Paul Manafort Remains a Bigger Scandal than Hunter Biden

I haven’t had the time to dig into Gary Shapley’s purported whistleblower claims about the case against Hunter Biden, which several US Attorneys have already disputed.

My read, thus far, matches Andrew Prokop’s: after IRS investigators tried to take steps during a pre-election prohibition period last year, someone in their vicinity leaked to Devlin Barrett, as right-wingers do every pre-election period. That led Delaware US Attorney David Weiss to (justifiably) remove the suspected leakers from the case. As other right wing officials have before, they then ran to Congress and belatedly claimed whistleblower status.

The purported whistleblowers claim that investigative steps — pertaining to allegations about conduct after Biden left the Obama White House — were slow-walked in 2020, during Bill Barr’s tenure as Attorney General. The most serious claim made by the purported whistleblowers is that US Attorneys appointed by Joe Biden refused to file charges against Hunter in the venues where they occurred — MDCA and DC. Merrick Garland, David Weiss, and Matthew Graves have all denied that.

But even if that allegation is true, even if Weiss continues to investigate and substantiates some foreign influence peddling (at this point, limited to 2017, a time when Biden was not in office), the allegations against Hunter Biden would still be far less scandalous than the Paul Manafort case. That’s true because the scale of Manafort’s tax crimes were far worse. That’s true because Manafort has confessed to his foreign influence crime. And that’s true because Trump pardoned Manafort after his former campaign manager lied to investigators about what he did with (since confirmed) Russian agent, Konstantin Kilimnik, during and after the 2016 campaign.

Here’s my understanding of the comparison. The claims against Hunter, in bold, reflect the two Informations docketed as part of the plea deal. All but the pardon TBDs in his case reflect allegations from the so-called whistleblowers that remain unresolved.

Note: I have not listed “lied to protect the president” for Hunter because, as far as I am aware, the President’s son has not made sworn statements to law enforcement — true or false — about matters affecting his father. Manafort did make false statements about matters implicating Trump during his breached cooperation with Robert Mueller’s prosecutors.

A whole pack of DC journalists have chased the IRS allegations, like six year olds do a soccer ball, but with perhaps less consideration of what they’re chasing. They’re doing that even as Trump’s pardons remain largely unreviewed since he announced his run. This manic response to contested IRS claims reflects a choice. Just not a justifiable journalistic one, given the contested allegations to date.

Paul Manafort sources

Millions in tax avoidance: On August 21, 2018, an EDVA jury convicted Manafort of filing false tax returns each year from 2010 to 2014. On September 14, 2018, Manafort pled guilty to tax crimes spanning from 2006 through 2015. Between 2010 and 2014, he failed to report over $15M in income on FBAR.

FARA component: On September 14, 2018, Manafort pled guilty to serving as an unregistered foreign agent from 2006 through 2015.

Money laundering: On September 14, 2018, Manafort pled guilty to laundering over $6.5M in payments, from 2006 through 2016, as part of his FARA scheme.

Bank fraud: In August 21, 2018, an EDVA jury convicted Manafort of two counts of bank fraud, totalling $4.4M. On September 14, 2018, Manafort admitted to over $25M more in bank fraud.

Conspiracy with foreign spy: On September 14, 2018, Manafort pled guilty to a conspiracy to witness tamper with Konstantin Kilimnik. In a 2021 sanctions filing, Treasury stated as fact that Kilimnik is a Russian Intelligence Services agent.

Joint Defense Agreement with President: Before Manafort pled guilty, Rudy Giuliani confirmed that Manafort was part of a Joint Defense Agreement with the President.

Lied to protect President: On February 13, 2019, Amy Berman Jackson ruled that Manafort had breached his plea agreement by — among other things — lying about what he did in an August 2, 2016 meeting with Konstantin Kilimnik at which he described how the campaign planned to win swing states.

Intervention from Attorney General: On May 13, 2020, Manafort was given COVID release to home confinement, even though his prison was at that point low risk and his case did not meet the criteria laid out by Bureau of Prisons. He served less than two years of an over seven year sentence in prison.

Pardoned: On December 23, 2020, Trump pardoned Manafort.

Hunter Biden sources

Hundreds of thousands in tax avoidance: In both 2017 and 2018, Hunter failed to pay full taxes on $1.5M in income ($3M total).

Gun possession: For 11 days in 2018, Hunter possessed a gun in violation of a prohibition on gun ownership by an addict.

Update: Just to give a sense of scale, in his Ways and Means interview, Whistleblower X tried to explain how big the scale of Hunter Biden’s graft was by noting that he and his associates, over five years, got $17.3M.

But Manafort was doing more than that himself.

Where the Trump Investigations Stand: The January 6 Conspiracies

As noted in this post, I started to write short summaries of where the three main investigations into Trump stand, but they turned into posts. So I’m posting them serially. I wrote about the Georgia investigation here and the stolen documents investigation here.

On Thursday, Mike Pence testified to the January 6 grand jury for over five hours. Many commentators have suggested — and I agree — that was one of the last major testimonial steps Jack Smith would need to take before deciding whether and if so how to charge Trump for inciting a mob to threaten to assassinate his Vice President.

But — in addition to Smith’s efforts to obtain recordings from Rudy Giuliani and others that former Fox producer Abby Grossberg has in her possession (which are going to make great evidence at trial) — there are still a few pieces that Smith’s prosecutors seem to be working on.

The most important of those may be continued appellate uncertainty regarding the law that Smith is likely to use to charge Trump and others in conjunction with January 6, obstruction of the vote certification, 18 USC 1512(c)(2), a charge successfully used against dozens of other January 6 defendants already. The DC Circuit will have a hearing on that, in an appeal former Virginia cop Thomas Robertson made of his obstruction conviction, on May 11.

To understand its import, let me explain how I think the various things Smith is investigating fit together. I think it likely that, in addition to some charges relating to the obstruction of this or the January 6 Committee’s investigation, Smith’s team is pursuing:

  • Conspiracy to defraud the United States for submitting fake elector certificates to the Archives (18 USC 371)
  • Obstruction of the vote certification and conspiracy to obstruct (18 USC 1512(c)(2) and (k))
  • Conspiracy to commit wire fraud (18 USC 1343; 1349)
  • Aiding and abetting assault (18 USC 111(b) and 2)

This differs from the January 6 Committee’s referrals in that I’ve included wire fraud, for which they provided abundant evidence, in an appendix, but did not include in their referrals. Also, I believe Smith would charge conspiracy tied to January 6 under 1512(k) rather than 371, as DOJ has been doing for over a year, not least because it provides stiffer sentences and more flexibility at sentencing. And I’ve suggested DOJ might use aiding and abetting of Michael Fanone’s assault based off Amit Mehta’s ruling addressing it and the evidence DOJ used in the Ed Badalian trial. I think that’s more likely than a charge for incitement of insurrection (18 USC 2383) unless DOJ built upwards off of still-hypothetical guilty verdicts in the Proud Boys case, but it might take time. I frankly think adding seditious conspiracy charges would be more likely than incitement of insurrection, if one spent the time to build up the intervening case, but that’s highly unlikely for constitutional reasons.

The way these three main charges — conspiracy to defraud tied to the fake elector certificates, conspiracy to obstruct the vote certification, and wire fraud — intersect likely provide some prosecutorial tools for the same reason that some Georgia Republicans are now turning on other ones.

While the fake electors case may seem like a slam dunk, the criminal exposure it presents is quite uneven.

Part of that stems from the fact that the extent to which a fake certificate was fraudulent is tied to state law about the requirements for elector ascertainment. On December 9, 2020, campaign lawyer Kenneth Cheesebro wrote down (!!) where such efforts would be less and more problematic.

Many of the States contested by the Trump team had laws that specified requirements for electors to validly cast and transmit their votes—and the December 9, 2020, memo recognized that some of these criteria would be difficult, if not impossible, for the fake electors to fulfill. (As described later, most were not fulfilled.) For example, Nevada State law required that the secretary of state preside when Presidential electors meet,16 and Nevada Secretary of State Barbara Cegavske, a Republican, had already signed a certificate ascertaining the Biden/Harris electors as the authorized, winning slate.17 Several States also had rules requiring electors to cast their votes in the State capitol building, or rules governing the process for approving substitutes if any original proposed electors from the November ballot were unavailable. As a result, Chesebro’s December 9, 2020, memo advised the Trump Campaign to abide by such rules, when possible, but also recognized that these slates could be “slightly problematic in Michigan,” “somewhat dicey in Georgia and Pennsylvania,” and “very problematic in Nevada.”18

That memo marks the moment when Trump’s official campaign lawyers like Justin Clark and Matt Morgan started to distance themselves from the campaign efforts, to be replaced by Rudy Giuliani and his band of merry warriors.

Something similar happened at the states, as smarter people insulated themselves from this stupid legal move. The fake electors in New Mexico and Pennsylvania included caveats that likely protects them from legal exposure; in other states (notably, Wisconsin) the fake electors credibly believed that the certificates would only be used if a court ruled that there was some remaining legal dispute. Fourteen fake electors refused to participate, several of whom had very useful things to say about its dubious legality even to the January 6 Committee.

While there’s lots of documentary record reflecting that Trump approved the plan, proving his knowledge of the legal problems with the fake certificates themselves would likely require witnesses who saw him do so after having been advised of the legal sketchiness of it all (that may have been among the things the two Pats, Philbin and Cipollone, were asked about in their grand jury testimony in December). To include Trump in these charges, you need witnesses. His call to Brad Raffensberger and his assent to a lawsuit using numbers known to be dodgy are related; his pressure on electors to participate is part of the same conspiracy; but to charge him with the conspiracy itself you need those direct witnesses (in addition to the two Pats, Jason Miller, Rudy, Mark Meadows, Epshteyn, and John Eastman are likely those witnesses).

By last June, the subpoenas DOJ sent out asking for communications with those deeply implicated reflected this differential exposure. So do the phone seizures of Mike Roman and Epshteyn in September, both of whom were key gatekeepers of this process. This post shows how the investigation proceeded from there. In other words, the parts of the fake elector investigation we can see reflect awareness from before the first J6C hearing that the scam implicated differential legal exposure.

That kind of differential exposure is the same thing that Fani Willis is using to secure cooperating witnesses in Georgia.

While I’ll come back to it, the same kind of differential exposure exists with the wire fraud case. Just as one example, while Justin Clark claims to have distanced himself from the obviously illegal fake elector scam, he remained in Trump’s employ as he spent the money earned from making false claims about voter fraud between November and January. He already would have had an incentive to provide evidence to prosecutors that he had no part of the fake electors scheme. His incentive to do so increases to the extent that he benefitted from fraudulent fundraising and spending.

But first I want to explain one thing Smith may be waiting on: A clear sense of how the DC Circuit will define “corrupt purpose” under 18 USC 1512(c)(2).

If he charges it, Smith will likely prove that Trump obstructed the vote certification by:

  • Asking Mike Pence to take action to delay the certification that Trump had been told was illegal (Greg Jacob, Mark Short, the two Pats, and Pence are witnesses to this, all of whom have now made Executive Privilege-waived grand jury appearances)
  • Falsely leading the mob to believe that Pence could take that action (changes Trump made to his speech, about which Stephen Miller was likely asked by the grand jury this month, and his tweets are evidence of this)
  • After Pence refused to take that action, using the mob to try to pressure him to take it anyway or to otherwise disrupt the certification (DOJ has spent two years obtaining evidence that this was, in fact, why many people rioted, with specific evidence tied to Danny Rodriguez)

Contrary to what a million TV lawyers have told you, to prove obstruction, Smith won’t have to prove Trump knew he lost. DOJ has repeatedly won convictions of other January 6 defendants who tried to use that as a defense.

