In the Durham Report’s telling of the FBI investigation into the Alfa Bank anomalies, it describes that the two cyber agents who conducted the first technical review of the allegations, Scott Hellman (Cyber Agent-1) and Nate Batty (Cyber Agent-2, the guy who appears to have misplaced the Blue Thumb Drive with all the data), congratulated themselves on the fact that they had both come to the same conclusion in spite of “their own very different political views.”

Cyber Agent-1 testified that both he and Cyber Agent-2 did not agree with the conclusion in the white paper and assessed that (i) the authors of the white paper ‘jumped to some conclusions that were not supported by the technical data,” (ii) the methodology was questionable, and (iii) the conclusions drawn did not “ring true at all.” 1479 In interviews with the Office, both Cyber Agent-1 and Cyber Agent-2 said that they were proud of their work because they had both come to the same conclusion despite their own very different political views. [my emphasis]

The interviews at which these men told this story are not cited (elsewhere in this passage, Durham relies on Hellman’s trial testimony rather than any of his interviews for the report, though according to trial testimony, he interviewed with Durham six times).

It’s an odd measure of investigative rigor, particularly in a report complaining that other FBI agents let bias infect their work.

It’s also a good place to start to describe the multiple layers of deceit in which Durham engages to avoid admitting that Batty and Hellman steered him wrong.

• Durham adopted his “fabrication” theory from Hellman and Batty
• The “fabrication” theory came with an understanding the DNC was involved
• Hellman and Batty made materially contradictory comments about politics
• Durham covered up Cyber’s clear errors
• Durham’s made post-indictment efforts to sustain his false claims (this will be a follow-up because this got too long)

Durham adopted his “fabrication” theory from Hellman and Batty

As noted, Durham cites Hellman’s trial testimony, rather than those interviews he doesn’t cite, for his description of what Hellman and Batty concluded. At trial, immediately after the exchange cited, Durham lead prosecutor Andrew DeFilippis had Hellman walk through the written summary the two cyber guys wrote.

DeFilippis used that document to improperly cue Hellman, who was not qualified as an expert — someone who had, minutes earlier, admitted he knew only the basics of DNS — to express his opinion about the white paper, which I laid out here. Coming as it did after weeks of wrangling over Durham’s belated attempt to spring a different expert on Sussmann, the stunt unsurprisingly drew an objection.

But DeFilippis wasn’t working with the full summary. A redaction in the Hellman-Batty summary DeFilippis introduced as part of this exchange hid part of Hellman and Batty’s immediate response to the white paper. But a different version of the same document (introduced by the defense), reveals more about their initial conclusion to the anomalies: The otherwise redacted information reveals that Hellman and Batty floated the possibility that the researchers had fabricated the data by spoofing it themselves.

In conclusion, ECOU 1 suggests there is currently no cyber intrusion component in this case and that the report provided contains questionable methods and intentions. Based on the information provided, it also remains a possibility that the report was fabricated. If the domain maill.trump-email.com were discovered by researchers, a computer at Alfa Bank could be configured to conduct multiple DNS inquiries to create the appearance that a Russian bank is communicating exclusively with the domain maill.trump-email.com. Furthermore, it appears suspicious that the presumed suspicious activity began approximately three weeks prior to the stated start of the investigation conducted by the researcher. [emphasis, which marks otherwise redacted language, my own]

Hellman didn’t just share this opinion in the summary, which was sent out to others no later than September 21 at 4;46PMET (some of these time zones are in CDT, so an hour behind). It was the primary conclusion they shared with the Chicago-based agents conducting the actual investigation. As Curtis Heide’s Lync notes show (these are probably UTC, so morning ET), 8 minutes after Heide made a second request for the thumb drives, Batty and Hellman asked Heide to get on the phone. They spoke for five minutes, after which Heide texted Pientka to tell him that “we’re leaning towards this being a fake server not attributed to the trump organization.”

While Hellman was on the phone with Heide, Batty was texting Heide’s boss, Dan Wierzbicki, that, “we think it’s a setup. it smells like a setup.” Minutes after these two exchanges another Cyber guy shared with Joe Pientka Phil Todd’s opinion, described below, that this was a DNC set-up timed for the debate.

