act, Trump no longer had authorization to store those documents. I included it because, if Trump pushed the point, he could be charged under that statute instead of 793e.

Both before and, especially, since this has blown up, Kash Patel and John Solomon have been the loudest purveyors of false claims that this is about classified information. Both were insisting in July, for example, that they knew that all the Russian-related documents Trump tried to declassify in the last minutes during which he still had authority had in fact been declassified and remained declassified. Kash, especially, knows that the Espionage Act is not about classified information anyway, but instead National Defense Information.

I still don’t think that these events are primarily about Kash and Solomon. But I think Trump’s efforts to have them continue to purvey false claims that he had not actually been implicated with improper ties to Russia may have led him to do stupid things that expanded his own (and their) liability under the Espionage Act.

DOJ could have written the warrant to convey that Trump was only under investigation for 18 USC 793e, the most obvious clause covering his refusal to give documents back. They did not. And all the people around Trump should be more worried about their own legal liability right now than spreading false claims that any attempt by Trump to declassify National Defense Information could change his legal exposure.

emptywheel Trump Espionage coverage

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

18 USC 793e in the Time of Shadow Brokers and Donald Trump

[from Rayne] Other Possible Classified Materials in Trump’s Safe

Trump’s Stolen Documents

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

[from Peterr] Merrick Garland Preaches to an Overseas Audience

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

Merrick Garland Calls Trump’s Bluff

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

[from Rayne] Expected Response is Expected: Trump and Right-Wing DARVO

DOJ’s June Mar-a-Lago Trip Helps Prove 18 USC 793e

The Likely Content of a Trump Search Affidavit

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

Some Likely Exacerbating Factors that Would Contribute to a Trump Search

FBI Executes a Search Warrant at 1100 S Ocean Blvd, Palm Beach, FL 33480

The ABCs (and Provisions e, f, and g) of the Espionage Act

Other Possible Classified Materials in Trump’s Safe

[NB: As always, check the byline. Thanks. /~Rayne]

I’ve been sitting on this since last November. I had pieces I couldn’t quite pull together. But now that the FBI has executed a warrant on Trump at Mar-a-Lago to seize stolen presidential records and classified materials, those disparate pieces may be coming together.

While this is nowhere near as exciting as missing nuclear documents, is it possible there were other crimes in progress at the time Trump left office — ones which might have happened under our noses and may have posed national security threats then and now?

Please also note this post is partially speculative as well.

~ ~ ~

In late 2020, something happened in Morocco which might offer hints at whatever crimes might have been cooked up elsewhere.

There was little mainstream news coverage in the U.S.; we were too preoccupied with election-related coverage to pay much attention.

In exchange for recognizing Morocco’s illegitimate occupancy of Western Sahara – violating West Saharan Sahrawi people’s human rights to self determination – the Trump administration sold nearly a billion dollars in weapons to Morocco.

The deal was characterized as part of a process of restoring Morocco’s relationship with Israel. Morocco’s land grab was first recognized on Thursday, December 10, 2020 in a tweet by Trump. The arms deal was reported on Friday, December 11.

In other words, the arms deal portion of the negotiations was buried in the news dump zone, while much of the U.S. was watching Team Trump’s election theatrics.

The arms deal could have been another quid pro quo. As late as it happened in Trump’s term, as hushed and hurried as it was, with as little support as it had among Republicans, something about the deal still reeks to high heaven.

The United Nations didn’t see eye to eye with the Trump administration about this new disposition of West Sahara; it had been blindsided by what it saw as an abrupt reversal of US policy.

The UN continued to recognize West Saharan Sahrawi people’s human rights to autonomy though West Sahara remains a non-self governing territory.

What a coincidence, though, that Morocco issued a one billion euro bond in September 2020 before the US election. It had been toying with issuing a two billion euro bond at least as early as the first week of August, thought this may have been an expansion of a two-bond program announced in March 2019 with a one billion euro bond sold out in November 2019.

It’s also a coincidence that Morocco finished building a new base in summer of 2020, with plans to build or expand another for a large number of F-16 fighters and Apache helicopters it agreed to buy from the US in 2019.

Finally, it could be a hat trick that Morocco hosted Ukrainian national guard members for training early this year at that brand new base, before Russia’s attack on Ukraine began in late February. Was this part of the earlier negotiations?

Timeline:

March 25, 2019 — Morocco agreed to purchase 25 F-16s from US

November 2019 — Sale of 24 Apache helicopters to Morocco approved

April 2020 — Sale of 10 Harpoon air-to-sea missiles to Morocco approved

June 1, 2020 — Construction of a military base completed in Morocco

August 9, 2020 — Morocco considered 2 billion euro bond

September XX, 2020 — Morocco issued 1 billion euro bond

November 3, 2020 — US Election Day

November 9, 2020 — Trump fired SecDef Mark Esper over Twitter, replacing him with Acting SecDef Christopher Miller; Moroccan news noted this change.

December 10, 2020 — Trump reversed US policy over Western Sahara when Trump tweeted recognition of Morocco’s claim over Western Sahara

December 11, 2020 — Arms deal announced

~ ~ ~

Back in 2020, journalist Zack Kopplin of the Government Accountability Project had gotten a tip:


It’s a long thread written over several days which includes links to reporting Kopplin did.

At the heart of this story, though, is a war crime.

Remember when Trump said “We’re keeping the oil” from Syria in October 2019? That.

Trump openly expressed a desire to commit a violation of Article 33 of the Fourth Geneva Convention, the 1907 Hague Laws and Customs of War on Land, and 18 U.S. Code 2441 War crimes, for starters. There may be more applicable laws which could have been broken.

Trump also knew the value of the oil in question — $45 million a month.

Kopplin was tipped to the basics about the company which was supposed to begin development in the northeast region of Syria, but the ultimate owner of this entity and development process wasn’t clear.

Following Kopplin’s reporting, some names pop up as connected by role (like then-Secretary of State Mike Pompeo), or rumored as connected by other relationships (like Erik Prince who funded a business tangentially related to Delta Crescent).

