September 23, 2022 / by Peterr

 

Three Questions at the Start of an Intelligence Review

Why? Why? Why not?

There’s been a lot of focus on the narrow legal battles over the documents seized at Mar-a-Lago, but sometimes stepping back to look at the big picture helps bring the conflict into focus. As a legal matter and a political matter, Trump, his lawyers, and his apologists are trying to make the claim that this is just a dispute about documents, like overdue library books. The passion with which the DOJ went after them since receiving the referral from NARA last February, especially the ferocity of the legal arguments and filings over the last two weeks, demonstrates how wrong the DOJ believes that framing to be.

I agree with the DOJ.

The documents are not really what is being fought over — the battle is over the damage  (hypothetical or actual) done to our intelligence services, our national defense, and our broader foreign policy by Trump’s possession of these documents at Mar-a-Lago. The documents are the first puzzle pieces the intelligence community [IC] has to put together, to fill in the whole picture and plan a way forward.

To understand why, let’s parse out what an intelligence review might look like. What follows is not based on any insider sources at the DOJ, ODNI, or any other federal agencies, but on my own experience (long ago) with classified materials and the general experiences of others I know with deeper and more recent work in classified matters, as well as analyzing other cases where classified materials were stolen from the government and passed along to foreign governments.

An intelligence review is designed to look at three things: what got exposed, to whom, and what dangers does that pose to intelligence sources, methods, and broader foreign policy objectives? These are all backwards-looking questions, to understand how this could have happened in the first place. They also serve as the starting point for forward-looking actions, as we and our allies pivot our overt and covert foreign policy approaches in a new context. Think of Klaus Fuchs, a German-born British scientist who passed US and British nuclear secrets to the USSR in the 1940s. A backwards looking intelligence review ultimately identified him as the spy and spotted the flaws in our security procedures, and a forward looking review pivoted the US and British policy toward a world with nuclear powers who opposed each other.

In the current case, the IC review begins with three interrelated questions:

  1. Why did Trump take government documents to Mar-a-Lago in the first place?
  2. Why these documents?
  3. Why not those other documents?

The second and third questions begin to move toward an answer to the first question, so let’s start there. Broadly speaking, I see five possible answers, each of which poses different dangers.

1: Vanity

If this is the answer to that first question, we would expect to find that Trump took documents that made him look good, that pointed to actions that he believed he could claim credit for, or that simply let him feel powerful because he knows stuff very few others know. Think of these as Extreme Presidential Souvenirs. These would be documents that shout to the world, “Look at how great Trump is . . .”

Danger: Simply having documents like this in his possession would likely not be enough for Trump’s ego. Trump’s ego would demand that he show them to others, so that they would know how great Trump is. The level and kind of danger depends on who the “others” are, and who they might have spoken to about what Trump showed them.

2: Fear

In this scenario, the IC review would see that Trump took documents that would help cover up his failures and/or possible crimes, such as a full transcript of the “Perfect Phone Call” with Zelenskyy. These would be documents that whisper in Trump’s ear, “This could get you into trouble. You better hide this . . .”

Danger: These are the documents least likely to be shared by Trump, so in that respect they are safe. On the other hand, they become prime material for blackmail if unfriendly parties realize he has them. Trump’s nightmare is getting a phone call about these documents, threatening to expose the documents to the “wrong” people. “I’d like you to do me a favor, though . . .”

3: Greed

Given Trump’s proclivity to monetize anything he can for his own personal gain, it is hard to imagine that Trump would not be looking at anything that crossed his desk to see how he might make money on it. (“Hmmm . . . I’m doing some traveling? OK, which of my properties are closest, and how much can I charge the Secret Service for staying there?”) Documents that showed him something that would let him make money would be particularly tempting to Trump. Think of this as corporate espionage, or a twisted form of insider trading. Perhaps he received knowledge of foreign government’s as yet unannounced plans to develop certain properties overseas, and figured he could jump in, buy the property first, and then get bought out for a profit. Or maybe he would buy the property next to the future development and cash in when the government project became public and went forward, driving up the value of what he purchased. Perhaps these were not projects led by foreign governments, but by US corporations acting abroad whose plans were picked up as part of a signals intelligence surveillance program aimed at less-than-friendly nations. Documents like this would be calling out to his wallet, telling him “Hey, you can really use this . . .”

