The FBI Believed Michael Sussmann Was Working for the DNC … Until Andrew DeFilippis Coached Them to Believe Otherwise

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs of transcripts. But if you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations. This coverage reflects the culmination of eight months work. 

There’s accumulating evidence that at least some people — including some key decision-makers — believed the FBI believed that the Alfa Bank tip came from the DNC — and that Andrew DeFilippis has engaged in a lot of coaching to try to make that evidence go away.

The first time FBI Agent Ryan Gaynor testified to John Durham about the investigation into the Alfa Bank anomaly in October 2020, he told prosecutors that the DNC was the source of the allegation.

Q. Okay. So in your first meeting with the government, you — this is October of 2020, correct?

A. Yes.

Q. You told them multiple times that you believed that the Democratic National Committee was the source of the allegations of connections between Alfa-Bank and Russia, correct?

A. Correct, which was wrong.

Q. Okay. But you said that you thought the Democratic party itself was who provided the information, correct?

A. I did say that in the meeting.

That’s even what he has written down in a briefing document he kept in Fall 2016.

At the end of that October 2020 interview, prosecutors threatened Gaynor with prosecution.

His more recent testimony, starting for the first time on May 13, was that Sussmann was representing himself. The reason he now remembers that to be true goes to the heart of Durham’s materiality: it would have mattered if Sussmann was representing the DNC, so he must have been representing himself.

Q. Okay. I want to ask you, first, about testimony that you gave today where you said that when Mr. Moffa told you that Mr. Sussmann was a DNC attorney, you said, “I understood that to mean that he had been affiliated with the Democratic party but that he had come representing himself on the Alfa-Bank allegations.” Do you remember giving that testimony?

A. That was my take-away.

Q. And you gave that testimony that I just read?

A. Yes; that he was a DNC attorney, but that my take-away from that discussion was that he wasn’t there representing the DNC.

Q. When you were asked, “When Mr. Moffa said Mr. Sussmann was an attorney for the DNC, what impression did you come away with?” what did you understand that to mean? And your answer was: “I understood that to mean that he had been affiliated with the Democratic party, but that he had come representing himself,” right?

A. So he’s affiliated with the Democratic party because he was a DNC attorney.

Q. And your impression was he had come representing himself?

A. My take-away from that meeting, what I recall, is that I did not believe that he was there representing the DNC specifically because, had he been, that would have been information that would have impacted it.

This is a tautology: If Sussmann had been representing the DNC it would have mattered so it must be the case that Gaynor believed he was not representing the DNC. It also happens to be the central argument of DeFilippis’ materiality claim.

Meanwhile, Scott Hellman — Durham’s star cyber witness — received a text from his boss, Nate Batty (with whom he compared notes before his first interview with Durham), referring to the white paper as a “DNC report” on September 21, 2016, two days after Jim Baker received the materials.

Michael Sussmann lawyer Sean Berkowitz asked Hellman about that the other day. At first, Hellman expressed surprise about that text.

Q. All right. And then, with respect to Stranahan, he asks you and Nate to write a report about the — write a summary of the DNC report. Correct? That’s what it says?

A. That’s what it says in this chat, yes.

Q. And did you understand, sir, that the information had come from a DNC, meaning Democratic National Committee, source?

A. I did not understand that, no.

Q. Did you know what Nate Batty knew about it?

A. I don’t think he knew anything about it.

Q. Did you call up Tim and say, what a second. This is a DNC report? That’s political motivation.

A. No.

Q. Didn’t do anything or it didn’t occur to you?

A. The first time I saw this was two years ago when I was being interviewed by Mr. DeFilippis, and I don’t recall ever seeing it. I never had any recollection of this information coming from the DNC. I don’t remember DNC being a part of anything that we read or discussed.

Q. Okay. When you say, the first time you saw it was two years ago when you met with Mr. DeFilippis, that’s not accurate. Right? You saw it on September 21st, 2016. Correct?

A. It’s in there. I don’t have any memory of seeing it.

Later in Berkowitz’ cross-examination he returned to the text. He asked how it could be that a white paper from a DNC lawyer could be referred to as a DNC report.

Q. And although you were surprised to see it today, it appears that at least somebody, such as Mr. Batty was aware and you were aware that somebody was calling this white paper a DNC report. Correct?

A. I was not aware that anybody was calling it a DNC report, and I don’t believe Mr. Batty knew that either.

Q. But you saw the link message. Right?

A. I did see the link message, yes.

Berkowitz asked Hellman how it could be that he would see a reference to a DNC report and not take from that it was a DNC report. Hellman describes “the only explanation that … was discussed” — which is that it was a typo.

Q. What’s your explanation for it?

A. I have no recollection of seeing that link message. And there is — have absolutely no belief that either me or Agent Batty knew where that data was coming from, let alone that it was coming from DNC. The only explanation that popped or was discussed was that it could have been a typo and somebody was trying to refer to DNS instead of DNC.

Q. So you think it was a typo?

A. I don’t know.

Q. When you said the only one suggesting it — isn’t it true that it was Mr. DeFilippis that suggested to you that it might have been a typo recently?

A. That’s correct.

Q. Okay. You didn’t think that at the time. Right?

A. I did not. I had never seen it or had any memory of seeing it ever before it was put in front of me.

With some prodding, Hellman admitted that when he referred to “discussing explanations,” he meant doing so with Andrew DeFilippis. This exchange was, quite literally, Berkowitz eliciting Hellman to provide an answer that DeFilippis thought up — one necessary to sustain DeFilippis’ narrative — without, at first, admitting it was DeFilippis’ opinion of what the truth must be.

So after DeFilippis threatened Gaynor with prosecution, he came to remember something other than what the note, tying the white paper to DNC lawyer Michael Sussmann, that he used to “refresh his memory” said.

And when faced with the possibility, two years or maybe six after the fact, that Scott Hellman’s epically shitty analysis of the white paper could have been influenced by being told that it was a DNC white paper, Hellman offered up the explanation that DeFilippis offered him.

At least twice, then, under coaching from Durham’s lead prosecutor, key witnesses have come to believe something other than what the documentary evidence suggests.

The fact that DeFilippis has twice coached witnesses to deny any understanding at FBI that this was a DNC tip — whether it was a DNC tip or not — is really telling. That’s because DeFilippis has to try to pitch a nearly unsustainable position: how his single witness to Sussmann’s alleged crime, Jim Baker, can in 2016 have told Bill Priestap the following:

Q. I think you testified yesterday that by this time you were at least generally aware that Mr. Sussmann represented the DNC in connection with hacks; is that right?

A. That’s correct.

Q. And what, if anything, did you say to Mr. Priestap about that?

A. I think I told him like, okay, this is who Michael is. He’s represented the Democratic party in the Russian hack that we were also investigating and/or the Hillary Clinton Campaign. So just, again, to orient Bill to who Michael was. I mean, that’s a serious credential in terms of being a cyber security expert. And then to explain: But in this case he said he’s not appearing on behalf of them. In this case he’s coming in as a good citizen.

And then, in 2018, have told Jim Jordan the following:

Q. Mr. Jordan then says: “And he was representing a client when he brought this information to you or just out of the goodness of his heart? Someone gave it to him and he brought it to you?”

A. In that first interaction, I don’t remember him specifically saying that he was acting on behalf of a particular client.

Q. Did you know at the time that he was representing the DNC in the Clinton campaign?

A. I can’t remember. I had learned that at some point. I don’t, as I said — as I think I n said last time, I don’t specifically remember when I learned that — excuse me — so I don’t know that I had that in my head when he showed up in my office. I just can’t remember.

Q. Did you learn that shortly thereafter if you didn’t know it at the time?

And then testify last week this way.

Q. Okay. Number two, did you know on the September 19th, 2016 meeting that Mr. Sussmann had been representing Hillary For America’s campaign and the DNC in connection with the hack investigation. Did you know that on September 19th when he met with you?

A. Sitting here today, I think the answer is, yes, I did know that by that point in time.

Q. I’ve written down, “yes, DNC and HFA and hack”. I want to be really clear. You’re not saying that he said that in the meeting. correct?

A. Correct.

Q. And you’re not saying he said he was there on behalf of them? You’re just saying that in your mind you knew that he had been acting as a lawyer for those two entities in connection with the hack. Correct?

It’s not just a question of whether Baker will be a credible witness, though his wildly changing claims about the DNC are among the reasons why his testimony is not credible.

It’s also that Durham wants to point to Sussmann’s failure, a year earlier in a Congressional hearing, to offer up his ties with the Democrats as proof he was lying. But Durham is treating Baker’s failure to do so in the same situation as an innocent mistake. For his single witness to be credible, DeFilippis has to find a way to excuse Baker’s failure to offer that up in a far more direct question while pointing to Sussmann’s failure to offer it up as proof of guilt.

He has to do so to defend his prosecutorial decisions, too. Given how much stake DeFilippis has placed on Baker sharing with Priestap that he knew Sussmann represented the Democrats, it makes it far less credible that Baker didn’t knowingly lie to Jordan. Especially given the way Baker responded to a Berkowitz question, suggesting that perhaps he hadn’t been truthful with Jordan, but instead was “careful.”

Q. And when you gave voluntary information to Congress, you understood that you were under oath?

A. I don’t think I was under oath, but I understood that it’s a crime to make false statements to Congress.

Q. So you tried to be as careful as you could. Correct?

A. I tried to be as careful as I could in that environment, yes, sir.

Q. You tried to be as truthful as you could?

A. (No response)

Q. Tried to be as truthful as you could?

A. Yes, sir.

Sussmann’s team is going to argue that there are a long list of people against whom there is far better evidence for false statements or perjury charges than him, with the single difference being that the other people were willing to tell the storytale DeFilippis is using prosecutorial resources to tell. And the first person on that list — it makes me sick to my stomach to say — is Jim Baker.

Finally, it’s a matter of materiality. DeFilippis has to find a way for it to be the case that his single witness knew when he met with Sussmann that Sussmann was a DNC lawyer (because Bill Priestap’s notes reflect that), but didn’t view that to be material to everything that happened next.

And the only way to sustain that rickety narrative is to ensure that no one else — not even the people using documentary proof reflecting a belief that this was a DNC report to refresh faded memories — understood that the white paper came from the DNC.

Thus far, Sussmann’s cross-examination has elicited evidence that at least three witnesses changed their testimony after interviews with DeFilippis, adopting a “memory” that conflicts with the documentary record with regards to whether the FBI believed the white paper to be associated with the DNC.

OTHER SUSSMANN TRIAL COVERAGE

Scene-Setter for the Sussmann Trial, Part One: The Elements of the Offense

Scene-Setter for the Sussmann Trial, Part Two: The Witnesses

The Founding Fantasy of Durham’s Prosecution of Michael Sussmann: Hillary’s Successful October Surprise

With a Much-Anticipated Fusion GPS Witness, Andrew DeFilippis Bangs the Table

John Durham’s Lies with Metadata

emptywheel’s Continuing Obsession with Sticky Notes, Michael Sussmann Trial Edition

Brittain Shaw’s Privileged Attempt to Misrepresent Eric Lichtblau’s Privilege

The Methodology of Andrew DeFilippis’ Elaborate Plot to Break Judge Cooper’s Rules

Jim Baker’s Tweet and the Recidivist Foreign Influence Cheater

That Clinton Tweet Could Lead To a Mistrial (or Reversal on Appeal)

John Durham Is Prosecuting Michael Sussmann for Sharing a Tip on Now-Sanctioned Alfa Bank

Apprehension and Dread with Bates Stamps: The Case of Jim Baker’s Missing Jencks Production

Technical Exhibits, Michael Sussmann Trial

Jim Baker’s “Doctored” Memory Forgot the Meeting He Had Immediately After His Michael Sussmann Meeting

Apprehension and Dread with Bates Stamps: The Case of Jim Baker’s Missing Jencks Production

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs of transcripts. But if you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations. This coverage reflects the culmination of eight months work. 

I’ve done a couple of posts showing how much fun one can have with Bates stamps — the serial numbers stamped onto every page of discovery that tells you a little bit about how any document was treated. In this post, for example, I showed that when John Durham accidentally-on-purpose released an exhibit with a bunch of Fusion GPS documents, he wasn’t doing so primarily to get them admitted at trial, because he had no intention of using most of them at trial. In this post, I showed that Durham hadn’t looked at key investigative documents that Michael Horowitz had relied upon in the Inspector General investigation into Crossfire Hurricane before Durham claimed he knew better than Horowitz about the predication of the Russian investigation. As of now, by the way, Horowitz is on the schedule to be a witness for Michael Sussmann. Ostensibly he’ll just talk about how valuable an anonymous tip that Sussmann once shared on behalf of Rodney Joffe proved to be, but who knows whether he’ll get a question about comments Durham has made about knowing better than Horowitz about things he hadn’t done the work to understand?

This post about Bates stamps won’t be so fun. It fills me with dread.