There’s also the frustrating interrelation between Syria, Russia, Iraq, the Kurdistan region, Turkey, Iran, and the UN’s humanitarian aid for displaced Syrians. The aid became leverage in negotiations which have been fairly opaque in US news.

The status of the oil, too, isn’t particularly clear, with Delta Crescent’s development running into policy changes with Biden’s administration, terminating its sanctions waiver.

Add to the picture the fluid challenge of trying to keep Turkey on board with US during increasing Black Sea tensions, as well as Iran in JCPOA negotiations, thwarting Russia in more than Syria, while trying to assure both humanitarian aid along with global grain shipments.

It’s a damned complex mess through which oil may or may not be smuggled through Iraq by a Kurdish political family, sanctioned or not sanctioned depending on how the Biden administration is trying to leverage the situation for humanitarian aid access, improved relations in the Levant, or decreased oil prices.

What’s really unclear is whether there were any kickbacks offered in 2019-2020 for “keeping the oil” and if any, who received or receives them.

~ ~ ~

Since his testimony before the House Oversight Committee in May 2021, I’ve not been persuaded former Acting Secretary of Defense Christopher Miller is on the up and up, along with his former chief of staff Kash Patel — one of two guys Trump is known to have named his representatives to the National Archives.

The timing of Miller’s placement as Acting SecDef in tandem with the election may seem like an obvious effort to pre-plan for January 6, but Trump is a crook. We need to look at the situation through a crook’s eyes.

What if January 6 wasn’t just about an attempt to obstruct the certification of the vote, but an effort to buy time to deal with illicit profiteering like oil obtained through a war crime?

American troops were supposed to guard the area in which Delta Crescent would develop the oil Trump was intent on keeping. Wouldn’t the Secretary of Defense need to go along with this long enough for a supply chain to be established from the oil wells to distribution?

Is this why Miller, a former Director for Special Operations and Irregular Warfare who worked during the Trump administration in counterterrorism involved in operations against Islamic State in Iraq and Levant, ended up Acting SecDef in the last days of the Trump administration?

What does Christopher Miller know? What of his sidekick Kash Patel — the one who knew the contents of Trump’s classified documents cache?

~ ~ ~

Marcy wrote about some very strong candidates for classified documents Trump might have had at Mar-a-Lago. I think both the circumstances surrounding the rushed Morocco arms deal and the Syrian oil development are two more candidates, especially since both matters may have tentacles reaching into ongoing national security concerns.

But I also have a feeling we’re scratching the surface with the boxes of paper seized this week.

I hadn’t even gotten around to the Kurdish link to Miami, Florida or illegal drug trade.

Obstruction: The Two-Receipt Search of the Former President’s Golf Resort

There are two separate receipts for the search of Mar-a-Lago signed, in the same minute, by Trump lawyer Christina Bobb.

There’s the one consisting of five boxes and a separate category, “Documents,” not associated with any boxes, signed by the Supervisory Special Agent. There are no classified documents described. I’ll refer to that as the SSA Receipt in this post.

Then there’s the one that consists of 27 items, mostly boxes, many with sub-items, which are often descriptions of the kinds of classified documents contained in the box or the leather case they were seized in. It was signed by a Special Agent. I’ll refer to that as the CLASS Receipt in this post.

Bobb signed them both at 6:19PM, so unless she’s a shitty lawyer, these receipts were presented to her together as one running receipt.

Whatever else the FBI is, their searches are methodical. They come in, secure the location, serially take pictures of the rooms being searched (so the criminal suspects don’t claim evidence was planted, as criminal suspects are wont to do), label the things to be searched, start sorting through items according to a search protocol to see if they’re covered by the warrant, then inventory the things being seized. In this case, there would have been another part of the process to make sure no attorney-client privileged materials were seized.

In the search of Trump’s house, at least 73 boxes appear to have been labeled (based on the highest box label number), but just 26 boxes were seized.

By all appearances, these two receipts stem from the same methodical search. For example, the documents listed as item 4 on SSA receipt are in the same overall inventory as everything else, but appear out of sequence. They likely bear some proximal relation to low-item numbers in the CLASS receipt — things like the Roger Stone clemency and the binders of photos. Perhaps they were all found in Trump’s office or residence. But they are on the SSA receipt.

The series of box labels crosses both receipts. For example, it appears that boxes A-14 and A-13, which appear in the SSA receipt, were labeled in close proximity and time as boxes A-12 and A-15, which are among the lowest numbered boxes on the CLASS receipt. But they got listed on the SSA receipt, where all boxes appear together as the final five items on the combined inventory, items 29 through 33.

I’d like to talk more about the search, but first let me spoil the punchline: One likely (though not the only) explanation for the two receipts has to do with the venue in which Trump’s suspected crimes were committed and therefore the ultimate destination of the seized materials, with the SSA receipt materials being sent to DC as evidence of 18 USC 1519 and the CLASS receipt materials being kept in Miami as evidence of multiple violations of the Espionage Act that occurred at Mar-a-Lago.

But let’s go back.

I believe this warrant is the totality of the search on Trump’s mansion. While File411 suspects there’s another warrant (or two), I don’t believe those authorize a search of Trump’s house, not least because Judicial Watch has only asked to unseal one, and Trump’s people will have told them what they wanted unsealed. Merrick Garland referred to unsealing the documents relating to Trump’s house, and I’d be surprised if he played word games to hide further search materials when Trump would literally have receipts to call out any such obfuscation. That doesn’t rule out that the other warrants identified by File411 were related searches, perhaps of locations where Trump’s stolen documents may have been moved, but I believe we’re looking at the totality of the physical search at Mar-a-Lago. Update, August 15: DOJ has now confirmed that this is an entirely separate ongoing investigation. Remember that lots of January 6 suspects live in Florida, so it could be something like that or an entirely different type of crime.

The warrant authorizes the FBI to search Trump’s office (the narcissist appears to have renamed it the 45 Office but it has been referred to as the bridal suite), all storage rooms (the one that Trump’s lawyers showed Jay Bratt when he visited in June is not identified by name), and anywhere else Trump or his staff might have stashed boxes or documents. We know from reports that that included Trump’s personal residence, but the FBI didn’t call it out by name. Curiously, the FBI made clear that when it said the search did not include spaces occupied by guests or other residents, they mean “currently,” as if there’s a room someone recently vacated that is of interest.

