Peter Smith Had a Penchant for Secrecy, But Whence Might Be More Interesting Than How

After a long period of press disinterest in the Peter Smith operation during election year, the WSJ has an important story that describes that “investigators” are (predictably) showing intense interesting in the Republican rat-fucker’s efforts, which extended to working with presumed Russian hackers, to find Hillary’s deleted emails.

Before I address the headline claim of the story — about Smith’s secrecy — I’d like to lay out what the story actually describes.

Way at the end of the story, it provides evidence that casts doubt on the claim Smith killed himself last year — an on the record quote from retired Wall Street financier Charles Ortel, who had been involved in the anti-Clinton effort, describing correspondence with Smith in the days before he died laying out optimistic future plans.

As regards the Clinton email effort itself, the story says that the Smith effort “remain[s] of intense interest to federal investigators working for special counsel Robert Mueller’s office and on Capitol Hill,” suggesting it relies on both Hill sources and people who know what Mueller is up to (the latter of which up to this point, has always been mediated through witnesses). In key places in the story, it conflates those two investigations, which doesn’t necessarily mean witnesses making claims about Mueller’s intensifying focus are wrong, but does show real sloppiness on the part of the reporting, which invites some skepticism about the significance of the conclusions offered (including the article’s focus on Mike Flynn role in Smith’s rat-fuck; click through to read that).

People familiar with the investigations described Mr. Smith’s activities as an area of expanding interest.

The article also relies on documents, which it describes to include emails and court records, including:

  • Court records involving Smith associate John Szobocsan’s efforts to get Smith’s estate to repay him for legal fees associated with three interviews with the Mueller team and an August grand jury appearance (which is pretty good evidence of Mueller’s focus, though not why).
  • Correspondence showing Smith asking associates to “folder,” writing drafts in a Gmail account under the fake name of Robert Tyler, that both the associates and Smith had access to.
  • “[A]n email in the ‘Robert Tyler’ [foldering] account [showing] Mr. Smith obtained $100,000 from at least four financiers as well as a $50,000 contribution from Mr. Smith himself.” The email was dated October 11, 2016 and has the subject line, “Wire Instructions—Clinton Email Reconnaissance Initiative.” It came from someone calling himself “ROB,” describing the funding as supporting “the Washington Scholarship Fund for the Russian students.” The email also notes, “The students are very pleased with the email releases they have seen, and are thrilled with their educational advancement opportunities.” The WSJ states that Ortel is not among the funders named in the email, which means they know who the other four funders are (if one or more were a source for the story, it might explain why WSJ is not revealing that really critical piece of news).

The WSJ really bolloxes describing the significance of the timing of this email as coming,

just days after WikiLeaks and the website DCLeaks began releasing emails damaging to Mrs. Clinton’s campaign and four days after the U.S. government publicly warned that Russia was attempting to interfere in the U.S. election

What it means is that it came just four days after the Podesta emails first started coming out, suggesting that the reference to Russian students is actually code for happiness about the emails already being released by the Russians.

For reasons I’ll return to, the suggestion Smith and his fellow rat-fuckers appear to have been using code to discuss already released emails that were neither Clinton Foundation nor deleted emails are really interesting.

With all that in mind, here are Smith’s adopted methods of secrecy (beyond whatever funding methods are described in the email; Buzzfeed talked about different suspicious transactions here):

  • The apparent code used by an unidentified person, which appears to show conspirators speaking about stolen emails in the guise of a student fund in DC
  • Foldering — a method for which law enforcement has had effective countermeasures that have been widely publicized since the David Petraeus case, the use of which Smith committed to correspondence that got shared outside of the immediate conspirators
  • A burner phone or phone number: “one phone number that he used for sensitive matters”
  • Proton Mail or similar: “a commercially available encrypted email account”
  • Encryption not described to be anything beyond typical full disk encryption (but which could be PGP)

The code is interesting and perhaps intentionally damning. But fat lot of good either the code or the foldering does if the emails in question bear the smoking gun subject line, “Wire Instructions—Clinton Email Reconnaissance Initiative,” to say nothing of the correspondence that commits to writing that they’re using foldering. Indeed, using code in an email with an uncoded subject line is the opposite of good operational security; it serves instead as a blinking red light telling investigators where to look and that the code is code. “Bobby Three Sticks Read Me!!!”

As for the other things — basically the use of encryption and a burner that, given that it was discovered, wasn’t narrowly enough executed — they show an effort to use secrecy. But not a successful effort to do so.

Further, with regards to encryption, this Politico article from last year reveals Royal O’Brien (who, except for the context, might be a candidate to be the October 11 email described by WSJ) advising Smith about PGP, which suggests any non-commercial encryption may have been adopted after key parts of the conspiracy took place.

In an email chain from October obtained by Politico, Smith sought the advice of a tech-savvy business associate about concerns that WikiLeaks had been attacked by hackers. In the email, the associate, Royal O’Brien, a Jacksonville-based programmer Smith described as a dark web expert, advised Smith about the use of PGP keys for encryption and opined that anyone who launched an attack on WikiLeaks would likely face stiff blowback from the group’s web-savvy supporters.

All of this leads me to be more interested in where the methods adopted imperfectly by this 80 year old came from than that he did. An obvious candidate is Chuck Johnson, whose cooperation with the Smith rat-fuck is detailed in the Politico article, and whose businesses have all been shutting down in recent months, and whose defense attorney did not respond to a question from me last week about whether he still represents Johnson. Though Johnson, and his Nazi friend living in Ukraine, Weev, are better at operational security than what the WSJ describes here.

Someone got this old rat-fucker to use just enough secrecy to serve as signposts for the interesting bits.

I’m as interested in who provided that advice (and when) as I am in the identity of the four donors whom WSJ must know but isn’t sharing.

As I said in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

A Tale of Two GRU Indictments

Yesterday, DOJ indicted a bunch of GRU hackers again, in part for hacks in retaliation for anti-doping associations’ reports finding a state-run Russian effort to help its athletes cheat (though also including hacks of Westinghouse and the Organization for the Prohibition of Chemical Weapons (OPCW)).

As the DNC GRU indictment did, this indictment provides a snapshot of the division of labor in GRU, made easier by the capture of four of these guys, with all their hacking toys in the trunk of their rented car, in the Netherlands. I find a comparison of the two indictments — of some of the same people for similar activity spanning the same period of time — instructive for a number of reasons.

The team

Consider the team.

There are Aleksei Morenets and Evgenii Serebriakov, whom the indictment calls “on-site GRU hackers who traveled to foreign countries with other conspirators, in some instances using Russian government issued diplomatic passports to conduct on-site operations.” Serebriakov even has a title, “Deputy Head of Directorate,” which sounds like a pretty senior person to travel around sniffing WiFi networks.

There are the three men we met in the DNC indictment, Ivan Yermakov, Artem Malyshev, and Dmitriy Badin, all of whom work  out of Moscow running hacks. Yermakov and Malyshev were closely involved in both hacks in 2016 (as demonstrated by the timeline below).

Finally, there are Oleg Sotnikov and Alexey Minin, who joined Morenets and Serebriakov as they tried to hack the Organization for the Prohibition of Chemical Weapons (OPCW) and tried to hack the Spiez Chemical laboratory that was analyzing the Novichok used to poison Sergei Skripal.

There are slightly different tactics than in the DNC hack. For example, GRU used a bunch of bit.ly links in this operation (though some of those are an earlier campaign against Westinghouse). And they sent out hackers to tap into targets’ WiFi networks directly, whereas none of the DNC hackers are alleged to have left Russia.

But there’s a ton of common activity, notably the spearphishing of targeted individuals and the use of their X-Agent hacking tool to exploit targeted machines.