In this post and these two threads (Thursday nightFriday morning), I tried to summarize the Greek tragedy of Sussmann lawyer Sean Berkowitz’ cross-examination of Jim Baker. The short version of it is that these two men, men who used to be friends, are stuck in some nightmare Hunger Games created by a right wing mob led by Donald Trump. After years of being dragged through the mud because they dared to try to protect the United States from Russia in 2016, the survival of each depends on taking out the other. Jim Baker only avoids prosecution if he adheres obediently to John Durham’s internally contradictory script. Sussmann only gets his life back if he takes Baker out. While just Sussmann’s lawyer, Sean Berkowitz, and Jim Baker appear on this stage, it’s quite clear that Durham and DeFilippis set it.

Berkowitz started by quoting Baker’s explanation, from his earlier testimony, for why he had never searched his own files for texts with Sussmann.

Q. It’s your investigation, you said. I’m just here to answer the questions. Right? It’s Mr. DeFilippis’ investigation. You’re just here to answer the questions. Is what you said?

The context of that statement, from Andrew DeFilippis’ direct questioning of Baker, is crucial to understanding what follows.

The comment was Baker’s explanation to Durham’s lead prosecutor for why he only found a September 18, 2016 text from Michael Sussmann in March of 2022, almost six months after an entire indictment had been built around what Sussmann had said, instead, on September 19. As teed up by DeFilippis, Baker went looking for and found that text because Durham was just trying to comply with Jencks obligations, the requirement that prosecutors provide the prior statements of government witnesses in their possession to defendants.

Q. Are you familiar with the concept of Jencks materials or 3500 materials?

A. Yes.

[snip]

A. Correct. Yes. It’s an act of Congress that requires that — the reference to 3500 is a section in the U.S. Code.

Q. So did there come a time when you were asked by the Government to give any statements you might have on the subject of your testimony today?

A. Yes.

Q. And just tell us how that happened and then what you did in response.

A. There was a phone call with the Government. I think it was in March of this year. And it was to discuss discovery-related matters in part in the conversation. And I think it was Mr. Durham who asked me, you know: You need — we have an obligation to hand over discovery to the defense in this case. And can you go look for emails and other communications that you might have had with Mr. Sussmann?

And so in response to that, I — after we got off the phone, I immediately went to my phone and started looking through emails and then I looked for texts. And I did a search for texts with Michael’s last name; and texts came up, and I scrolled through them. They took a while to down — it was clear to me at least that they were downloading from the cloud.

And as I scrolled through and got to the beginning of my set of communications with Michael, this is the first one that I had.

Q. Now, had you — have you spoken to and met with the Government in connection with this case previously?

A. Yes.

Q. And had you previously located this text message here?

A. Not to the best of my recollection. No.

Q. What, if anything, was the reason for that?

A. It’s — I was not — I mean, the way I thought about it was that frankly, like, I am not out to get Michael. And this is not my investigation; this is your investigation. And so if you ask me a question, I answer it. If you ask me to look for something, I go look for it. But to the best of my recollection, nobody had asked me to go look for this material before that. [my emphasis]

Nobody had ever asked him to go look for evidence in his own possession related to the defendant against whom he was the key witness before, Baker testified. There’s a lot that’s unsaid — and batshit crazy — about this. One is that Durham only asked for communications directly with Sussmann, at least as Baker described events that happened just a few months ago.

Anyway, that was Durham’s explanation for how this text got shared with the government in March, six months after Durham had charged Sussmann for lying to hide what Durham imagines were Sussmann’s self-interests in a meeting with Baker on September 19, 2016. And by Baker’s telling, this belated request wasn’t just an example of DeFilippis trying to cover up his past incompetence (again). Durham was personally involved in this.

The only Bates stamp on this exhibit looks like this:

As you can see from Sussmann’s challenges to Durham’s exhibits submitted earlier this month, SCO-###### is one of two standard Bates stamps that Durham uses, the other being SC-########. Note both have a dash.

I knew as soon as I read the transcript that DeFilippis’ suggestion that this was about Jencks was intentionally misleading. Almost certainly, Durham found this text because they were still trying to comply with Sussmann’s demands, first made immediately after the indictment and then over and over after that, that prosecutors find  the communications about Sussmann’s role in killing a NYT story that he knew must exist. Besides, Jencks is an obligation to turn over statements about an investigation in the government’s possession. These texts weren’t, until Durham asked for them, in the government’s possession.

I mean, I guess if they were, and Durham had been sitting on them for six months, then Durham has even bigger problems, which I don’t rule out.

That’s the background to the way Sussmann’s lawyer began his cross-examination. After reminding Baker of this statement, Berkowitz then laid out that, while Baker had met over ten times with Durham’s team, he had declined to meet with Sussmann’s team. Berkowitz introduced a letter he had sent Baker’s lawyer on April 20, asking to meet.

That letter had no Bates stamp. Just the Exhibit number submitting it into evidence.

That suggests Durham’s team hadn’t seen this letter yet — though I’m sure nothing about the letter was a surprise to them. Baker has met with Durham’s team at least twice since Berkowitz sent this letter. Berkowitz asked if Baker knew about the letter but Baker dodged, saying only that he had delegated the decision about meeting with Sussmann’s team to his lawyer, Dan Levin.

Then Berkowitz asked whether Baker knew what it was like to be under criminal investigation.

A. Yes.

Q. That’s Mr. Durham?

A. Yes.

They talked for a while about an earlier Durham investigation, one that lasted from 2017 until 2019 (Berkowitz made Baker repeat the dates), into whether information about surveillance that Baker had shared with a journalist had, or had not, been an authorized disclosure. Berkowitz talked about what might have happened had Baker been charged.

Loss of his legal career.

Being prosecuted.

Berkowitz talked about how that investigation basically boiled down to several conflicting versions of a phone call that other witnesses had given Durham. Their word against Baker’s.

Q. So at least one of their recollections was inconsistent with yours. Right?

A. Yes. Yes.

Q. Memories are a difficult thing, aren’t they, sir?

A. That’s a difficult question to answer. That depends.

That’s how Berkowitz prefaced the first of a long list of things Baker had said in Michael Sussmann’s trial that conflicted with things he had said in the past, a list that carried into a second day (actually Baker’s third day on the stand). At this point, Berkowitz mentioned just one of them — Baker’s inconsistent testimony to the Inspector General in July 2019 — then interrupted.

He put up a text to Ben Wittes that Baker sent the day after Durham was appointed in this matter (so weeks before that particular interview with the IG). Wittes and Baker were talking about TV appearances, but Baker seemed preoccupied by the Durham appointment.

MR. BERKOWITZ: The date, Mr. Cleaves.

THE WITNESS: There we go. Okay. Sorry. May 14th, 2019. Thank you.

BY MR. BERKOWITZ:

Q. And you write: “It went well. It was about the Love piece which was good. CNN Tonight was okay but didn’t cover that at all. And now I get to be investigated for another year or two by John Durham. Lovely.” Correct?

A. Right.

Q. So you expected to be investigated further by Mr. Durham. Correct?

A. Yes, I did.

I’ll come back to the metadata on the text in just a bit.

The text makes it clear how, after being investigated by John Durham from 2017 to 2019, upon learning that Durham had just been appointed to investigate other matters implicating Baker, FBI’s former General Counsel immediately realized the investigation would continue for another two years.

Baker was wrong about the timing. Durham’s investigation just celebrated its third birthday.

This text frames all of Baker’s subsequent cooperation in that light — in Baker’s immediate recognition that the hell he had been going through for the previous two years would continue another two. Or three. Or longer.

This is brilliant lawyering on Berkowitz’s part. But remember as you read along that this is really a Hunger Games conflict staged by Trump and Bill Barr to exploit the US Justice system to create a never-ending supply of revenge theater that will incite the base and lead the press to do shitty reporting for easy clicks. This is an act of revenge targeting anyone who has ever dared to question Trump’s corruption. Or even, question the dangers of Russian interference in American democracy.

Back to Berkowitz. After showing Baker the text reflecting his immediate dread about being investigated by Durham for two more years, Berkowitz described how, the day after Durham’s appointment (actually it was about three days after, and so two days after this text), Baker had his lawyer reach out to Durham and offer to cooperate.

The letter is actually kind of funny. It shows Levin emailing and saying, “Jim asked me to reach out and let you know that he is available if you wish to interview him (he just spoke to the IG today).” Durham seems to have forwarded that email from one of his DOJ emails to another. I sort of wonder if there was a BCC, because Durham was in really close contact with Bill Barr’s office in these weeks. Durham then attempted to write back to Levin but at least as it appears (because he forwarded the email to himself rather than simply replying with a CC to his second DOJ account), Durham simply wrote to himself, responding into a void about meeting with “tour client” soon.

The Bates stamp for this exhibit looks like this:

DX-811 is the exhibit number for this trial (DX shows that it is one of Sussmann’s exhibits, as opposed to one of the government’s).

LW-06_0001 may reflect Sussmann’s Latham & Watkins’ lawyers sharing their proposed exhibits with Durham and Judge Cooper before the trial.

SCO-012114 is the regular Bates stamp associated with Durham’s production to Sussmann. It’s part of the same series (though much earlier in) the Bates stamp of the text that Baker turned over to Durham on March 4. SCO dash ######.

And SCO-3500U-4007 seems to be a Bates stamp specifically tied to Jencks discovery, which as noted above is called Rule 3500. That’s a really handy Bates stamp because it may indicate what Durham is treating as Jencks discovery. It appears in other direct statements made by Durham’s witnesses about this investigation. The calendar entry for the September 19, 2016 meeting between Baker and Sussmann, for example, has one of those 3500 stamps.

The text that, DeFilippis suggested, Durham had only asked for out of a diligent desire to comply with Jencks obligations doesn’t have one of these 3500 Bates stamps. Here it is again, SCO dash ######.

Having shown those three documents — Berkowitz’s request for a meeting with Baker, Baker’s text to Wittes dreading two more years of investigation by Durham, and Levin’s letter to Durham immediately after his appointment offering to come in for an interview — Berkowitz then resumed talking about inconsistencies in Baker’s testimony. He alluded, briefly, to a sworn statement Baker made to the grand jury under questioning from DeFilippis about the role that the General Counsel would have in FBI investigations. Then, after going through what Baker’s current testimony is, Berkowitz asked,

Q. The fact that Mr. Sussmann stated specifically in his message that he was acting on his own and not for a client did not factor heavily into your decision to meet with him. Correct?

This statement is inconsistent with the testimony Baker gave on the stand. Baker disavowed it.

A. I disagree with that.

So Berkowitz did what’s known as “refreshing” a witness’ memory, first by reading him what the 302 memorializing an FBI interview said.

Q. All right. Do you remember speaking with these folks in March of this year — by these folks to be, correct for the record, the prosecution team, Mr. DeFilippis?

A. In March of this year, I spoke to them, yes.

Q. Okay. And in March of this year, is it not true that you told them you do not believe that the fact that Sussmann stated specifically in his texts that he was acting on his own and not for a client factored heavily into your decision to meet with Michael Sussmann the very next day. You told them that?

A. Can you repeat the first part of that again? Sorry.

Q. “Baker does not believe that the fact that Sussmann stated specifically in his text message that he was acting on his own and not for a client factored heavily into his decision to meet with Sussmann the very next day”?

Baker, perhaps realizing that this interview from a few months ago conflicts with the testimony he has just given, had forgotten the question.

A. So, I’m sorry. What’s your question?

Q. You told them that on March 4th of 2022.

Baker didn’t recall giving that conflicting testimony.

A. Sitting here today, I don’t recall telling them that.

Berkowitz offered to show him the proof: a 302 interview report that, unlike the meeting between Baker and Sussmann on September 19, 2016, actually documents what was said.

Q. Refresh your recollection to see the 302 of your meeting, sir?

A. Sure. I haven’t seen that 302 before.

This is an opportunity for Berkowitz to explain, as he did when he used one to refresh Scott Hellman’s memory earlier in the week, what a 302 is and how FBI always creates 302s for fact witnesses.

Q. All right. And to orient the jury is when an agent is present and take notes. Correct?

A. It’s a report of an interview.

Q. And when a witness is interviewed by the FBI, an agent is there to take notes, if it’s a fact witness, and put it into a report. Correct?

A. Correct.

Q. You didn’t do that with Mr. Sussmann. Right?

A. Correct.

Berkowitz asked Baker if he remembered making the statement on March 4. DeFilippis’ single witness to Sussmann’s alleged crime professed, for the second time in short order, not to remember something that happened just a few months ago.

Q. Does it refresh your recollection that, on March 4th of 2022, you told the FBI and Mr. DeFilippis that you didn’t believe the fact that Mr. Sussmann stated specifically in his text he was acting on his own and not for a client factored heavily into your decision to meet with Mr. Sussmann the next day?

A. I don’t recall making that statement sitting here today.

Q. And it’s your testimony

MR. BERKOWITZ: You can take that down.

BY MR. BERKOWITZ: Q. It’s your testimony that that’s not accurate. Correct?

A. It’s my testimony today that, as I think about it today, that that’s not accurate.

More than just forgetting what he said a few months ago, Baker is showing the jury how, if his current belief conflicts with a past one shared under threat of false statements charges, he’ll simply say his past truth is not the truth. Not accurate.

Then Baker thinks of something: the significance of the date.