In other words, the premature Hellman and Batty opinion that this was a set-up tainted everything that followed in the investigation. And they shared it before anyone else looked at the evidence.

Notably, this opinion led the FBI to take overt acts during a pre-election period that prevented the FBI from conducting a robust investigation afterwards. At 4:22PM ET that same day, Alison Sands wrote from Chicago to New York explaining that this probably wasn’t actually a Trump domain. At 4:53PM ET, Sands wrote back to correct that: Miami FBI agents had taken overt investigative steps during an election season (though they used a ruse as to why they were asking), and learned that it was a legitimate email server. At 1:53PM the next day, Sands wrote back to note that Cendyn had responded to FBI’s overt investigative steps by updating their DNS tables, tainting the investigation and public reporting on it irreparably.

More importantly, the opinion Hellman and Batty formed — that this was a setup — influenced more than the initial investigation. It’s the entire organizing logic of the September 16, 2021 indictment against Michael Sussmann. Durham accused Sussmann of packaging all this up in a “narrative” fed by “purported” data provided by April Lorenzen, whom he called “Originator-1,” and then sharing it with the FBI. That’s why Durham needed it to be the case that Sussmann intentionally hid a tie to the DNC.

And because Durham adopted that hasty Hellman and Batty theory as his own, to the extent that Hellman and Batty made grave errors, Durham had to (and has to) cover those errors up.

The “fabrication” theory came with an understanding the DNC was involved

And that means covering up how politics — or at least a suspicion about politics — played a part.

Durham treated Batty and Hellman’s initial conclusions as reliable, he said, because, “they had both come to the same conclusion despite their own very different political views.”

That’s remarkable because Durham includes something in his report that he chose not to introduce at trial under oath: that Nate Batty told him in 2019 that he and Hellman had considered filing a whistleblower complaint against Jim Baker because FBI’s General Counsel refused to tell them where the tip came from.

Cyber Agent-2 told the Office that he and Cyber Agent-1 considered filing a whistleblower claim about Baker’s failure to provide the information but ultimately decided that they would not because the data provided was not formal evidence in a criminal proceeding. 1492

1492 OSC Report of Interview of Cyber Agent-2 on Sept. 16, 2019 at 2.

This is likely where the whole idea of charging someone for lying to the FBI about this evidence came from.

What Durham didn’t say in his report — but what the public record strongly suggests — is that one or both of these guys were affirmatively dishonest with him about how significantly politics played into this investigation. Three pieces of evidence submitted at trial show that Batty understood this tip to have come from the DNC and one of his colleagues treated it as a set-up by the DNC.

First, there’s the Lync text showing Batty was informed that Sussmann was in the evidentiary chain even before he picked up the thumb drives on September 20 (remember, these are probably UTC).

As this post makes clear, Batty learned that Sussmann was in the chain of custody before he picked up the thumb drives from Baker. He didn’t need Baker to tell him where they came from. He already knew.

Less than a day after being told Sussmann was in the evidentiary chain, Batty wrote Hellman, saying they had been asked to write “a brief summary of what we think about the DNC report,” and then conceded maybe they should look at the actual DNS logs before writing such a summary.

Then, the next morning at 8:09AM, one of the Cyber supervisors, Phil Todd, wrote an email claiming that “the DNC person” who dropped the thumb drives off planned to release the Trump – Alfa Bank tie prior to the Presidential debate that would be on October 4.

The DNC person that provided these thumb drives stated to Baker that he/she was going to release the information concerning the Trump server, and direct contact with the Russians through Alpha Bank in Moscow, to the press on Friday, 9/23/16, prior to the upcoming Trump / Clinton debate this weekend.

Sussmann obviously didn’t tell Baker his outreach to the press was timed for the debate. It’s something the Cyber guys made up and put into writing. But it shows that people in the Cyber division didn’t just make conclusions before investigating, but did so through that political lens, precisely the political lens Durham claimed that Sussmann thwarted by allegedly lying to Jim Baker.