Overlapping hack schedule

I’m also interested in the way the WADA hack, in particular, overlaps with the DNC one. I’ve got a timeline, below, of the two indictments look like (I’ve excluded both the Westinghouse and OPCW hacks from this timeline to focus on the overlapping 2016 operations).

Yermakov and Malyshev are described by name doing specific tasks in the DNC hack though May 2016. By August, they have turned to hacking anti-doping targets. Yermakov, in particular, seems to play the same research role in both hacks.

Given the impact of these operations, it’s fairly remarkable that such a small team conducted both.

Common bitcoin habits and possibly even infrastructure

There are also paragraphs in the WADA indictment, particularly those pertaining to the use of bitcoin to fund the operation used to substantiate the money laundering charge, that appear to be lifted in their entirety from the DNC one (or perhaps both come from DOJ or Western PA US Attorney boilerplate — remember that the DNC hack was originally investigated in Western PA, so this language likely originates there).

These include:

  •  58/106: Describing how conspirators primarily used bitcoin to pay for infrastructure
  • 59/107: Describing how bitcoin works, with examples specific to each operation provided
  • 60/108: Describing how conspirators used dedicated email accounts to track bitcoin transactions
  • 61/109: Describing how conspirators used the same computers to conduct hacking operations and facilitate bitcoin payments
  • 62/110: Describing how conspirators also mined bitcoin and then used it to pay for servers, with examples specific to each operation
  • 64/111: Describing how conspirators used the same funding structure and sometimes the same pool of funds to pay for hacking infrastructure, with examples specific to each operation provided

The similarity of these two passages suggests two things. First, it suggests that the August 8, 2016 transaction in the WADA indictment may have been orchestrated from the gfade147 email noted in the DNC indictment. With both, the indictment notes that “One of these dedicated accounts … received hundreds of bitcoin payment requests from approximately 100 different email accounts,” with the DNC indictment including the gfade147 address. (Compare paragraphs 60 in the DNC indictment with 108 in the WADA one.)  That would suggest these two operations overlap even more than suspect.

That said, there’s one paragraph in the DNC indictment that doesn’t have an analogue in the WADA one, 63. It describes conspirators,

purchasing bitcoin through peer-to-peer exchanges, moving funds through other digital currencies, and using pre-paid cards. They also enlisted the assistance of one or more third-party exchangers who facilitated layered transactions through digital currency exchange platforms providing heightened anonymity.

Given how loud much of these operations were, it raises questions about why some of the DNC hack (but not, at least by description) the WADA one would require “heightened anonymity.”

Different treatment of InfoOps

I’m perhaps most interested in the different treatment of the InfoOps side of the operation. As I noted here, in general there seems to be a division of labor at GRU between the actual hackers, in Unit 26165, which is located at  20 Komsomolskiy Prospekt, and the information operations officers, in Unit 74455, which is located in the “Tower” at 22 Kirova Street, Khimki. Both units were involved in both operations.

Yet the WADA indictment does not name or charge any Unit 74455 officers, in spite of describing (in paragraphs 1 and 11) how the unit acquired and maintained online social media accounts and associated infrastructure (paragraph 76 describes that infrastructure to be “procured and managed, at least in part, by conspirators in GRU Unit 74455”). Five of the seven named defendants in the WADA indictment are in Unit 26165, with Oleg Sotnikov and Alexey Minin not identified by unit.

By comparison, three of the 11 officers charged in the DNC indictment belong to Unit 744555.

And the WADA campaign did have a significant media component, as explained in paragraphs 76-87. The indictment even complains (as did DOJ officials as the press conference announcing this indictment) about,

reporters press[ing] for and receiv[ing] promises of exclusivity in such reporting, with one such reporter attempting to make arrangements for a right of first refusal for articles on all future leaks and actively suggesting methods with whicch the conspiracy could search the stolen materials for documents of interest to that reporter (e.g., keywords of interest).

That said, the language in much of this discussion (see paragraphs 77 through 81) uses the passive voice — “were registered,” “were named,” “was posted,” “were released,” “were released,” “were released,” “were released” — showing less certainty about who was running that infrastructure.

That’s particularly interesting given that the government clearly had emails between the Fancy Bear personas and journalists.

One difference may be, in part, that in the DNC indictment, there are specific hacking (not InfoOps) actions attributed to two of the Unit 74455 officers: Aleksandr Osadchuk and Anatoliy Kovalev. Indeed, Kovalev seems to have been added on just for that charge, as he doesn’t appear in the introduction section at the beginning of the indictment.

Whereas Unit 74455’s role in the WADA indictment seems to be limited to running the InfoOps infrastructure.

Importance of WikiLeaks and sharing with Republicans

It’s not clear how much we can conclude form all that. But the different structure in the DNC indictment does allow it to foreground the role of a number of others, such as WikiLeaks and Roger Stone and — as I suggested drop in some or all of  those others in a future conspiracy indictment — that were a key part of the election operation.

Timeline

February 1, 2016: gfade147 0.026043 bitcoin transaction

March 2016: Conspirators hack email accounts of volunteers and employees of Hillary campaign, including John Podesta

March 2016: Yermakov spearphishes two accounts that would be leaked to DC Leaks

March 14, 2016 through April 28, 2016: Conspirators use same pool of bitcoin to purchase VPN and lease server in Malaysia

March 15, 2016: Yermakov runs technical query for DNC IP configurations and searches for open source info on DNC network, Dem Party, and Hillary

March 19, 2016: Lukashev spearphish Podesta personal email using john356gh

March 21, 2016: Lukashev steals contents of Podesta’s email account, over 50,000 emails (he is named Victim 3 later in indictment)

March 25, 2016: Lukashev spearphishes Victims 1 (personal email) and 2 using john356gh; their emails later released on DCLeaks

March 28, 2016: Yermakov researched Victims 1 and 2 on social media

April 2016: Kozachek customizes X-Agent

April 2016: Conspirators hack into DCCC and DNC networks, plant X-Agent malware

April 2016: Conspirators plan release of materials stolen from Clinton Campaign, DCCC, and DNC

April 6, 2016: Conspirators create email for fake Clinton Campaign team member to spearphish Clinton campaign; DCCC Employee 1 clicks spearphish link

April 7, 2016: Yermakov runs technical query for DCCC’s internet protocol configurations

April 12, 2016: Conspirators use stolen credentials of DCCC employee to access network; Victim 4 DCCC email victimized

April 14, 2016: Conspirators use X-Agent keylog and screenshot functions to surveil DCCC Employee 1

April 15, 2016: Conspirators search hacked DCCC computer for “hillary,” “cruz,” “trump” and copied “Benghazi investigations” folder

April 15, 2016: Victim 5 DCCC email victimized

April 18, 2016: Conspirators hack into DNC through DCCC using credentials of DCCC employee with access to DNC server; Victim 6 DCCC email victimized

April 19, 2016: Kozachek, Yershov, and co-conspirators remotely configure middle server

April 19, 2016: Conspirators register dcleaks using operational email [email protected]

April 20, 2016: Conspirators direct X-Agent malware on DCCC computers to connect to middle server

April 22, 2016: Conspirators use X-Agent keylog and screenshot function to surveil DCCC Employee 2

April 22, 2016: Conspirators compress oppo research for exfil to server in Illinois

April 26, 2016: George Papadopolous learns Russians are offering election assistance in the form of leaked emails

April 28, 2016: Conspirators use bitcoin associated with Guccifer 2.0 VPN to lease Malaysian server hosting dcleaks.com

April 28, 2016: Conspirators test IL server

May 2016: Yermakov hacks DNC server

May 10, 2016: Victim 7 DNC email victimized

May 13, 2016: Conspirators delete logs from DNC computer

May 25 through June 1, 2016: Conspirators hack DNC Microsoft Exchange Server; Yermakov researches PowerShell commands related to accessing it