A. Can I ask you a question? When was that 302? What was the date? What meeting or what interview was that pertaining to?

Q. There’s a lot of different meetings and interviews here. This one was a couple of months ago on March 4th of 2022 —

A. Okay.

Q. — in connection with your trial preparation for today.

A. That was the date that I found the text, yes.

Q. Okay. Did that change your recollections at all or —

Baker explains that discovering a text in which Sussmann had stated that he wasn’t asking for the September 19, 2016 meeting “on behalf of any client,” but wanted to help the FBI had upset him, suggesting that might explain why he gave testimony a few months ago that substantially differs from the testimony he gave on the stand.

A. Well it’s just it was a very — it was a very difficult day for me and it was a bit upsetting.

As a reminder, this day was not just a stressful one for Baker. While I can’t think of an evidentiary basis by which Sussmann could share this with the jury, after Baker found a text that greatly complicated Durham’s prosecution, Durham accused Sussmann of hiding evidence, a stance he was forced to drop after Sussmann obtained a subpoena on his own to disprove that accusation.

Anyway, after noting that Baker met with Durham in spite of the stress of having found the text, Berkowitz asked Baker, for the first time in this Hunger Games conflict, whether he was aware that it was a crime to lie to the FBI.

A. I know very well it’s a crime to make a false statement to the FBI if that’s what you are getting at. Whether they say it or not, I know it.

At that point, Berkowitz pulled out a white board and starting writing down the things that Baker was committing to believing were the truth. He started with “the elephant in the room,” the memory that, if the jury finds it shaky, will sink this entire prosecution.

Q. Let’s start with the elephant in the room. Sitting here today, what is your testimony about what Mr. Sussmann told you relative to clients?

A. At the meeting in person on the 19th of September?

Q. Yes.

A. Okay. My testimony is that he said that he was not there on behalf of any particular client or words to that effect.

Q. Oh, now it’s “words to that effect.” Okay.

DeFilippis objected.

He didn’t want Berkowitz to write this down, I’m sure, because any juror taking notes is going to write down exactly what Berkowitz writes down, thereby solidifying the points in their memory. That’s how my memory works anyway: If I write it down, I’m far more likely to remember it. People think I have a really good memory, but in actuality, I just write a lot more than most people.

DiFilippis probably also didn’t want Berkowitz to write this down because it’ll isolate the key claims that Baker has made, thereby making it easier for jurors to compare his currently operative statements with what he had said in the past. DeFilippis wanted just the court reporter to write this down, in a transcript that won’t ever be shared with the jury.

MR. DeFILIPPIS: Objection, Your Honor, we do have a court reporter.

THE COURT: Overruled.

Berkowitz walked Baker through his currently operative story for the following:

  • What Sussmann said on September 19 about having a client
  • Whether Baker knew Sussmann worked for Hillary that day
  • How long the meeting was
  • What Sussmann said about a news organization ready to publish a story
  • Whether he identified any particular cyber experts
  • Whether those experts — Steve Bellovin, Matt Blaze, and Susan Landau — had vouched for the data
  • Whether Baker or Sussmann had taken notes
  • Whether he had refused to share Sussmann’s name when Scott Hellman and an FBI administrative person  named Jordan Kelly had come to obtain the materials, as Scott Hellman testified earlier in the week

That’s when they break for lunch. After lunch they go over Baker’s meeting with Bill Prietsap, his calls to get Eric Lichtblau’s name later in the week, and his foggy memory about the details from the the March 6, 2017 when the Alfa Bank allegation comes back up. I’m not sure whether this got written onto a white board or not (it sounds like Berkowitz had filled the white board before lunch).

Berkowitz then returned to the many times Baker had given conflicting testimony under oath, starting with his testimony before Congress.

Q. And when you gave voluntary information to Congress, you understood that you were under oath?

A. I don’t think I was under oath, but I understood that it’s a crime to make false statements to Congress.

Q. So you tried to be as careful as you could. Correct?

A. I tried to be as careful as I could in that environment, yes, sir.

Q. You tried to be as truthful as you could?

A. (No response)

Q. Tried to be as truthful as you could?

A. Yes, sir.

Berkowitz then went through and laid out how his prior testimony conflicts with what he’s just laid out on the whiteboard and after lunch.

Again, great lawyering, but the reason this is so dreadful is because this is precisely the kind of Hunger Games conflict that Reality TV show star Donald Trump uses to accrue power.

Berkowitz reminded Baker that his two appearances before Congress in October 2018 could be subject to false statement prosecution, his 2019 interview with the Inspector General (which Baker calls “the I.G. thing”), the two meetings with Durham at which Sussmann was raised in June 2020 (at such time as Trump and Barr were pressuring Durham for pre-election results). All potentially subject to prosecution as false statements or perjury.

Berkowitz ended the day by asking about threats, returning again to the possibility that any single one of these inconsistent statements — the most recent of which discussed thus far was on March 4, 2022, the statute of limitation for which would not expire until 2027 — could be charged as a false statement.

Q. Did they threaten you, sir, with anything — based on the fact that you had previously told folks under oath or subject to perjury — that you had said inconsistent things?

A. Mr. Durham and his team have never threatened me in any way.

Q. But you understood, sir, did you not, as a lawyer, that if you had said something that someone determined was false, under oath, or subject to perjury, you could be prosecuted. Correct?

I suspect that, by the end of the week, Berkowitz will argue that several of Durham’s witnesses have made more easily provable false statements — and more material — to the Special Counsel and others than Sussmann, but Durham is not choosing to prosecute the ones who tell the story he wants told, the story he chooses to refresh. Remember, there are at least three documents already introduced that Durham chose not to use to refresh Baker’s memory to something different than he delivered on the stand last week.

Which brings me back to DeFilippis’ excuse for finding a text that Sussmann was asking for but which Durham had never bothered to look for, and the inconsistent statement — that Sussmann’s notice that he was not there on behalf of any client had a big role in him taking the meeting — and Baker’s attribution of his now-inconsistent answer to stress.

Durham discovered on March 4 that Baker had relevant texts he never bothered to ask for in 16 months of investigation before he charged Sussmann. DeFilippis introduced that text by claiming prosecutors had discovered it by asking — John Durham asked himself, according to Baker — for Jencks material.

That text has no Bates stamp reflecting that it is Jencks material.

There’s something else about that text. It looks nothing like the text that Berkowitz entered describing Baker’s dread as he realized Durham was going to be investigating for two more years. Here’s the text Baker turned over in March, in response to Durham’s request for any communications involving Sussmann, but only communications involving Sussmann.

Here’s the text to Wittes expressing certainty that Durham would investigate him for two more years.

These are both iMessage texts! They look entirely different, though, because one is a screen cap turned over by Baker, and the other was obtained via legal process served on Apple (which is where all the extra metadata comes from).

More interesting still, however, is the Bates stamp on the set of texts involving Wittes. The Bates stamp on that text looks like this:

There’s the red stamp that, I’m guessing, is the stamp associated with a pre-trial proposed exhibit.

There’s the trial exhibit stamp, DX-810.

And then there’s a Bates stamp that does not match any Durham Bates stamp I’ve seen. SCO_######. Underscore, not dash.

Although this is a statement by a witness — the key witness!! — about this very investigation, there’s no Jencks stamp.

Mind you, the government only has to turn over statements about an investigation under Jencks if it is in their possession. So maybe this was never in their possession? If it was, it’d be a Jencks violation and Sussmann could ask to have the entirety of Baker’s testimony thrown out. All of it.

I have no idea where this text string comes from. Perhaps it came from an FBI Inspection Division investigation of all these same people; such material was among the stuff that Durham was permitted to turn over late. Perhaps, as Latham & Watkins did when Durham accused Sussmann of hiding this text, they got a subpoena and obtained it themselves. But it appears, at least, that it didn’t come from Durham.

If that’s right — if, even after discovering that Baker had texts that were absolutely critical to this investigation that he had never turned over, Durham didn’t choose to obtain these texts directly from Apple themselves, or at the very least ask Baker to turn over all texts pertinent to his investigation — there are several implications. First, it’s proof that Durham never ever subjected Baker, the guy who offered to cooperate on day three, to investigative scrutiny for his role in the events from September 19, 2016 that Durham has chosen to criminalize. Nor has Durham tested what might be behind any of Baker’s subsequent inconsistent statements. And when Durham discovered that Baker had had texts that were critical to his investigation almost three years into the investigation, his first response was to attempt to blame Sussmann. When that didn’t work, it appears, Durham didn’t put his prosecution at risk to see what other texts, texts that might be critical to Durham’s investigation but which didn’t involve communications between him and Sussmann, might be in Baker’s iCloud account.

This is brilliant lawyering. But it’s all just a part of Donald Trump’s Hunger Games, revenge theater targeting the people who questioned his complicit ties with Russia. And the wrong people are going to get hurt.

Other Sussmann trial coverage

Scene-Setter for the Sussmann Trial, Part One: The Elements of the Offense

Scene-Setter for the Sussmann Trial, Part Two: The Witnesses

The Founding Fantasy of Durham’s Prosecution of Michael Sussmann: Hillary’s Successful October Surprise

With a Much-Anticipated Fusion GPS Witness, Andrew DeFilippis Bangs the Table

John Durham’s Lies with Metadata

emptywheel’s Continuing Obsession with Sticky Notes, Michael Sussmann Trial Edition

Brittain Shaw’s Privileged Attempt to Misrepresent Eric Lichtblau’s Privilege

The Methodology of Andrew DeFilippis’ Elaborate Plot to Break Judge Cooper’s Rules

Jim Baker’s Tweet and the Recidivist Foreign Influence Cheater

That Clinton Tweet Could Lead To a Mistrial (or Reversal on Appeal)

John Durham Is Prosecuting Michael Sussmann for Sharing a Tip on Now-Sanctioned Alfa Bank

The Methodology of Andrew DeFilippis’ Elaborate Plot to Break Judge Cooper’s Rules

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

When Michael Sussmann attorney Sean Berkowitz was walking FBI Agent Scott Hellman through the six meetings he had with Durham’s team on Tuesday — meetings he first had as a witness about the investigation into the Alfa Bank allegations and later in preparation for his trial testimony — Berkowitz asked Hellman about how, sometime earlier this year, Andrew DeFilippis and Jonathan Algor asked him whether he could serve as their DNS expert for the trial.

Q And then, more recently, you met with Mr. DeFilippis and I think Johnny Algor, who is also at the table here, who’s an Assistant U.S. Attorney. Correct?

A. Yes.

Q. They wanted to talk to you about whether you might be able to act as an expert in this case about DNS data?

A. Correct.

To Hellman’s credit, he told Durham’s prosecutors — who have been investigating matters pertaining to DNS data for two years — that he only had superficial knowledge of DNS and so wasn’t qualified to be their expert.

Q. You said, while you had some superficial knowledge, you didn’t necessarily feel qualified to be an expert in this case, correct, on DNS data?

A. On DNS data, that’s correct.

It wasn’t until the third day of trial before Durham’s team presented any evidence about the alleged crime. Instead, Durham’s first two witnesses were their nominal expert, David Martin, and Hellman, who told Durham he wasn’t an expert but who offered opinions he neither had the expertise to offer nor had done the work to substantiate.

That’s important, because DeFilippis used him to provide an opinion only an expert should give. And virtually everything about his testimony — his claim to have relied on the data in the materials without looking at the thumb drives, an apparently made up claim about the timing of the analysis, and behaviors that the FBI normally finds suspicious — suggest he’s not only not a DNS expert qualified to assess this report, but his assessment of the white paper Sussmann shared also suffers from serious credibility issues.

The battle over an expert

The testimony of the nominal expert, David Martin, was remarkably nondescript, particularly given the fight that led up to his testimony. Durham’s team sprung even having an expert on Sussmann at a really late date: on March 30, after months of blowing off Sussmann’s inquiries if they would. Not only did they want Martin to explain to the jury what DNS and Tor are, Durham’s team explained, but they also wanted him to weigh in on the validity of conclusions drawn by researchers who had found the anomaly.

  • the authenticity vel non of the purported data supporting the allegations provided to the FBI and Agency-2;
  • the possibility that such purported data was fabricated, altered, manipulated, spoofed, or intentionally generated for the purpose of creating the false appearance of communications;
  • whether the DNS data that the defendant provided to the FBI and Agency-2 supports the conclusion that a secret communications channel existed between and/or among the Trump Organization, Alfa Bank, and/or Spectrum Health;

[snip]

  • the validity and plausibility of the other assertions and conclusions set forth in the various white papers that the defendant provided to the FBI and Agency-2;

As Sussmann noted in his motion to limit Martin’s testimony, he didn’t mind the testimony about DNS and Tor. He just didn’t want this trial to be about the accuracy of the data, especially without the lead time to prepare his own expert.

As the Government has already disclosed to the defense, should the defense attempt to elicit testimony surrounding the accuracy and/or reliability of the data that the defendant provided to the FBI and Agency-2, Special Agent Martin would explain the following:

  • That while he cannot determine with certainty whether the data at issue was cherry-picked, manipulated, spoofed or authentic, the data was necessarily incomplete because it was a subset of all global DNS data;
  • That the purported data provided by the defendant nevertheless did not support the conclusions set forth in the primary white paper which the defendant provided to the FBI;
  • That numerous statements in the white paper were inaccurate and/or overstated; and
  • That individuals familiar with these relevant subject areas, such as DNS data and TOR, would know that such statements lacked support and were inaccurate and/or overstated.