Attachment B, which describes the items to be searched for, is one of the things that may explain the two receipts. It starts by listing three crimes: 18 USC 793 (Gathering, transmitting or losing defense information, which is part of the Espionage Act), 18 USC 2071 (Concealment, removal, or mutilation [of official records] generally), and 18 USC 1519 (Destruction, alteration, or falsification of records in Federal investigations).

Despite the fact that every single leak to the press about the scope of the warrant claimed that two crimes were listed, “mishandling classified information” and the Presidential Records Act, those leaks were all false. The former was a transparent attempt to avoid saying the word “Espionage” and the latter is not listed on the warrant as a crime being investigated at all (though I would bet a great deal of money that it features prominently in the affidavit). 18 USC 2071, in this context, may serve as a proxy, criminalizing the removal of records covered by PRA. And one of the four bullets describing materials that can be seized, bullet c,  stems from PRA: “Any government and/or Presidential Record created between January 20, 2017, and January 20, 2021.” Because it would cover items implicated in the two other crimes, National Defense Information and evidence from Federal investigations, that bullet point serves as a larger umbrella in this search. If Trump tries to claim he declassified the items seized in the Espionage Act investigation, for example, the government will be able to say they still seized them lawfully given that bullet point and the inclusion of 18 USC 2071, because to still be at Mar-a-Lago at this point, they would have had to have been removed improperly from government control.

There are two bullet points scoping out materials relating to the Espionage count. Bullet point b authorizes the seizure of information about the storage of NDI or classified information.

Information, including communications in any form, regarding the retrieval, storage, or transmission of national defense information or classified material.

If Trump or his flunkies are charged under the Espionage Act, DOJ will have to rebut the claims being floated by Kash Patel and John Solomon that Trump declassified this material. One way to do that is to show that Trump or his lawyers instructed staffers to treat certain materials as if it was classified. If, for example, Trump put up post-it notes on his storage room saying “Danger: Sekrits. Keep Out,” it would prove that he was telling others to treat the documents with care. I’m only partly joking. We know there were efforts to prevent uncleared staffers from looking at classified information. Obtaining written proof of such instructions is one of the ways DOJ would prove that Trump did know this stuff remained classified. Even if those efforts were only enforced by his lawyers — the same lawyers who failed to turn over these materials in response to subpoena — it will be powerful evidence that those documents were being treated as if they remained classified.

The other bullet point authorizing evidence covered by the Espionage Act reminds me of Borges’s writings on classification.

Any physical documents with classification markings, along with any containers/boxes (including any other contents) in which such documents are located, as well as any other containers/boxes that are collectively stored or found together with the aforementioned documents and containers/boxes.

Effectively, this allows the FBI to seize documents with classification markings and then work out from there, seizing the box containing the document marked as classified, as well as the contents of the closet that a box containing a classified document was in. It’s fairly easy to understand why the FBI wrote it this way (and it may be tailored to overcome the justifications Trump made over the course of 18 months to try to retain certain materials). The President looks at — and in many cases, generates — a whole slew of things that are considered highly classified, but in a form that wouldn’t have classification marks on it, especially if he never shared it with a staffer. If Trump took notes with his Sharpie on a cocktail napkin during a phone call directly with Mohammed bin Salman, for example, it would not include classification marks, but it might be highly classified. So this bullet point allows FBI to seize stuff being treated the same way as documents that do have formal classification markings, which government classification experts can then apply the appropriate classification to.

How this might have worked in practice appears on the CLASS receipt. The second-most interesting item on the list (after the Roger Stone clemency that seems to have some tie to the French President) is the leather box in which the only documents inventoried as TS/SCI were stored.

Not all of these documents are TS/SCI; the inventory even notes that some are just classified. But given the way the warrant is written, the FBI was permitted to seize the entire box, which appears to contain Donald’s precious treasures, even if some of the documents in there are not labeled as classified. It may be that witnesses told the FBI of the existence of this box so the FBI knew to look for it. By seizing the entire box, the FBI would get things that might be even more sensitive than the TS/SCI stuff, but that don’t bear markings, like that hypothetical cocktail napkin with notes of Trump’s secret calls with MbS.

The thing is, these categories overlap. There may have led to some triage onsite about how to classify seized documents. I suggested that item 4 — documents — may have been stored with items 1 through 7 in Trump’s office or residence. If so, they could have been seized by proximal location. But they’re inventoried on the other receipt for some reason, potentially even taken out of a box or that leather case and seized separately as individual documents.

Similarly, boxes A-13 and A-14 were likely stored in close proximity to box A-15, which includes at least some Secret Documents, and box A-16, which includes at least some Top Secret Documents. So they could have been seized under the logic of proximity. But like item 4, they’re on a different receipt.

Which brings me to the final bullet describing the scope of the search (and back to my working hypothesis for the two different receipts, that the SSA receipt covers evidence of obstructive acts committed in DC). It authorizes the seizure of evidence of the destruction of records.

Any evidence of the knowing alteration, destruction, or concealment of any government and/or Presidential Records, or of any documents with classification markings.

This language comes right out of the obstruction statute, though leaves out the reference to “investigation[s] or proper administration:”

Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both.

This part of the warrant, not the reference to the Espionage Act, was the biggest secret of the week. I was not surprised that anonymous sources from the Trump camp soft-pedaled the word “Espionage.” It’s why I was pushing for pressure on Trump to release the warrant. It’s what I believed Trump most wanted to hide.

But remarkably, Trump’s leakers were hiding this part of the warrant even more aggressively. In the entire week of post-search coverage, there was never a hint that obstruction was on the warrant, too. The “Expert Explainers” gaming out what crimes might be on the warrant completely missed obstruction. I did too.

We shouldn’t have. The coverage of the Archives’ referral of Trump to DOJ described his destruction of evidence even more prominently than it did his theft of classified documents.