And while there’s no evidence Batty shared the assumed tie between the tip and the DNC with the agents in Chicago, it’s important background to the way Hellman and Batty reached out to Heide and his boss to explain, in a way that would leave no written record, why they believed this was not a real server, an opinion that Heide would cite as one of four reasons he dismissed the allegations. Batty shared that opinion before sharing the substantive materials in the white paper with the Chicago agents.

These records should have led any sane prosecutor to conclude he had no case against Sussmann. These, along with at least two more exhibits (Bill Priestap’s notes and Ryan Gaynor’s briefing notes), show that numerous people in the FBI, including one of the guys who conducted the initial technical review of the anomalies, believed the white paper had a DNC tie. And at least some people at the FBI had concluded, absent evidence, that it was a political hit job.

How could Sussmann’s alleged lie be material if the initial conclusions about the anomaly presumed Sussmann was bringing the white paper for the DNC?

Hellman and Batty made materially contradictory comments about politics

As noted, Batty’s claim, made in a 2019 interview with Durham, seems to conflict with the record showing that he was informed of Sussmann’s involvement before he first obtained the thumb drives.

All the evidence that people in Cyber knew of and considered the role of the DNC in this tip — plus the way Durham measured Batty and Hellman’s reliability based on their partisanship — makes Hellman’s testimony at trial suspect, too. Hellman claimed, under oath, that he and Batty didn’t talk about whether these allegations had political origins in advance.

Q. And you and Special Agent Batty at least talked about whether this had political origins, didn’t you?

A. At that point I think the only thing that came up was just questioning the motive of somebody providing — like, who provided this report? I don’t recall any discussion about political motivations.

Q. Who would it have helped if the allegations were true?

A. It would have helped the opposing — it would have helped the democratic party.

Q. And that didn’t occur to you at all that that motivation might have been involved?

A. No.

This is one of several reasons I find it so curious that Durham didn’t cite the actual interviews in which Hellman and Batty talked about how they responded to the white paper by invoking politics: If Sussmann’s attorneys had received 302s reflecting they had, as Brady or even Jencks in Hellman’s case, you’d think they would have followed up on Hellman’s claim that politics didn’t come up by noting that he and Batty had both told Durham differently.

Hellman also claimed, under oath, that he never saw that text mentioning the DNC screencapped above, to which he responded by writing up a report, until 2020.

Q. All right. And then, with respect to Stranahan, he asks you and Nate to write a report about the — write a summary of the DNC report. Correct? That’s what it says?

A. That’s what it says in this chat, yes.

Q. And did you understand, sir, that the information had come from a DNC, meaning Democratic National Committee, source?

A. I did not understand that, no.

Q. Did you know what Nate Batty knew about it?

A. I don’t think he knew anything about it.

Q. Did you call up Tim and say, what a second. This is a DNC report? That’s political motivation.

A. No.

Q. Didn’t do anything or it didn’t occur to you?

A. The first time I saw this was two years ago when I was being interviewed by Mr. DeFilippis, and I don’t recall ever seeing it. I never had any recollection of this information coming from the DNC. I don’t remember DNC being a part of anything that we read or discussed.

Q. Okay. When you say, the first time you saw it was two years ago when you met with Mr. DeFilippis, that’s not accurate. Right? You saw it on September 21st, 2016. Correct?

A. It’s in there. I don’t have any memory of seeing it.

Later Berkowitz returned to the text. He asked Hellman how it could be that Batty could refer to the white paper from a lawyer who represented the DNC, in a text to Hellman, as the DNC report, without Hellman becoming aware that someone — his superior — was calling it a DNC report.

Q. And although you were surprised to see it today, it appears that at least somebody, such as Mr. Batty was aware and you were aware that somebody was calling this white paper a DNC report. Correct?

A. I was not aware that anybody was calling it a DNC report, and I don’t believe Mr. Batty knew that either.

Q. But you saw the link message. Right?

A. I did see the link message, yes.

Then Berkowitz asked Hellman how it could be that he would see a reference to a DNC report and not take from that it was a DNC report. Hellman responded by describing “the only explanation that … was discussed” — was that it was a typo.