May 30, 2016: Malyshev upgrades the AMS (AZ) server, which receives updates from 13 DCCC and DNC computers

May 31, 2016: Yermakov researches Crowdstrike and X-Agent and X-Tunnel malware

June 2016: Conspirators staged and released tens of thousands of stolen emails and documents

June 1, 2016: Conspirators attempt to delete presence on DCCC using CCleaner

June 2, 2016: Victim 2 personal victimized

June 8, 2016: Conspirators launch dcleaks.com, dcleaks Facebook account using Alive Donovan, Jason Scott, and Richard Gingrey IDs, and @dcleaks_ Twitter account, using same computer used for other

June 9, 2016: Don Jr, Paul Manafort, Jared Kushner have meeting expecting dirt from Russians, including Aras Agalarov employee Ike Kaveladze

June 10, 2016: Ike Kaveladze has calls with Russia and NY while still in NYC

June 14, 2016: Conspirators register actblues and redirect DCCC website to actblues

June 14, 2016: WaPo (before noon ET) and Crowdstrike announces DNC hack

June 15, 2016, between 4:19PM and 4:56 PM Moscow Standard Time (9:19 and 9:56 AM ET): Conspirators log into Moscow-based sever and search for words that would end up in first Guccifer 2.0 post, including “some hundred sheets,” “illuminati,” “think twice about company’s competence,” “worldwide known”

June 15, 2016, 7:02PM MST (12:02PM ET): Guccifer 2.0 posts first post

June 15 and 16, 2016: Ike Kaveladze places roaming calls from Russia, the only ones he places during the extended trip

June 20, 2016: Conspirators delete logs from AMS panel, including login history, attempt to reaccess DCCC using stolen credentials

June 22, 2016: Wikileaks sends a private message to Guccifer 2.0 to “send any new material here for us to review and it will have a much higher impact than what you are doing.”

June 27, 2016: Conspirators contact US reporter, send report password to access nonpublic portion of dcleaks

Late June, 2016: Failed attempts to transfer data to Wikileaks

July, 2016: Kovalev hacks into IL State Board of Elections and steals information on 500,000 voters

July 6, 2016: Conspirators use VPN to log into Guccifer 2.0 account

July 6, 2016: Wikileaks writes Guccifer 2.0 adding, “if you have anything hillary related we want it in the next tweo [sic] days prefabl [sic] because the DNC [Democratic National Convention] is approaching and she will solidify bernie supporters behind her after”

July 6, 2016: Victim 8 personal email victimized

July 10-19: Morenets travels to Rio de Janeiro

July 14, 2016: Conspirators send WikiLeaks an email with attachment titled wk dnc link1.txt.gpg providing instructions on how to access online archive of stolen DNC documents

July 18, 2016: WikiLeaks confirms it has “the 1Gb or so archive” and would make a release of stolen documents “this week”

July 22, 2016: WikiLeaks releases first dump of 20,000 emails

July 27, 2016: Trump asks Russia for Hillary emails

July 27, 2016: After hours, conspirators attempt to spearphish email accounts at a domain hosted by third party provider and used by Hillary’s personal office, as well as 76 email addresses at Clinton Campaign

August 2016: Kovalev hacks into VR systems

August 2-9, 2016: Conspirators use multiple IP addresses to connect to or scan WADA’s network

August 2-4, 2016: Yermakov researches WADA and its ADAM database (which includes the drug test results of the world’s athletes) and USADA

August 3, 2016: Conspirators register wada.awa.org

August 5, 9, 2016: Yermakov researches Cisco firewalls, he and Malyshev send specific WADA employees spearfish

August 8, 2016: Conspirators register wada-arna.org and tas-cass.org

August 8, 2016: .012684 bitcoin transaction directed by dedicated email account

August 13-19, 2016: Morenets and Serebriakov travel to Rio, while Yermakov supports with research in Moscow

August 14-18, 2016: SQL attacks against USADA

August 15, 2016: Conspirators receive request for stolen documents from candidate for US congress

August 15, 2016: First Guccifer 2.0 exchange with Roger Stone noted

August 19, 2016: Serebriakov compromises a specific anti-doping official and obtains credentials to access ADAM database

August 22, 2016: Conspirators transfer 2.5 GB of stolen DCCC data to registered FL state lobbyist Aaron Nevins

August 22, 2016: Conspirators send Lee Stranahan Black Lives Matter document

September 1, 2016: Domains fancybear.org and fancybear.net registered

September 6, 2016: Conspirators compromise credentials of USADA Board member while in Rio

September 7-14, 2016: Conspirators try, but fail, to use credentials stolen from USADA board member to access USADA systems

September 12, 2016: Data stolen from WADA and ADAMS first posted, initially focusing on US athletes

September 12, 2016 to January 17, 2018: Conspirators attempt to draw media attention to leaks via social media

September 18, 2016: Morenets and Serebriakov travel to Lausanne, staying in anti-doping hotels, to compromise hotel WiFi

September 19, 2016 to July 20, 2018: Conspirators attempt to draw media attention to leaks via email

September 2016: Conspirators access DNC computers hosted on cloud service, creating backups of analytics applications

October 2016: Linux version of X-Agent remains on DNC network

October 6, 2016: Emails stolen from USADA first released

October 7, 2016: WikiLeaks releases first set of Podesta emails

October 28, 2016: Kovalev visits counties in GA, IA, and FL to identify vulnerabilities

November 2016: Kovalev uses VR Systems email address to phish FL officials

December 6, 2016 – January 2, 2017: Using IP frequently used by Malyshev, conspirators compromise FIFA’s anti-doping files

December 13, 2016: Data stolen from CCES released

January 19-24, 2017: Conspirators compromise computers of four IAAF officials

June 22, 2017: Data stolen from IAAF’s network released

July 5, 2017: Data stolen from IAAF’s network released

August 28, 2017: Data stolen from FIFA released

As I said in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

Mueller’s Inquiry Expands and Contracts: The Rat-Fucking Is More Interesting than the Manafort Plea

There were two pieces of news today on the Mueller inquiry.

Most intriguing is the news that the FBI has told Republican operative Cheri Jacobus that their investigation of her hack and catfish in 2016 has been referred to Mueller. Click through for the full account of what happened to Jacobus after she exposed a Corey Lewandowski PAC to be coordinating with the campaign. The short version, though, is that the campaign first used deceit to try to collect information on what anti-Trump PACs were planning, later carried out a sustained campaign of abuse, and finally hacked her email when she prepared to reveal the catfishing scheme.

The FBI has been investigating ever since. But on September 10, the agents she had been working with let her know that their inquiry had grown beyond the hack itself and so had referred the case.

Jacobus has been in regular contact with FBI agents since the bureau opened an investigation into the hacking of her email after Jacobus filed a complaint around September 2016.

Following Trump’s election, Jacobus relayed additional incidents she considered suspicious to the agents investigating the hack.

Jacobus said she was also interviewed by FBI agents in the Southern District of New York for several hours in February 2017 and has had dozens of phone calls with the agents over the past two years. A lawyer who worked for Jacobus at the time, Jay Butterman, said he also attended the February 2017 meeting and had follow-up conversations with FBI agents.

In November 2017, the FBI asked Jacobus to turn over the remainder of her communications related to the catfishing scheme, some of which she had already submitted, according to an email reviewed by POLITICO.

On Sept. 10 of this year, an FBI agent wrote to Jacobus that he would be calling her, which is when, she said, the bureau informed her of the case’s referral to Mueller.