The National Archives and Records Administration has asked the Justice Department to examine Donald Trump’s handling of White House records, sparking discussions among federal law enforcement officials about whether they should investigate the former president for a possible crime, according to two people familiar with the matter.

The referral from the National Archives came amid recent revelations that officials recovered 15 boxes of materials from the former president’s Mar-a-Lago residence in Florida that were not handed back in to the government as they should have been, and that Trump had turned over other White House records that had been torn up. Archives officials suspected Trump had possibly violated laws concerning the handling of government documents — including those that might be considered classified — and reached out to the Justice Department, the people familiar with the matter said.

[snip]

Trump’s years-long defiance of the Presidential Records Act, which requires the preservation of memos, letters, notes, emails, faxes and other written communications related to a president’s official duties, has long raised concerns among historians and legal observers. His penchant for ripping up official documents was first reported by Politico in 2018, but it has drawn new scrutiny in recent weeks because of a House select committee’s investigation of the Jan. 6, 2021, attack on the U.S. Capitol.

The Washington Post reported late last month that some of the White House records the National Archives turned over to the committee appeared to have been torn apart and then taped back together. The Post later found — and the Archives confirmed — that officials had recovered 15 boxes of presidential records from Mar-a-Lago.

As described, by the time of its criminal referral, the Archives had already found that documents that were responsive to the January 6 Committee’s investigation (and so, derivatively, DOJ’s investigation of Trump personally) had been “altered, destroyed, or mutilated.” DOJ would have started this investigation knowing that Trump had attempted to destroy evidence implicating him in January 6 (though we actually have evidence of him attempting to destroy or alter evidence pertinent to other criminal investigations, too).

By description, when Trump tried to destroy evidence, he did so immediately, in the heat of the moment, in the White House. For that reason, and because the known federal investigations — his attempted coup on January 6, but also his ties to Russia, his coercion of Ukraine, even his inauguration graft — were all predicated in DC, the investigation into Trump’s obstruction of those investigations would be in DC too. That’s why I hypothesize that FBI may have inventoried everything and then, when compiling a final inventory to share with Trump, they distinguished between the suspected crimes that would have been committed in Florida, by storing classified information improperly and refusing to return it to the Federal government, and the suspected crimes that would have been committed in DC when — on January 20 or before, including between January 6 and January 20 — Trump ripped up, flushed, burned, or tried to eat incriminating evidence.

Unless Trump were to waive venue (which he would never do), any prosecution of Trump under the Espionage Act would happen in SDFL, because that’s where he illegally retained classified information after the government asked him to give it back. But any prosecution of Trump for obstruction would happen where the investigations he obstructed were and where he ripped up evidence, in DC.

Item 4, documents, might just be documents that bore visible signs of destruction that had some identifiable tie to January 6 or some other known investigation. They could even be classified! The obstruction bullet point includes classified documents! But they would have been seized, first and foremost, because they were evidence that Trump was trying to impede an investigation or some other government function by destroying evidence.

That has one more big implication, which may be why Trump’s team tried so hard to hide that FBI was looking for evidence of obstruction. There were also leaks (including leaks from the government side) that nothing on this search warrant pertains to January 6. Technically that’s true. Obstruction of the vote certification and conspiracy to defraud the government, the most obvious crimes covering Trump’s conduct leading up to and on January 6, aren’t on the warrant. But as that coverage of the original referral we all forgot to read makes clear, January 6 is at least one of the investigations that Trump is being investigated for obstructing. If the evidence of obstruction is being boxed up and sent back to DC where such an investigation would be predicated, then the evidence would thereby become available to investigators, both for evidence of Trump’s obstruction of an investigation, but also for evidence of Trump’s conduct as well.

Oh. And if Trump were found to have obstructed an investigation into conspiracy by destroying evidence, it might extend the statute of limitations on that conspiracy.

I wrote a long thread yesterday about how Trump epically fucked up by giving DOJ grave reasons to come search his home. DOJ would never have searched Mar-a-Lago for materials Trump withheld in violation of the PRA. They probably would never have searched MAL for evidence he withheld regarding January 6. But Trump kept refusing to turn over classified information DOJ knew he had, some of it reportedly incredibly sensitive. Trump dared Merrick Garland to come get those classified documents. And in so doing, Donald J. Trump gave the FBI urgent reason to come into his home to seize — along with at least 11 boxes containing classified documents — the evidence about January 6 and other investigations that is so sensitive Trump tried to destroy it before refusing to turn it over to the Archives.

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

On June 22, Kash Patel announced that he had just been made a representative for Trump at the National Archives. (h/t to Suburban Gal for these links)

I can tell you now that I am now officially a representative for Donald Trump at the National Archives. And I’m going to march down there — I’ve never told anyone this, because it just happened, and I’m going to identify every single document that they blocked from being declassified at the National Archives.

The next day, Kash described that that letter, making him Trump’s representative to the Archives, “just came in, literally before I came on the show” the day before.

[Update, August 15] Trump had informed the Archives three days earlier, on June 19, that Kash and Solomon would be added to his list of representatives.

As it happens, June 22 is also the same day that the FBI sent a subpoena to Mar-a-Lago for surveillance footage.

On June 22, the Trump Organization, the name for Mr. Trump’s family business, received a subpoena for surveillance footage from cameras at Mar-a-Lago. That footage was turned over, according to an official.

According to a John Solomon column that was actually the first to report details of this purported cooperation in June, the subpoena specifically asked for surveillance videos covering the room where Trump had stashed his stolen documents.

Around the same time, the Trump Organization, which owns Mar-a-Lago, received a request for surveillance video footage covering the locker and volunteered the footage to federal authorities, sources disclosed.

On June 24, two days after DOJ sent a subpoena for the surveillance footage, Betsy Woodruff Swan reported that it wasn’t just Kash who had been given privileged access to Trump’s Archives. Solomon had also been made Trump’s representative at the Archives.

That seeming coincidence — that the FBI formally asked for surveillance videos showing who had accessed Trump’s stash of stolen records on the same day that Kash and Solomon were officially added to the list of those who represented Trump’s interests with the Archives — may raise the stakes of Trump’s legal exposure significantly.