DOJ will need to prove he had corrupt purpose in attempting to obstruct the vote certification. And what that means in the DC Circuit won’t be decided until after May 11.

This post provides both a summary of the debate as it existed in January. This post describes how a DC Circuit panel of Florence Pan, Justin Walker, and Greg Katsas ruled that 1512(c)(2) does apply to the vote certification and that obstruction can extend beyond documentary obstruction. It also explains how none of the three of them could agree on what “corrupt purpose” means, from which some January 6 defendants have tried to argue (unsuccessfully in at least two cases) that Walker’s preferred meaning should apply.

Wildly simplified, the three main definitions of what corrupt purpose might mean are:

  • Corrupt benefit
  • Using otherwise illegal means, which in the case of other January 6 defendants has meant trespass or assault
  • Aiming to obtain an unlawful benefit

On May 11, a DC Circuit panel including Pan, Poppy Bush appointee Karen Henderson, and Obama appointee Cornelia Pillard will consider whether former Virginia cop Thomas Robertson had the corrupt purpose required to be convicted of obstruction. As part of that, they’ll decide whether the earlier ruling decided the issue of what corrupt purpose is, and if not, what it is.

As I wrote, to the extent that Smith has proof Trump knew the fake elector certificates were fraudulent, 1512 should apply to Trump in every imaginable case, far more easily than it does with rioters. The attempted delivery of the fake elector certificates to Pence constitutes a documentary attempt to obstruct the vote certification. Trump’s illegal request to Pence, as well as the knowingly fraudulent lawsuit in Georgia and the effort to pressure Raffensperger, to say nothing of any incitement or aid-and-abet liability in the assaults, are illegal means he used to stop the vote certification. And Trump, more than anyone else involved in efforts to obstruct the vote certification on January 6 was seeking an unlawful personal benefit, the ability to remain in power for another term. Mitch McConnell protégé Walker clearly laid out that basis for that case in his concurring opinion in Fischer.

But former Trump White House counsel Katsas didn’t necessarily view the continued election of Donald Trump to be such an advantage, at least not for those accused of assault before him. He sought a stricter definition of “financial, exculpatory, or professional” gain.

Which brings me (back) to the wire fraud investigation, something that DOJ has been investigating since at least September and in which CNN reported DOJ got cooperators after January 6.

[T]he financial investigation has sought information about Trump’s post-election Save America PAC and other funding of people who assisted Trump, according to subpoenas viewed by CNN. The financial investigation picked up steam as DOJ investigators enlisted cooperators months after the 2021 riot, one of the sources said.

Wire fraud charges would closely resemble the successful Build the Wall prosecution for which Steve Bannon’s co-conspirators just got four year sentences (he was pardoned in for it in one of Trump’s last pardons but faces trial for the same scam in New York State in November). It would follow a similar wire fraud investigation of Sidney Powell that dates back to before September 2021.

If you think of these three prongs of the investigation, the wire fraud prong serves two purposes. First, many of the people who were witnesses but not subjects of the events leading up to January 6 might be subjects of the wire fraud investigation. As I noted, it may provide a tool to get cooperators.

Just as importantly, even under the most constrained definition of corrupt purpose for obstruction, grifting off false claims of election fraud would qualify.

That is, for Trump, a prosecutor should be able to prove corrupt purpose regardless of any conceivable standard that the DC Circuit or even a conservative SCOTUS would adopt, because he attempted to obstruct the vote certification so that he could remain President after losing the election.

But even if you don’t believe getting Trump elected provides an unlawful benefit to his supporters (or, to put it another way, disqualifying the votes of 81 million other Americans so yours counts more), disseminating false claims about voter fraud to get rich and then cashing in on that Big Lie for years afterwards is a different kind of corrupt purpose, the kind of financial corrupt purpose that Katsas is looking for.

If you riled up tens of thousands of Trump supporters who went on to attack the Capitol just so you could benefit financially, you’ve realized the kind of corrupt financial benefit from the riot that would seem to meet Katsas’ most constrained definition of corrupt purpose.

So it’s not just that the wire fraud part of the investigation is a crime that should, like all the other ways Trump and his flunkies have exploited his credulous followers, be prosecuted. It’s a important complement to the two other conspiracies, both because it’s likely to motivate more cooperators, but also because it helps to prove corrupt purpose for all the people who profited off the fraud.

And that may have an impact on the timing.

As I’ve noted, Trump should qualify under the definition of corrupt purpose no matter what the DC Circuit decides, though some of his flunkies might not. And so on top of whatever continued investigation Smith has to do on the wire fraud prong, he may want to wait until at least after that hearing before he makes final charging decisions.

Lots of people are impatient that neither Trump nor his flunkies have been charged thirty months after their crimes. But the likely charge hasn’t even been defined yet.

Links

Where the Trump Investigations Stand: Georgia

Where the Trump Investigations Stand: Stolen Documents

Where the Trump Investigations Stand: The January 6 Conspiracies

How the Government Proved Their Case against John Podesta’s Hacker

We’re almost seven years past the hack of the DNC, and self-imagined contrarians are still clinging to conspiracy theories about the attribution of that and related hacks. In recent weeks, both Matt Taibbi and Jeff Gerth dodged questions about the attribution showing Russia’s role in the hack-and-leak by saying that the Mueller indictment of twelve GRU officers would never be tested in court (even while, especially in Gerth’s case, relying on unsubstantiated claims in John Durham indictments from his two failed prosecutions).

And while’s it’s likely true that DOJ will never extradite any of those twelve men to stand trial, DOJ did successfully convict one of their co-conspirators on a different hack: the hack-and-trade conspiracy involving Vladimir Klyushin and accused John Podesta hacker, Ivan [Y]Ermakov.

(The Mueller indictment and Ermakov’s second US indictment, for hacking anti-doping agencies, transliterated his name with a Y, the Boston one does not.)

That trial provides a way to show how DOJ would prove the 2018 indictment if one of the twelve men charged ever wandered into a jurisdiction with an extradition treaty with the US.

As laid out at trial, between 2018 and 2020, the co-conspirators hacked two securities filing agencies, Toppan Merrill and Donnelly Financial, to obtain earnings statements in advance of their filing, then traded based off advance knowledge of earnings. Klyushin was one of seven people (two charged in a separate indictment, three who were clients of Klyushin’s company M-13) who did the trading. Ermakov didn’t trade under his own name. He may have been compensated for Klyushin’s side of the trades with a Moscow home and a Porsche. But at least as early as May 9, 2018, forensic evidence introduced at trial shows, an IP address at which Ermakov’s iTunes account had just gotten updates was used to steal some of the filings.

Ermakov did not show up in a courtroom in Boston to stand trial and Klyushin has launched a challenge to his conviction that rests entirely on a challenge to venue there. But the jury did convict Klyushin on the hacking charge along with the trading charges, meaning a jury has now found DOJ proved Ermakov’s hacking beyond a reasonable doubt.

And they did it using the same kind of evidence cited in the Mueller indictment.

The crime scene

Start with the crime scene: the servers of the two filing agencies victimized in the hack-and-trade, Toppan Merrill and Donnelly Financial.

According to the trial record, neither figured out they had been hacked on their own. As the FBI had tried to do for months beforehand in the case of the DNC, a government agency, the SEC, had to tell them about it. The SEC had seen a number of Russians making big, improbable stock trades from clients of the two filing agencies, all in the same direction, and wanted to know why. So it sent subpoenas to both companies.

As the DNC did with CrowdStrike in 2016, both filing agencies hired an outside incident response contractor — Kroll Cyber in the case of Toppan Merrill, Ankura in the case of Donnelly Financial — to conduct an investigation.

The lead investigators from those two contractors were the first witnesses at trial. Each explained how they had been brought in in 2019 and described what they found as they began investigating the available logs, which went back six months, a year, and two years, depending on the type and company. The witness from Kroll described finding signs of hacking in Toppan Merrill’s logs:

The Ankura witness described how they first found the account of employee Julie Soma had been compromised, then used the IP addresses associated with that compromise to find other employees whose accounts were used to download reports or other unauthorized activity.

In sum, the two incident response witnesses described providing the FBI with the forensic details of their investigation — precisely the same thing that CrowdStrike provided to FBI from the DNC hack. There’s not even evidence that they shared a full image of the filing agencies’ servers (though an FBI agent described going back to Donnelly to search for the domain names behind the intrusions that Kroll had found at Toppan Merrill), which was one of the first conspiracy theories about the DNC hack Republicans championed: that the FBI failed to adequately investigate the DNC hack because it didn’t insist on seizing the actual victim servers during the middle of an election.

The forensic evidence wasn’t the only evidence submitted at trial from the crime scene. One after another of the employees whose credentials had been misused testified. Each described why they normally accessed customer records, if at all, how and when they would normally access such records, and from what locations they might access corporate servers remotely, including their use of the corporate VPN. Julie Soma — the Donnelly employee whose credentials were used most often to download customer filings — described that she would never have done what was done in this case, download one after another filing from Donnelly customers in alphabetical order.

Q. Would you ever go from client to client and alphabetically access those types of documents?

A. No.

Both interview records from the Mueller investigation (one, two, three) and documents from the Michael Sussmann case show that the FBI did similar interviews in the DNC hack. The Douglass Mackey trial, too, featured witnesses describing how the Hillary campaign identified that attack on the campaign as well.

In proving their case against John Podesta’s hacker, DOJ presented witness testimony that eliminated insiders as the culprit.

Fingerprinting

Having established the forensic data tied to intruders through the incident response contractors, prosecutors then called FBI agents as witnesses to describe how — largely through the use of IP addresses obtained using subpoenas or pen registers and the materials found in the suspects’ iCloud accounts — they tied Klyushin’s company, M-13, to both the hacking and the trading.

The trading was fairly easy: the co-conspirators accessed the two online brokers used to execute the trades under their own names and from IP addresses tied to M-13. An SEC witness described in detail how trades always shortly followed hacks but preceded the public filing of earnings statements.

Tying M-13 to the hacking took a few more steps.

For the hacking conducted via the domains Kroll identified, the FBI first found the account that registered the domains. Each was registered under a different name, but each of the names were based on a Latvian-based email service and used similar naming conventions. Each had been accessed from the same set of 3 IP addresses.

For IPs that Kroll identified, the FBI found BitLaunch servers created by an account in the name of Andrea Neumann, which was controlled from one of the same IP addresses that had registered the domain names. The FBI got search warrants to obtain images of those BitLaunch servers.

Another IP address used to steal filings, several FBI agents explained, was from an Italian-run VPN, AirVPN. The FBI used a pen register to show that someone accessed AirVPN from the M-13 IP address during the same period when the AirVPN IP was stealing records from the filing companies. The FBI also showed that Klyushin had accessed his bank at the same time from that same IP address. The FBI also showed that eight common IP addresses had accessed Ermakov’s iTunes account and the AirVPN IP address (in this case, the access was not at the same time because the FBI only had a pen register on the VPN for two months in 2020). While FBI witnesses couldn’t show that the specific activity tied to an AirVPN IP at the victim companies tied back to M-13, they did show that both Klyushin and Ermakov routinely used AirVPN.

Plus there were the filing thefts — noted above — that were done on May 9, 2018 using the same IP address that, four minutes earlier, had downloaded an Apple update from Ermakov’s iTunes account. As I’ve noted repeatedly, before Ermakov was first indicted by Mueller, he had already left a smoking gun in the servers at Donnelly in the form of IP activity that the FBI obtained over a year later inside the US.