Based off repeated assurances from Durham that they weren’t going to make accuracy an issue in their case in chief, Judge Cooper ruled that the government could only get into accuracy questions if Sussmann tried to raise the accuracy of the data himself. But if he said he relied on the assurances of Rodney Joffe, it wouldn’t come in.

The government suggests that Special Agent Martin’s testimony may go further, depending on what theories Sussmann pursues in cross-examination or his defense case. Consistent with its findings above, the Court will allow the government’s expert to testify about the accuracy (or lack thereof) of the specific data provided to the FBI here only in certain limited circumstances. In particular, if Sussmann seeks to establish at trial that the data were accurate, and that there was in fact a communications channel between Alfa Bank and the Trump Campaign, expert testimony explaining why this could not be the case will become relevant. But, as the Court noted above, additional testimony about the accuracy of the data—expert or otherwise—will not be admissible just because Mr. Sussmann presents evidence that he “relied on Tech Executive-1’s conclusions” about the data, or “lacked a motive to conceal information about his clients.” Gov’s Expert Opp’n at 11. As the Court has already explained, complex, technical explanations about the data are only marginally probative of those defense theories. The Court will not risk confusing the jury and wasting time on a largely irrelevant or tangential issue. See United States v. Libby, 467 F. Supp. 2d 1, 15 (D.D.C. 2006) (excluding evidence under Rule 403 where “any possible minimal probative value that would be derived . . . is far outweighed by the waste of time and diversion of the jury’s attention away from the actual issues”).

Then, days before the trial, the issue came up again. Durham sent a letter on May 6 (ten days before jury selection), raising a bunch of new issues they wanted Martin to raise. Sussmann argued that Durham was trying to expand the scope of what his expert could present. Among his complaints, Sussmann argued that Durham was trying to make a materiality argument via his expert witness.

Third, the Special Counsel apparently intends to offer expert testimony about the materiality of the false statement alleged in this case. Indeed, the Special Counsel’s supplemental topic 9 regarding the importance of considering the collection source of DNS data is plainly being offered to prove materiality. But the Special Counsel did not disclose this topic in either his initial expert disclosure or Opposition, and the Court’s ruling did not permit such testimony. The Special Counsel should not now be allowed to offer an entirely new expert opinion under the guise of eliciting testimony regarding the types of conclusions that can be drawn from a review of DNS data.

Judge Cooper considered the issue Tuesday morning, before opening arguments. When asking why Martin had to present the concept of visibility, DeFilippis explained that Hellman–the Agent who’s not an expert on DNS but whom DeFilippis nevertheless had asked to serve as an expert on DNS–would talk about the import of knowing visibility to assess data.

THE COURT: Well, but isn’t the question here whether a case agent — is your case agent later going to testify that that was something that the FBI looked at or wanted to look at in this case and was unable to do so, and that that negatively affected the FBI’s investigation in some way? MR.

DeFILIPPIS: Yes, and I expect Special Agent Hellman, who will testify likely today, Your Honor, I expect that that is a concept that he will say was relevant to the determination that — determinations he was making as he drafted analysis of the data that came in. And, again, I don’t think we — for example, another way in which this comes up is that the FBI routinely receives DNS data from various private companies who collect that data, and it is always relevant sort of the breadth of visibility that those companies have. So it’s relevant generally, but also in this particular case the fact that the FBI did not have insight into the visibility or lack of visibility of that data certainly affected steps that the FBI took.

THE COURT: Okay. But Mr. Sussman has not been accused of misrepresenting who the source is. He’s simply — but rather who the client is. So how do you link that to the materiality of the alleged false statement?

MR. DeFILIPPIS: Because, Your Honor, I think we view them as intertwined. It was because — it was in part because Mr. Sussman said he didn’t have a client that made it more difficult for the FBI to get to the bottom of the source of this data or made it less likely they would, and so — and, again, I don’t think we expect to dwell for a long time on this, but I think the agents and the technical folks will say that that is part of why the origins of the data are extremely relevant when they took investigative steps here.

When Cooper noted Sussmann’s objection to Martin discussing possible spoofing of data, DeFilippis again answered not about what Martin would testify, but what Hellman would.

As DeFilippis explained, he claimed to believe that under Cooper’s ruling, the government could put in any little thing they wanted that they claimed had been part of the investigation.

And Special Agent Hellman, when he testifies today — now, Your Honor’s ruling we understand to permit us to put into evidence anything about what the FBI analyzed and concluded as its investigation unfolded because that goes to the materiality of the defendant’s statement. So Special Agent Hellman — through Agent Hellman we will offer into evidence a paper he prepared when the data first came in, and among its conclusions is that the data might — he doesn’t use the word “spoof” — but might have been intentionally generated and might have been fabricated. That was the FBI’s initial conclusion in what it wrote up.

So in order for the jury to understand the course of the FBI’s investigation and the conclusions that it drew at each stage, those concepts are at the center of it.

[snip]

MR. DeFILIPPIS: Okay. Your Honor, I’m sorry. We understood your ruling to be that the FBI’s conclusions as it went along were okay as long as we weren’t asserting the conclusion that it was, in fact, fabricated. You know, I mean, it’s difficult to chart the course of the FBI’s investigation unless we can elicit at each stage what it is that the FBI concluded.

Judge Cooper ordered that references to spoofing be removed — leading to a last minute redaction of an exhibit — but permitted a discussion of visibility to come in.

After all that fight, Martin’s testimony was not only bland, but it was recycled powerpoint. He not only admitted lifting the EFF description of Tor for his PowerPoint, but he included their logo.

Hellman delivers the non-expert expert opinion Durham was prohibited from giving

As I said, Martin was witness number one, Hellmann — the self-described non-expert in DNS — was witness number two.

Even though Hellman admitted, again, that he’s not a DNS expert, DeFilippis still had him go over what DNS is.

Q. How familiar or unfamiliar are you with what is known as DNS or Domain Name System data?

A. I know the basics about DNS.

Q. And in your understanding, on a very basic level, what is DNS?

A. DNS is basically how one computer would try and communicate with another computer.

After getting Hellman to explain how he purportedly got chain of custody signatures on September 20, 2016 for the materials Michael Sussmann dropped off with James Baker on September 19, DeFilippis walked Hellman through how, he claimed, he had concluded that the allegations Sussmann dropped off were unsupported. Hellman reviewed the data accompanying the white paper, Durham’s star cybersecurity witness claimed on the stand, and after reviewing that data, determined there was no allegation of a hack in the materials and therefore nothing for the Cyber Division to look at. And, as a report he wrote “within a day” summarized, he concluded the methodology was horrible.

As you read the following exchange, know that (as I understand it) some, if not most, of what Hellman describes as the methodology is wrong. Obviously, if Hellman’s understanding of the methodology is wrong, then the opinion that DeFilippis elicits from a guy who admitted he was not an expert on DNS but whom DeFilippis nevertheless asked to serve as his expert witness on DNS before inviting David Martin in to present slides lifted from the Electronic Frontier Foundation instead [Takes a breath] … If Hellman’s understanding of the methodology and the data he’s looking at is wrong, then his opinion about the methodology is going to be of little merit.

With that understanding, note the objection of Sean Berkowitz, who fought DeFilippis’ late hour addition of an expert that DeFilippis wanted to use to opine on the validity of the research, bolded below.

So we looked at the top part, which set out your top-line conclusion. You then have a portion of the paper that says, “The investigators who conducted the research appear to have done the following.” Now, Special Agent Hellman, it appears to be a pretty technical discussion, but can you just tell us, in that first part of the paper, what did you set out and what did you conclude?

A. It looks to be that they were looking for domains associated with Trump, and the way that they did that was they looked at a list of sort of all domains and looked for domains that had the word “Trump” in them as a way to narrow down the number of domains they were looking at.

And then they wanted to find, well, which of that initial set of Trump domains, which of them are email servers associated with those domains. And the way they did that was to search for terms associated with email, like “mail” or other email-related terms to then narrow down their list of domains even further to be Trump-associated domains that were email servers.

Q. And did you opine on the soundness of that methodology? In other words, did you express a view as to whether this was a good way to go about this project?

A. We did not — I did not feel that that was the most expeditious way to go about identifying email servers associated with the domain.

Q. And why was that?

A. You can name an email server anything you want. It doesn’t have to have the words “mail” or “SMTP” in it. And so by — if you’re just searching for those terms, I would wager to guess you would miss an actual email server because there are other — there are other more technical ways that you can use — basically look-up tools, Internet look-up tools where you can say, for any domain, tell me the associated email server. That’s essentially like a registered email server. But the way that they were doing it was they were just looking for key terms, and I think that it just didn’t make sense to me why they would go about identifying email servers that way as opposed to just being able to look them up.

Q. Was there anything else about the methodology used here by the writer or writers of this paper that you found questionable or that you didn’t agree with?

A. I think just the overall assumptions that were being made about that the server itself was actually communicating at all. That was probably one of the biggest ones.

Q. And what, if anything, did you conclude about whether you believed the authors of the paper or author of the paper was fairly and neutrally conducting an analysis? Did you have an opinion either way?

MR. BERKOWITZ: Objection, Your Honor.

THE COURT: Basis?

MR. BERKOWITZ: Objection on foundation. He asked him his opinion. He’s not qualified as an expert for that.

THE COURT: I’ll overrule it.

A. Sorry, can you please repeat the question?

Q. Sure. Did you draw a conclusion one way or the other as to whether the authors of this paper seemed to be applying a sound methodology or whether, to the contrary, they were trying to reach a particular result? Did you —

A. Based upon the conclusions they drew and the assumptions that they made, I did not feel like they were objective in the conclusions that they came to.

Q. And any particular reasons or support for that?

A. Just the assumption you would have to make was so far reaching, it didn’t — it just didn’t make any sense.

That’s how, as his second witness, Andrew DeFilippis introduced the opinion of a guy who admitted he wasn’t an expert on DNS that DeFilippis had asked to serve as an expert even though DeFilippis should have known that he didn’t have the expertise to offer expert opinions like this.

If Sussmann is found guilty, I would bet a great deal of money this stunt will be one part of a several pronged appeal, because Judge Cooper permitted DeFilippis to do precisely what Cooper had prohibited him from doing before trial, and he let him do it with a guy who by his own admission is not a DNS expert.

Cyber Division reaches a conclusion without looking at the thumb drives

Now let’s look at what Hellman describes his own methodology to be.

First, it was quick. DeFilippis seems to think that serves his narrative, as if this stuff was so crappy that it took a mere glimpse to discredit it.

Q. Special Agent Hellman, how long would you say it took you and Special Agent Batty to write this up?

A. Inside of a day.

Q. Inside of a day, you said?

Berkowitz walked Hellman through the timeline of it, and boy was it quick. There’s some uncertainty about this timeline, because John Durham’s office doesn’t feel the need to make clear whether exhibits they’re turning over in discovery reflect UTC or ET. But I think I’ve laid it out below (Berkowitz got it wrong in cross-examination, which DeFilippis used to attack his analysis).

As you can see, not only were FBI’s crack cybersecurity agents making a final conclusion about the data within a day but — by all appearances — they did so before they had ever looked at the thumb drives included with the white papers. From the record, it’s actually not clear when — if!!! — they looked at the thumb drives. But it’s certain they had their analysis finalized no more than one working day after they admitted they hadn’t looked at the thumb drive, which was itself after they had already decided the white paper was shit.

Timeline

September 20, 10:20AM: Nate Batty tells Jordan Kelly they’ll come from Chantilly to DC get the thumb drives

September 20, 10:31AM: Jordan Kelly tells Batty the chain of custody is “Sussman to Strzock to Sporre”

September 20, 12:29PM: Hellman and Nate Batty accept custody of the thumb drives

September 20, 1:30PM: Hour drive back to Chantilly, VA

September 20, 4:44PM: Hellman appears to explain the process of picking up the thumb drives to jrsmith, claiming to have spoken to Baker on the phone. jrsmith jokes about “doctor[ing] a chain of evidence form.”

September 20, 4:58: Hellman says the more he reads the report “it feels a little 5150ish,” suggesting (as he explained to Berkowitz on cross) the authors suffered from a mental disability, and Hellman complains that “it contains an absurd quantity of data” to which Batty responded, the data seemed “inserted to overwhelm and confuse the reader.”

September 21, 8:47AM: Batty tells Hellman their supervisor wants them to “write a brief summary of what we think about the DNC report.” Batty continues by suggesting that “we should at least plug the thumb drives into Frank’s computer and look at the files…”

9/22, 9:44AM: Curtis Heide, in Chicago, asks Batty to send the contents of the thumb drive so counterintelligence agents can begin to look at the evidence. The boys in Cyber struggle to do so for a bit.

9/22, 2:49PM: Batty asks Hellman what he did with the blue thumb drive.

9/22, 4:46PM: Batty sends “analysis of Trump white paper” to others.