That’s because if Trump deliberately allowed people not permitted access to classified documents or his negligence allowed people to remove such documents, it would trigger other parts of the Espionage Act than the one that prohibits someone from stealing classified documents and refusing to give them back (and all are covered by the warrant).

(d)Whoever, lawfully having possession of, access to, control over, or being entrusted with any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, or note relating to the national defense, or information relating to the national defense which information the possessor has reason to believe could be used to the injury of the United States or to the advantage of any foreign nation, willfully communicates, delivers, transmits or causes to be communicated, delivered, or transmitted or attempts to communicate, deliver, transmit or cause to be communicated, delivered or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it on demand to the officer or employee of the United States entitled to receive it; or

[snip]

(f)Whoever, being entrusted with or having lawful possession or control of any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, note, or information, relating to the national defense, (1) through gross negligence permits the same to be removed from its proper place of custody or delivered to anyone in violation of his trust, or to be lost, stolen, abstracted, or destroyed, or (2) having knowledge that the same has been illegally removed from its proper place of custody or delivered to anyone in violation of its trust, or lost, or stolen, abstracted, or destroyed, and fails to make prompt report of such loss, theft, abstraction, or destruction to his superior officer—
Shall be fined under this title or imprisoned not more than ten years, or both.

Neither of these men would have been authorized to access classified documents, if they did, after January 20, 2021.

Solomon, of course, has come under scrutiny for his role as a mouthpiece for Russian-backed attacks on Joe Biden. While DOJ was not known to have obtained a warrant on him by April 2021, much could have happened after that.

Kash Patel did have the top levels of clearance until Trump left office. But at least by April 2021, Kash was reported to be under investigation for leaking classified information.

Patel repeatedly pressed intelligence agencies to release secrets that, in his view, showed that the president was being persecuted unfairly by critics. Ironically, he is now facing Justice Department investigation for possible improper disclosure of classified information, according to two knowledgeable sources who requested anonymity because of the sensitivity of the probe. The sources said the investigation resulted from a complaint made this year by an intelligence agency, but wouldn’t provide additional details.

Once that investigation was predicated, Kash would have been stripped of clearance, if he hadn’t already been.

Which means both the men that Trump picked to dig through his documents would pose grave security concerns.

And Kash, at least, is the single witness claiming — belatedly, starting in May — that Trump declassified this information. Before much of this became public, Kash claimed Trump had declassified it all, but just not marked it as declassified.

“Trump declassified whole sets of materials in anticipation of leaving government that he thought the American public should have the right to read themselves,” Patel told Breitbart News in a phone interview.

“The White House counsel failed to generate the paperwork to change the classification markings, but that doesn’t mean the information wasn’t declassified,” Patel said. “I was there with President Trump when he said ‘We are declassifying this information.’”

“This story is just another disinformation campaign designed to break the public trust in a president that lived on transparency. It’s yet another way to attack Trump and say he took classified information when he did not,” he added.

At the point he made those claims, in May, Kash demonstrated extensive familiarity with the content of that first batch of stolen classified documents that had been stashed at Mar-a-Lago for a year.

Patel did not want to get into what the specific documents were, predicting claims from the left that he was disclosing “classified” material, but said, “It’s information that Trump felt spoke to matters regarding everything from Russiagate to the Ukraine impeachment fiasco to major national security matters of great public importance — anything the president felt the American people had a right to know is in there and more.”

If Kash knows that first-hand — if Kash knows that because Trump let him wade through Top Secret documents he was no longer cleared to access — then Trump may have additional criminal liability.

Update: After a week of bullshit excuses, Trump — via John Solomon — is now offering a new bullshit excuse: That Trump had a standing order that everything he back to the residence in the White House was declassified. The claim is mostly interesting because Solomon — who wasn’t even at the White House! — is feeding it up.

Update: Added link to June 19 request.

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

It’s that time that comes in many high profile investigations where it becomes prudent to remind readers — and journalists! — that the word “cooperate,” even the word “inform,” may not mean what sources want you think it does.

Correction: It’s long past the time to remind journalists that investigative subjects will boast to the press about “cooperating,” when their lawyers really mean, “complying” with the most basic requirements of legal process. When Ali Alexander ran to the press revealing he had received a subpoena (revealing a subpoena is something investigators generally consider uncooperative), most outlets repeated his claim to have “agreed to cooperate” with DOJ. What Alexander described instead was “compliance,” not cooperation.

Nevertheless, some really experienced legal beat reporters used the words often reserved for someone who has entered into a cooperation agreement to describe Alexander’s compliance and they did so in articles probably pitched as a way to share details revealed in a subpoena with other suspects in an investigation.

The latest messaging strategy from Trump demonstrates why the subject of an investigation might do this. This detailed WSJ report is based on Trump sources reading the content of letters sent between Trump lawyer Evan Corcoran and counterintelligence head Jay Bratt in June.

Aides to Mr. Trump have said they had been cooperating with the department to get the matter settled. The former president even popped into the June 3 meeting at Mar-a-Lago, shaking hands. “I appreciate the job you’re doing,” he said, according to a person familiar with the exchange. “Anything you need, let us know.”

Five days later, Trump attorney Evan Corcoran received an email from Mr. Bratt, the chief of the Justice Department’s counterintelligence and export control section, who oversees investigations involving classified information.

“We ask that the room at Mar-a-Lago where the documents had been stored be secured and that all the boxes that were moved from the White House to Mar-a-Lago (along with any other items in that room) be preserved in that room in their current condition until further notice,” according to what was read to the Journal over the phone.

Mr. Corcoran wrote back, “Jay, thank you. I write to acknowledge receipt of this letter. With best regards, Evan.” By the next day, according to a person familiar with the events, a larger lock was placed on the door. It was the last communication between the men until Monday’s search of Mar-a-Lago, according to the person.

On June 22, the Trump Organization, the name for Mr. Trump’s family business, received a subpoena for surveillance footage from cameras at Mar-a-Lago. That footage was turned over, according to an official. [my emphasis]

Side note: The nice thing about Trump sharing a lawyer, Corcoran, with Steve Bannon is that we can evaluate Corcoran’s credibility based off stunts he pulled in Bannon’s case — which is a good reason to expect his representation of these events is not entirely forthcoming, especially when made without the ethical obligations stemming from making them as an officer of the court.