In fact, much of the evidence used to prove this case (particularly establishing the close relationship between the conspirators) came from Apple, including WhatsApp chats saved in Klyushin and other co-conspirators’ iCloud accounts. We know Mueller used the same source of evidence. In March of this year, emails stolen by hacktivists revealed, Apple informed another of the GRU officers charged in the DNC hack that the FBI had obtained material from his Apple account in April 2018, in advance of the Mueller indictment.

The indictment likely also relied on warrants served on Google, especially on Ermakov’s account. The Mueller indictment (as well as the later anti-doping one) attributes much of the reconnaissance conducted in advance of the hacks to Ermakov: the names of some victims; information on the DNC, the Democratic Party, and Hillary; how to use PowerShell (which would be used against Toppan Merrill); and CrowdStrike’s reporting on GRU tools. If he did this research via Google, it would all be accessible with a warrant served on the US tech company.

The getaway car

One pervasive conspiracy theory about the Mueller indictment stems from testimony that Shawn Henry gave to the House Intelligence Committee in December 2017, describing that Crowdstrike did not see the data exfiltrated from the DNC servers. Denialists claim that is proof that the information was never exfiltrated by the GRU hackers. The conspiracy theory is ridiculous in any case, since there were so many other Russian hacks involving so many other servers, including servers run by Google and Amazon that had a different kind of visibility on the hack (something that Henry alluded to in his testimony), and since the indictment describes that the DNC hackers destroyed logs to cover their tracks.

But the Klyushin trial featured testimony about a tool used in the hack-and-trade conspiracy that has a parallel in the DNC hack: the AMS panel, hidden behind an overseas middle server, which the Mueller indictment described this way:

X-Agent malware implanted on the DCCC network transmitted information from the victims’ computers to a GRU-leased server located in Arizona. The Conspirators referred to this server as their “AMS” panel. KOZACHEK, MALYSHEV, and their co-conspirators logged into the AMS panel to use X-Agent’s keylog and screenshot functions in the course of monitoring and surveilling activity on the DCCC computers. The keylog function allowed the Conspirators to capture keystrokes entered by DCCC employees. The screenshot function allowed the Conspirators to take pictures of the DCCC employees’ computer screens.

[snip]

On or about April 19, 2016, KOZACHEK, YERSHOV, and their co-conspirators remotely configured an overseas computer to relay communications between X-Agent malware and the AMS panel and then tested X-Agent’s ability to connect to this computer. The Conspirators referred to this computer as a “middle server.” The middle server acted as a proxy to obscure the connection between malware at the DCCC and the Conspirators’ AMS panel. On or about April 20, 2016, the Conspirators directed X-Agent malware on the DCCC computers to connect to this middle server and receive directions from the Conspirators.

[snip]

For example, on or about April 22, 2016, the Conspirators compressed gigabytes of data from DNC computers, including opposition research. The Conspirators later moved the compressed DNC data using X-Tunnel to a GRU-leased computer located in Illinois.

In the hack-and-trade conspiracy, the hackers set up a similar structure, using the servers given names like “developingcloud” and “finshopland” as reverse proxies, with a final server behind them all executing orders on the hacked servers at Toppan Merrill (and the implication is, Donnelly, though the forensics came from Toppan Merrill via Kroll). The “computers numbered 1 through 7” in what follows are the servers identified by Kroll stealing earnings filings from Toppan Merrill.

A. So this is a digital depiction of the servers that I examined on the right there, so they each have a number on them, 1 through 9.

Q. Let me focus you first on the computers numbered 1 through 7. Do you see them there?

A. Yes.

Q. Are they kind of in a sideways V configuration?

A. Yes.

Q. Okay. And what do computers 1 through 7 show on this Exhibit DDD?

A. They functioned as gatekeepers for the furthest machine to the right, server number 8.

Q. And when you say “gatekeeper,” is there a technical term for that?

A. Yes. So the technical term is a “reverse proxy.”

Q. Can you explain to the jury, in a easy for me to understand way, what a reverse proxy or gatekeeper is in this chart, 1 through 7.

A. Yes. So in this chart, it would function — so the seven that are in that V formation, they would pass traffic to server number 8, if it was coming from an infected machine; and if it was something else, it would send the traffic to some other website.

This structure would have made it impossible for Toppan Merrill to understand the source or function of the anomalous traffic on its servers because any attempt to do so would be redirected away from the control server.

But not the FBI, because they obtained images of the servers with a warrant.

The forensic witness describing this structure showed, command by command, that the forensic clues identified by Kroll on the Toppan Merrill servers were controlled via that final server running PowerShell (the same tool that Mueller alleged Ermakov researched during the DNC hacks in 2016).

Q. And is there something on this log that you found that tells you the name of the program that was running on the victim’s computer at Toppan Merrill?

A. Yes, the process name line, and that reads rdtevc.

Q. And is process another name for computer program?

A. Yes.

Q. So this is a log that shows that a program named RDTEVC was running on a Toppan Merrill computer, right?

A. Yes.

Q. But it’s stored in the hacker computer?

[snip]

Q. And what does PowerShell do? You can call it anything, right? You can call it RDTEVC?

A. That’s probably a randomly chosen name.

Q. But no matter what it’s called, what does it do?

A. So it allows it to be remotely controlled and accessed.

Q. Allows what to be remotely controlled and accessed?

A. The infected machine.

The same forensic expert explained that he didn’t find any downloads of stolen files.

But he also explained why.

He had also found secure tunnels, readily available but similar in function to a proprietary GRU tool Crowdstrike found in the DNC server. As he described, these would be used to transfer data in encrypted form, making it impossible to identify the content of the data while it was in transit.

Q. Mr. Uitto, are you familiar with the concept of exfiltration?

A. Yes.

Q. Big word, but what does it mean?

A. It means to steal data, take data.

Q. And in your review, did you find evidence — you told Mr. Nemtsev you didn’t find evidence of the taking of data from the victim computers to these particular hacker servers; is that right?

A. That’s right, but I did see secure tunnels that were created.

Q. So when you say there were secure tunnels, were you able to tell what was going through those secure tunnels?

A. No.

Q. Those were encrypted, right?

A. Yes.

Q. So you actually don’t know whether or not there was financial information in those tunnels?

A. That’s correct.

Q. Or sports scores or anything?

A. That’s correct.

Q. It’s encrypted.

A. Yes.

[snip]

Q. What role does encryption serve in this hacker architecture?

[snip]

A. Yes, so it can be used to hide data or information.

Q. So if it’s encrypted, we can’t know what’s being passed?

To prove the hack, you would have to — and FBI did, in both cases — prove that the stolen data made it to the end point.

This testimony is important for more than explaining where you’d need to look to find proof of a hack (at the end points). It shows the import of understanding not just the crime scene and those end points, but the infrastructure used to control the hack and exfiltrate the data. With both the hack-and-trade conspiracy and the hack of the DNC, the FBI got forensics about the victim from the incident response contractors, but they obtained the data from these external servers directly, with warrants.

The denialists looking for proof in the DNC server were focused on just the crime scene, but not what I’ve likened to a getaway car, one to which the FBI had direct access but Crowdstrike did not.

Follow the money

Another specialized kind of fingerprint prosecutors used to prove the case against Klyushin parallels the one in the Mueller indictment (and, really, virtually all hacking cases these days): the cryptocurrency trail. As the Mueller indictment explained, the hackers who targeted the DNC used the same cryptocurrency account to pay for different parts of their infrastructure, thereby showing they were all related.

The funds used to pay for the dcleaks.com domain originated from an account at an online cryptocurrency service that the Conspirators also used to fund the lease of a virtual private server registered with the operational email account [email protected]. The dirbinsaabol email account was also used to register the john356gh URL-shortening account used by LUKASHEV to spearphish the Clinton Campaign chairman and other campaign-related individuals.

[snip]

For example, between on or about March 14, 2016 and April 28, 2016, the Conspirators used the same pool of bitcoin funds to purchase a virtual private network (“VPN”) account and to lease a server in Malaysia. In or around June 2016, the Conspirators used the Malaysian server to host the dcleaks.com website. On or about July 6, 2016, the Conspirators used the VPN to log into the @Guccifer_2 Twitter account. The Conspirators opened that VPN account from the same server that was also used to register malicious domains for the hacking of the DCCC and DNC networks.

By following the money, prosecutors were able to show the jury how these pieces of infrastructure fit together.

In the case of the hack-and-trade, the conspirators did nothing fancy to launder the cryptocurrency used in the operation. The servers obtained in the name of Andrea Neumann were paid using three successive cryptocurrency accounts, each with different names but accessed from the same IP address. The third name was Wan Connie. An interlocked Wan Connie email account had been accessed from M-13’s IP address. So while the cryptocurrency itself couldn’t tie the conspirators to the hack, the interlocked infrastructure did.

The conspiracy

To prove the hack, prosecutors at trial showed how the FBI had used evidence from the crime scene, the “getaway” car, the money trail, and evidence obtained at the end point from iCloud accounts to tie the hack back to Ermakov personally and M-13 more generally. The biggest smoking gun came from matching the IP addresses to which Ermakov got his iTunes updates to the infrastructure used in the hack (or, in the case of the May 9, 2018 thefts, directly to someone exploiting Julie Soma’s stolen credentials.

All that was left in the Klyushin case was proving the conspiracy, showing that Klyushin and others had used this stolen information to make millions by trading in advance of earnings announcements. This would be the functional equivalent of tying the records stolen from Democrats (and some Republicans) to their release via Guccifer 2.0, dcleaks, and WikiLeaks.

At Klyushin’s trial, the government proved the conspiracy via two means: an SEC analyst presented a bunch of coma-inducing analysis showing how the trades attributed to online brokerage accounts that Klyushin and others had in their own names lined up with the thefts. The analyst explained that odds of seeing those trading patterns would be virtually impossible.

More spectacularly, prosecutors introduced Klyushin’s role with a bunch of pictures establishing that he was “besties” with Ermakov (and, eventually, that there were unencrypted and encrypted communications, along with a picture of Klyushin’s yacht, sent via Ermkaov to two guys in St. Petersburg who didn’t work for M-13 but who were making the same pattern of trades); I looked at some of that evidence here. One picture found in Klyushin’s account showed Ermakov, crashed on a chair, wearing an M-13 sticker, taken in the same period as some of the logs provided by Kroll showed hacking activity. About the only thing the FBI found in Ermakov’s iCloud account was the online brokerage account used to execute the insider trading, in Klyushin’s name, but that tied him to the trading side of the conspiracy.

As their trades began to attract attention, Ermakov and another M-13 employee attempted to craft cover stories, evidence of which prosecutors found via Apple. Prosecutors even introduced Threema chats in which Ermakov told Klyushin, his boss, not to share details about their trading clients or he might end up a defendant in a trial.

He did.

And at that trial, prosecutors were able to prove a hacking conspiracy against Klyushin using evidence and victim testimony from the crime scene, but also from other data readily available with a subpoena or warrant inside the US.

Update: Tweaked language describing secure tunnels.

“$$$$$$:” Josh Dawsey Comes Full Circle on Trump’s Fundraising Corruption

I’m going to share something I’ve been laughing to myself about for months, since before I wrote this post on how the financial aspect of Jack Smith’s investigation would be a way to break through the otherwise formidable wall of lawyer-witnesses between investigators and Trump’s crimes.