To answer a question many have posed, I don’t think any investigation into what I perceived as threats mirrors this. That’s in part because the technical threats were more oblique. But it’s also because the FBI really doesn’t want to talk to me, and so (with one exception) generally only followed up via my lawyer. The one instance I involved the cops may have been different, but if so, I never heard about it directly.

I’m more interested in the possibility that Jacobus’ treatment mirrors some of the stuff that Roger Stone was doing with his Stop the Steal çampaign.

The possibility that Mueller’s interest in Stone (and Manafort) extends back to the primary is all the more interesting given how centrally some of Stone’s core skill-sets played out in the lead-up to the Convention. There were veiled threats of violence (and in the home of his dark money, actual violence), a smear story projecting on Cruz the infidelity more typical of Trump, and lots of money sloshing around.

It’s not entirely clear what crime that would implicate — besides potential campaign finance violations (particularly, given Trump’s repeated disavowals of any coordination between Stone and his old buddy Manafort).

And, given how rabidly Republican base voters support Trump, I could see why Republicans would let bygones be bygones. It’s not like the Republican party has ever before shown distaste for Stone’s rat-fucking. Plus, no one likes Ted Cruz, and he may not even survive his race against Beto O’Rourke. So, no, Republicans won’t be any more disposed against Stone if he is shown to have helped Trump cheat in the primary.

All that said, if Mueller indicts Stone in other crimes that Republicans would like to distance themselves from, any allegations about the primary may provide cover.

Indeed, the comparison is one a number of people made when I started focusing on Stone’s PACs.

With one caveat, I’d think these would probably be parallel efforts, with two different sets of dark money groups funding two different sets of dirty tricks, violating both campaign law and probably some other fraud statutes. I say that because Corey Lewandowski, who was behind the attack on Jacobus, and Roger Stone really don’t get along.

That said, the two parallel tracks likely show a tolerance among the principals who did get along with both Lewandowski and Stone (starting with Trump) for this kind of rat-fucking. And to the extent that some of the rat-fucking involved either intelligence obtained from Russians or coordinated voter suppression later in the campaign, then it’d have a solid Russian nexus.

The one caveat is this tweet from Jacobus, which reveals a text she received from a guy making explicit threats, which she clearly identifies as a Stone-related threat. (h/t TC)

So maybe Stone just took over all the rat-fucking after Jacobus busted Lewandowski’s PAC for illegal coordination?

Also remember that, the illegal coordination between PACs and the campaign is likely one way that the campaign benefitted from Cambridge Analytica.

And that’s why I find the referral of the attack on Jacobus to be one of the most important details to provide insight onto the Mueller investigation in some time.

I find the news that money laundering expert Kyle Freeny and National Security Division prosecutor Brandon Van Grack are moving back to their normal homes at DOJ less intriguing.

Kyle Freeny and Brandon Van Grack, two prosecutors who worked on Paul Manafort’s criminal cases, are ending their tenure working for special counsel Robert Mueller.

Van Grack left recently to return to his job in the National Security Division of the Justice Department, and Freeny will leave the office in mid-October to return to the Criminal Division.

The most obvious explanation for both moves is that the Paul Manafort and Mike Flynn plea deals have been sealed (CNN notes that Van Grack will continue to work on the Flynn sentencing, but has mostly moved back to NSD for now). Which would make the different timing — Van Grack has already left, apparently, whereas Freeny has a few more weeks of work — the most interesting part of the report. Perhaps Van Grack left as soon as Flynn got a sentencing date?

Though there is another possibility, particularly in Freeny’s case.

I’ve long said that it’s possible once Mueller puts together the conspiracy case, he may farm out the “garden variety” corruption to other parts of DOJ. One key part of that, for example, is the non-Russian inauguration pay-for-play. That might be the kind of thing Freeny would move with to another part of DOJ.

As for Van Grack, I don’t rule out a tidbit or two that he had touched being moved back under NSD, though if so, it’s not a part of the investigation that has any public sign yet.

Remember: We still haven’t seen what a good number of Mueller’s prosecutors have been up to for the last 15 months. Those are some of the prosecutors who remain quietly busy.

As I disclosed in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

The DNC-Centric Focus of the HPSCI Investigation

Through the duration of the various Russia investigations, skeptics always harp on two questions pertaining to the Russian election year hacks — why the Democrats never turned over the DNC “server,” singular, to the FBI, allegedly leaving the FBI to rely on Crowdstrike’s work, and whether several sets of files released via Guccifer 2.0 showed signs of non-Russian origin. That is, skeptics look exclusively at the DNC, not the totality of the known Russian targeting.

Looking at the list of witnesses the House Intelligence Committee called (which the committee will release in the coming weeks) shows one reason why: that the most public and propagandist of all the Russia investigations focused on the DNC to the detriment of other known Democratic targets.

Here’s what the list of the HPSCI interviews looks like arranged by date (HPSCI will not be releasing the bolded interviews).

  1. [Comey, Jim (May 2 and 4, 2017): Intel]
  2. [Rogers, Mike (May 4, 2017): Intel]
  3. [Brennan, John (May 23, 2017): Intel]
  4. Coats, Dan (June 22, 2017): Intel
  5. Farkas, Evelyn (June 26, 2017): Ukraine/RU DOD
  6. Podesta, John (June 27, 2017): Clinton Chair
  7. Caputo, Michael (July 14, 2017): RU tied Trump
  8. Clapper, James (July 17, 2017): Intel
  9. Kushner, Jared (July 25, 2017): June 9 etc
  10. Carlin, John (July 27, 2017): Early investigation
  11. Gordon, JD (July 26, 2017): Trump NatSec
  12. Brown, Andrew (August 30, 2017): DNC CTO
  13. Tamene, Yared (August 30, 2017): DNC tech contractor
  14. Rice, Susan (September 6, 2017): Obama response to hack/unmasking
  15. Stone, Roger (September 26, 2017): Trump associate
  16. Epshteyn, Boris (September 28, 2017): RU-tied Trump
  17. Tait, Matthew (October 6, 2017): Solicit hack
  18. Safron, Jonathan (October 12, 2017): Peter Smith
  19. Power, Samantha (October 13, 2017): Obama response to hack/unmasking
  20. Catan, Thomas (October 18, 2017): Fusion
  21. Fritsch, Peter (October 18, 2017): Fusion
  22. Lynch, Loretta (October 20, 2017): Investigation
  23. Parscale, Brad (October 24, 2017): Trump’s data
  24. Cohen, Michael (October 24, 2017): Trump lawyer
  25. Rhodes, Benjamin (October 25, 2017): Obama response to hack/unmasking
  26. McCord, Mary (November 1, 2017): Early investigation
  27. Kaveladze, Ike (November 2, 2017): June 9 meeting
  28. Yates, Sally (November 3, 2017): Early investigation
  29. Schiller, Keith (November 7, 2017): Trump bodyguard
  30. Akhmetshin, Rinat (November 13, 2017): June 9
  31. Samachornov, Anatoli (November 28, 2017): June 9
  32. Sessions, Jeff (November 30, 2017): Trump transition
  33. Podesta, John (December 4, 2017): Dossier
  34. Denman, Diana (December 5, 2017): RNC platform
  35. Henry, Shawn (December 5, 2017): Crowdstrike
  36. Trump, Jr. Donald (December 6, 2017): June 9
  37. Phares, Walid (December 8, 2017): Trump NatSec
  38. Clovis, Sam (December 12, 2017): Trump NatSec
  39. Goldfarb, Michael (December 12, 2017): Dossier
  40. Elias, Marc (December 13, 2017): Dossier
  41. Nix, Alexander (December 14, 2017): Cambridge Analytica
  42. Goldstone, Rob (December 18, 2017): June 9
  43. Sussmann, Michael (December 18, 2017): Hack and dossier
  44. McCabe, Andrew (December 19, 2017): Early investigation
  45. Kramer, David (December 19, 2017): Dossier
  46. Sater, Felix (December 20, 2017): RU connected Trump
  47. Gaeta, Mike (December 20, 2017): Dossier go-between
  48. Sullivan, Jake (December 21, 2017): Dossier
  49. [Rohrabacher, Dana (December 21, 2017): Russian compromise]
  50. [Wasserman Schultz, Debbie (December 21, 2017): dossier]
  51. Graff, Rhona (December 22, 2017): June 9
  52. Kramer, David (January 10, 2018): Dossier
  53. Bannon, Stephen (January 16, 2018): Trump official
  54. Lewandowski, Corey (January 17, 2018): Trump official
  55. Dearborn, Rick (January 17, 2018): Trump official
  56. Bannon, Stephen (February 15, 2018): Trump official
  57. Hicks, Hope (February 27, 2018): Trump official
  58. Lewandowski, Corey (March 8, 2018): Trump official