So this exchange, which doesn’t rule out further contact with Mar-A-Lago and which likely misrepresents Trump’s conviviality at having the head of DOJ’s espionage prosecutors waltzing into his golf resort, is designed to present the illusion of full “cooperation.”

And Trump’s spox uses that portrayal, later in the story, to claim that a search — the spox calls it a “raid” — was unnecessary. Trump had been so cooperative, the WSJ relays Trump camp claims, that his unreliable lawyer was even engaged in “breezy chats” with the head of the department that prosecutes spies.

“Monday’s brazen raid was not just unprecedented, it was completely unnecessary,” Trump spokesman Taylor Budowich said. “President Trump and his representatives have gone to painstaking lengths in communicating and cooperating with all the appropriate agencies.”

WSJ doesn’t hide that this story is the one they’re being pitched.

A timeline of events, they say, demonstrates this cooperation, down to quickly fulfilling the June request to place a new lock on the storage door.

But it also doesn’t consider why putting a lock on a room full of suspected stolen documents amounts to cooperation.

More importantly, WSJ admits it doesn’t have the one detail that would test whether this fairy tale of cooperation were true or not: the warrant showing which crimes were being investigated, as well as the warrant return showing whether the government had obtained evidence that confirmed the suspicions they used to obtain probable cause.

The warrant, signed by a judge in Palm Beach County, refers to the Presidential Records Act and possible violation of law over handling of classified information, according to Christina Bobb, a lawyer for the former president. The warrant hasn’t been made public by Mr. Trump nor has the inventory of documents retrieved by the government.

The warrant Trump’s lawyers received doesn’t refer to “possible violation of law over handling classified information,” it refers to a law, possibly even the Espionage Act. Simply sharing that warrant and return would tell us far more about whether Trump was as cooperative as his unreliable lawyer — who made virtually identical claims about his contemptuous client Steve Bannon’s “cooperation” — now wants to claim about Trump.

There is a significant legal reason why Trump’s lawyers would like to claim he was cooperative, aside from ginning up threats against judges from Trump’s mob. As I laid out here, “fail[ing] to deliver [National Defense Information] to an officer or employee of the United States entitled to receive it,” is a key element of 18 USC 793e. So in addition to stoking violence, it’s possible that Trump is already attempting to set up a defense for trial, that he simply had not yet complied with DOJ and NARA requests to give back the stolen documents, but surely would have if they just asked nicely one more time. This is, in fact, precisely the argument Corcoran made for Bannon at trial: he would have cooperated if only Bennie Thompson would have accepted a last minute offer to cooperate.

Anyway, given abundant precedent, it’s probably too late. If you’re storing stolen classified information in your basement, with or without a substantial padlock, you’ve committed the crime of unauthorized retention of NDI.

The issue of cooperation extends beyond Evan Corcoran’s dubious (and provably false, in Bannon’s case) claims of cooperation, though.

WSJ seems to match far more inflammatory reporting from William Arkin in Newsweek, that someone told DOJ that Trump still had classified documents at Mar-a-Lago.

In the following weeks, however, someone familiar with the stored papers told investigators there may be still more classified documents at the private club after the National Archives retrieved 15 boxes earlier in the year, people familiar with the matter said. And Justice Department officials had doubts that the Trump team was being truthful regarding what material remained at the property, one person said. Newsweek earlier reported on the source of the FBI’s information.

Arkin is a well-sourced reporter (though not a DOJ reporter), but Newsweek is no longer a credible outlet. And in Arkin’s story — which seems like it was meant to be a comment primarily on the political blowback from the search — a headline Arkin probably didn’t write calls this person “an informer” (notably, language Arkin likely did have some say over also called it a raid, which credible DOJ sources would never do).

Exclusive: An Informer Told the FBI What Docs Trump Was Hiding, and Where

The raid on Mar-a-Lago was based largely on information from an FBI confidential human source, one who was able to identify what classified documents former President Trump was still hiding and even the location of those documents, two senior government officials told Newsweek.

There are other parts of this story that raised real credibility questions for me and for multiple counterintelligence experts I spoke with about. For example, it describes a 30-year veteran of the FBI, now a senior DOJ official, sharing grand jury information. Because Special Agents retire after 25 years, there are a very small number of 30-year FBI veterans running around, and describing the person as a senior DOJ official to boot would pinpoint the source even further. If this person really had knowledge of grand jury proceedings, it would be child’s play to charge them based on this story for violating laws prohibiting such things. Plus, the person doesn’t even describe what happens in a grand jury accurately, suggesting that the grand jury had “concluded” the law was broken (in which case there would be an indictment).

Moreover, the story relies on public reporting, based off Trump’s lawyer’s own claim, for its evidence that DOJ knew precisely where to look.

According to news reports, some 10-15 boxes of documents were removed from the premises. Donald Trump said in a statement that the FBI opened his personal safe as part of their search. Trump attorney Lindsey Halligan, who was present during the multi-hour search, says that the FBI targeted three rooms—a bedroom, an office and a storage room. That suggests that the FBI knew specifically where to look.

That claim is fundamentally incompatible with the earlier report that an “informer” had told FBI precisely where to look.

More importantly, it wouldn’t take an informant — a confidential human source infiltrated into the Trump camp — to obtain this kind of information.

Cassidy Hutchinson, who helped Trump move to Mar-a-Lago, reportedly “cooperated” (that word again!) with DOJ after her blockbuster testimony before the January 6 Committee. She worked at Mar-a-Lago and unlike others who moved with Trump to Florida, had the clearance to handle these documents. Her attorney, former Assistant Attorney General Jody Hunt, knows firsthand about Trump’s attempts to suppress sensitive classified information from his attempts to kill the Russian investigation. So if Hutchinson had information that would be useful to this investigation (including details about where Trump stored what at Mar-a-Lago), DOJ likely has it.