Q. What’s your explanation for it?

A. I have no recollection of seeing that link message. And there is — have absolutely no belief that either me or Agent Batty knew where that data was coming from, let alone that it was coming from DNC. The only explanation that popped or was discussed was that it could have been a typo and somebody was trying to refer to DNS instead of DNC.

Q. So you think it was a typo?

A. I don’t know.

Q. When you said the only one suggesting it — isn’t it true that it was Mr. DeFilippis that suggested to you that it might have been a typo recently?

A. That’s correct.

Q. Okay. You didn’t think that at the time. Right?

A. I did not. I had never seen it or had any memory of seeing it ever before it was put in front of me.

That is, Hellman responded by explaining that Durham’s lead prosecutor Andrew DeFilippis, rather than asking whether the Lync text refreshed Hellman’s memory that he had been already been told this was a DNC report when he conducted the analysis, rather than recognizing that the evidence actually undermined his entire case, instead scripted an alternate explanation.

Just a typo.

And then Hellman repeated that script on the stand.

Under oath.

There are no declination decisions in Durham’s Report assessing how Hellman and Batty’s statements — in the 2019 interview and under oath on the stand — can be squared with the public record. Of course there aren’t declinations! When faced with documentary evidence that his disclaimer about awareness of a DNC role was suspect, Hellman simply parroted Durham’s own team.

But the fact that Durham didn’t even consider whether there was more evidence that Batty and Hellman lied to him than that Sussmann did is a testament to the fact that any misstatements they made would upend his entire project.

At trial, when Durham was desperate to claim that the five different exhibits that showed the FBI knew this report came from a DNC lawyer didn’t mean that the FBI had treated this as a DNC report, his star witness Scott Hellman said there was no discussion of politics when he and his boss assessed this report.

But in his report itself, Durham’s proof that their analysis was sound was that both FBI agents had told him (in interviews that he doesn’t cite) that they approached the report through a lens of politics.

Durham covered up Cyber’s clear errors

The fact that a supervisor in the Cyber Division concluded that this was a Democratic hit job timed to the debate makes Durham’s silence about Batty and Hellman’s clear errors all the more problematic.

I wrote them up in this post describing Hellman’s advice to newbie agent Alison Sands that, “any chance you get to work something like this that truly has 0 repercussions if you mess it up ….take those opportunities.”

The two most problematic clear errors bookend the otherwise redacted claim that they suspected this was a set up.

As that Lync text itself above makes clear: Hellman and Batty had already made conclusions about the white paper before he opened the thumb drive with the data that — Hellman later testified — is what made the two of them more qualified to assess this report than the counterintelligence agents who would later conduct the investigation. After having made a conclusion prior to reviewing the logs, Hellman and Batty claimed that the anomaly had only been going on for three weeks before the researchers started looking at it. That was probably a misreading of one of two histographs in the white paper. But it would have easily been debunked had they reviewed just the DNS logs provided, much less the data provided on the misplaced Blue Thumb Drive itself. There’s no way you make that error after having reviewed the DNS logs. Yet they did make that error, an error Durham never mentions in his report.

And Durham knows this claim is wrong, because the expert report he cites in his own report — which examined the smaller set of two logs included on the Red Thumb Drive — notes that the researchers included logs dating from May to September.

Durham repeats in his report, without correction, an even more serious error. Durham states, truthfully, that Batty and Hellman — two of the only FBI agents who investigated anything having to do with Russia in 2016 who haven’t subsequently been disciplined for their fuck-ups — claimed that there was no allegation of hacking in the white paper.

The report’s summary stated that they had “assess[ed] there is no CyD [Cyber Division] equity in this report and that the research conducted in the report reveals some questionable investigative steps taken and conclusions drawn.” 1477 The report acknowledged that there was no allegation of hacking and so there was no reason for the Cyber Division to investigate further.

But Durham doesn’t reveal that this claim — there was no allegation of hacking in the report — was false. Rather, he adopts it as his own.