While John Podesta, one of the earliest spearphishing victims, was one of  the earliest witnesses (and, as HPSCI shifted focus to the dossier, one of the last as well), the other hack witnesses, DNC CTO Andrew Brown and DNC IT contractor Yared Tamene, represent the DNC. Perhaps that’s because of the NYT’s big story on the hack, which was obviously misleading in real time and eight months old by the time of those interviews. While Perkins Coie lawyer and former DOJ cyber prosecutor Michael Sussmann would surely have real insight into the scope of all the Democratic targets, he was interviewed during HPSCI’s dossier obsession, not alongside Brown and Tamene.

All of which is to say that the HPSCI investigation of the hack was an investigation of the hack of the DNC, not of the full election year attack.

To get a sense of some of what that missed, consider the victims described in the GRU indictment (which leaves out some of the earlier Republican targets, such as Colin Powell). I’ve included relevant paragraph numbers to ID these victims.

  1. Spearphish victim 3, March 21, 2016 (Podesta)
  2. Spearphish victim 1 Clinton aide, March 25, 2016 (released via dcleaks)
  3. Spearphish victim 4 (DCCC Employee 1), April 12, 2016 ¶24
  4. Spearphish victim 5 (DCCC Employee), April 15, 2016
  5. Spearphish victim 6 (possibly DCCC Employee 2), April 18, 2016 ¶26
  6. Spearphish victim 7 (DNC target), May 10, 2016
  7. Spearphish victim 2 Clinton aide, June 2, 2016 (released via dcleaks)
  8. Spearphish victim 8 (not described), July 6, 2016
  9. Ten DCCC computers ¶24
  10. 33 DNC computers ¶26
  11. DNC Microsoft Exchange Server ¶29
  12. Act Blue ¶33
  13. Third party email provider used by Clinton’s office ¶22 (in response to July 27 Trump request)
  14. 76 email addresses at Clinton campaign ¶22 (in response to July 27 Trump request)
  15. DNC’s Amazon server ¶34
  16. Republican party websites ¶71
  17. Illinois State Board of Elections ¶72
  18. VR Systems ¶73
  19. County websites in GA, IA, and FL ¶75
  20. VR Systems clients in FL ¶76

Effectively, HPSCI (and most hack skeptics) focused exclusively on item 11, the DNC Microsoft Exchange server from which the emails sent to WikiLeaks were stolen.

Yet, at least as laid out by Mueller’s team, the election year hack started elsewhere — with Podesta, then the DCCC, and only after that the DNC. It continued to target Hillary through the year (though with less success than they had with the DNC). And some key things happened after that — such as the seeming response to Trump’s call for Russia to find more Hillary emails, the Info-Ops led targeting of election infrastructure in the summer and fall, and voter registration software. Not to mention some really intriguing research on Republican party websites. And this barely scratches on the social media campaign, largely though not entirely carried out by a Putin-linked corporation.

HPSCI would get no insight on the overwhelming majority of the election year operation, then, by interviewing the witnesses they did. Of particular note, HPSCI would not review how the targeting and release of DCCC opposition research gave Republican congressmen a leg up over their Democratic opponents.

And while HPSCI did interview the available June 9 meeting witnesses, they refused to subpoena the information needed to really understand it. Nor did they interview all the witnesses or subpoena available information to understand the Stone operation and the Peter Smith outreach.

Without examining the other multiple threads via which Russia recruited Republicans, most notably via the NRA, HPSCI wouldn’t even get a sense of all the ways Russia was trying to make Republicans and their party infrastructure into the tools of a hostile foreign country. And there are other parts of the 2016 attack that not only don’t appear in these interviews, but which at least one key member on the committee was utterly clueless about well past the time the investigation finished.

The exception to the rule that HPSCI didn’t seek out information that might damn Republicans, of course, is the interview of Dana Rohrabacher, who (along with President Trump) proved reliably willing to entertain Russian outreach via all known channnels. But that’s one of the interviews Republicans intend to keep buried because — according to an anonymous Daily Beast source — they don’t want Rohrabacher’s constituents to know how badly Russia has pwned him before November 6.

“The Republicans are trying to conceal from the voters their colleague Dana Rohrabacher’s Russia investigation testimony,” said a committee source familiar with the issue. “There were highly concerning contacts between Rohrabacher and Russians during the campaign that the public should hear about.”

By burying the Comey, Rogers, and Brennan transcripts, Republicans suppress further evidence of the degree to which Russia specifically targeted Hillary, and did so to help not just Trump, but the Republican party.

I’m sure there will be some fascinating material in these transcripts when they’re released. But even before the selective release, designed to hide any evidence gathered of how lopsided the targeting was, the scope of these interviews makes clear that the HPSCI investigation was designed to minimize, as much as possible, evidence showing how aggressively Russia worked to help Republicans.

As I laid out in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

The Christie Ouster and the Flynn Hiring

The Guardian has an excerpt from Michael Lewis’ new book, The Fifth Risk, which happens to be the chapter focusing on Trump’s transition team. On top of describing how Trump believed spending money, as required by law, to pay a transition team amounted to stealing his own money, the excerpt includes this account of Chris Christie’s firing.

Not long after the people on TV announced that Trump had won Pennsylvania, Jared Kushner grabbed Christie anxiously and said: “We have to have a transition meeting tomorrow morning!” Even before that meeting, Christie had made sure that Trump knew the protocol for his discussions with foreign leaders. The transition team had prepared a document to let him know how these were meant to go. The first few calls were easy – the very first was always with the prime minister of Great Britain – but two dozen calls in you were talking to some kleptocrat and tiptoeing around sensitive security issues. Before any of the calls could be made, however, the president of Egypt called in to the switchboard at Trump Tower and somehow got the operator to put him straight through to Trump. “Trump was like … I love the Bangles! You know that song Walk Like an Egyptian?” recalled one of his advisers on the scene.

That had been the first hint Christie had of trouble. He had asked Kushner what that was about, and Kushner had simply said, Trump ran a very unconventional campaign, and he’s not going to follow any of the protocols.

[snip]

Christie was scheduled to brief the Trump children, Kushner and the other members of Trump’s inner circle. He was surprised to find, suddenly included in this group, retired army lieutenant general Michael Flynn. Flynn was a jobseeker the transition team had found reasons to be extremely wary of. Now he wanted to be named Trump’s national security adviser, which was maybe the most important job in the entire national security apparatus. The national security team inside the Trump transition – staffed with senior former military and intelligence officials – had thought that was an especially bad idea. Flynn’s name was not on the list. But here he was, in the meeting to decide who would do what in the Trump administration, and Ivanka was asking him which job he would like to have.

Before Christie could intercede, Bannon grabbed him and asked to see him privately. Christie followed Bannon to his office impatiently. Hey, this is going to have to be quick, said Christie.