There’s a reason why the fundraising aspect of Trump’s Big Lie has been accessible to investigators, even beyond the fact that there’s boatloads of financial evidence available with a subpoena. That’s because reporters, including Josh Dawsey, were able to track Trump’s fundraising in real time back in 2020, and when they saw what he was doing, they asked the Director of Communications for Trump’s campaign, Tim Murtaugh, about it.

Heck, Dawsey even wrote a story on December 1, 2020, over a month before the Big Lie led to an insurrection, reporting on this scam.

President Trump’s political operation has raised more than $170 million since Election Day, using a blizzard of misleading appeals about the election to shatter fundraising records set during the campaign, according to people with knowledge of the contributions.

The influx of political donations is one reason that Trump and some allies are inclined to continue a legal onslaught and public relations blitz focused on baseless claims of election fraud, even as their attempts have repeatedly failed in court and as key states continue to certify wins for President-elect Joe Biden.

Much of the money raised since the election is likely to go into an account for the president to use on political activities after he leaves office, while some of the contributions will go toward what is left of the legal fight.

[snip]

The donations are purportedly being solicited for the Official Election Defense Fund, whose name is featured prominently atop the Trump campaign’s website.

There is no such account, however. The fundraising requests are being made by the Trump Make America Great Again Committee, a joint fundraising effort of the Trump campaign and the Republican National Committee. As of Nov. 18, that committee also shares its funds with Save America, a new leadership PAC that Trump set up in early November and that he can use to fund his activities after the presidency.

Dawsey appears to have gotten no response from Murtaugh.

What happened with his inquiry instead — along with one Politico’s Maggie Severns sent on November 11 and a follow-up question CNN’s Jeremy Diamond sent on November 24 — is that Murtaugh, who could have no conceivable attorney client privilege, sent the query to Justin Clark, who otherwise would have attorney-client privilege, along with a bunch of other senior campaign officials, to ask whether they should “still ignore” press inquiries about the fundraising.

In the case of Dawsey’s email, they said things like this to each other:

On Nov 30, 2020, at 7:03 PM, Tim Murtaugh <[email protected]> wrote:

I side with no comment. He’s going to write about the split and if we say stuff about legal expenses it will serve to highlight the argument that the fundraising pitch is misleading.

From: Jason Miller <[email protected]> Sent: Monday, November 30, 2020 7:24 PM

To: Tim Murtaugh <[email protected]> Cc: Sean Dollman <[email protected]>; Justin Clark <[email protected]>; Bill Stepien <[email protected]>

Subject: Re: [EXTERNAL]$$$$$$

Fair points. Sean -what are the reporting deadlines for these respective entities -12/15? It will be tougher to dodge such answers after reporters can find it themselves.

[snip]

Re: [EXTERNAL]$$$$$$

We should talk tomorrow about whether to just announce this by press release like we would any other fundraising announcement. If we have the numbers we can discuss how the breakdown among entities needs to be messaged. Also key, as Jason pointed out, that POTUS is on board with how it will be described. [my emphasis]

In response to Dawsey’s query back on November 30, 2020, Murtaugh, Clark, Jason Miller, CFO Sean Dollman, and Campaign Manager Bill Stepien exchanged emails recognizing that the fundraising pitch they were using was misleading, strategizing how they were going to continue to distract journalists from the misleading aspect of their pitches after they had to disclose their fundraising, and noting that they were going to ask Trump if he was comfortable with them fluffing journalists on how they were misleading small donors.

And Murtaugh, because he had no conceivable privilege in these exchanges, sent this exchange to the January 6 Committee and, I assume, to DOJ when they subpoenaed him.

That’s why I find it hilarious that Dawsey, in a report on a new set of subpoenas sent out in March that follow ones sent in December or November and September, wonders whether prosecutors will find the same kind of damning evidence that Trump’s campaign knew they were engaged in fraud as the Steve Bannon Build the Wall fraud did.

It’s unclear whether prosecutors will find similar kinds of evidence to support an indictment in this case.

I’m pretty sure they’ll find it, because that evidence has your name on it, Josh! One way Jack Smith will prove that Trump’s people knew they were lying to the rubes sending in their spare cash is by showing how panicked the campaign was when people like Dawsey started to ask about it.

WaPo suggests the subpoenas he describes disclose “the breadth of Smith’s investigation” and claims this prong of the investigation follows the release of the January 6 Committee Report.

The special counsel’s increased interest in fundraising follows the December release of the final report of the House select committee that investigated the Jan. 6 attack, which concluded that the Trump campaign and Republican National Committee’s joint fundraising operation brought in $250 million between the November election and Jan. 6, sending as many as 25 emails to supporters each day, many claiming that the election had been “rigged” or that Democrats had tried to steal the presidency and urging people to join the “Trump Army.” The Trump campaign sent several emails on Jan. 6 itself, including one declaring, “TODAY. This is our LAST CHANCE … The stakes have NEVER been higher. President Trump needs YOU to make a statement and publicly stand with him and FIGHT BACK.”

But not only have other outlets been reporting on it, CNN reported in December that this financial prong of the probe (which like NYT, they reported in September) had been going on, at that point, for a year, though the PAC prong of it may have post-dated the J6C presentation of this scam last June.

Another top prosecutor, JP Cooney, the former head of public corruption in the DC US Attorney’s Office, is overseeing a significant financial probe that Smith will take on. The probe includes examining the possible misuse of political contributions, according to some of the sources. The DC US Attorney’s Office, before the special counsel’s arrival, had examined potential financial crimes related to the January 6 riot, including possible money laundering and the support of rioters’ hotel stays and bus trips to Washington ahead of January 6.

In recent months, however, the financial investigation has sought information about Trump’s post-election Save America PAC and other funding of people who assisted Trump, according to subpoenas viewed by CNN. The financial investigation picked up steam as DOJ investigators enlisted cooperators months after the 2021 riot, one of the sources said.

That may be why Merrick Garland has been saying the investigation was following the money since October 2021, at which point the similar fraudulent fundraising investigation into Sidney Powell was reported by … the Washington Post.

The investigation into fundraising fraud is important by itself for the (outside) possibility it’ll lead Trump’s supporters to turn on him for cheating them. It could help to prove that Trump’s efforts to obstruct the vote certification on January 6 were “corrupt” by any definition of the term that the DC Circuit will ultimately adopt. But it likely also serves as a useful prosecutorial tool not just because it had a public-facing aspect that resulted in non-privileged conversations like the one above, but also because a goodly number of Trump people who weren’t implicated in the actual election theft were involved and cognizant of the financial fraud.

Trump Organization’s Other New York State Case

[NB: check the byline, thanks. /~Rayne]

Because we’re running in excess of 500 comments across the last three threads about Donald Trump’s indictment and arraignment in Manhattan, I want to post another thread for more discussion.

I’ll remind you now I’m not a lawyer and I don’t have either Marcy’s holographic memory or her skills at fine reading, nor bmaz’s experience representing criminal defendants.

But I want to bring up a couple subjects we haven’t discussed which are related to D.A. Alvin Bragg’s criminal suit against Trump.

First, only one member of the emptywheel community made a passing reference to Trump’s post-arraignment speech. They didn’t mention Trumps’ threats.

Yes, that’s plural Trumps, because Donnie Jr. and Eric posted in social media a photo of New York Supreme Court Justice Juan Merchan and his daughter on the day of his father’s arraignment. They targeted Merchan’s daughter for having worked for Kamala Harris’ campaign.

You’ll recall in July 2020 that U.S. District Court for the District of New Jersey Judge Esther Salas’ family members were attacked at their home – her husband was shot three times and her son shot and killed. The attacker was an aggressive anti-feminist who killed himself shortly after the attack on Salas’ family. He had been able to locate Salas’ home using her personal information publicly available online.

Last November, Congress passed the Daniel Anderl Judicial Security and Privacy Act of 2021, named after Salas’ son, to protect the personal information about judges on the internet.

Trump himself attacked Judge Merchan verbally in his speech from Mar-a-Lago after returning from his arraignment. He’d been strongly cautioned against threatening speech during his arraignment, but he fulminated anyhow about Merchan being a “Trump-hating judge with a Trump-hating wife and family,” repeating the same disparaging remarks he’d made earlier the same day over social media. He also targeted Merchan’s daughter.

Apart from the obvious potential incitement to violence the Trumps attempted against Judge Merchan and his family, was this a move to manipulate the Manhattan case?

Being a state jurist, Merchan and his family are not protected by the federal Judicial Security and Privacy Act. But I wonder if these threats made online and on an interstate basis were intended not just to influence the judge or D.A. Alvin Bragg.

Are there potential federal repercussions?

~ ~ ~

Secondly, the emptywheel community and the legal commentariat at large have sifted through Trump’s indictment and the statement of facts. The amount of related discussion across social media has been exhausting.

However community member c-i-v-i-l shared a link to a thread by University of Texas Professor of Law Lee Kovarsky which checked me short and made me rethink the 34 count indictment.

You can catch the thread on the Wayback Machine at this Internet Archive link (I won’t make you go to Elmo’s House of Doge Nazi Bar for this).

What gave me pause was Kovarsky’s analysis of preemption and the matrix of possible underlying crime(s) which Bragg did not disclose but underpin the charges Bragg filed against Trump.

Here’s what the matrix looked like, with Not-Trump = Pecker, Cohen, etc. according to Kovarsky:

(1) federal tax law violation by Trump (2) federal tax law violation by Not-Trump
(3) state tax law violation by Trump (4) state tax law violation by Not-Trump
(5) federal election law violation by Trump (6) federal election law violation by Not-Trump
(7) state election law violation by Trump (8) state election law violation by Not-Trump

Kovarsky made a lot of sense to a non-lawyer like me as he pointed out where others’ arguments about preemption are weak and what’s most likely as a preemption.

And then it clicked, all the tumblers fell into place.

In my uneducated opinion, the underlying crime isn’t one which can be preempted by federal law.

It’s a crime which has been prosecuted by the state of New York already.

It’s a crime which has already been prosecuted by the Manhattan D.A.

It’s a crime which explains the narrow emphasis on business records and falsification of the same, and a crime which relied on falsified business records.

And the crime looked like this:

These are counts for which Trump Organization and its CFO (TO CFO) was already convicted and is now serving time in Rikers Island.

It’s the April 2017 and April 2018 tax returns and related supporting documentation filed based on falsified business records for which TO CFO Allen Weisselberg has already been charged.

But so has the Trump Organization – the same organization which was responsible for the financial records of Donald J. Trump Revocable Trust, and the financial records of Donald J. Trump.

This January both Trump Corporation and the Trump Payroll Corporation were assessed a total of $1.6 million in fines for their tax fraud as part of Trump Organization.

Again, I’ll remind you I’m not a lawyer, don’t even play one on TV, though I’ve done bookkeeping for several small businesses in my career and worked for a lawyer and CFO. I’ve shared my speculation here knowing I’m going to get a drubbing from my partner in (im)moderation bmaz.

I don’t even know if I can muster much defense of my own argument here except that Weisselberg’s case is one which hasn’t been discussed much at all since Tuesday morning.

Yet it was reported on March 30 that Weisselberg had “dumped” his Trump-funded lawyer Nicholas Gravante or that the Trump organization had fired Weisselberg’s lawyer. Gravante was apparently too willing to let Weisselberg talk with Bragg’s office.

Weisselberg is now represented by Seth L. Rosenberg who was a former member of the Manhattan D.A.’s office; Rosenberg has been with Clayman & Rosenberg LLP since 1986.

The late shuffle of attorneys could be a sign that it is the tax fraud for which Trump Org has already been charged that is the predicate to Trump’s 34-count indictment.