In other words, the cyber division spent less than 28 hours doing this analysis.

Yes. The analysis was quick.

Hellman says his analysis is valid because he looked at the data

The hastiness of the analysis and the fact that Hellman didn’t look at the thumb drive before making initial conclusions about the research is fairly problematic, because when he discussed his own methodology, he described the data driving everything.

Q. Now, what principally, from the materials, did you rely on to do your analysis?

A. So it was really two things. It was looking at the data, the technical data itself. There was a summary that it came with. And then also we were comparing what we saw in the data, sort of the story that the data told us, and then looking at the narrative that it came with and comparing our assessment of the data to the narrative.

[snip]

Q. And in connection with that analysis, did you also take a look at the data itself that was underlying this paper?

A. Yes

[snip]

Q. And if we look at that first page there, Agent Hellman, what kind of data is this?

A. It appears to be — as far as I can tell, it looks to be — it’s log data. So it’s a log that shows a date and a time, a domain, and an IP address. And, I mean, that’s — just looking at this log, there’s not too much more from that.

Q. And do you understand this to be at least a part of the DNS data that was contained on the thumb drives that I think you testified about earlier?

A. Yes.

[snip]

A. It would have mattered — well, I think on one hand it would not have mattered from the technical standpoint. If I’m looking at technical data, the data’s going to tell me whatever story the data’s going to tell me independent of where it comes from. So I still would have done the same technical analysis.

But knowing where the data comes from helps to tell me — it gives me context regarding how much I believe in the data, how authentic it is, do I believe it’s real, and do I trust it. [my emphasis]

He repeated this claim on cross with Berkowitz.

I just disagreed with the conclusions they came to and the analysis that they did based upon the data that came along with the white paper.

When Berkowitz asked him why counterintelligence opened an investigation when Cyber didn’t, Hellman suggested that the people in CD wouldn’t understand how to read the technical logs.

A. Um, I think they’d probably be looking at it from the same vantage point, but if you’re not — you don’t have experience looking at technical logs, you may not have the capability of doing a review of those logs. You might rely on somebody else to do it. And perhaps counterintelligence agents are going to be thinking about other investigative questions. So I guess it would probably be a combination of both.

“If I’m looking at technical data,” DeFilippis’ star cybersecurity agent explained, “the data’s going to tell me whatever story the data’s going to tell me.”

Except he didn’t look at the technical data, at least not the data on the thumb drives, before he reached his initial conclusion.

Hellman makes a claim unsupported by the data in his own analysis

I’ll leave it to people more expert than me to rip apart Hellman’s own analysis of the white paper Sussmann shared with the FBI. In early consultations, I’ve been told he misunderstood the methodology, misunderstood how researchers used Trump’s other domains to prove that just one had this anomaly (that is, as a way to test their hypothesis), and misstated the necessity of some long-term feedback loop for this anomaly to be sustained. Again, the experts will eventually explain the problems.

One part of his report that I know damns his methodology, however, is where he says the researchers,

Searched “…global nonpublic DNS activity…” (unclear how this was done) and discovered there are (4) primary IP addresses that have resolved to the name “mail1.trump-email.com”. Two of these belong to DNS servers at Russian Alfa Bank. [my emphasis]

This is the point where every single person I know who assessed these allegations who is at least marginally expert on DNS issues stopped and said, “global nonpublic DNS activity? There are only a handful of people that could be!” See, for example, this Robert Graham post written in response to the original Slate story, perhaps the most influential critique of the allegations, probably even on Durham. Every marginally expert person I know has, upon reading something like that, tried to figure out who would have that kind of visibility on the data, because that kind of visibility, by itself, would speak to their expertise. Those marginally expert people did not have the means to identify the possible sources of the data. But a lot of them — including the NYTimes!! — were able to find people who had that kind of visibility to better understand the anomaly. When Hellman read that, he simply said, “unclear how this was done” and moved on.

Still, Hellman did not contest (or possibly even test) the analysis that said there were really just four IP addresses conducting look-ups with the Trump marketing server. Dozens of people have continued to test that result in the years since, and while there have been adjustments to the general result, no one has disproven that the anomaly was strongest between Alfa Bank and Trump’s marketing domain.

Where Hellman’s insta-analysis really goes off the rails, however, is in his assertion that, “it appears that the presumed suspicious activity began approximately three weeks prior to the stated start date of the investigation conducted by the researcher.”

I’m not a DNS expert, but I’m pretty good at timelines, and by my read here are the key dates in the white paper.

May 4, 2016: Beginning date for look-up analysis

July 28, 2016: Lookup for hostnames yielding Trump

September 4, 2016: End date for look-up analysis

September 14, 2016: Updated search for look-ups covering June 17 through September 14

The start date reflected in this white paper is July 28, 2016. Three weeks before that would be July 7, 2016, a date that doesn’t appear in the white paper. The anomaly started 85 days before the start date reflected in this white paper (and the start date for the research began months earlier, but still over three weeks after the May 4 start date).

I don’t understand where he got that claim. But DeFilippis repeated it on the stand, as if it were reflected in the data, I guess believing it makes his star cybersecurity agent look good.

DeFilippis’ star cybersecurity agent has some credibility problems

There are a few more problems with the credibility of Hellman, DeFilippis’ star cybersecurity agent who is not a DNS expert. One of those is that he compared notes with his boss before first testifying.

Q: And you also spoke with Nate Batty around that time, Right?

A: Yes.

Q: Did you talk to him before the first interview to kind of get ready for it?

A: I think so, but I don’t remember.

Q: Is that something that you encourage witnesses to do, to talk to other witnesses to see if your recollections are consistent?

A: No.

In addition, notwithstanding that Batty was told that Sussmann was in the chain of control, Batty claimed to believe the source was “anonymous” and Hellmann claimed to believe it was sensitive–a human source. Even after comparing notes their stories didn’t match.

There are other problems with Hellman’s memory of the events, notably that in his first interview — the one he did shortly after comparing notes with Batty — he claimed that Baker had told him he was unable to identify the source of the data.

Q. And when you went to Mr. Baker’s office, do you remember what, if anything, was said during that discussion or during that interaction?

A. I remember being in the office, but I don’t distinctly recall what the conversation was. I do remember after the fact, though, that I was frustrated that I was not able to identify who had provided these thumb drives, this information to Mr. Baker. He was not willing to tell me.

At the very least, this presents a conflict with Baker’s testimony, but it’s also another testament to how variable memories can be four years, much less six years, after the fact.

Hellman also claimed, when asked on cross, that the first time he had ever seen the reference to a “DNC report” in September 21 Lync notes he received was two years ago, when he was first interviewed.

A: The first time I saw this was two years ago when I was being interviewed by Mr. DeFilippis, and I don’t recall ever seeing it. I never had any recollection of this information coming from DNC. I don’t remember DNC being a part of anything we read or discussed.

Q: Okay. When you say, the first time you saw it was two years ago when you met with Mr. DeFilippis, that’s not accurate. Right? You saw it on September 21st, 2016. Correct?

A: It’s in there. I don’t have any memory of seeing it.

And when Sean Berkowitz asked about Hellman the significance of seeing the reference to a “DNC report” first thing on September 21, he described that DeFilippis suggested to him that it was likely just a typo for DNS.

Q. What’s your explanation for it?

A. I have no recollection of seeing that link message. And there is — I have absolutely no belief that either me or Agent Batty knew where that data was coming from, let alone that it was coming from DNC. The only explanation that popped or was discussed was that it could have been a typo and somebody was trying to refer to DNS instead of DNC.

Q. So you think it was a typo?

A. I don’t know.

Q. When you said the only one suggesting it — isn’t it true that it was Mr. DeFilippis that suggested to you that it might have been a typo recently?

A. That’s correct.

When asked about a topic for which there was documentary evidence Hellman had seen in real time that he claimed not to remember, Andrew DeFilippis offered up an explanation that Hellman then offered on the stand.

On the stand, DeFilippis also tried to get Hellman to call a marketing server a spam server, though Hellman resisted.

Once you look closely, I don’t think Hellman’s testimony helps Durham all that much. What it proves, however, is that DeFilippis attempted to coach testimony.

One final thing. DeFilippis got his star cybersecurity agent to observe that the researchers didn’t include their name or other markers on their report, as if that’s a measure of unreliablity.

Q. Now, let me ask you, were you able to determine from any of these materials who had actually drafted the paper alleging the secret channel?

A. No.

Q. In other words, was it contained anywhere in the documents?

Here’s what Hellman’s own report looks like:

There’s a unit — ECOU1 — but the names of the individual agents appear nowhere in the report. The report is not dated. It does not specifically identify the white papers and thumb drives by control numbers, something key to evidentiary analysis.

It has none of the markers of regularity you’d expect from the FBI. Hellman’s own analysis doesn’t meet the standards that DeFilippis uses to measure reliability.

This long-time Grand Rapids resident is furious that Hellman judged there was no hack

Everything above I write as a journalist who has tried to understand this story for almost six years. Between that and 18 years of covering national security cases, I hope I now have sufficient familiarity with it to know there are real problems with Hellman’s analysis.

But let me speak as someone who lived in Grand Rapids for most of this period, and had friends who had to deal with the aftermath of Spectrum Health appearing at the center of a politically contentious story.

Hellman had, as he testified, two jobs. First, he was supposed to determine whether there were any cyber equities, then he was supposed to do some insta-analysis of the data without first looking at the thumb drives.

According to Hellman, there was no hack.

I was asked to perform two tasks in tandem with Special Agent Batty, and our tasks were, number one, to look at this data, look at the data and look at the narrative that it came with and identify were there any what’s known as cyber equities. And by that it was, was there any allegation of a hacking. That’s what cyber division does. We investigate hacking. So was there an allegation that somebody or some company or some computer had been hacked. That was first.

[snip]

As I mentioned, the first piece was we had to identify was there any real allegation of hacking; and there was not. That was our first task by our supervisor. There was not.

[snip]

The allegation was that someone purported to find a secret communication channel between the Trump organization and Russia. And so we identified first that, no, we didn’t think that there was any cyber equity, meaning that there was probably nothing more for cyber to investigate further, if there was no hacking crime.

Except here’s what the white paper says about Spectrum, that Grand Rapids business that was swept up in this story.

The Spectrum Health IP address is a TOR exit node used exclusively by Alfa Bank. ie.,  Alfa Bank communications enter a Tor node somewhere in the world and those communications exit, presumably untraceable, at Spectrum Health There is absolutely no reason why Spectrum would want a Tor exit node on its system. (Indeed, Spectrum Health would not want a TOR node on its system because, by its nature, you never know what will come out of a TOR node, including child pornography and other legal content.)

We discovered that Spectrum Health is the victim of a network intrusion. Therefore, Spectrum Health may not know it has a TOR exit node on its network. Alternatively, the DeVos family may have people at Spectrum who know there is a TOR node. i.e.,  could have been placed there with inside help.

When faced with some anomalous activity that seemed to tie into the weird DNS traffic, the experts suggested that maybe the Spectrum hack related to the DNS anomaly.

To be clear, this Tor allegation is the the weakest part of this white paper. You will hear about this to no end over the next week. It was technically wrong.

But the allegation in the white paper is that maybe a recent hack of Spectrum Health is why it had this anomalous traffic with Trump’s marketing server. There’s your hack!!

Had the people at FBI’s cybersecurity side actually treated this as a possible compromise, it might have addressed the part of this story that never made any sense. And we might not, now, six years later, be arguing about what might explain it.

Let me be clear: I do think the white paper overstated its conclusions. I don’t think secret communication is the most obvious explanation here.

But there are hacks and then there are hacks in the testimony of DeFilippis’ star cybersecurity agent.

Update: Corrected an attribution to Batty instead of Hellman.

Update: Fixed my own timeline.

Update: Added link to Robert Graham’s analysis.

Update: This may be where Hellman gets his erroneous three week claim. There were two histograms included with the report. One, the close-up, does start around July 7.

But the broader scope shows look-ups earlier, very actively in June, but with a few stray ones in May.

The government didn’t include the pages and pages of logs that Batty complained about in this exhibit. Had they, it would be clear to jurors that this claim is false.

Update: Correction on two points. First, I think I’ve finally got the Lync exchange above correct between Batty and Hellman. As noted, Hellman complains that “it contains an absurd quantity of data” to which Batty responded, the data seemed “inserted to overwhelm and confuse the reader.”

Second, I was wading through exhibits this morning and found the exhibit of 19 pages of logs. Here’s just a subset of them, including logs that go back to May 2016. Hellman didn’t look even at the printed page of log files closely enough to realize his claim about three weeks was wrong. These data weren’t intended to overwhelm the reader. They were there to show how the anomaly accelerated during the election.

With a Much-Anticipated Fusion GPS Witness, Andrew DeFilippis Bangs the Table

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

Andrew DeFilippis has done several arguably unethical things in an attempt to win the Michael Sussmann trial.

He repeatedly attempted to get Marc Elias to repeat something Elias shouldn’t have said in the first place: that the only way to understand whether Sussmann had gone to the FBI to benefit the Hillary campaign would be to ask him (in response to which stunt Sussmann is asking for a mistrial).