Danger: Suppose Trump acts on this information in some way, and the foreign government in question starts wondering “Did Trump merely get lucky in choosing to invest right where our project was going in, or did US spies give him the information?” Questions like that might lead to the exposure of human assets (sources) and signals intelligence capabilities (methods), which in turn could lead to those sources being shut down/arrested/killed, those signals intelligence methods being countered, or either the sources or methods being turned and used to feed false information to the US.

4: Corruption

As bad as #3 is, this scenario is the IC nightmare: Trump took documents that he knows other foreign governments, perhaps some of our greatest enemies, would love to have, and then deliberately passed them along to those governments. It might be to get revenge on Biden and the Dems for beating him in 2020. It might be to sabotage the work of the current administration and cause great public political problems for the Dems, to enable his return to the White House in 2024. It might be that some foreign adversary has compromising information about Trump or holds a private loan to Trump, his family, or his Trump Organization, and that country demanded classified information from Trump in exchange for not revealing the compromising information they hold or for not calling in the loan he could not immediately repay.

Danger: Beyond the damage done to sources, methods, and US foreign policy objectives created by disclosing the classified information in these documents, this scenario is worse. It weakens our relationships with our allies and harms our position in the world, simply by indicating we can’t keep secrets and by making us weaker through whatever is revealed. Should Trump have provided classified intelligence deliberately, it only gives those folks more leverage over Trump, which they would use to push for more information and more favors. Once you’ve turned over classified information to a hostile power, those folks own you forever. “Nice resort you’ve got here. It’d be a shame if anything were to happen to it.”

And it is not beyond the realm of possibility that foreign governments might lean on Trump to use his family to further their goals. “You need to have Jared talk to his friends in the Middle East, and convince them to . . . “

5: Some/all of the above

Trump might have taken some documents to feed his ego, others to hide them, and still others to try to monetize their contents. He might have taken some for his own reasons, and others because he was pressured to do so by hostile powers. The permutations are . . . troubling.

Danger: some/all of the above.

HOW BAD IS ALL THIS? DON’T ANSWER YET . . .

On top of these five possible explanations of Trump’s motives, one other thing is absolutely certain. Documents like those that were seized by the DOJ would have been catnip for the intelligence agencies of other nations. Once word got out that Trump had taken highly classified documents out of the WH (or once folks even suspected he had done so), all manner of foreign spies no doubt became very interested in Mar-a-Lago – much more than they had been during the Trump administration itself. It’s hard as hell to get into the WH and take classified materials, or to plant electronic surveillance devices inside the WH. Mar-a-Lago, on the other hand, is a relative sieve, especially after Trump left office and the security around Trump was much more directed to protecting his person rather than protecting all the stuff around a sitting president. At Mar-a-Lago these days, you pay your membership fee, and walk right in for a grand tour. Whatever the reason Trump chose to take these documents, even if he simply wanted to hold onto them as presidential souvenirs and he does nothing with them otherwise, should foreign agents copy them or steal them from Mar-a-Lago, that’s almost as bad it as it gets for the US.

Danger: Exposing whatever classified information to the prying eyes of our adversaries not only exposes sources and methods of our intelligence services, but provides our adversaries with insight into our strengths and weaknesses, depending on what the intelligence said. It also opens Trump to blackmail, as noted above in scenarios #2 and 4. “Well look what we found at your home. It sure would be terrible if the FBI were to discover that you were so sloppy with security that we were able to waltz right in and take them.”

To sort out the likelihood of each of these scenarios and the specific dangers posed, those conducting the IC review will do a couple of things. First, the leaders of the intelligence agencies are likely going back to the original creators of these documents, to tell them they were found in unsecured locations at Mar-a-Lago, and therefore (a) the creators need to assess what the specific danger would be if this particular document were to be exposed, and (b) the creators should look around to see if they have any signs that these documents had been shared already. The former is to measure the hypothetical damage, while the latter is to assess the likelihood that this is not hypothetical. Did spies suddenly go quiet, or did the quality of their information suddenly become different? Did satellites that used to provide good, regular photos of intelligence targets begin to provide much less good intelligence? All the while, the IC reviewers know that this is likely even worse.

