As I wrote here, three top Pete Hegseth aides were ousted (most reports continue to use the passive voice) last week, purportedly in the witch hunt he started to look for the sources of various suspected leaks. Longtime Trump press aide John Ullyot also resigned or was asked to, depending on whom you believe.

That seems to have precipitated the exposure — first by NYT — that Whiskey Pete Hegseth had a second Signal chat, one he himself curated. Although the list, which dates back to before Hegseth’s confirmation, purports to convey administrative and scheduling details, Hegseth included roughly the same Houthi attack information that he shared on the Signal thread that included Jeffrey Goldberg.

That means he shared it with people who didn’t have a need to know — his brother and his lawyer, Tim Parlatore — and his spouse, who is not a DOD employee at all (even though she babysits him in important meetings).

[T]he information Mr. Hegseth shared on the Signal chat included the flight schedules for the F/A-18 Hornets targeting the Houthis in Yemen — essentially the same attack plans that he shared on a separate Signal chat the same day that mistakenly included the editor of The Atlantic.

Mr. Hegseth’s wife, Jennifer, a former Fox News producer, is not a Defense Department employee, but she has traveled with him overseas and drawn criticism for accompanying her husband to sensitive meetings with foreign leaders.

Mr. Hegseth’s brother Phil and Tim Parlatore, who continues to serve as his personal lawyer, both have jobs in the Pentagon, but it is not clear why either would need to know about upcoming military strikes aimed at the Houthis in Yemen.

[snip]

Mr. Hegseth created the separate Signal group initially as a forum for discussing routine administrative or scheduling information, two of the people familiar with the chat said. The people said Mr. Hegseth typically did not use the chat to discuss sensitive military operations and said it did not include other cabinet-level officials.

Mr. Hegseth shared information about the Yemen strikes in the “Defense | Team Huddle” chat at roughly the same time he was putting the same details in the other Signal chat group that included senior U.S. officials and The Atlantic, the people familiar with Mr. Hegseth’s chat group said.

Sharing the attack details with his spouse put him at far greater exposure of willful violation of 18 USC 793, sharing National Defense Information with someone not authorized to receive it.

Of the 13 people that AP reports were in the thread, NYT identifies the following:

1. Hegseth
2. His wife Jennifer
3. His brother Phil
4. His lawyer turned DOD employee Tim Parlatore
5. DOD spox Sean Parnell
6. Chief of Staff Joe Kasper (who reportedly is moving elsewhere)
7.  Dan Caldwell (who was also on the Goldberg list)  …
8. And Darin Selnick, the latter two of whom were ousted in Kasper’s witch hunt last week

NYT does not say that either Colin Carroll — also fired last week — or Ullyot participated in the chat, though Ullyot was a booster during his confirmation and so by definition could have.

But everyone who participated in the chat would be witness to Hegseth sharing data he insists is not classified, but which a jury could easily find to be National Defense Information because its sharing could obviously put service members at risk. In Espionage Act cases, a jury decides whether something is NDI.

NYT implies that this thread differs from the Mike Waltz one because Hegseth used his personal device, but I’m not sure there’s any confirmation that he used a DOD device for the Waltz chat, either. (John Ratcliffe used his personal device, and Tulsi implied she had in congressional testimony; Marco Rubio had two versions of the thread and so probably two different devices).

In either case, Hegseth’s thread includes a stupid mixture of public and private, and the administrative details on the thread alone, to say nothing of the Houthi attack details, would mean the Federal Records Act covers the thread. By law Hegseth has to make copies of the thread and archive it on DOD servers.

There’s increasing reason to believe that the witch hunt Hegseth initiated on March 21 led to this place — has created and is creating more risk going forward. That is, it increasingly looks like the paranoid witch hunt that Hegseth started in March may now ensnare him personally, if no other way than making those targeted willing to share secrets they were otherwise keeping about Hegseth but now have incentive to share to exonerate themselves.

Hegseth himself tied the story directly to the firings last week at an appearance at the White House today.