DeFilippis also set up a ploy to get a non-expert to offer opinions that only an expert should offer (more on that later).

At times (such as during Neustar employee Steve DeJong’s testimony), DeFilippis seemed more focused on eliciting testimony that might help him make a case against Rodney Joffe than obtain a guilty verdict against Sussmann.

And in direct examination yesterday of Fusion’s Laura Seago (my reading of the transcript is here), he did both, violating Judge Cooper’s orders in an attempt to set up his ongoing investigation in a way that did nothing to help him win the trial against Sussmann.

For all the anticipation for it, Seago’s testimony was not all that helpful to Durham’s team. She described having about as much awareness of which Democratic entity Fusion’s ultimately client was as the FBI did on Carter Page’s FISA applications. She indicated that the Alfa Bank allegations were just one of a whole bunch of possible ties to Russia that Trump had. She described how, to the extent Fusion could assess the Alfa Bank allegations, they found them credible. In discussing Fusion’s pitch to Franklin Foer on the Alfa Bank story, she described the other major data scientists who had backed the Alfa Bank allegations, identities that Durham has always suppressed because they kill his conspiracy theory.

Q. And what was discussed? What did you say, and what did they say?

A. I really don’t remember the specifics six years on. We talked about the allegations between the Trump organization and Alfa-Bank. We talked about highly credible computer scientists who seemed to think that these allegations were credible.

Q. And by that, are you referring to Mr. Joffe or somebody else?

A. There were others that ended up being cited in Mr. Foer’s article. He cited L. Jean Camp and Paul Vixie, who invented the DNS system.

During cross-examination by Sussmann lawyer Sean Berkowitz, Seago made it clear she didn’t tell Foer about the FBI investigation into these matters.

Q. And with respect to your meeting with Mr. Foer, did you tell Mr. Foer that the FBI was investigating these allegations?

A. No. I had no knowledge of that investigation.

Q. So before your meeting with Franklin Foer, did you have any information that the FBI was involved in any way?

A. No.

Q. All right. Did Mr. Fritsch or anyone else at the meeting say, “The FBI is looking into this”?

A. Not that I can remember.

Also on cross, Seago described that her impression from having dealt with Joffe is that he really did believe the allegations too.

Q. And your impression of Mr. Joffe that was made at that meeting was that he was — he seemed reliable?

A. Yes.

Q. And he seemed well-placed to have knowledge and information about the server issues?

A. Yes, he did.

Q. And you understood that Mr. Joffe supported the suggestion that there was at least potential contact between Trump servers and Alfa-Bank servers?

A. Yes, I did.

MR. DeFILIPPIS: Objection, Your Honor.

THE COURT: Overruled.

Q. You answered the question?

A. Yes, I did understand that.

But it was in DeFilippis’ treatment of emails that Judge Cooper granted Durham’s team access to, but did not permit them to use at trial, where he got particularly obnoxious. Remember: while Durham’s team maintained from the start that the privilege claims behind these emails were not proper (because they were largely about communicating with the press, not about providing research assistance to the Democrats), the reason they didn’t get access to them was their own incompetence. They didn’t ask for a privilege review until right before trial.

DeFilippis has no one to blame but himself, but in true right wing fashion, he’s lashing out.

Perhaps in an attempt to make some drama out of documents that Cooper described “not very revelatory,” DeFilippis walked Seago through all the ones she was privy to, including those with Joffe that Cooper ruled were privileged.

Generally, such exchanges went something like this:

Q. Ms. Seago, does this appear to be part of the same chain as the prior email exchanges?

A. It has the same “Subject” line and says “Re,” so that is what it appears to be. I have no independent recollection of this email.

Q. And what, if any, connection in your mind did the Alfa Bank issue have to New York? I ask because “New York” is in the “Subject” line. Any sense?

A. I don’t know.

Q. And the attachment on this email, any sense of what that was?

A. I don’t know.

Note: there’s no reason to believe Seago has reviewed these emails recently.

That was all setup for DeFilippis’ last set of questions:

Q. Did you ever receive instructions that you couldn’t disclose your affiliation with Fusion GPS to the media?

A. No. I don’t remember hiding that affiliation from the media ever.

Q. Do you ever remember hiding or considering hiding that affiliation from anyone?

A. No.

Q. How certain are you of that?

A. I’m quite certain. You know, we don’t go around advertising who we are and where we work, but I certainly don’t lie to people, and I don’t lie to the press about where I work.

Q. Okay. So you’re fairly certain you never sought to conceal that?

A. Not that I can recall.

Immediately after Seago left the stand, DeFilippis asked for a bench conference (the DC Court adopted phones for the purpose during COVID and all the judges love them, so they’re keeping them). Seago’s answer to the question, DeFilippis noted, was inconsistent with the content of the email, which referenced Tea Leaves.

MR. DeFILIPPIS: Your Honor, could we speak to you on the phone?

THE COURT: Excuse me?

MR. DeFILIPPIS: Could we speak to you on the phone?

THE COURT: Yes. (The following is a bench conference outside the hearing of the jury)

MR. DeFILIPPIS: Your Honor, can you hear me now?

THE COURT: Yes.

MR. DeFILIPPIS: So we have an issue with regard to Ms. Seago’s testimony. The government followed carefully Your Honor’s order with regard to the Fusion emails that were determined not to be privileged but that the government had moved on.

As Your Honor may recall, there was an email in there in which Ms. Seago talks very explicitly about seeking to approach someone associated with the Alfa-Bank matter and concealing her affiliation with Fusion in the email. When we asked her broadly whether she ever did that, she definitively said no when I, you know, revisited it with her. So it raises the prospect that she may be giving false testimony.

And so we were — you know, I considered trying to refresh her with that, but I didn’t understand that to be in line with Your Honor’s ruling. So the government is — we’d like to consider whether we should be — we’d like Your Honor to consider whether we should be able to at least recall her and refresh her with that document?

THE COURT: I don’t remember that question, but the subject matter was concealing Fusion or her identities in conversations with the press. If I recall correctly, that email related to “tea leaves,” correct?

MR. DeFILIPPIS: Your Honor, I thought I had phrased it more broadly. We can go to the transcript.

THE COURT: Mr. Berkowitz?

MR. BERKOWITZ: Judge, I’m not familiar with the specifics. I’m happy to take a look at the transcript. I certainly got the impression he was asking if she had ever concealed Fusion as an entity from the press. That was what was asked in her deposition, and she answered the same way in her deposition. One thing, just to note, some of our paralegals can hear Mr. DeFilippis talking, so I suggest, just as a reminder, to keep your voices down.

MR. DeFILIPPIS: Sure, sure.

THE COURT: All right. Let me look at the transcript.

(Pause)

THE COURT: Can you hear me?

MR. DeFILIPPIS: Yes, Your Honor.

THE COURT: All right. Looking at the transcript, I think you did ask a more open-ended question. She said, “I don’t remember hiding that affiliation from the media ever.” And then you followed up, “Do you ever remember hiding or considering hiding that affiliation from anyone?” And she answered, “No.” I would — so I think that she — I think the email is inconsistent with her answer, Mr. Berkowitz. But the question now is whether they can refresh her with that email notwithstanding the Court’s order. And now she’s gone.

How are we going to do that even if we were to allow it? Is it worth the candle of calling her back?

MR. DeFILIPPIS: Your Honor, I understand she’s still in the building.

MR. BERKOWITZ: Your Honor, is this email privileged?

MR. DeFILIPPIS: This was one of the emails that was determined not to be privileged by Your Honor.

MR. BERKOWITZ: So why didn’t they impeach her with it when they had the chance?

MR. DeFILIPPIS: Your Honor, the reason is because I didn’t want to violate Your Honor’s order that we couldn’t use those affirmatively.

THE COURT: Well, I think the time to have asked the Court whether using the document to refresh was consistent with the order was before she was tendered and dismissed. So I think you waived your opportunity. All right? So we’re going to move on.

Frankly, I think using the formerly privileged emails to impeach was beyond the scope of Cooper’s order, too. This was an affirmative use of the email!

But this was nothing more than a perjury trap, and with it an attempt to get the content of the email DeFilippis had been prohibited from using before the jury. Cooper didn’t allow it in, though he shouldn’t have allowed that line of questions in either (had such questions been permitted, then Seago should have been permitted to refresh her own memory of them).

Probably, DeFilippis will consider charging her with perjury over this. I think the fact that both Judge Cooper and Berkowitz had the impression that the question pertained solely to outreach to the press, Seago’s reiteration that, “I don’t lie to the press about where I work,” reinforcing that understanding, plus her last minute caveat, “Not that I can recall,” would make such a case as flimsy as this one. Probably, DeFilippis will use this exchange as part of his bid to get access to some subset of the 1,500 other not very revelatory emails that Democrats have claimed privilege over.

But this was a stunt. It wasn’t about getting, or sharing, the truth with the jury (and any scenario in which I can imagine Seago trying to hide her identity with Tea Leaves would suggest a more distant relationship than even I imagined Fusion had, though I would love to know what it was).

When a prosecutor engages in as many stunts as DeFilippis has, it’s a confession he knows the facts are not on his side.

Like the January 6 Investigation, the Mueller Investigation Was Boosted by Congressional Investigations

Midway through an article on which Glenn Thrush — who as far as I recall never covered the Russian investigation and has not yet covered the January 6 investigation — has the lead byline, the NYT claims that it is unusual for a congressional committee to receive testimony before a grand jury investigation does.

The Justice Department has asked the House committee investigating the Jan. 6 attack for transcripts of interviews it is conducting behind closed doors, including some with associates of former President Donald J. Trump, according to people with knowledge of the situation.

The move is further evidence of the wide-ranging nature of the department’s criminal inquiry into the events leading up to the assault on the Capitol and the role played by Mr. Trump and his allies as they sought to keep him in office after his defeat in the 2020 election.

[snip]

The Justice Department’s request for transcripts underscores how much ground the House committee has covered, and the unusual nature of a situation where a well-staffed congressional investigation has obtained testimony from key witnesses before a grand jury investigation. [my emphasis]

That’s simply false. This is precisely what happened with the Mueller investigation, and there’s good reason to believe that DOJ made a decision to facilitate doing the same back in July, in part to avoid some evidentiary challenges that Mueller had difficulties with, most notably Executive Privilege challenges.

First, let’s look at how Mueller used the two Congressional investigations.

At the start, he asked witnesses to provide him the same materials they were providing to Congress. I believe that in numerous cases, the process of complying with subpoenas led witnesses to believe such subpoenas were the only way Mueller was obtaining information. Trump Organization, especially, withheld a number of documents from Mueller and Congress, including direct contacts with Russian officials and a Steve Bannon email referencing Russian involvement in the election. By obtaining a warrant for Trump Transition materials held by GSA and the Trump Organization emails of Michael Cohen hosted by Microsoft, Mueller got records the subjects of the investigation were otherwise hiding. Steve Bannon, too, falsely told Mueller he didn’t use his personal accounts for campaign business, only to discover Mueller had obtained those records by the time of his October 2018 interview. Surprising witnesses with documents they had been hiding appears to have been one of the ways Mueller slowly coaxed Bannon and Cohen closer to the truth.

We should assume for key figures in the vicinity of Ali Alexander and John Eastman, the same is happening with the January 6 investigation: the very people who’ve been squealing about complying with subpoenas or call records served on their providers are likely ones DOJ obtained covert warrants for.

Then there are the prosecutions that arose entirely out of Congressional interviews. There were three Mueller prosecutions that arose out of Committee investigations.

Perhaps the most interesting was that of Sam Patten — whose interview materials are here. He had an interview with SSCI on January 5, 2018, where he appears to have lied about using a straw donor to buy Inauguration tickets for Konstantin Kilimnik. By March 20, the FBI attempted their first interview of Patten, after which Patten deleted some emails about Cambridge Analytica. And when Mueller did interview Patten on May 22, they already had the makings of a cooperation deal. After getting Patten to admit to the straw purchase and also to violating FARA — the latter of which he would plead guilty months later, on August 31 — Patten then provided a ton of information about how Kilimnik worked and what he had shared with Patten about his role in the 2016 operation, much of which still remained sealed as part of an ongoing investigation in August 2021. Patten had two more interviews in May then appeared before the grand jury, at which he shared more information about how Kilimnik was trying to monitor the investigation. He had two more interviews before pleading guilty, then at least two more after that.

Not only did Patten share information that likely served as part of a baseline for an understanding about Russia’s use of Ukraine to interfere in US politics and provided investigators with an understanding of what the mirror image to Paul Manafort looked like, but this remained secret from much of the public for three months.

It’s less clear precisely when SSCI shared Cohen’s lies with Mueller. But in the same period, both Mueller and SDNY were developing parallel investigations of him. But by the time Cohen pled guilty in SDNY (also in August 2018), Mueller had the evidence to spend almost three months obtaining information from Cohen as well before he entered into a separate plea agreement with Mueller in which he admitted to the secret communications with the Kremlin that he and Trump lied to hide.