As a footnote in the white paper Sussmann shared described, one reason the researchers offered that Spectrum might not have known it had this weird occurrence on its network (which the researchers incorrectly concluded was a Tor node) was because they had been hacked.

We discovered that Spectrum Health victim of a network intrusion. Therefore, Spectrum Health may not know what has a TOR exit node on is network. Alternatively. the De Vos family may have people at Spectrum who know here is a TOR node, i.e., TOR node could have been placed there with inside help.

“Network intrusion.” That’s a hack.

Outside researchers informed the FBI of an anomaly involving an IP address known to have been hacked. And yet the cyber guys concluded not just that this white paper was shit, but also that there was no Cyber Division equity — a hack — in it, and did so in just over a day.

The researchers were wrong about Tor, but they were right about the hack. When the FBI checked the Spectrum IP in question, they found that it had been compromised.

One reason this error is so problematic — aside from it discredits everything else Hellman and Batty did — is because it came as supervisors in the Cyber Division were trying to spin off this investigation because they had concluded, with no evidence, that it was a pre-debate set-up. Hellman and Batty concluded there was no hack not because of the evidence, but because they didn’t want to do this case.

John Durham congratulates these men because a Democrat and a Republican agreed about this white paper. But he doesn’t reveal that, in addition to getting several other key technical details wrong, they failed at their one job, to determine whether there was a hack involved. So instead of revealing that they failed in their one job in his report, Durham instead repeats their false claim, “The report acknowledged that there was no allegation of hacking,” and boasts because a Democrat and Republican ended up being badly, embarrassingly wrong together.

Now, as I noted, Durham covers up some of the other problems with this investigation.

The two most important are that the FBI violated the rule prohibiting overt investigative steps during the pre-election period, and perhaps partly because of that (as well as FBI’s failure to act immediately after Sussmann provided Eric Lichtblau’s name on September 22), by the time the FBI spoke to Alfa Bank, the potential suspect in this crime drama — the potential suspect which reached out to FBI rather than vice versa — Alfa had no log files left to review.

That’s the other big error the investigative team made, which Durham also covers up. The FBI didn’t understand that Mandiant’s judgement was useless until a March 2017 interview with Mandiant. Curtis Heide described at trial that he never — never!! — actually learned that the reassurances Alfa Bank had offered were based on a claim that a bank had no log files to review.

Q. And were you aware, while you were doing the investigation, that Mandiant, when it went to talk to AlfaBank to look into these allegations, did not have any historical data, that Alfa-Bank did not provide any historical data to Mandiant? Did you know that?

A. No

Here’s how Durham covered up that embarrassing failure in his report:

Mandiant provided the FBI with its findings, which too concluded that there was no evidence to support the allegations of a secret communications channel nor any evidence of direct communications between the Alfa Bank servers and Trump Organization servers.

In his report, Durham cites only an October 2016 302, not the March 2017 one where the FBI first learned how useless the Mandiant review would have been. Again, he makes absolutely no mention that a potential suspect in this story reached out to the FBI told the FBI that a potential crime scene had been wiped of digital fingerprints and did nothing.

Durham complains about other problems with the part of the investigation conducted by the counterintelligence agents — they made an error in their opening memo, for example.

But rather than bitching and moaning about the outright errors the FBI cyber agents committed during the investigation, like he did for every other FBI agent in his report (including the counterintelligence agents on the Alfa Bank investigation), Durham simply … covered those errors up. Repeated their false claims. Perpetuated the foundational error in the Alfa Bank anomaly investigation.

Durham couldn’t treat Hellman and Batty with the same ruthless contempt as he did all the other FBI agents he interviewed. That’s because the materially inconsistent claims and outright errors they made were all foundational to Durham’s project. Durham can’t admit that Hellman and Batty were among the most suspect and incompetent of every FBI agent involved. That’s because Durham built his entire case on the conclusion they drew before they even opened the thumb drives.

And that’s important for another reason: because of the investigative steps Durham took on DNS-related issues after he indicted Sussmann on September 16, 2021, and what they say about Durham’s efforts to manufacture claims to discredit the anomalies.