You know, what a big surprise that a bunch of — a few leakers get fired and suddenly a bunch of hit pieces come out from the same media that peddled the Russia hoax, won’t give back their Pulitzers…

[snip]

This is what the media does. They take anonymous sources from disgruntled former employees and then they try and slash and burn people and ruin their reputation.

But the witch hunt also intersects with the legal response to the disclosure of the original thread in important ways.

As a reminder, Kasper ordered the investigation on March 21, between the time, on March 15, that Jeffrey Goldberg concluded Mike Waltz’ Signal chat was real and so dropped off the chat, and the time, on March 24, Goldberg first disclosed it. As I laid out here, one of the stories identified among the suspected leaks — on the deployment of the USS Vinson carrier group from the East China Sea to the Red Sea — overlaps with the original Houthi thread (and so could be among the texts exchanged after Goldberg dropped off).

In any case — as this timeline makes clear — the witch hunt was in process even as two separate legal responses to the Atlantic story, an American Oversight lawsuit and an Inspector General investigation requested by both Roger Wicker and Jack Reed — kicked off.

A CIA declaration submitted in the American Oversight lawsuit, which the government has construed to apply only to the Signal chat disclosed by Goldberg, confirmed that Ratcliffe’s copy of the text thread includes none of the substantive messages but did include metadata showing there were changes to the original Signal text thread made after the first disclosures of it, on March 26 and 28. Whoever made those changes is at risk not just of violating the FRA, but also obstructing the legal processes that started after Goldberg revealed the texts.

The declarations submitted by DOD (the first, reflecting a request that Hegseth forward a copy of the chat to DOD, a second, by a more senior lawyer, noting that a search of Hegseth’s mobile device was conducted and “available Signal messages … have been preserved,” and a third, noting that the screen shots of the Signal texts were taken on March 27) have been more ambiguous. As American Oversight noted in its most recent filing,

For example, rather than specifying which messages were preserved, the Supplemental DoD Declaration vaguely references the preservation of “existing Signal application messages,” which, as shown by the Supplemental Blankenship Declaration, could be none. Suppl. Bennett Decl. ¶ 2, ECF No. 15-1.

But in any case, DOD took those screen shots on a day between changes made to the list (and the day Wicker and Reed asked DODIG to investigate), and so might reflect the first set of alterations.

CNN describes that the three men ousted last week — Dan Caldwell, Darin Selnick, and Colin Carroll — will be interviewed in the IG investigation, an investigation about which (CNN reports) Hegseth is increasingly concerned.

Hegseth has also grown increasingly concerned about the inspector general investigation, the sources said. Caldwell, Selnick and Carroll expect to be interviewed as part of that probe, the sources added.

That all three will be interviewed is of some interest: only Caldwell was known to be on the Waltz Signal list. If DOD’s IG has reason to interview the other two, it suggests they may already have more reason to be interested in Hegseth’s other use of Signal. But as the NYT noted, “Mr. Hegseth’s aides” (a term not necessarily limited to those on the Signal chats) advised him not to discuss operational details on that chat.

One person familiar with the chat said Mr. Hegseth’s aides had warned him a day or two before the Yemen strikes not to discuss such sensitive operational details in his Signal group chat, which, while encrypted, is not considered as secure as government channels typically used for discussing highly sensitive war planning and combat operations.

[snip]

Several of these staff members encouraged Mr. Hegseth to move the work-related matters in the “Defense | Team Huddle” chat to his government phone. But Mr. Hegseth never made the transition, according to some of the people familiar with the chat who spoke on condition of anonymity to discuss internal deliberations.

I don’t rule out the possibility that Hegseth fired them all to make it impossible for Acting Inspector General Steven Stebbins to subpoena the men (rather than because of the witch hunt he attributed it to). But it sounds like they’re willing to submit to voluntary interviews at this point, if for no other reason then to vindicate their innocence.

Which brings me to a point I’ve obsessed about since the beginning. The witch hunt, as laid out by Joe Kasper, was never designed to be a normal leak investigation. For those, you make a referral right away to the FBI, describing the suspected leak and providing a list of all the people known to have access to the leaked material.