It’s really quick, said Bannon. You’re out.

Why? asked Christie, stunned.

We’re making a change.

“OkayOK, what are we changing?

You.

Why?

It’s really not important.

A week after Christie, along with former HPSCI Chair Mike Rogers, got purged from the Transition Team, I wrote a post that concluded this way.

One of the first things Trump has done has been to ensure agreement in its national security team on this point: that by letting our Middle Eastern allies arm al Qaeda-allied fighters, the Obama Administration created the mess that is in Syria.

And unanimity on that point — accompanied by what is sure to be a very ugly campaign of recriminations against the Obama Administration for cooking intelligence (even aside from the merit of this claim, Flynn has been bitter about his firing for what he sees as objecting to this cooked intelligence) — will provide the basis for Trump to work with Putin on ending the civil war in Syria to Bashar al-Assad’s advantage.

When I wrote that post, this text I received less than 15 hours after the polls closed, from someone I later came to conclude was involved in the election attack, was in my mind.

The text continued, in part, “clearly this confirms key role for Trump admin.”

As I surmised two years ago, there was a close tie between the moment Christie and other Republican realists got fired and when Flynn got picked.

According to this Michael Lewis account, though, the tie is far more direct than I imagined. The moment that Flynn got hired is the moment that Chris Christie got fired.

As I disclosed in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

On Rosenstein, We Shall See …

For a panicked two hours today, it appeared that Rod Rosenstein had either resigned or been fired. Instead, he was attending a regularly scheduled Principal’s Committee after having talked at some length to Trump and John Kelly about the NYT report he was acting erratically in the wake of Trump firing Jim Comey and boasting that he had done so to end the Russian investigation (though the NYT’s reporting wasn’t even that responsible).

The two men will meet again Thursday, as Trump’s SCOTUS nominee gets grilled about an increasing number of sexual assault accusations, to decide Rosenstein’s future.

It’s not entirely clear who would then oversee Mueller if Rosenstein gets fired, but Marty Lederman argues according to normal succession, Solicitor General Noel Francisco would supervise Mueller, but because he has a conflict, it’d likely fall to OLC head Steve Engel.

Those are ordinarily the AG’s functions, not the DAG’s, and unless there’s been a change, DOJ’s view is that the AG’s functions/duties can’t be performed by an “acting” officer (i.e., no “double-acting”). So the responsibility to oversee those investigations would fall to Solicitor General Noel Francisco. Francisco, however, is probably recused from the Russia investigation (at a minimum), because Jones Day, his former firm, represents the Trump Campaign (unless there’s been a change). NF has recused from all SCOTUS cases where Jones Day represents a party, including in the new Term. If NF recuses from supervising Mueller, and any other investigations involving the Trump campaign, those AG functions presumably would be performed by Assistant AG for OLC Steve Engel.

In either case, Jeff Toobin declares that one way or another, that means Mueller is finished.

This issue of who, technically, would be in charge of Mueller is an important one, but it’s not nearly as significant as the broader issue raised by Rosenstein’s likely departure. The President is in charge of the executive branch, and Mueller, as the special counsel, is a subordinate in that branch of the government. If Trump is determined to fire Mueller, or to constrict his investigation in untoward ways, he and his advisers will figure out a way to do it. There is little doubt that the President could ultimately find a compliant Justice Department official to carry out his order of execution. In other words, the massacre this week may lead to another, like the one on a Saturday night in 1973 when Richard Nixon fired Archibald Cox, the Watergate special prosecutor. This modern version would be an abuse of power of the most profound sort. Firing Mueller—who has been investigating Trump and his campaign and Administration for a year and a half—would be the very definition of a high crime and misdemeanor, as impeachable offenses are defined in the Constitution. But would the Republicans who control Congress see it that way?

Put another way, the real question is whether there is any political will among the Republicans who run the legislative branch of government to check Trump’s power.

My guess is what happens between now and Thursday matters a lot. It’s possible, for example, that the Trump Administration could implement some plan to put an even more competent hatchet man in place behind Rosenstein (or get him to resign, which would leave more options). Or it’s possible that Mueller has key indictments sufficiently developed to roll them out in the next day or so (though there’s no grand jury before Thursday at the earliest). I think it even possible that Rosenstein will not only be able to explain the NYT report away (in part by suggesting that it’s just an Andrew McCabe attempt to get back at Trump), but also explain why things will be worse for Mueller if he does fire him.

So we shall see.

On KT McFarland’s Belated Unforgetting of the Truth

The WaPo has an important story about how KT McFarland decided to unforget key details about her role in coaching Mike Flynn through reassuring Russia, on December 29, 2016, that the Trump Administration would ease off on sanctions. McFarland lied about whether sanctions were discussed in a summer 2017 interview with the FBI, then her memory seems to have cleared up after the Mike Flynn plea deal.

When FBI agents first visited her at her Long Island home in the summer of 2017, McFarland denied ever talking to Flynn about any discussion of sanctions between him and the ambassador, Sergey Kislyak, in December 2016 during the presidential transition.

For a time, investigators saw her answers as “inconsistent,” putting her in legal peril as the FBI tried to determine if she had lied to them.

[snip]

Not long after Flynn’s plea, McFarland was questioned by investigators again about her conversations with Flynn, and she walked back her previous denial that sanctions were discussed, saying a general statement Flynn had made to her that things were going to be okay could have been a reference to sanctions, these people said.

McFarland’s account does not answer the question of what the president knew or didn’t know about Flynn’s interactions with the ambassador, these people said.

McFarland didn’t respond to multiple requests for comment, including emails and calls to her home.

Eventually, McFarland and her lawyer Robert Giuffra were able to convince the FBI that she had not intentionally misled the bureau but had rather spoken from memory, without the benefit of any documents that could have helped her remember her exchanges with Flynn about the Kislyak conversations, these people said.

This is thoroughly unsurprising, and it probably has as much to do with McFarland withdrawing her nomination to be Ambassador to Singapore as did any concerns about a confirmation hearing where her past lies to Congress would be an issue. It explains part (though just part) of the Transition Team’s outrage that Mueller had obtained emails that the Trump people would have otherwise claimed privilege over. By doing that, Mueller caught McFarland (and, likely, a number of other people) in lies by showing their extensive communications that contradicted the emails.

Nor is it surprising that McFarland was able to clear up her testimony (indeed, the WaPo notes that Sean Spicer was telling similar lies as McFarland was telling, so he may have also had to have cleaned up testimony). She’s got a serious attorney, Robert Giuffra, and unlike George Papadopoulos she (presumably) didn’t do anything stupid, like deleting her entire Facebook account, when she tried to clean up her lies. That happens in cases like this (especially where the witnesses are powerful enough to fight a false statements case aggressively). Remember that Karl Rove cleaned up his testimony in the Plame investigation four different times.

Indeed, similar unforgettings have probably happened in the wake of each plea deal, or with the unveiling that Mueller obtained search warrants for at least five AT&T phones (and probably a similar number of Verizon phones) in the wake of the Rick Gates plea. That’s what I meant when I suggested that the Paul Manafort plea may set off a kind of mass Game Theory, as each of up to 30 co-conspirators consider whether they want to change their testimony before the former campaign chair clarifies it to Mueller for them, or before their fellow rats jump ship first.

They’re trying to stave off an awful game of prisoner’s dilemma.

Consider if you’re one of the other 37 (which might be down to 34 given known cooperators, or maybe even fewer given how uncertain Rudy seems to be about Don McGahn’s third session of testimony) members of the Joint Defense Agreement, especially if you’re one who has already testified before the grand jury about matters that Manafort (and Gates) might be able to refute. So long as there’s no chance Trump will be touched, you’re probably still safe, as you can count on Trump rewarding those who maintain the omertà or at the very least working to kill the Mueller inquiry shortly after the election.