Similarly, of the seven people whom Trump named to represent his interests with the Archives, three — Pat Cipollone, Pat Philbin, and Steve Engel — have been willing to testify with varying degrees of resistance before the January 6 Committee. Engel would have likewise been asked to cooperate on any DOJ investigation of Jeffrey Clark, but he didn’t share details of that with the press. The two Pats both recently received subpoenas in DOJ’s January 6 probe (which they did share with the press). And Pat Philbin is likely the lawyer described in earlier reports who attempted, but failed, to negotiate transfer of Trump’s stolen documents to the Archives.

Longtime Archives lawyer Gary Stern first reached out to a person from the White House counsel’s office who had been designated as the President Records Act point of contact about the record-keeping issue, hoping to locate the missing items and initiate their swift transfer back to NARA, said multiple sources familiar with the matter. The person had served as one of Trump’s impeachment defense attorneys months earlier and, as deputy counsel, was among the White House officials typically involved in ensuring records were properly preserved during the transfer of power and Trump’s departure from office.

But after an extended back and forth over several months and after multiple steps taken by Trump’s team to resolve the issue, Stern sought the intervention of another Trump attorney last fall as his frustration mounted over the pace of the document turnover.

If Philbin was the person who tried but failed to resolve the Archives’ concerns, he is a direct, material witness to the issue of whether Trump had willfully withheld classified documents the Archives was asking for, something the Archives would have made clear in its referral to DOJ. And because of the way the Espionage statute is written (note the Newsweek article, if accurate, mentions National Defense Information, language specific to the Espionage Act), Philbin would have personal legal exposure if he did not fully disclose information about Trump continuing to hoard stolen classified documents. Plus, Philbin has been involved in national security law since the 00s, and probably would like to retain his clearance to represent clients in national security cases.

All of which is to say that DOJ has easily identifiable people who are known to be somewhat willing to testify against Donald Trump and who are known to have specific knowledge about the documents he stole. If either Hutchinson or Philbin (or both!) answered FBI questions about Trump’s document theft, they would not be “informants.” They would be witnesses. Just like they’re both witnesses to some of Trump’s other suspected crimes.

Nor does that make them “cooperators” in the stricter sense — people who’ve entered into plea agreements to work off their own criminal liability.

As remarkable as six years of Trumpism has made it seem, sometimes law-abiding citizens answer FBI questions without the tantrums that Corcoran seems to tolerate from his clients.

Indeed, if the crime that FBI is investigating really is as serious as the Espionage Act, far more witnesses may see the wisdom of sharing their information with the FBI.

Update: Propagandist John Solomon offers a version of the same story as WSJ, though in his telling, DOJ also subpoenaed Trump in June, specifically asking for documents with classified markings, including those involving correspondence with foreign officials.

The subpoena requested any remaining documents Trump possessed with any classification markings, even if they involved photos of foreign leaders, correspondence or mementos from his presidency.

This is the kind of detail that the lawyers who negotiated initial efforts to retrieve stolen documents would know about. If Philbin, for example, knows that Trump had tried to hold onto his love letters with Mohammed bin Salman and Vladimir Putin, but Trump still didn’t provide them in response to a subpoena, then there’d be a clearcut case of withholding classified documents.

Update: CNN has matched Solomon’s report.

Trump and his lawyers have sought to present their interactions with Justice Department prosecutors as cooperative, and that the search came as a shock. The subpoena was first reported by Just the News.

In response to questions about the grand jury subpoena, Trump spokesman Taylor Budowich said in a statement to CNN: “Monday’s unprecedented and absolutely unnecessary raid of President Trump’s home was only the latest and most egregious action of hostility by the Biden Administration, whose Justice Department has been weaponized to harass President Trump, his supporters and his staff.”

But CNN’s version suggests that Trump’s lawyers showed the head of the espionage division of DOJ classified documents, but only agreed to hand over those that were Top Secret or higher.

During the meeting, Trump’s attorneys showed the investigators documents — some of them had markings indicating they were classified. The agents were given custody of the documents that were marked top secret or higher, according to a person familiar with the matter.

That suggests even after turning over 15 boxes of documents, Trump still had highly classified documents lying around the basement of a building riddled with counterintelligence concerns. And when the head of the espionage department came to collect classified documents, Trump withheld less classified ones.

Of course they had probable cause there were classified documents still at Mar-a-Lago. Trump’s lawyers told DOJ there were.

The Likely Content of a Trump Search Affidavit

Even Trump supporters are beginning to call on him to release the warrant used to search Mar-a-Lago Monday. In spite of serving as a source for multiple outlets yesterday, the lawyer who received the warrant, Christina Bobb, has refused to turn it over.

She’s probably refusing for several reasons. First, it’s likely that 18 USC 793 is among the suspected crimes cited on the warrant. If Trump admitted he’s under investigation for part of the Espionage Act, his supporters might be less likely to prepare for civil war, as they currently are doing. Plus, given the inconsistent numbers of boxes seized in Bobb-sourced stories (the WSJ reported at least 10 boxes were seized, Politico and WaPo reported that 12 were), it suggests the search warrant return is far more detailed than just listing boxes of stolen documents, but instead lists individual documents.

If the return looked something like, [and to be clear, this is strictly hypothetical, and my “yaddayadda” is a fake compartment name] …

  1. Single existing copy of transcript of phone call between President Donald Trump and Ukrainian President Volodymyr Zelenskyy, July 25, 2019, TS/SCI/SAR-YADDAYADDA/NF
  2. Single existing copy of hand-written notes of meeting between President Donald Trump and Russian President Vladimir Putin, July 16, 2018, TS/SCI/SAR-YADDAYADDA/NF
  3. Transcript of NSA intercept of Saudi intelligence official in advance of Turkey operation involving Jamal Khashoggi, September 29, 2018, TS/SCI/SAR-YADDAYADDA/NF
  4. NSA targeting list for Russia, dated January 15, 2021, TS/SCI/SAR-YADDAYADDA/NF (see this post)

…Then the gravity of Trump’s crime would become immediately apparent.

Plus, Bobb didn’t receive the most interesting part of it, the affidavit the FBI used to obtain the search warrant.

So I wanted to write up what an affidavit would likely include, based on the public understanding of the investigation.