This situation would explain why Bragg would have been reluctant to outline the underlying crime when the 34 counts against Trump were filed and Trump was arraigned. Trump has already been manipulating Weisselberg through the legal representation Trump organization has been providing him; it’s reasonable to assume this is an attempt to throttle Weisselberg’s possible testimony against Trump.

What other crime might have been the predicate upon which the Manhattan D.A.’s charges would have relied if not the tax fraud charges against Trump Organization?

What other underlying crime would avoid preemption?

Trump’s People Have Attempted to Cover Up That He Cheated to Cover Up Cheating in 2016 at Least Six Times

Among the things Trump said in his tweet yesterday complaining that he had been “indicated” is that his criminal prosecution was “a continuing attack on our once free and fair elections.”

Thanks to the former President for reminding us what the charges against him, in part, are about: That he cheated to win.

Whether it would have made a difference or not, Donald Trump believed it sufficiently important to lie to American voters about fucking two women– both Karen McDougal and Stormy Daniels — that both were paid in the last months of his 2016 campaign to prevent voters from finding out.

Paying his former sex partners to hide from voters that he cheated on Melania is not, itself, illegal.

Having corporations pay sex workers for the purpose of benefitting a political campaign is. The company that owned the National Enquirer paid for the first payment, to McDougal; Trump Organization, by reimbursing the payment that Michael Cohen made, eventually paid for the second payment, to Daniels.

The charges brought against Trump in NY reportedly relate, at least in part, to the second payment — to the treatment of the reimbursement to Cohen as a legal retainer rather than a reimbursement for a political donation. That is, the cheapskate billionaire, who could have legally paid off the women himself, allegedly covered up his cover-up.

Trump’s eponymous corporate persons have already been found guilty of serving as personal slush funds. In 2019, he admitted the Trump Foundation had engaged in self-dealing. And last year, a jury convicted Trump Organization of compensating employees via untaxed benefits rather than salary.

The new charges against Trump aren’t so much unprecedented, as they simply charge Trump’s biological person with the same crimes for which his corporate persons have already been convicted.

But there’s more history here, too. On multiple occasions, agents of Donald Trump reportedly engaged in further attempts to cover-up this cover-up.

Trump Organization withheld multiple documents from investigators. Most known documents that were withheld — such as the email showing Cohen had a substantive conversation with a Dmitri Peskov aide during the election — pertain to Russia, but it’s certainly possible they withheld others.

In 2018, in the days after SDNY seized phones that included recordings of conversations about the hush payments, Trump is suspected of floating a pardon to Cohen to keep him quiet, about this and about the impossibly lucrative Trump Tower deal both had lied to hide from voters in 2016.

In an email that day to Cohen, [Robert] Costello wrote that he had spoken with Giuliani.1026 Costello told Cohen the conversation was “Very Very Positive[.] You are ‘loved’. . . they are in our corner. . . . Sleep well tonight[], you have friends in high places.”1027

Cohen said that following these messages he believed he had the support of the White House if he continued to toe the party line, and he determined to stay on message and be part of the team.1028 At the time, Cohen’s understood that his legal fees were still being paid by the Trump Organization, which he said was important to him.1029 Cohen believed he needed the power of the President to take care of him, so he needed to defend the President and stay on message.1030

Cohen also recalled speaking with the President’s personal counsel about pardons after the searches of his home and office had occurred, at a time when the media had reported that pardon discussions were occurring at the White House.1031 Cohen told the President’s personal counsel he had been a loyal lawyer and servant, and he said that after the searches he was in an uncomfortable position and wanted to know what was in it for him.1032 According to Cohen, the President’s personal counsel responded that Cohen should stay on message, that the investigation was a witch hunt, and that everything would be fine.1033

Note that the payments for Cohen’s legal fees — which stopped after he pled guilty — are another expense that Trump Organization may not have accounted for properly.

Later in 2018, during the period where he was feigning cooperation with Mueller’s prosecutors but really just stalling past the midterm elections, Paul Manafort attempted to lie about some aspect of a different investigation

Manafort gave different versions of events surrounding an incident in the summer 2016 that was potentially relevant to the investigation: one version that was more incriminating was given prior to signing the plea agreement (on September 13, 2018), and another that was more benign was made after on October 5, 2018, after his plea. When confronted with the inconsistency by the government and his own counsel, Manafort largely retracted the second version.

A footnote in that discussion cites the Cohen plea, suggesting the 2016 conversations that Manafort lied to prosecutors in an attempt to spin pertained to these hush payments.

83 See United States v. Cohen, 18-cr-602 (S.D.N.Y. 2018); Information, United States v. Cohen, 18-cr602 (S.D.N.Y Aug. 21, 2018) (Doc. 2).

Unlike Cohen, of course, Manafort did get a pardon.

In the months after Cohen’s plea, Main DOJ attempted to interfere in the Cohen investigation repeatedly, as laid out in Geoffrey Berman’s book. They did so first on Rod Rosenstein’s orders, by demanding the SDNY rewrite Cohen’s statement of offense to hide the degree to which Trump ordered the hush payments (Rosenstein’s deputy, Ed O’Callaghan tried to eliminate all reference to Individual-1).

We then sent a copy to Rod Rosenstein, informing him that a plea was imminent. The next day, Khuzami, who was overseeing the case, received a call from O’Callaghan, Rosenstein’s principal deputy.

O’Callaghan was aggressive.

Why the length, he wanted to know. He argued that now that Cohen is pleading guilty we don’t need all this description.

[Robert] Khuzami responded, What exactly are you concerned about? O’Callaghan proceeded to identify specific allegations that he wanted removed, almost all referencing Individual-1.

It quickly became apparent to Khuzami that, contrary to what O’Callaghan professed, it wasn’t the overall length or detail of the document that concerned him; it was any mention of Individual-1.

[snip]

The team was tasked with the rewrite and stayed up most of the night. The revised information, now twenty-one pages, kept all of the charges but removed certain allegations, including allegations that Individual-1 acted “in concert with” and “coordinated with” Cohen on the illegal campaign contributions. The information now alleged that Cohen acted in concert and coordinated with “one or more members of the campaign.” But in the end, everything that truly needed to be in the information was still there.

Then, after Bill Barr came in, he amazingly tried to order SDNY to dismiss the charges against Cohen entirely, the functional equivalent of what he tried with Mike Flynn, undoing a successful criminal prosecution after the fact.

When Barr took over in February 2019, he not only tried to kill the ongoing investigations but—incredibly—suggested that Cohen’s conviction on campaign finance charges be reversed.

Barr summoned Rob Khuzami in late February to challenge the basis of Cohen’s plea as well as the reasoning behind pursuing similar campaign finance charges against other individuals. Khuzami was told to cease all investigative work on the campaign finance allegations until the Office of Legal Counsel, an important part of Main Justice, determined there was a legal basis for the campaign finance charges to which Cohen pleaded guilty—and until Barr determined there was a sufficient federal interest in pursuing charges against others.

Barr had Steven Engel write up an OLC opinion about the charges (which is likely one of the reasons SDNY didn’t charge Trump).

About six weeks later, Khuzami returned to DC for another meeting about Cohen. He was accompanied by Audrey Strauss, Russ Capone, and Edward “Ted” Diskant, Capone’s co-chief. Barr was in the room, along with Steven Engel, the head of the Office of Legal Counsel, and others from Main Justice. A fifteen-page memo, drafted by Engel’s office, had been provided to our team the day before, which they were still analyzing. I learned later that it was an intense meeting.

When SDNY refused to dismiss the case against Cohen, Barr tried to transfer the case to EDNY, under Richard Donoghue, so he could kill it.

 About a week after our office tussled with Barr and Engel, Barr attempted to do just that. Word was passed to me from one of Barr’s deputies that he wanted Richard Donoghue, the US Attorney for the Eastern District of New York (who would later transfer to Main Justice to work under Barr), to take over supervision of anything I was recused from.

At the same time that Barr was trying to cover up that Trump cheated to win in 2016, Republicans on the FEC were joining in the cover-up. After FEC’s General Counsel recommended acting on several complaints about the payments, Republican Commissioners Sean Cooksey and Trey Trainor refused to do so because, they said, Michael Cohen had already been prosecuted for it and, thanks to Trump’s own actions, there was a backlog of other complaints.

Before the Commission could consider the Office of General Counsel’s (“OGC”) recommendations in these matters, Mr. Cohen pleaded guilty to an eight-count criminal information,2 and in connection thereto admitted, among other things, to making an excessive contribution in violation of the Act by making the Clifford payment from his personal funds. 3 The plea hearing transcript includes a step by step review of how U.S. District Judge William Pauley verified the plea, confirming that a federal judge was sufficiently satisfied with the circumstances surrounding the plea deal and the responses given by Cohen at the hearing, including the explanations given by Cohen, count by count, during his allocution.4 Ultimately Mr. Cohen was sentenced to three years in prison and ordered to pay $1.39 million in restitution, $500,000 in forfeiture, and $100,000 in fines for two campaign finance violations (including the payment at issue in these matters) and other charges. In sum, the public record is complete with respect to the conduct at issue in these complaints, and Mr. Cohen has been punished by the government of the United States for the conduct at issue in these matters.

Thus, we concluded that pursuing these matters further was not the best use of agency resources.5 The Commission regularly dismisses matters where other government agencies have already adequately enforced and vindicated the Commission’s interests.6 Furthermore, by the time OGC’s recommendations came before us, the Commission was facing an extensive enforcement docket backlog resulting from a prolonged lack of a quorum, 7 and these matters were already statute-of-limitations imperiled.

This was one of 22 credible campaign finance allegations against Trump that Republicans refused to consider, nothing less than a partisan effort to make the leader of their party immune from all campaign finance rules.

There’s a lot of shite being written about how the indictment of a former President — for actions that stem from cheating to win — will test democracy.

But Trump’s serial cover-ups of his own actions in this and other matters already threaten democracy.

Trump is right: This is about free and fair elections. This is, like most of his allegedly criminal behavior, about his refusal to contest elections fairly. It’s about his corruption of the entire Republican Party, from top to bottom. And it’s about one of at least six times that Trump and his agents have tried to cover up that he cheated to win in 2016.

Pavlov’s Press Corps: Trump Once Again Got Journalists to Willingly Serve as His Incitement Mules

When we left the mainstream Trump press corps on Friday afternoon, they were all focused on the decision by Beryl Howell to rule that some of Evan Corcoran’s testimony in the stolen document case was crime-fraud excepted. Sure, there were journalists using wildly exaggerated descriptions for the uniqueness or surprise of the development. But, on Friday, reporters covering Trump’s legal woes were providing factual descriptions of actual newsworthy developments.

At the time, there was a general awareness that an indictment from Alvin Bragg may come next week, but the focus was the stolen documents investigation, in part because some journalists appear to believe that the crime-fraud ruling was some new sign that Jack Smith believed a crime had been committed.