Meanwhile, HPSCI’s much more hapless investigation proved a way to get a limited hangout prosecution of Roger Stone. By May 2018, when Mueller developed evidence showing not just ways that Stone was obstructing his own investigation but also how Stone attempted to craft lies to tell to the Committee — coordinated with Jerome Corsi and reliant on threats to Randy Credico — it provided a way to prosecute Stone while protecting Mueller’s ongoing investigation into whether Stone conspired with Russia.

And by all public appearances at the time, it appeared that Congress was acting while Mueller was not. But that was false (and is probably false now). The entire time during which SSCI and HPSCI were taking steps with Cohen and Stone that would late become really useful to the criminal investigation, Mueller was taking active, albeit covert, steps in his own investigations of the two men (whether he was investigating Patten personally or just Kilimnik is uncertain). Mueller obtained his first warrants against Cohen and Stone in July and August, respectively. But no one knew that until the following spring. That is, Cohen and Stone and everyone else focused on Congress while Mueller got to investigate covertly for another nine months.

We should assume the same kind of thing is happening here. All the more so given the really delicate privilege issues raised by this investigation, including Executive, Attorney-Client, and Speech and Debate. When all is said and done, I believe we will learn that Merrick Garland set things up in July such that the January 6 Committee could go pursue Trump documents at the Archives as a co-equal branch of government bolstered by Biden waivers that don’t require any visibility into DOJ’s investigation. Privilege reviews covering Rudy Giuliani, Sidney Powell, and John Eastman’s communications are also being done. That is, this time around, DOJ seems to have solved a problem that Mueller struggled with. And they did so with the unsolicited help of the January 6 Committee.

Even those of us who’ve been covering DOJ’s January 6 prosecution day-to-day (unlike Thrush) have no way of saying what DOJ has been doing covertly in the last year — though it is public that they’ve been investigating Alex Jones, the purported new thrust of this investigation, since August.

What we know from recent history, however, is that DOJ’s use of Congress’ work in no way suggests DOJ hasn’t been doing its own.

Comings and Goings on the Proud Boy Leaders Prosecution

When DOJ finally added Enrique Tarrio to the Proud Boy leader conspiracy, I noted that the way DOJ has structured the prosecution team for the Proud Boys made it really hard to understand where things were headed.

I’ve been expecting and predicting this indictment since December 28. But for the life of me, I’m not sure where DOJ expects to go from here.

This indictment describes the numbers of people massed at several stages of the operation. 65 members on the Ministry of Self Defense (MOSD) Members Group. 90 people in the New MOSD members group created on January 4. Approximately 100 Proud Boys who met at the Washington Memorial the morning of the attack. Donohoe bragging at 12:00PM on January 6 that “WE ARE WITH 200-300 PBS,” just before they kicked off the riot.

Perhaps this framework is meant to provide a way to implicate all those others, 300 people who agreed, by signing up, that they were following a plan that DOJ has now shown (and that Matthew Greene’s cooperation was designed to show) was a plan to occupy buildings from the start.

But otherwise, this still feels really dispersed, and the prosecution team (which consists of three visible members for the leadership conspiracy, including Erik Kenerson, Jason McCullough, and Luke Jones, and about four detailees from other offices for satellite cases; a fourth prosecutor who had been on the core cases, Christopher Berridge, left immediately after [Matthew] Greene pled) has a far harder caseload than the significantly larger team on the Oath Keepers.

Perhaps something will really start to crystalize as some of these continuances end in April. Or perhaps DOJ will be serially prosecuting Proud Boys for the foreseeable future.

That remains true. But on Friday, there were several minor structural changes worth noting. I’ve attempted to summarize the status of some key Proud Boy and related cases here (I’ve only listed a judge if it is someone other than Tim Kelly).

First, Trial Attorney Conor Mulroe filed a notice of appearance in the Proud Boy Leaders and the Biggs Co-Traveler cases. He hasn’t shown up on any January 6 cases before this. It’s likely he was added because on April 22, Judge Kelly set a trial date in the Proud Boy leaders for August 8. That is, it’s likely he was added to start preparing for trial. But the Biggs co-travelers, on whose case he also filed an appearance, won’t be going to trial anytime soon. That’s partly because three of the defendants have to work through the conflict created by John Pierce’s representation of three of them — Paul Rae, Kevin Tuck, and Nate Tuck (though Pierce recently ceded representation to William Shipley for the Tucks). In hearings, prosecutors have said that at least three of the defendants are considering plea deals.

Then Luke Jones, who has been part of the Leaders case from the start, dropped off the case (he recently dropped off an unremarkable misdemeanor case as well though remains on the Ryan Nichols and Alex Harkrider case). Jones had been focusing on Zach Rehl’s prosecution, and he remains on the Rehl co-traveler case, which has not yet been indicted. I don’t know what to make of his departure (perhaps a recognition that his efforts to flip Rehl won’t ever come to fruition?). Jones has, in the past, worked on national security cases, and in fact was listed as prosecuting Russian hacker Evgeny Viktorovich Gladkikh in the press release (though not the docket). That case will never go to trial (because the US is not about to get custody of Gladkikh anytime soon). But it suggests that Jones may have spent time last June helping co-counsel present that case to a DC grand jury.

I’m most interested in the addition of Nadia Moore to the Leaders case. She’s a Brooklyn-based prosecutor, among five or so prosecutors from around the country who’ve been working the Proud Boy cases (in this table, William Dreher is from Seattle, Alexis Loeb is from San Francisco, Michael Gordon is from Tampa, and Christopher Veatch is from Chicago). And as the table makes clear she has been working the Florida-based Proud Boy and related cases, as well as the case of Steven Miles and Matthew LeBrun, who spent January 6 with Florida Proud Boys AJ Fischer and friends, and the former of whom is accused of helping to bust open the other side window in the original breach of the Capitol. This may suggest the government believes they’ll obtain the testimony of multiple Floridians against Biggs and Tarrio.

Meanwhile, a slew of these cases have just one (listed) prosecutor, including the Kansas City case with its five remaining defendants.

We’ll still see some significant movements in the Proud Boys cases. But for now, the focus — as so much of the January 6 investigation is — may be on Florida.

Scene-Setter for the Sussmann Trial, Part Two: The Witnesses

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

In this post, I laid out the elements of the offense, a single count of a false statement to the FBI, which will drive the outcome of the Michael Sussmann trial, in which jury selection begins today. As I showed, John Durham has to prove that:

  • Michael Sussmann said what Durham has accused him of saying, which is that he was not sharing information with the FBI on behalf of any client
  • Sussmann said that on September 19, not just September 18
  • Sussmann meant his statement to be understood to mean that no client of his had an interest in the data, as opposed to that he was not seeking any benefit for a client from the FBI
  • The lie made a difference in how the FBI operates

In this post I’d like to say a bit about the expected witnesses. Before I do, remember the scope of the trial, as laid out in several rulings from Judge Cooper.

  • Durham can only raise questions about the accuracy of the Alfa Bank anomaly if Sussmann does so first
  • He generally can only discuss how the data was collected via witnesses; with one exception, Cooper has ruled the emails between Rodney Joffe and researchers to be inadmissible in a trial about whether Sussmann lied
  • While Cooper found that 22 of 38 Fusion emails over which Democrats had claimed privilege were not privileged, he also ruled that because Andrew DeFilippis got cute in delaying his request for such a review, Durham can’t use those emails or pierce any related claims of privilege at trial
  • That leaves the unprivileged emails between Fusion and journalists, which Cooper has ruled admissible; he even considered changing his decision and letting a tweet from Hillary come in as evidence (though note that the emails Durham got pre-approved barely overlap with the emails Durham wants to use at trial, so there still could be problems admitting individual emails at trial)
  • Cooper ruled the communications between Rodney Joffe, the person who shared the DNS anomaly with Michael Sussmann, and Laura Seago, his connection with Fusion, were privileged
  • Cooper ruled that Sussmann can elicit testimony from witnesses, including Robby Mook and Marc Elias, about how Trump’s request that Russia hack Hillary some more made him not just a campaign opponent, but a threat to national security

As I noted, a dispute over the final jury instructions suggests that Durham is beating a tactical retreat from his charged claim that Sussmann lied to cover up that he was representing both Hillary and Rodney Joffe.

Mr. Sussmann proposes modifying the last sentence as follows, as indicated by underlining: Specifically, the Indictment alleges that, on or about September 19, 2016, Mr. Sussmann, did willfully and knowingly make a materially false, fictitious, and fraudulent statement or representation in a matter before the FBI, in violation of 18 U.S.C. § 1001(a)(2), namely, that Mr. Sussmann stated to the General Counsel of the FBI that he was not acting on behalf of any client in conveying particular allegations concerning Donald Trump, when, in fact, he was acting on behalf of specific clients, namely, Rodney Joffe and the Clinton Campaign.5 The government objects to the defense’s proposed modification since it will lead to confusion regarding charging in the conjunctive but only needing to prove in the disjunctive.

Durham wants to be able to get a guilty verdict if the jury decides that Sussmann was hiding Hillary but not hiding Joffe. What Durham will really need to prove won’t be finalized until sometime next week, meaning both sides will be arguing their cases without knowing whether Durham will have to prove that 1) the allegations pertained to Donald Trump personally 2) Sussmann had two clients 3) he lied to hide both of them, or whether he has to prove only that Sussmann lied to hide one or more client.

Durham’s tactical retreat is likely dictated by the scope set by Cooper and will dictate the witnesses he wants to call.

This post laid out whom, as of last week, each side planned to call. Remember that it’s not uncommon for a defendant not to put any witnesses on the stand (though I would be surprised if that happened in this case). Normally, the scope of a witness’ testimony is set by the Direct examination of them. So, for example, if Durham puts Marc Elias on the stand to talk exclusively about his decision to hire Fusion GPS, then Sussmann could not ask him questions about other topics. But Sussmann incorporated Durham’s entire witness list, and Cooper ruled that he would rather not have to call people twice. So for at least the Democratic witnesses, Sussmann will have the ability to ask about things that Durham would really prefer not to appear before the jury even though Durham called that witness as a government witness. Because Durham doesn’t understand much of what really went on here, that may be a really useful thing for Sussmann to exploit.

Summary Witness: It is typical for prosecutors to call one of their FBI agents at trial as a sort of omniscient narrator who can both introduce a vast swath of evidence (such as records the accuracy of which have been stipulated for emails that can be introduced without witness testimony) and provide some interpretation of what it all means. Usually, that agent is not the lead agent, because the lead agent knows things that the prosecutor wants to keep from the defendant and the public, either details of an ongoing investigation or major investigative fuck-ups that haven’t been formally disclosed to the defendant. As of last week, DeFilippis maintained that, “It may be an agent who’s our summary witness, but we’re not looking to put a case agent on the stand.” That suggests there is no agent on his team that is sufficiently compartmented from his secrets to take the stand. Judge Cooper seemed a bit surprised by that.

Jim Baker: Jim Baker is the single witness to Michael Sussmann’s alleged crime. Durham is going to have a challenge walking him through the version of this story Durham wants to tell, not least because the materiality parts of it — whether Baker thought it unusual to hear from Sussmann, whether he thought it mattered who Sussmann’s client was — are also recorded in Baker’s past sworn testimony. Given the late discovery of a text showing that Sussmann wrote Baker on September 18 telling him he wanted to benefit the FBI, and given the even later discovery of March 2017 notes recording that the FBI understood that Sussmann did have an (undisclosed) client, Sussmann doesn’t even have to trash Baker to call into question his memory: he can allow Baker to admit he can’t separate out what happened in which of at least five communications he had with Sussmann that week, the sum total of which show that Sussmann wasn’t hiding the existence of a client, did represent that he was trying to help the FBI, and did help the FBI. The cross-examination of Baker will, however, be an opportunity for Sussmann to implicate Durham’s investigative methods, both for building an entire case around Baker after concluding, years earlier, that he wasn’t credible, and then, for refreshing Baker’s memory only with the notes that said what Durham wanted Baker to say, and not what the FBI ultimately came to know.

Bill Priestap and Tisha Anderson, Mary McCord and Tasha Gauhar: This trial is expected to feature two sets of witnesses — the first set called by Durham and the second called by Sussmann — who will be asked to reconstruct from their own notes what was said in a meeting attended by Baker. Priestap and Anderson will say that the day of Baker’s meeting with Sussmann, they wrote down that Sussmann didn’t have a client (but not in the words Sussmann is known to have used or the words that Durham has charged). McCord and Gauhar will say that in March 2017, Andy McCabe stated, in front of Baker and with no correction, that the FBI did know Sussmann had a client. The only notes in question that use the same phrase — “on behalf of” — that Durham used in the indictment say that Sussmann did say he was meeting with FBI on behalf of someone. I expect at least several of these witnesses will be asked materiality questions: If they didn’t ask who the client is, doesn’t that prove it didn’t matter? The notes of everyone involved, importantly, emphasized the import of Sussmann sharing an imminent newspaper article. Sussmann will also ask Priestap how and why he asked the NYT to hold the Alfa Bank story.