EVEN WORSE? HOW CAN THIS BE EVEN WORSE?

If any of this information came to the US IC through our partnerships with other friendly nations (like Five Eyes or NATO), that means going to the intelligence folks in those countries who trusted us with their secrets and telling them that their trust was misplaced, at least while Trump was in office. They are the folks who need to assess the danger that exposure of this information would create, and who would have to see if there were signs that this information had already been shared. Of course we would promise to do whatever we could to assist them in that analysis, but that’s like telling a shopkeeper that you will help sweep up the shards of all the broken crystal after your kid threw a bowling ball into the display case.

Danger: It’s bad enough if our secrets get exposed, but if we let their secrets get exposed, that’s going to make them less likely to trust us in the future. As I said before, this is why having career diplomat William Burns as head of the CIA was a stroke of genius by Biden, and why Burns and the rest of the IC is no doubt bending over backwards to help Garland get this right, and bending farther over backwards to help our allies get this fixed.

SO HOW MIGHT THIS REVIEW WORK?

This is why the analysis of what was taken and trying to determine Trump’s motive(s) is the starting place. It leads to other critical questions like these:

  • What does Trump’s selection of documents — classified and unclassified — tell us about what is going on?
  • Were the documents tucked away by Trump over a long period of time, or did they all get tucked away in a specific, relatively short time period?
  • And what else was tucked in the drawers, file folders, and boxes next to these classified documents? Are there notes or letters that appear to have been written based on the content of the classified materials?

Depending on what this initial analysis reveals, the reviewers will begin to talk to the counterintelligence people in their agencies, especially if there is some concentration of subject matters or particular time frames involved.

  • Have you noticed any unusual behavior in known foreign agents around those time frames?
  • Was there any unusual signals traffic between foreign agents here and their bosses back home?
  • Were there any new agents who arrived here, who have a particular focus to their work that meshes with the subject matters of the documents Trump took? What actions have they taken?

To dig into all this, the analysts will be looking at other information and also be in contact with the folks in the field who are managing the human sources or electronic surveillance methods, to see what insights they might have. They know that decisions will need to be made about protecting or extracting sources who might be in danger, shutting down electronic surveillance already in place (pull out/relocate bugs and cameras if possible, re-direct satellite orbits, change communications frequencies, reprogramming software, etc.), and otherwise working to replace these sources and methods in some way to avoid further exposure. They hope to restore secrecy to the people and programs, and restore quality to the intelligence that might have been harmed through exposure.

While all this covert review work is going on, the FBI will no doubt be doing an ordinary shoe-leather investigation into the folks who have been going in and out of Mar-a-Lago over the last 18 months after the security of the resort was scaled back to simply protect the former president. They will be looking at guests and staff alike, trying to see what can be learned from videos, logs of visits, work schedules, and in some cases interviews. They will be looking at the White House document handling, especially after December 18, 2020 when the head of the White House Office of the Staff Secretary resigned and no one was named to take his place — even in an acting capacity — until January 20, 2021. They will be doing deeper domestic investigations of any new foreign agents that were identifies by the IC analysts.

And then there’s the investigation that NARA is probably already trying to complete: what other documents from the Trump White House were not turned over?

This is all very time consuming and expensive. You don’t want to do this if it isn’t necessary, but you absolutely have to do it if these sources and methods are likely to have been (or actually were) blown. Only when the Why?, Why?, and Why not? questions have been answered can the forward looking work really begin in earnest.

There’s a lot more that can be inferred about what an intelligence review would contain, but one thing is certain. The panel of judges from the 11th Circuit Court of Appeals and Special Master Raymond Dearie are focused on what Judge Cannon does not want to recognize: this is not a case about misfiled documents, but a national security case in which documents hold the key to assessing the dangers posed and actual damage done to our nation, so that the current government can begin to address it.

Copyright © 2022 emptywheel. All rights reserved.
Originally Posted @ https://www.emptywheel.net/2022/09/23/three-questions-at-the-start-of-an-intelligence-review/