But if you have doubts about that — or concerns that other witnesses might have doubts about that — you still have an opportunity to recall the things you claimed you could not recall a year ago. Depending on how central your testimony is, you might even be able to slip in and fix your testimony unnoticed.

So each of 37 (or maybe just 30) people are considering whether they have to recalculate their decisions about whether to remain loyal to the President or take care of themselves.

While I suspect Mueller has key players in the case in chief largely sewn up, this should accelerate the process and make any prosecutions easier (assuming the NYT doesn’t get Rosenstein fired before then).

So one takeaway from this story — told probably eight months after the fact — is that Mueller has been slowly chipping away at the omertà, and that process will only keep getting easier (in part because virtually none of these people have any decent operational security).

But the other takeaway, and the likely explanation for it coming out, is that my assessment of why the Transition squawked so loudly last year is correct: they wanted to hide how closely Donald Trump micromanaged the sanctions conversation with Sergei Kislyak, and so both Flynn and McFarland lied about it, then subsequently cleaned up their lies. That puts Donald Trump attempting to deliver the quo of the quid pro quo.

Trump may be answering the take home exam he told Mueller he’d be willing to complete, which includes this question, which got added in the wake of Flynn’s plea and probably McFarland’s revised testimony: What discussions did you have during the campaign regarding Russian sanctions?

The correct answers to that question are getting narrower and narrower.

Update: Fixed syntax of Spicer description.

As I disclosed in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

Rob Goldstone Continues to Work the Press to Spin His Role in the June 9 Meeting

There’s a really funny line in Rosalind Helderman’s profile of Rob Goldstone in conjunction with the release of his book. First, Helderman comically asserts that Goldstone — who did an interview for a long piece in the British Times that helped witnesses coordinate their stories last November — kept his mouth shut about his testimony.

Goldstone has emerged as a rare independent voice in the Russia story — one of the few witnesses who voluntarily sat with any investigator who asked and, out of courtesy to the process, kept his mouth shut along the way.

Helderman suggests she would know about witnesses who had provided testimony to investigators even if they kept their mouths shut. While it’s true that Helderman gets leaks from places few other journalists do (indeed, it’s one reason I did not share everything I knew with certain investigators, to prevent leaks through her), I’m fairly certain that a pretty significant number of witnesses have managed to stay quiet.

The comment is all the funnier given how the at-times-conflicting-with-the-sworn-record WaPo story ends, with Goldstone falsely claiming that the first time he started thinking of the June 9 meeting again after it happened was when the WaPo called him on July 9 and asked him if he set up the meeting.

Then, he said, he did his best to put the meeting out of his mind — until more than a year later, when the New York Times broke the news of the gathering.

Sitting at lunch at a cafe in Greece the next day, he received a call from a Post reporter, inquiring if he had set up the encounter.

The claim is false on a number of fronts. Goldstone made some efforts (albeit, according to his sworn testimony, reluctantly) to set up a November meeting following up on the June 9 meeting. And he started thinking about the meeting again at least at least as early as June 2, 2017, when Trump Organization lawyer Alan Garten reached out to him to learn more details about the meeting that Don Jr was denying ever took place.

Goldstone’s silence on both those details in his WaPo profile puts his actions in much more favorable light than they really were. They hide how substantive the meeting was treated by both sides.

And I find all that pretty amusing given that Goldstone doesn’t name which Post reporter reached out to him in July 2017.

Here’s that story’s byline:

And the reason that’s important is because, at least according to Goldstone on July 9, 2017, his involvement in the meeting got leaked.

His insinuation to Emin Agalarov (in a comment that makes clear he spoke with Helderman, not Hamburger) was that the Trump people had leaked his name to preemptively blame the Agalarov side for misrepresenting the meeting.

Whether or not Goldstone is correct about who leaked his involvement is actually a fairly important detail in the investigation. In any case, the story of the mutual recriminations between the Trumps and Agalarovs really reveals how early both sides realized the meeting was going to cause real problems for the Trumps.

Which is all the more reason for journalists to be honest about where there are and are not leaks.

As I disclosed in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

The Shiny Object of the May 2017 Russian Investigation: The Evidence Mostly Came in after August 1

There’s a reason today’s NYT story so infuriates me — to say nothing of Trump’s efforts to declassify documents from the Russia investigation that, because of the personnel moves of virtually everyone involved, would mostly end by August 1, 2017.

That’s because it’s clear that — because Peter Strzok lost an August 2016 battle to investigate more aggressively in summer and fall 2016 — DOJ, FBI, and then Mueller were only obtaining key information around about August 1, 2017, a year later. It’s no surprise, then, that (as the frothy right has been obsessing about recently) Lisa Page and Strzok weren’t sure if there was evidence of “collusion” on May 17, 2017. Of course they weren’t. The government hadn’t started collecting the evidence in earnest yet.

Consider the following investigative steps:

FBI appears not to have sent a preservation request to Government Services Administration for George Papadopoulos’ material until March 9, 2017, and they appear not to have pursued his privately held call records (especially the Facebook ones that would have revealed the existence of Ivan Timofeev) until some time later.

On June 6, 2017, the Mueller team was still debating whether they would access Section 702 materials, something they otherwise do routinely with assessments, to say nothing of fully predicated national security investigations.

The John Dowd letter wrongly claiming unprecedented cooperation reveals that Mueller started to receive the documents requested by congressional committees on July 21; that would presumably be the first that the government obtained the version of the June 9 emails that included Paul Manafort’s replies.

Copies of all documents provided to the committees by the Campaign, and all search term lists and the privilege log, were also provided to the Special Counsel.

  • By letter dated May 17, 2017, the Campaign received a request for documents from the Senate Select Committee on Intelligence (SSCI).
  • By letter dated June 7, 2017, the Campaign received a request for documents from the House Permanent Select Committee on Intelligence (HPSCI). The records requested included records generated from June 16, 2015, to 12pm on January 20, 2017, and hence, included the transition period.
  • The Campaign voluntarily responded to these requests by providing 840 documents on July 21, 2017, and another set of 4,800 documents on July 31, 2017. By letter dated July 19, 2017, the Campaign received a request for documents from the Senate Judiciary Committee (SJC).

Mueller sent a preservation request for Transition materials on June 22. He obtained all the emails and devices from 13 transition staffers in late August.

Specifically, on August 23, 2017, the FBI sent a letter (i.e., not a subpoena) to career GSA staff requesting copies of the emails, laptops, cell phones, and other materials associated with nine PTT members responsible for national security and policy matters. On August 30, 2017, the FBI sent a letter (again, not a subpoena) to career GSA staff requesting such materials for four additional senior PTT members.

The list of documents the White House provided, organized by Bates number, show that some key documents couldn’t have come in until July 2017. Indeed, documents pertaining to Comey’s firing appear to be the last of the document sets obtained, sometime after the disclosure of the June 9, 2016 meeting in July 2017.

BuzzFeed’s big scoop on financial transfers between Aras Agalarov and Ike Kaveladze around the time of the June 9 meeting shows banks didn’t start looking for such suspicious transfers until after the June 9 meeting was disclosed on July 8, 2017.

None of these transactions was discovered until 2017, after the New York Times revealed the Trump Tower meeting. Shortly after that report, investigators asked financial institutions to look back at their accounts to learn how money flowed among the people who planned and attended the meeting: Agalarov; Kaveladze; Agalarov’s pop star son, Emin; their employee, Rob Goldstone, who sent the original email to Trump Jr.; and others.

To unearth connections between some of their accounts, banks took an extraordinary step: They invoked a provision of the Patriot Act — a post-9/11 law that included new tools to track money laundering and terrorist financing. That provision, rarely used in the Trump-Russia investigation, allowed the banks to share information about customers with one another.