Instead, this leak investigation envisioned a report for Whiskey Pete, and referrals by Kasper if he discovered leakers he wanted to face further investigation.

This investigation will commence immediately and culminate in a report to the Secretary of Defense. The report will include a complete record of unauthorized disclosures within the Department of Defense and recommendations to improve such efforts. I expect to be informed immediately if this effort results in information identifying a party responsible for an unauthorized disclosure, and that such information will be referred to the appropriate criminal law enforcement entity for criminal prosecution

A paragraph added to CNN’s story (along with an April 4 story about which Hegseth was worried, one which could show up in Hegseth’s personal Signal list) describes that Hegseth “demanded” the FBI get involved but some of his aides dissuaded him because of the IG investigation.

Following the press reports — including one in The New York Times about the questionable success of a massive military campaign against the Houthis — Hegseth began to lash out and grew suspicious that senior military officials, as well as some of his closest advisers, were leaking to undermine him, the sources added.

At one point, Hegseth even demanded an FBI probe into the leaks — which some of his aides advised against, sources said. There was already an active inspector general investigation focusing on Hegseth, and bringing in the FBI might only invite more scrutiny, those aides advised. [my emphasis]

But this conversation should have happened before March 21, almost a week before DOD IG considered investigating. And the only reason aides would recommend against FBI involvement is if they were protecting people — perhaps themselves, perhaps those close to Hegseth, perhaps Hegseth himself — from criminal exposure.

That is, at least some of Hegseth’s aides worried that if the FBI got involved, they would discover a crime.

That’s not surprising. At least four of them witnessed Hegseth providing his wife information that a jury might decide was NDI.

Anyway, this probably is not done.

In a blockbuster op-ed claiming to support Hegseth but calling on Trump to fire him, Ullyot described things in (which decried the “horrible crisis-communications advice” offered by Parnell without naming him), “key Pentagon reporters have been telling sources privately” that, “more shoes to drop in short order, with even bigger bombshell stories coming this week.”

With the original thread, in which Hegseth unwittingly shared information on a pending attack with someone not authorized to receive it, there are already questions about whether Hegseth destroyed communications covered by the Federal Records Act. Now, he has fired at least three people, two of whom witnessed Hegseth wittingly share the same information with, at least, his spouse, and some of whom likely told him not to do so before he did.

Having fired them under cover of a leak investigation, he may make it much clearer to American Oversight, to DOD’s Inspector General, and to Congress, that he was the leaker he was looking for from the start.

Update: American Oversight amended their complaint today, incorporating Whiskey Pete’s family Signal list.

Update: NBC seems to confirm something that appeared obvious to me: Whiskey Pete used his personal device for both the Friends and Family thread and the Waltz one.

The material Kurilla sent included details about when U.S. fighters would take off and when they would hit their targets — details that could, if they fell into the wrong hands, put the pilots of those fighters in grave danger. But he was doing exactly what he was supposed to: providing Hegseth, his superior, with information he needed to know and using a system specifically designed to safely transmit sensitive and classified information.

But then Hegseth used his personal phone to send some of the same information Kurilla had given him to at least two group text chats on the Signal messaging app, three U.S. officials with direct knowledge of the exchanges told NBC News.

The sequence of events, which has not been previously reported, could raise new questions about Hegseth’s handling of the information, which he and the government have denied was classified. In all, according to the two sources, less than 10 minutes elapsed between Kurilla’s giving Hegseth the information and Hegseth’s sending it to the two group chats, one of which included other Cabinet-level officials and their designees — and, inadvertently, the editor of The Atlantic magazine. The other group included Hegseth’s wife, his brother, his attorney and some of his aides.

Hegseth shared the information on Signal even though, NBC News has reported, an aide warned him in the days beforehand to be careful not to share sensitive information on an unsecure communications system before the Yemen strikes, according to two sources with knowledge of the matter.

That raises the stakes on that second DOD declaration which describes that someone (the declaration uses the passive voice) searched the device Hegseth used for the Waltz chat.