Then, on Saturday morning, on his failing social media platform, the former President tweeted out incitement that included the following, in all caps:

  • An unsubstantiated claim about illegal leaks probably based on Fox News reporting about efforts to prepare for potential violence as a response to a Trump indictment next week
  • An attack on Alvin Bragg’s record on crime
  • A claim Bragg is funded by George Soros, the kind of coded antisemitism Trump is including in virtually all his communications these days
  • An assertion that he would be charged on something that “numerous other prosecutors!” had debunked as a fairy tale
  • An overstatement of the degree to which he is leading in polls and an admission that he is the “former” President
  • A day, Tuesday, when he would be “arrested”
  • A call to “protest,” invoking one of the same cries used to incite a coup attempt on January 6, “take our country back”

The response was almost instantaneous, with one after another journalist screen-capping the tweet in its entirety, some like Kyle Cheney adding no other commentary other than, “🚨 Trumps says he expects to be arrested Tuesday,” with the siren adding to its inflammatory nature. Jonathan Lemire repeated select newsworthy bits — while still including the full screen cap — without mentioning the coded slur on Soros or labeling the entire tweet as obvious incitement; Lemire parroted Trump’s all caps for the purported timing and quoted the incendiary line also associated with January 6.

NEW: Trump is suggesting that he will be ARRESTED ON TUESDAY due to Manhattan DA probe

This is historic: he would be the first former president to be indicted

He urges his supporters to “Protest, take our nation back!”

The absolutely most hysterical tweet magnifying Trump’s words unfiltered came from Jared Holt, a supposed expert on radicalization online, who introduced Trump’s full tweet onto Twitter (where Trump has not tweeted under his own ID since being permitted back on) with the following:

It will be hard to think of a bigger tech moderation failure than if Trump uses the platforms he’s been allowed back onto (FB, YouTube, Twitter) to incite protests again.

As of this morning, Holt’s tweet, along with the screen cap of Trump’s tweet unfiltered, had garnered 230,000 views on Twitter, over 300 RTs and almost 1,700 likes. Lemire’s had garnered 300 quote tweets, almost 600 RTs, over 2,000 likes, and 1.3M views. Cheney’s had garnered 770 quote tweets, 1,200 RTs, 7,400 likes, and 2.6M views.

By publishing such an inflammatory tweet on Truth Social, Trump was rightly calculating that even people like Holt would help to make his unfiltered words go viral on Twitter, as Trump has consistently done during the period when he still remained banned on Twitter.

It’s like Pavlov’s dogs, pure reflexive behavior at this point: The more incendiary Trump’s tweets, the more quickly journalists rush to disseminate them unfiltered on Twitter.

Remarkably, neither Lemire nor Cheney noted the import of the fact that a habitual liar like Trump was only claiming that he expected to be arrested Tuesday, not that he knew he would be.

In its report on the tweet, NYT noted, even in the subhead, that the timing was unclear, but given that at least one more witness is expected to testify on Monday, a Tuesday arrest is unlikely. It further described that Trump’s team was already in discussions about how to minimize the kind of showy arrest Trump was promising on Truth Social. NYT went on to report how Trump’s team simply guessed the date of his arrest.

His indictment by a Manhattan grand jury is expected, but its timing is unclear.

[snip]

Two hours later, a spokesman issued a statement saying that Mr. Trump had not written his post with direct knowledge of the timing of any arrest,

[snip]

Prosecutors working for Mr. Bragg have signaled that an indictment of Mr. Trump could be imminent. But they have not told Mr. Trump’s lawyers when the charges — expected to stem from a 2016 hush money payment to a porn star — would be sought or an arrest made, people with knowledge of the matter said. At least one more witness is expected to testify in front of the grand jury, which could delay an indictment, the people said.

One of the people said that even if the grand jury were to vote to indict the former president on Monday, a Tuesday surrender was unlikely, given the need to arrange timing, travel and other logistics.

The statement from Mr. Trump’s spokesman did not explain how he had landed on Tuesday as an arrest date. One person with knowledge of the matter said that Mr. Trump’s advisers had guessed that it could happen around then, and that someone might have relayed that to the former president.

A lawyer for Mr. Trump, Susan R. Necheles, said that his post had been based on news reports,

CNN, including Kaitlan Collins, who was among the first to help disseminate this incendiary tweet, later reported on the legal discussions going on inside Trump’s camp.

Trump’s defense team is expected to be notified following any possible indictment and then they would engage in negotiations for surrender and an initial appearance.

Another witness is expected to testify Monday before the grand jury investigating the hush money payments, according to a source familiar with the investigation. It is not clear whether this would be the final witness before it votes on a possible indictment.

Trump’s team has said repeatedly that he will not accept an invitation to testify before the grand jury. But multiple sources familiar with his legal team’s thinking says that if there is an indictment, he would negotiate an agreed upon surrender date with the district attorney’s office.

Trump’s team has been huddled all week planning for various scenarios, including Trump traveling to New York as well as having a remote hearing where he stays at Mar-a-Lago, according to sources familiar with the meetings.

Some members of his legal team are advising Trump to ask for a remote appearance for security reasons should an indictment occur but it is unclear if he would agree to that as he has also discussed with his team wanting to give a statement at the courthouse, sources said.

But before it got to those details, CNN described that the tweet was just a political ploy based off a guess about timing.

The former president has been agitating for his team to get his base riled up and believes that an indictment would help him politically, multiple people briefed on the matter told CNN.

[snip]

Joe Tacopina, an attorney for Trump, later said the former president had based his claims on press reports.

“No one tells us anything which is very frustrating. President Trump is basing his response on press reports,” Tacopina said in a statement to CNN.

In other words, the most newsworthy detail in Trump’s tweet (beyond the incitement) — the day he would be charged — was just made up, a guess based off the same information all the rest of us have. It was nevertheless treated as newsworthy by a slew of journalists needing an excuse to disseminate unfiltered incendiary speech on Twitter. And no one has since gone back to amend their original tweets to note that Trump’s claims to know the date of his arrest were a lie.

Trump’s team simply guessed what day he’ll be charged so as to make a call to fight newsworthy enough for kneejerk journalists to help it go viral for him.

It worked.

It works every single fucking time Trump does this.

Every. Single. Time.

And it’s not just the fact that a bunch of journalists served as willing data mules for Trump’s incendiary tweet, bringing it onto Twitter for him and helping it to go viral in unfiltered form.

It’s the other effect the tweet had on reporting about Trump.

First, everyone completely dropped the significant development in a case that even a number of diehard Republicans think has real gravity, Trump’s refusal to return all the classified documents he stole. That story — a burning story late into Friday — utterly disappeared by Saturday morning. Trump is so good at playing the media that he can effectively just dictate what even CNN and MSNBC will cover. And his tweet managed to make that more damaging investigation — an investigation led by a white man rather than a Black one, and so harder to use to mobilize Trump’s most racist followers — completely disappear from coverage. Journalists who had broken key details about the crime-fraud ruling Friday were instead asked to cover Trump’s tweet on the cable shows on Saturday.

And it wasn’t just cable coverage that Trump’s incendiary tweet managed to dictate. One after another politician — Kevin McCarthy, Mike Pence, Elise Stefanik (who released then deleted multiple drafts before hers was sufficiently dripping in obsequious propaganda) — was forced to comment on the made up news that Trump has a date when he’ll be indicted. Even poor Asa Hutchinson, who was trying hard to launch a Presidential run that didn’t define itself entirely in terms of Trump, was forced to answer multiple questions about Trump’s tweet.

In other words, by releasing the tweet, Trump not only made it the sole focus of cable programming, but made it the leading political question of the day. He made the presidential race about him again, exclusively about him. And in the case of McCarthy and Stefanik — both of whom cling to power by ceaselessly performing their obeisance to Trump — made it a matter of loyalty, a political litmus test that Trump supporters and opponents alike would be required to publicly adhere to.

Finally, all this was done without any mention of the actual facts of the case. All this was done in a way guaranteed to short-circuit rational thought — that’s the point.

To be clear, I don’t know all that many people who are sure this is going to be a substantive indictment, and there are real questions about how it is not time-barred. Perhaps Bragg will surprise us, but even many lefties are skeptical about the legal soundness and wisdom of this indictment.

But the substance of it stems from Trump fucking a sex worker.

He fucked a sex worker then paid her to cover it up. And then, in his efforts to cover that up, Trump engaged in some dodgy corporate accounting. There may be other exacerbating factors, like witness intimidation. But this is about trying to cover up the fact that he fucked a sex worker so it wouldn’t harm his chances of becoming President.

This case involves a crime for which, under Jeff Sessions, SDNY prosecuted Trump’s personal lawyer, Michael Cohen. One reason Trump wasn’t prosecuted as a result is that Bill Barr interfered; Barr even tried to force SDNY to reverse Cohen’s prosecution. And when Cohen went to jail because he refused to cover up Trump’s efforts to cover up fucking a sex worker, Trump cut him off, making him a pariah. Trump’s tweet falsely claimed that multiple prosecutors had deemed this case bullshit when instead he means his own Attorney General engaged in breathtaking corruption to protect him from it.

We don’t know what the indictment includes. But we know it involves fucking a sex worker. And all the journalists repeating Kevin McCarthy’s bullshit comments about investigating this investigation, or Mike Pence’s comments about how measly an indictment this would be, are not making them go on the record about whether they think voters should know if someone is spending significant money — several times what most Trump supporters make in a year — to cover up that they fucked a sex worker. Does Mike Pence, that god-fearing Christian, think a man who paid six figures then engaged in financial fraud to cover up that he fucked a sex worker should be President? Let’s ask him.

That’s not happening, in significant part because Trump has gotten journalists to shed all rationality when reporting on this story. The point is to make this about emotion, not facts, and journalists’ immediate instincts accommodated that.

Because Trump went on offensive, the substance of the indictment — however flimsy or not — has been largely absent from any reporting on the case.

Trump has these journalists trained to act reactively, without taking the time first to figure out whether he was again making shit up (as he was in this tweet). He has these journalists trained to mindlessly help him disseminate antisemitic incitement on platforms he’s not a part of, usually without commentary identifying that’s what he’s doing. Trump is so good at exploiting journalists who know better that he has made them participants in his incitement.

And it could well get people killed.

Updated: Added the circulation numbers for the three tweets disseminating Trump’s incitement.

Guo Wengui Arrested

Steve Bannon’s sometime partner Guo Wengui was arrested this morning on a sweeping indictment charging a $1 billion conspiracy, four sets of wire and security fraud charges each tied to a particularly business, as well as other money laundering charges.

It will take (me at least) some time to understand the full scope of the alleged behavior.

But for now, know that SDNY started seizing some of the proceeds of this fraud last year, and will now move to seize the yacht on which Bannon was arrested for his own fraud indictment, as well as some $36K mattresses Guo bought with the proceeds of his alleged fraud.

Update: Dave Weigel reminds that Guo found $75,000 to support CPAC, in spite of his claimed bankruptcy.

And the New Federal State of China, “declared” three years ago by Steve Bannon and exiled Chinese businessman Guo Wengui, made its first CPAC appearance with a $75,000 sponsorship, and two high-tech booths where volunteers handed out leaflets and explained why the battle to destroy the CCP had to be won in America.

That isn’t hyperbole. “The elimination of the Chinese Communist Party is essential in breaking the shackles of slavery imposed on the Chinese people,” Bannon said at the 2020 ceremony launching the NFSC, “and also, in bringing about peace to the international community and all mankind.” Guo, citing “Chinese culture,” pricked his finger and signed the declaration with his blood.

The Bannon-Wengui partnership burst into the headlines before the 2020 election, when Bannon was arrested on Guo’s yacht on charges that were later superseded by a pardon from President Trump. Guo declared bankruptcy last year, claiming that his wealth had dwindled to less than $100,000. But their flashy CPAC presentation, including some advocates who described fleeing China after the 1989 massacre at Tiananmen Square, found a receptive audience, and rhymed with what was happening on the main stage.

Maggie Haberman’s Foray into Campaign Finance Journalism

I started unpacking this Maggie Haberman story yesterday morning.