Three financial institutions — Citibank, JP Morgan Chase, and Morgan Stanley — discovered the $3.3 million that flowed from Agalarov to Kaveladze.

My interview with the FBI (I believe I was the second source about one aspect of what I shared, but believe I was the first about the stuff that tied more obviously to the campaign) was July 14. I believe my materials were moved under Mueller when Ryan Dickey got moved under Mueller in November, 2017.

So the constant six-year old soccer chases by journalists trying to learn what happened in May 2017 — when things were chaotic because Trump was breaking all norms and firing people who actually weren’t investigating that aggressively — to the detriment of attention on what happened in the months thereafter really does a huge disservice to the truth. The investigation into Trump’s conspiracy with Russia started in earnest around about August 1, 2017. Once the government actually started looking for evidence, I imagine the evidence of conspiracy was pretty obvious.

As I disclosed in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

The NYT “Scoop” Appears To Be an Effort to Spin Opening an Investigation into Trump as an Erratic Act

I’d like to point out something strongly suggested by the stories based on gossiping about Andrew McCabe memos. These stories portray what people not at a meeting that took place just after Comey’s firing think happened at the meeting based off hearing about memos memorializing them. From the WaPo’s far more responsible version of the story, we know that Lisa Page was also present at the meeting.

Another official at the meeting, then-FBI lawyer Lisa Page, wrote her own memo of the discussion which does not mention any talk of the 25th amendment, according to a second person who was familiar with her account.

And the WaPo’s version of the “wire” comment puts it in context, making it clear that Rosenstein was questioning how they could investigate the President.

That person said the wire comment came in response to McCabe’s own pushing for the Justice Department to open an investigation into the president. To that, Rosenstein responded with what this person described as a sarcastic comment along the lines of, “What do you want to do, Andy, wire the president?”

Now go back to earlier in the week, to the frothy right rehashing some texts Page and Peter Strzok sent, talking about opening an investigation into … someone, while Andrew McCabe was Acting Director. (Apologies for the Fox slurs about Page and Strzok.)

Text messages from disgraced FBI figures Peter Strzok and Lisa Page, discussing whether to open a “case” in a “formal chargeable way” after Director James Comey was fired, are under fresh scrutiny after Page told congressional investigators there was no evidence of Russian collusion at the time, according to three congressional sources.

Two hours after Comey’s termination became public on May 9, 2017, Strzok, a now-former FBI agent, texted Page, his then-colleague and lover: “We need to open the case we’ve been waiting on now while Andy is acting.”

“Andy” is a reference to then-Deputy Director Andrew McCabe who temporarily took over the bureau until Christopher Wray was confirmed as director in August 2017.

Page, a former FBI attorney, replied to Strzok: “We need to lock in (redacted). In a formal chargeable way. Soon.”

Strzok concurred. “I agree. I’ve been pushing and I’ll reemphasize with Bill,” believed to be Bill Priestap, the head of the FBI’s counterintelligence division.

Finally, here’s the WaPo version of Michael Bromwich’s description of the memos.

McCabe’s lawyer, Michael Bromwich, said in a statement that his client “drafted memos to memorialize significant discussions he had with high level officials and preserved them so he would have an accurate, contemporaneous record of those discussions. When he was interviewed by the special counsel more than a year ago, he gave all of his memos — classified and unclassified — to the special counsel’s office. A set of those memos remained at the FBI at the time of his departure in late January 2018. He has no knowledge of how any member of the media obtained those memos.”

These are “significant memos” and went right to Mueller when he was appointed. The kind of memos that might back investigative decisions, such as whether to open an investigation into the President.

So what the NYT spin of the story is about is suggesting that at the moment when DOJ opened an investigation into the President, the guy who opened it was “acting erratically.” Presumably based off the third-hand opinions of people like Jim Jordan, who knows a bit about acting erratically. It’s also about whether a discussion of removing the President took place at the same meeting where a discussion of investigating him did.

Likely, the messages are muddled, because they always are when getting laundered through Jim Jordan’s feverish little mind.

Update: NYT has now updated their story with two details designed to rebut the more responsible reporting of other outlets. First, they cite their sources claiming — without having to explain — that Rosenstein spoke about recording the President on another occasion, with the suggestion that that time it wan’t sarcastic.

Mr. Rosenstein also mentioned the possibility of wearing a wire on at least one other occasion, the people said, though they did not provide details.

More remarkably, they include a paragraph that reveals their original story was inaccurate as to timing. To rebut WaPo’s report that Lisa Page’s version of events don’t include the reference to the 25th Amendment, the NYT has now decided there were “at least two meetings that took place on May 16” (but note the knowledge of their sources all appears to come from memos, not from witnessing the events).

At least two meetings took place on May 16 involving both Mr. McCabe and Mr. Rosenstein, the people familiar with the events of the day said. Mr. Rosenstein brought up the 25th Amendment during the first meeting of Justice Department officials, they said. He did not appear to talk about it at the second, according to a memo by one participant, Lisa Page, a lawyer who worked for Mr. McCabe at the time, that did not mention the topic.

Well, okay, maybe that’s true. But that utterly demolishes some key premises of the story as originally written. The story collapses the timing of all this, emphasizing that it happened just two weeks into the job.

Mr. Rosenstein was just two weeks into his job. He had begun overseeing the Russia investigation and played a key role in the president’s dismissal of Mr. Comey by writing a memo critical of his handling of the Hillary Clinton email investigation. But Mr. Rosenstein was caught off guard when Mr. Trump cited the memo in the firing, and he began telling people that hefeared he had been used.

[snip]

The president informed them of his plan to oust Mr. Comey. To the surprise of White House aides who were trying to talk the president out of it, Mr. Rosenstein embraced the idea, even offering to write the memo about the Clinton email inquiry. He turned it in shortly after.

A day later, Mr. Trump announced the firing, and White House aides released Mr. Rosenstein’s memo, labeling it the basis for Mr. Comey’s dismissal. Democrats sharply criticized Mr. Rosenstein, accusing him of helping to create a cover story for the president to rationalize the termination. [my emphasis]

All this suggests the response was a direct response to the Comey firing.

And while the story does note the meetings take place a week later, the update emphasizes the actual date.

A determined Mr. Rosenstein began telling associates that he would ultimately be “vindicated” for his role in the matter. One week after the firing, Mr. Rosenstein met with Mr. McCabe and at least four other senior Justice Department officials, in part to explain his role in the situation. [my emphasis]

The “wire the president” comment (and the 25th Amendment one, if it did happen as described) took place on May 16, almost a week later.

One week after the firing, Mr. Rosenstein met with Mr. McCabe and at least four other senior Justice Department officials, in part to explain his role in the situation.

In this update, the NYT also took out language about Rosenstein wondering about motive.

wondered whether Mr. Trump had motives beyond Mr. Comey’s treatment of Mrs. Clinton for ousting him, the people said.

By May 16, of course, Rosenstein wouldn’t have to wonder about Trump’s motives, because he had already gone on TV and explained what his motive was — it was to end the Russia investigation.

More troublingly, he had taken a meeting with Sergei Lavrov and Sergei Kislyak — the latter of whom was a key figure in any conspiracy investigation — without American press present at which he shared highly sensitive Israeli secrets. While the public didn’t know it yet, at the meeting Trump also said he fired Comey to ease the pressure on him.

More importantly, if there were two meetings — one on whether Trump was handling the FBI hiring properly, and one on whether to open an investigation into the President — then it means those different topics have a different meaning. One meeting was about whether Trump was capable of doing the job, the other was about whether he had broken the law.

Anyway, what we’re not getting is any real understanding of the real context of these comments.

image_print