For comparison, here are the warrants for Reality Winner and Josh Schulte, both of which were also, at least in part, warrants for a 793 investigation. Here are warrants to search Roger Stone and Oath Keeper Jeremy Brown’s houses, both Federal searches in Florida related to investigations conducted in DC (the search of Brown’s house even found allegedly classified documents, albeit only at the Secret level). Here’s the warrant Robert Mueller’s team used to get Michael Cohen’s Trump Organization emails from Microsoft.

Cover Page

The cover page would include the address to be searched, 1100 S. Ocean Blvd, Palm Beach, FL. It would name the magistrate docket for the warrant, 9:22-mj-08332, references to Attachment A describing the premises to be searched, and Attachment B, the description of things to search for, as well as the Affidavit.

It would have checkboxes checked, listing that the search was for evidence of a crime and to retrieve contraband.

It would list the crimes under investigation — according to public reports, probably 40 USC 2201-2209, 18 USC 2071, and 18 USC 793.

It would be dated and signed by Magistrate Judge Bruce Reinhart.

Attachment A

Attachment A would include a description of Mar-a-Lago, probably with a nifty picture of the garish resort, possibly also pictures of the basement storage area that investigators saw in their June visit. It would likely mention Trump’s hotel safe in the bridal suite.

Attachment B

Attachment B would authorize seizure of all documents relating to violations of the statutes in question, so probably 40 USC 2201 and 18 USC 793, with bullet points stemming from what is covered under the PRA and what is covered — defense information — under the Espionage Act.

No computer files were described to have been seized, so it would consistent entirely of paper seizures.

Affidavit

This would include:

  • Several paragraphs describing the affiant’s background and training
  • An assertion that the affiant believed there was probable cause for the subject offenses
  • The statutory language, basically a cut-and-paste describing the elements of the offense
  • Language about classification, including the various levels of classification
  • Language about Presidential Records
  • Language about 32 CFR sections 2001 and 2003, which cover the storage of classified information

Then there’d be a probable cause section that would include:

  • A description of who is under investigation (whether it’s just Trump, or whether his staffers are as well)
  • A reference to the Archive’s February 2022 request that DOJ investigate Trump’s document theft
  • Background on the year-long effort leading up to the Archives’ request to get Trump to return stolen documents, including the specific records the Archives identified that Trump had withheld (CNN has a timeline here)
  • Other evidence of Trump’s refusal to abide by Presidential Records Act
  • Other evidence of Trump’s failures to protect classified information (particularly if FBI knows of any instances from after he left the presidency)
  • The outcome of the investigation into Mike Ellis’ efforts to retain highly sensitive NSA documents at the White House as staffers were packing boxes
  • The Archives’ three statements on the effort to obtain the documents
  • A description of what aides told the FBI in interviews about the stolen documents in April and May
  • Testimony about efforts to keep uncleared staffers from accessing boxes that included classified information
  • A description of the May subpoena to the Archives for the classified documents stolen
  • A summary of the classified documents found in the 15 boxes turned over last year, possibly with examples of the most sensitive documents
  • Some explanation of why DOJ believes that these documents weren’t actually declassified by Trump before he stole them
  • A description of the June 3 meeting at Mar-a-Lago, which show three really key parts of the probable cause:
    • Acknowledgement from Trump lawyers that he remained in possession of stolen documents
    • A description of things the lawyers said that proved Trump was treating these as classified documents
    • A description of the storage location in the basement, including why it did not meet the standards for storage of classified documents
    • Possibly a description of documents seen on that visit that would qualify as potentially classified Presidential Records
  • A description of the letter asking Trump to better secure the documents
  • A description of the subpoena for surveillance footage from Mar-a-Lago, including anything suspicious on it
  • A list of known Presidential Records that had not yet been shared with the Archives

The affidavit would explain why the items being searched for are necessary to investigate the crime, which would explain:

  • FBI needed to obtain the documents to see if they were Presidential Records not otherwise shared with the Archives
  • FBI needed to obtain the documents to see if they were defense information
  • DOJ needed to secure the documents because they are all the property of the Archives

Finally, the affidavit would include a conclusion stating that all this amounts to probable cause that Trump was in possession of documents that were covered by the PRA, some subset of which were believed to be classified.

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

The Ranking Member of the Senate Intelligence Committee went on a four tweet rant yesterday, complaining that the FBI is conducting an investigation into the suspected large-scale theft of highly-classified materials.

The House Minority Leader used the instance of a lawfully executed warrant in support of a national security investigation to call for an investigation not into the man suspected of stealing code word documents, but instead, of Attorney General Merrick Garland for authorizing this investigation into a classified breach.

The Ranking Member of the House Intelligence Committee, Mike Turner, more appropriately asked for a briefing, but even after admitting he hadn’t had one yet and claiming (dubiously) that he didn’t know of the suspected massive theft of highly classified information, scoffed at the seriousness that such a large-scale compromise of classified information might cause.

Mitch McConnell weighed in, belatedly, to demand transparency about an investigation into stolen secrets.

The country deserves a thorough and immediate explanation of what led to the events of Monday. Attorney General Garland and the Department of Justice should already have provided answers to the American people and must do so immediately

These men are all entrusted with the protection of Americans intelligence secrets. But when faced with a choice of putting party or America’s security first, they immediately rushed to protect their party, even while admitting they don’t know the facts of the underlying investigation.

And in spite of the fact that these men have all engaged in minimizing the large-scale compromise of classified information with their rants, virtually every press outlet has reported their comments as more horse race journalism, one side against the other, as if top Republicans attacking the FBI for trying to protect classified secrets is not itself newsworthy.

The lazy-ass press couldn’t even be bothered to show how all these men, especially Marco Rubio, made wildly inconsistent statements when Jim Comey or Hillary Clinton were suspected of mishandling far less sensitive intelligence. Nor did the press bother asking these men about the destruction of DHS (including Secret Service) and DOD records that Congress itself had already asked for before magnifying their comments.

They just let these men turn this into a partisan fight rather than a serious legal investigation, all for free!

Update, 8/10PM: Included Mitch McConnell’s statement.

image_print