It was an unusual story. Love or hate Maggie, she’s a really hard working journalist. But her forté is working phones, not documents.

Nevertheless, Maggie set out alone, without the involvement of an expert on documents generally or the FEC specifically (someone like David Fahrenthold) to explain why Jack Smith’s prosecutors are subpoenaing vendors of Trump’s Save America PAC.

The Justice Department has been subpoenaing documents from vendors paid by the PAC, including law firms, in an effort to determine what they were being paid for.

It seemed to be a follow-up to this story, which, by suggesting that JP Cooney had only joined the team with Smith’s hiring, falsely implied that DOJ had only started pursuing this angle after his appointment.

Three of his first hires — J.P. Cooney, Raymond Hulser and David Harbach — were trusted colleagues during Mr. Smith’s earlier stints in the department. Thomas P. Windom, a former federal prosecutor in Maryland who had been tapped in late 2021 by Attorney General Merrick B. Garland’s aides to oversee major elements of the Jan. 6 inquiry, remains part of the leadership team, according to several people familiar with the situation.

In addition to the documents and Jan. 6 investigations, Mr. Smith appears to be pursuing an offshoot of the Jan. 6 case, examining Save America, a pro-Trump political action committee, through which Mr. Trump raised millions of dollars with his false claims of election fraud. That investigation includes looking into how and why the committee’s vendors were paid.

In December, CNN reported that Cooney had been following the money for a year by that point, and even the NYT noted overt signs of that prong in September.

That earlier story nodded towards the same thing that this Daily Beast story, the January 6 Committee Report appendix on following the money, and this Campaign Legal Center complaint (the latter, focused on the 2020 campaign) did: Trump has apparently been treating campaign fundraising like a money laundering vehicle.

Go figure.

But Maggie, writing on her own, focuses instead on prospective crimes: the possibility that continuing to pay legal bills out of money raised starting in 2020 would be a different campaign finance violation.

Some of the $16 million appears to have been for lawyers representing witnesses in investigations related to Mr. Trump’s efforts to cling to power. But the majority of it — about $10 million — went to firms directly representing Mr. Trump in a string of investigations and lawsuits, including some related to his company, the filings showed.

Back in November, CLC did a report noting that Trump was doing that more generally, not just with lawyers.

All that’s not actually why I was interested in the story, but if you want an accounting of how much PAC money Trump is spending on legal services, Daily Beast’s tally includes the money spent by the MAGA PAC as well, adding up to $29.1 million since leaving office.

After I started unpacking Maggie’s story, I got distracted with the possibility that DOJ will tie Trump and Rudy Giuliani and John Eastman directly to the almost-murder of Michael Fanone. So, in the interim, Maggie broke the news that Smith’s prosecutors had subpoenaed Jared and Ivanka.

That story, written with Mike Schmidt, is exceptional only for the fact that they managed to avoid most of the hype about “aggressive steps” that peppers most reporting on Jack Smith. It pointed to things like the morning Oval Office meeting (Ivanka’s response to which her Chief of Staff Julie Radford was likely already questioned about, since — as the J6C Report noted explicitly — Radford was far more candid about it than Ivanka) and efforts to get Trump to call off his mob as likely topics of questioning.

Smith no doubt wants to get Jared and Ivanka’s stories about such topics locked in. Given questions about their candor before J6C, too, Smith will likely also give them an opportunity to revise their prior answers so they more closely match known facts.

Back to Maggie’s solo endeavor to read FEC filings.

There are two reasons I was interested in the story. First, having looked at FEC filings, Maggie seems to have discovered that the $195,000 in services that Boris Epshteyn billed to Save America PAC last year were not for legal services, but instead strategic consulting.

Another $1.3 million went to Silverman Thompson Slutkin and White, the firm of Evan Corcoran, a lawyer who began working with Mr. Trump last spring. Mr. Corcoran was brought into Mr. Trump’s orbit by Boris Epshteyn, a strategist who has played a coordinating role with some of the lawyers in cases involving Mr. Trump, as the investigation related to the Mar-a-Lago documents was heating up. (Mr. Epshteyn’s company was paid $195,000, but for broader strategic consulting, not legal consulting specifically.)

This is an important point, but one Maggie did not highlight (nor issue corrections on past stories). For the entirety of the time that Epshteyn was quarterbacking Trump’s response to the stolen documents probe, someone in his immediate vicinity has been telling reporters that he was playing a legal function, all the while billing Trump for the same old strategic consulting his firm, Georgetown Advisory, normally provides (though the two payments the campaign made to Epshteyn after Trump formalized his candidacy, totalling $30,000, were filed under “communications and legal consulting”).

NYT has, in various stories including Maggie in the byline, described Epshteyn’s role in the stolen documents case as “an in-house counsel who helps coordinate Mr. Trump’s legal efforts,” “in-house counsel for the former president who has become one of his most trusted advisers,” and “who has played a central role in coordinating lawyers on several of the investigations involving Mr. Trump.” Another even describes that Epshteyn “act[ed] as [a] lawyer [] for the Trump campaign.” The other day, Maggie described his role instead as “broader strategic consulting.”

All the time that NYT was describing Epshteyn as playing a legal role — and NYT is in no way alone in this — he was telling the Feds he wasn’t playing a legal function, he was instead playing a strategic consulting one. Many if not most of these stories also post-date the time, in September, when the FBI seized Epshteyn’s phone, which would give him a really good reason to try to claim to be a lawyer and not a political consultant.

DOJ is more likely to take FEC’s word on this issue than claims Epshteyn made to the press after his phone seizure.

Like I said, virtually every media outlet seems to be repeating the claim that Epshteyn has been playing a legal, not political role. But there’s one Maggie story, in particular, where the question of Epshteyn’s role is central: This story, quoting Eric Herschmann calling Epshteyn (and Evan Corcoran) idiots, a habit that made Herschmann a star witness for the January 6 Committee. Herschmann’s glee about calling Sidney Powell, Jenna Ellis, John Eastman, and now Epshteyn and Corcoran idiots always distracted from sketchier aspects of Herschmann’s behavior, such as Keith Kellogg’s puzzlement about why a lawyer sat in the Oval Office while Trump ordered Mike Pence to break the law and said nothing.

Anyway, this Maggie story focusing on Epshteyn’s role not only called him an idiot, but also insinuated he was witness tampering.

To the extent anyone is regarded as a quarterback of the documents and Jan. 6-related legal teams, it is Boris Epshteyn, a former campaign adviser and a graduate of the Georgetown University law school. Some aides tried to block his calls to Mr. Trump in 2020, according to former White House officials, but Mr. Epshteyn now works as an in-house counsel to Mr. Trump and speaks with him several times a day.

Mr. Epshteyn played a key role coordinating efforts by a group of lawyers for and political allies of Mr. Trump immediately after the 2020 election to prevent Joseph R. Biden Jr. from becoming president. Because of that role, he has been asked to testify in the state investigation in Georgia into the efforts to reverse Mr. Biden’s victory there.

Mr. Epshteyn’s phone was seized by the F.B.I. last week as part of the broad federal criminal inquiry into the attempts to overturn the election results and the Jan. 6 assault on the Capitol.

[snip]

In his emails to Mr. Corcoran and Mr. Rowley, Mr. Herschmann — a prominent witness for the House select committee on Jan. 6 and what led to it — invoked Mr. Corcoran’s defense of Mr. Bannon and argued pointedly that case law about executive privilege did not reflect what Mr. Corcoran believed it did.

Mr. Herschmann made clear in the emails that absent a court order precluding a witness from answering questions on the basis of executive privilege, which he had repeatedly implored them to seek, he would be forced to testify.

“I certainly am not relying on any legal analysis from either of you or Boris who — to be clear — I think is an idiot,” Mr. Herschmann wrote in a different email. “When I questioned Boris’s legal experience to work on challenging a presidential election since he appeared to have none — challenges that resulted in multiple court failures — he boasted that he was ‘just having fun,’ while also taking selfies and posting pictures online of his escapades.”

[snip]

In language that mirrored the federal statute against witness tampering, Mr. Herschmann told Mr. Corcoran that Mr. Epshteyn, himself under subpoena in Georgia, “should not in any way be involved in trying to influence, delay or prevent my testimony.”

“He is not in a position or qualified to opine on any of these issues,” Mr. Herschmann said.

Mr. Epshteyn declined to respond to a request for comment. [my emphasis]

The story ends by reporting that Herschmann’s, “testimony was postponed.”

I’m not aware of any report that describes Herschmann has been called back to testify.

The story is dated September 16, 2022.

Two days earlier, Cassidy Hutchinson had testified to the January 6 Committee (after already beginning to cooperate with DOJ) that after she testified on May 17 that Herschmann was present for a conversation about Trump saying that “Hang Mike Pence” chants were justified, her then-lawyer Stefan Passantino seemingly contacted Herschmann who then called Hutchinson and told her, “I didn’t know that you remembered so much.”

Ms. Cheney. When Stefan said “I’ll talk to some people,” do you know who he was referring to?

Ms. Hutchinson. I didn’t ask. assume it was the same entourage of people that he had been conferring with for the past few weeks.

You know, I had also received a call from Eric Herschmann, I believe on Friday, May 20th. I believe it was Friday, May 20th. It was, because this was after the interview.

And Eric called me that evening, and I just apologized. And he was like, you know, “I didn’t know that you remembered so much, Cassidy. Mark [Meadows] really put you in bad positions. I’m really sorry that he didn’t take care of you better. You never should’ve had to testify to any of that. That’s all of our jobs. I don’t know why they didn’t ask us, they asked you instead.”

And I was just like, “Look, Eric like, it is what it is.” And he kind of talked for — it was probably a 30-minute conversation.

In the same J6C appearance two days before that Maggie story painting Ephsteyn as a witness tamperer, Hutchinson told the committee that she suspected that Passantino had spoken to Maggie about her testimony, something that, if true, would have had the effect of sharing her testimony with other witnesses without appearing to obstruct the investigation. She also described Alex Cannon to be involved in the outreach to Maggie.

The next day, September 15, Hutchinson provided the committee more detail about Passantino’s alleged efforts to share her testimony with Herschmann and others. Passantino told her to call Trump’s lawyer, Justin Clark, as well as Alex Cannon and Eric Herschmann, Hutchinson told the committee on September 15.

The day after my third interview with the committee, on Wednesday, May 18th, Stefan let me know that I — he spoke with Justin Clark, Alex Cannon, and Eric Herschmann and suggested that I call — that I have a call with all three of them.

I reached out to initiate the call with Alex Cannon and Justin Clark per Stefan’s instruction. And the that Friday, May 20th, received a call on Signal from Eric Herschmann.

So on September 14, Hutchinson told J6C about behavior involving Herschmann resembling witness tampering, including behavior involving Maggie Haberman! On September 15, Hutchinson told J6C about behavior involving Herschmann resembling witness tampering. And on September 16, Maggie Haberman quoted Herschmann blaming Epshteyn for any witness tampering.

All that background is why I find the way Maggie ended her foray into campaign finance journalism so interesting. She quotes anonymous sources — not the public J6C transcripts showing that Passantino and Alex Cannon were sourcing her earlier reporting on this — attributing Hutchinson’s testimony as the genesis of this focus on paying law firms.

The questions of which lawyers and vendors have been paid, and for what, intensified after the House select committee investigating Mr. Trump’s efforts to cling to power told the Justice Department that it had evidence that a lawyer representing a witness had tried to coach her testimony in ways that would be favorable to Mr. Trump. The witness in question was later identified by people familiar with the committee’s work as Cassidy Hutchinson, a former White House aide.

Her lawyer at the time, Stefan Passantino, was a former White House deputy counsel under Mr. Trump and was paid through Save America.

The reason I’m interested in this is because the point of Passantino’s alleged efforts to coach Hutchinson’s testimony was not, primarily, to protect Trump. According to Hutchinson’s testimony, at least, it was to protect Eric Herschmann, someone who has had tremendous success (like his close associate Jared Kushner) laundering his reputation through Maggie Haberman.

Ms. Hutchinson. ~ You previously asked about individuals he had raised with me. In my conversation with him earlier that afternoon, when I [sic] asking him about the engagement letter, I did also ask Stefan if he was representing any other January 6th clients. And he had said, “No one that I believe that you would have any conflicts with.”

And I said, “Would you mind letting me know?” Now, again, to this day, I still don’t know if that’s really a kosher question to ask an attorney, if they can share their clients with me, but I wanted to make sure that there actually weren’t any conflicts, because I didn’t have anything in writing.

He wouldn’t tell me anybody he was representing before the January 6th Committee, but he did tell me that he had previously represented Eric Herschmann and Jared Kushner and Ivanka Trump in unrelated matters.

And in that same conversation, he said, “So if you have any conversations with any of them, especially Eric Herschmann, we want to really work to protect Eric Herschmann.”

And I remember saying sarcastically to him, “Eric can handle himself. Eric has his own resources. Why do I have to protect Eric?” He said, “No, no, no. Like, just to keep everything straight, like, we want to protect Eric with all of this.”

Ms. Cheney. Did he explain what he meant?

Ms. Hutchinson. No. And, to be honest, I didn’t ask. I didn’t have anything with Eric anyway that I felt that I had to protect. And I say that because, at the time of being back in Trump world — this is where I look back and regret some of this, but — like, I did feel a need to protect certain people. But with somebody like Eric, I didn’t feel that need, I didn’t find it necessary.  didn’t — I didn’t think that Eric did anything wrong at the time.

Ms. Cheney. Did it have something to do with NARA?

Ms. Hutchinson. He never really explained to me what it was exactly that we wanted to protect Eric on. I sort of erred on the side of: Maybe he just represents Eric in ongoing litigation, whether it’s financial disclosures or whatever it might be.

And, again, I just didn’t prod too much on that either, because, you know, I was under the impression that Eric helped set me up with Stefan, so I didn’t — I was worried that Stefan would then go back-channel to Eric and — this is my very paranoid brain at the time, but I was worried that if I, you know, pushed this subject a little too much, that he would then go back to Eric Herschmann and say, “Cassidy asked a lot of questions about you, like, why she needs to protect you.” So just didn’t really press the subject too much on that.

And as Hutchinson learned somewhat belatedly, Passantino had business ties to Alex Cannon and, possibly, Herschmann.

So I — “I want to make sure that I’m getting the dates right with these things?

He goes, “No, no, no.” He said, “Look, we want to get you in, get you out.

We’re going to downplay your role. You were a secretary. You had an administrative role. Everyone’s on the same page about this. It’s extremely unfair that they’re” “they’re” being the committee – “that the committee is putting you in this position in the first place. You really have nothing to do with any of this. It’s Mark’s fault that you’re even involved in this. We’re completely happy to be taking care of you now. We had no idea that you weren’t being taken care of this last year. So we’re really happy that you reached back out to us. But the less you remember, the better. I don’t think that you should be filling in any calendars or anything.”

[Redacted] When he said a

Ms. Cheney. Go ahead.

[Redacted] So everyone’s on the same page about this, did he explain who he was referring to when he said “everyone”?

Ms. Hutchinson. He didn’t at that moment. Then there are times throughout my working relationship with Stefan where he said similar things that I asked.

Later that day, sort of put together that the “they” he was referring to then were Justin Clark, Alex Cannon, Eric Herschmann. I think that’s — yeah, think that’s all of them.

Ms. Cheney. And how did you put that together?

Ms. Hutchinson.  Because he — he had said that — Justin — yeah, Justin Clark. Stefan had told me that — towards the end of the day that because he was involved with Elections, LLC, and tangentially, I guess Trump’s PACs, he had law partners. And unless I was extremely unwilling for him to share, he said it would be natural for him to have to share that information with the people that he works with that are his partners that are involved in Trump world.

That is, Hutchinson testified that Passantino’s alleged effort to coach her testimony was not (necessarily) an effort to protect Trump. It was an effort to protect his business scheme, a business scheme that may have included Herschmann.

In Maggie’s foray into campaign finance journalism, she did not calculate payments to Elections LLC in her discussion of law firms paid by Save America PAC, though it was paid upwards of $400,000 since Trump left office. The last of those payments — for $10,000 — was on December 7, after Trump formalized his 2024 presidential bid. So if Maggie’s right that these payments are illegal, then that $10,000 would be one of the first overt acts in this new criminal exposure.

As it happens, all this ties back to Maggie’s newest story breaking the news of a subpoena to Ivanka and Jared. I’m sure Jack Smith wants to ask Ivanka and Jared about their efforts to get dad to call off his mob.

But he may also want to know why Herschmann — a lawyer whose legal status in the White House remains entirely unexplained — why Herschmann, according to Pat Cipollone’s testimony, told the White House Counsel not to join in that Oval Office meeting where Trump ordered Pence to break the law because “this is family.”

“This is family,” Cipollone said Herschmann told him before he walked in the door. “You don’t need to be here.”

I would imagine that Jack Smith wants to know why, at that moment when Trump prepared to give his Vice President an illegal order, Herschmann was treated as family.

Update: Anna Bower informed me that Epshteyn told the Fulton County Grand Jury that he,

served as a legal, communications, and policy advisor to President Trump’s 2020 re-election campaign; and he continues to serve as legal counsel to President Trump to this day.

He cited NY state’s bar rules to argue that his ethical obligations extend well beyond attorney-client privilege.

In contrast, the client confidences that Mr. Epshteyn is required to safeguard as a New York-licensed attorney pursuant to Rule 1.6 of the New York Rules of Professional Conduct (“NYRPC”)4 reach a broader and less easily identifiable array of communications and information. Like its corollary rule in virtually every U.S. jurisdiction, NYRPC 1.6 provides that “[a] lawyer shall not knowingly reveal confidential information … or use such information to the disadvantage of a client or for the advantage of the lawyer or a third person” absent client consent or “to comply with other law or court order.” NYRPC l.6(a)-(b). The rule defines “Confidential Information” to mean “information gained during or relating to the representation of a client, whatever its source, that is (a) protected by the attorney-client privilege, (b) likely to be embarrassing or detrimental to the client if disclosed, or ( c) information that the client has requested be kept confidential.” NYRPC 1.6(a)(3). The duty to preserve client confidences under Rule 1.6 is much broader that the attorney-client privilege, it includes any information gained during the representation regardless of its nature or source, and it necessarily includes information that is not subject to any other privilege or protection, provided that it is not already generally known in the community.

Epshteyn has always had a far stronger case he was working in a legal role starting in April or May of last year than while he was on the campaign (where he was described by other witnesses, like Jenna Ellis was also described, as playing a PR role).

In public comments from Emily Kohrs, she suggested that Rudy, who was barred in NY still when he represented Trump during the 2020 election, provided thoughtful question by question answers about whether he could answer questions.

On emptywheel’s Continued Obsession with Delayed Oligarch Associate Arrests

A while back, I did a series of posts showing how, in late September, DOJ got a series of indictments targeting Oleg Deripaska and those who facilitated his sanctions violations. We didn’t see all that until months later (and I wouldn’t be surprised if there were a few stray indictments we haven’t seen yet).

That’s why I’m interested in the timing and venue for indictments of two men who facilitated Viktor Vekselberg’s alleged sanctions violations. The indictments were obtained in November, but they were rolled out yesterday. DOJ indicted, separately, Richard Masters (who was arrested in Spain yesterday) and Vladislav Osipov (who remains at large and, presumably, untouchable) for conspiring with each other. The indictments are connected to, and follows, the seizure of Vekselberg’s yacht, the Tango, in April.

The indictments themselves are standard sanctions violations ones. After the legal background on IEEPA (the law behind such sanctions) and the Bank Secrecy Act, a Ukraine-related sanctions under which Vekselberg was sanctioned (though without naming him), it lays out the Panamanian shell companies (which the seizure affidavit identifies as “Arinter”) through which Vekselberg allegedly owns the Tango and the yacht management company Masters runs, Master Yachts Safety, in Mallorca.

The corporate entities are the lead co-conspirators. Masters and Osipov only rank as Co-Conspirator 3 and 4, respectively.

There’s little surprising in the overt acts. One paragraph describes how, in September 2019, the co-conspirators changed the ownership structure of the Panamanian shell company so that Individual 1 (often used to describe someone who should be lawyering up) would appear to own the shell company and through it the yacht, instead of Vekselberg. Then, on March 9, 2022, in the wake of new sanctions after the invasion of Ukraine, Osipov instructed one of the yacht management company’s employees to restrict sharing of Individual 1’s association with the yacht.

The basis for the sanctions in the US includes a $1.3 million December 2017 payment from Vekselberg to the Panamanian shell company, which went through a correspondent bank in Connecticut, and a March 21, 2018 payment from the Panamanian shell company to a Russian company owned by Vekselberg, which went through another US correspondent bank. It also describes 41 payments, which span from December 6, 2018 through December 9, 2021, to an American Internet Service Provider. It describes some payments in 2020, 2021, and 2022 for things for the yacht, including a $2,600 payment to a US manufacturer for luxury robes for the Tango; two such payments for luxury robes also make up two counts of sanctions violation. Then there are five counts of money laundering for payments for services for the yacht.

Some of this, as well as more detail on the shell companies involved, is laid out in the seizure affidavit. The affidavit makes no mention of Osipov, however. It names the Panamanian Corporate Directors, mentions the Swiss bank account, even mentions transfers involving Master Yachts, but does not mention who was directing some of all that.

Which is one reason I find the existence of the two indictments curious. That would have made it possible to arrest Masters without revealing Osipov’s name (though references to Osipov in Masters’ indictment would presumably have been obvious to him). While the indictments of the men were announced in the same press release, the URLs for the press release files are  5 digits apart (1563251 and 1563256). And assuming that Masters has remained in Mallorca since November managing other yachts, he could have been arrested two months ago.

Meanwhile, the venue is curious. The press release ties this into the KleptoCapture initiative rolled out in the wake of the Russian invasion. That effort is led out of SDNY, though the Deripaska actions were charged in EDNY. And it’s likely Masters, if the extradition succeeds, would be first flown into EDNY (often JFK) or EDVA (Dulles), which is often how venue is assigned. The venue in DC is all the more curious given that it was investigated in Minneapolis: “The FBI Minneapolis Field Office is investigating the case.”

The only explanation in the indictment for a DC indictment is that,

Acts and omissions in furtherance of the offenses alleged herein occurred within the District of Columbia.

That suggests the venue lies, in part, on the conspiracy to defraud Treasury.

Or maybe it’s another Federal agency.

While the MN-based FBI affiant works on sanctions cases, she says she is, “currently assigned to conduct investigations involving the illegal export of controlled items, which are regulated by the U.S.” Fancy bath robes are not controlled items nor are any of the other items bought in the US for use on the Tango described in the indictment, at least not obviously. Given Vekselberg’s tech ties, I do wonder if there’s not something more.

In any case, DOJ may soon have an expert in yacht laundering in its custody, someone who might be able to help unpack other laundered yachts.

image_print