Agents Heide, Sands, and Gaynor, plus Agent Martin: Durham plans to call three of the FBI Agents who investigated the anomaly — for a couple of hours each, in the case of Heide and Sands — to talk about how they did so. Let me suggest that not only is this overkill, it may backfire in spectacular fashion, because the March 2017 notes make it clear that these agents did not take very basic steps to chase this anomaly down and Heide, at least, is not a cyber agent (in the same period he was also investigating George Papadopoulos). In addition to having those hours and hours of testimony, Durham will call Agent Martin, ostensibly to explain what one could learn from the anomaly, though there’s still a fight about the scope of his testimony,  particularly with respect to misleading claims he would make about the scope of the data accessed to find the anomaly in the first place.

Antonakakis, Dagon, DeJong, and Novick: According to what DeFilippis said last week, in the wake of Cooper’s ruling excluding all but one of the researchers’ emails, he likely will not call David Dagon, may or may not call Manos Atonakakis, but will call two employees of Rodney Joffe whom, DeFilippis claims, were “tasked by” Joffe, in the first case to pull some but not all of the data researchers used to test the anomaly, and in the second case to do research that may not have been presented to the FBI. If these decisions hold, his presentation of the data will be, as I understand it, affirmatively false. For that reason, Sussmann might have been able to challenge Durham’s reliance on these witnesses in the absence of others; that Sussmann is not doing so may suggest he knows that the witnesses won’t do what Durham thinks they will. If Durham persists in this plan, it means he’ll have FBI agents spend 5 hours describing how they chased down an anomaly, without ever really explaining what the anomaly is (and how it could have easily been investigated using about two different steps that the FBI didn’t take). Perhaps (given his tactical retreat), Durham may want to eliminate virtually all discussion of the anomaly at the heart of this case. Alternately, this is a tactical move to force Sussmann to call David Dagon (whom Durham has immunized) or Manos Antonakakis (whose status is unknown) in hopes that they’ll help him make his YotaPhone case or explain the full scope of the data accessed (particularly if he gets Martin to make misleading comments about that topic first). But if Durham forgoes his chance to call the researchers and Sussmann does so himself, it may allow Sussmann to rebut Durham’s claims about what the anomaly was and what went into the two white papers presented to the FBI. In addition, Sussmann can have these witnesses explain how far before the involvement of the Democrats this research started and how Trump’s open invitation to Russia to do more hacking meant the anomaly posed a possible national security threat worthy of sharing with the FBI.

Robby Mook, Marc Elias, and Debbie Fine: Rather than talking about the anomaly, Durham wants to talk about the Hillary campaign. At least as of last week (before Cooper excluded some of this stuff on privilege and belated privilege challenges), Durham will definitely call Mook, may call Elias, but may rely instead on a Hillary lawyer named Debbie Fine, who was on daily calls with Fusion. Durham wants to claim,

[T]he strategy, as the Government will argue at trial, was to create news stories about this issue, about the Alfa-Bank issue; and second, it was to get law enforcement to investigate it; and perhaps third, your Honor, to get the press to report on the fact that law enforcement was investigating it.

Sussmann, by contrast, knows he has a witness or witnesses who will rebut that.

[I]t’s not the truth; and in fact, it’s the opposite of the truth. We expect there to be testimony from the campaign that, while they were interested in an article on this coming out, going to the FBI is something that was inconsistent with what they would have wanted before there was any press. And in fact, going to the FBI killed the press story, which was inconsistent with what the campaign would have wanted.

As suggested above, Elias is a witness Sussmann will call even if Durham does not. Among other things, Sussmann will have Elias explain what it was like to have Donald Trump openly asking Russia to hack Hillary some more.

Laura Seago: Before Cooper ruled on privilege issues, DeFilippis (who doesn’t know how to pronounce her last name) said he would call Seago. She was the pivot point between Fusion and Rodney Joffe. According to Fusion attorney Joshua Levy, Seago knows little about the white paper from Fusion that Sussmann shared with the FBI. “Seago didn’t contribute to it, doesn’t know who did, doesn’t know who researched it, doesn’t know who wrote it, doesn’t know its purpose; and the government’s aware of all that.” So it’s unclear how useful she’ll be as a witness.

Eric Lichtblau: As I noted the other day, Durham is trying to prevent Lichtblau from testifying unless he’s willing to testify to all his sources for the Alfa Bank story (which would include a bunch of experts never named in any charging documents). My guess is that Cooper will rule that forcing Lichtblau to talk about communications with Fusion would be cumulative, though he might force Lichtblau to talk about an in-person meeting he had at which Fusion shared information that did not derive from Joffe. If Sussmann succeeds in getting Lichtblau’s testimony, however, he will be able to talk about what a serious story this was and what a disastrous decision agreeing to hold the story was for his own career and, arguably, for democracy.

Perkins Coie billing person and McMahon: As Durham has repeatedly confessed, most of the substance of his conspiracy theory is based off billing records. But there’s a dispute about whether Sussmann fully billed his meeting with Baker (Sussmann has noted, for example, that he paid for his own taxi to and from the meeting). Durham will have a Perkins Coie person explain how they track billing and will call a former DNC person with whom Sussmann had lunch immediately before his Baker meeting, either because Sussmann said something to him about the Baker meeting, or because he needs to rule out that Sussmann billed for the lunch meeting but not Baker.

Agent Grasso: In addition to the hours and hours of testimony about how the FBI did investigate the anomaly, Durham also wants to call an Agent Grasso, with whom Joffe shared a piece of the Alfa Bank allegations directly. This may actually be an important witness for Durham, because it might show that the packaged up allegations shared with Baker were substantially different than what Joffe was sharing when his identity was not hidden.

Kevin P: Durham only plans to call one of the two CIA personnel at the meeting in January 2017 (ironically meaning a meeting in March 2017 will get far more focus than a meeting that played a central role in the indictment). It sounds like Sussmann will get the one person to validate an email from another person who also recorded Sussmann saying he had a client.

Agent Gessford: One FBI Agent Sussmann will call will authenticate emails Sussmann will use with other witnesses to show what FBI’s understanding of Sussmann’s activities were in 2016. Not only will he use these emails to prove that the FBI knew well he was representing Hillary on cyber issues, but he will likely also use these emails to talk about what it looks like for a campaign to be systematically attacked through the entirety of a campaign by a hostile nation-state, which will make the potential seriousness of the Alfa Bank anomaly quite clear.

Agent Giardina: This is someone the scope of whose testimony Durham may have actually tried to limit by calling him himself. Sussmann will have Giardina explain that after the Frank Foer article, he tried to open an investigation, which Sussmann will use to prove that the FBI would have opened an investigation whether or not he shared the tip with the FBI.

Jonathan Moffa: Moffa, a senior FBI agent involved in the Crossfire Hurricane and Alfa Bank investigations will address materiality. He’ll explain how, given the UNSUB investigation open to find out who in Trump’s camp got a heads up to the hack-and-leak investigation, it was inevitable they would chase down this tip and treat it, like the CH investigation itself, as a Full Investigation.

DOJ IG Michael Horowitz: On paper, Horowitz’s testimony will be limited to explaining how an anonymous tip from Joffe via Sussmann is supposed to work, which is that someone in a position to direct a tip to the right person does so and succeeds in addressing a national security concern. Joffe provided a tip to Horowitz in January 2017 that — we can assume given Horowitz’s testimony — proved to be valuable. This tip will also demonstrate that DNS research is not as limited as Agent Martin will claim it is. But given the way that Durham has failed to understand basic aspects of Horowitz’s investigation, including ones that disproved large swaths of Durham’s conspiracy theories, this testimony might be somewhat contentious.

Update, 5/22: Very belatedly added Moffa after writing this post.

Will KleptoCapture Catch John Durham, Along with the Russian Spies and Oligarchs?

I’ve been right about a lot of things regarding John Durham’s investigation (though not, apparently, that he would supersede the indictment against Michael Sussmann — maybe he was afraid of getting no-billed if he corrected the things in the indictment he has since discovered to be false?).

Perhaps the most prescient observation I’ve made, though, was that Durham had no fucking clue where to look for evidence related to his already-charged allegations.

I’ve seen reason to believe Durham doesn’t understand the full scope of where he needs to look to find evidence relevant to that case.

I said that in November. Since that time in the Sussmann case, Durham has had to publicly confess he had not:

Effectively, Durham spent most of three years speaking to those who would confirm his conspiracy theories, and not consulting the actual evidence. It took until six months after Durham charged Sussmann before Durham tested Sussmann’s sworn explanation for his Baker meeting — and when he checked, he found the evidence backed Sussmann’s explanation.

Six months after indicting Igor Danchenko, Durham asked to extend discovery another month

It’s that record that makes me so interested in Durham’s second bid to extend deadlines for classified discovery in the Igor Danchenko case.

After Danchenko argued he couldn’t be ready for an April 18 trial date, Durham proposed a March 29 deadline for prosecutors to meet classified discovery; that means Durham originally imagined he’d be done with classified discovery over six weeks ago. A week before that deadline, Durham asked for a six week delay — to what would have been Friday. Danchenko consented to the change and Judge Anthony Trenga granted it. Then on Monday, Durham asked for another extension, this time for another month.

When Durham asked for the first delay, he boasted they had provided Danchenko 60,000 unclassified documents and promised “a large volume” of classified discovery that week (that is, before the original deadline).

To date, the government has produced over 60,000 documents in unclassified discovery. A portion of these documents were originally marked “classified” and the government has worked with the appropriate declassification authorities to produce the documents in an unclassified format.

[snip]

Nevertheless, the government will produce a large volume of classified discovery this week

This more recent filing boasts of having provided just one thousand more unclassified documents and a mere 5,000 classified documents — for a case implicating two known FISA orders and several past and current counterintelligence investigations.

To date, the Government has produced to the defense over 5,000 documents in classified discovery and nearly 61,000 documents in unclassified discovery. The Government believes that the 5,000 classified documents produced to date represent the bulk of the classified discovery in this matter.

Danchenko waited six weeks and got almost nothing new.

See this post for an explanation of all the classified information that Danchenko should be able to demand and the onerous process that using it requires, called Classified Information Procedures Act. Even in November, I showed that Danchenko could likely make a case that he should get discovery from the FBI and NSA, and probably CIA and Treasury. There is no way Durham is getting through this case with just 5,000 classified documents.

As he noted in his opposition to this latest request for an extension, with each request, Durham’s proposed schedule was shrinking the time afforded Danchenko to review classified discovery before providing a list of the classified information he wanted to use at trial (called a CIPA 5 notice), first from 60 days to 40, and then from 40 days to 22.

On March 22, 2022, the Special Counsel filed a Consent Motion to Adjourn the Classified Discovery and CIPA Schedule. Dkt. 44. In his Motion, the Special Counsel sought to extend the deadline to produce classified discovery from March 29, 2022, to May 13, 2022. Id. at 2. The Special Counsel’s motion also sought to extend the dates for various CIPA filings and hearings. Id. Importantly, the Special Counsel’s proposed schedule reduced the amount of time within which Mr. Danchenko had to file his Section 5(a) written notice from approximately 60 days after the close of classified discovery to approximately 40 days.

[snip]

On May 9, 2022, the Special Counsel filed his Second Motion to Adjourn the Classified Discovery and CIPA Schedule. Dkt. 48. In his motion, the Special Counsel now tells the Court that he can provide the outstanding classified discovery by “no later than” June 13, 2022. See id. at 2. He also proposes a June 29, 2022, deadline for Defendant’s Section 5(a) written notice. Id. Therefore, the Special Counsel has essentially asked this Court to enter an Order that will now decrease Mr. Danchenko’s time within which to file his Section 5(a) written notice from approximately 40 days after the close of classified discovery to approximately 22 days.

[snip]

Mr. Danchenko would be substantially prejudiced by the Special Counsel’s proposed schedule because it significantly shortens the time period within which Mr. Danchenko can review any final classified productions and file his CIPA Section 5(a) notice. That is of particular concern to Mr. Danchenko because the Special Counsel has not provided sufficient notice of how much additional classified discovery may be forthcoming other than his “belie[f]” that the “bulk” of the classified discovery has already been produced.

Shrinking Danchenko’s deadlines would make the additional discovery that is still outstanding far less useful. In the Sussmann case, for example, it took over a month for Sussmann’s team to find the documents that disprove Durham’s case buried among 22,000 other documents provided on his extended deadline. So while Durham might be trying to comply with discovery obligations, arguing that the proper solution to his struggles fulfilling discovery is to shrink Danchenko’s own time to review the evidence suggests he’s not doing so in good faith.

Judge Trenga must have agreed. While he granted the government’s request for an extension, he gave Danchenko 42 days to submit his CIPA 5 notice.

A Russian dog named Putin ate Durham’s classified homework

I’ve noted how the post-invasion sanctions on Alfa Bank deprived John Durham of a second investigative team, Alfa Bank’s Skadden Arps lawyers, whose filings a judge observed seemed to be “written by the same people” as Durham’s.

But the aftermath of Putin’s attempt to overthrow Ukraine may be causing Durham even bigger problems in the Danchenko case.

When Durham asked for an extension of his CIPA deadline in the Sussmann case days after Russia extended its invasion of Ukraine, he explained that the people who had to write declarations in support of CIPA (usually agency heads like CIA Director William Burns or NSA Director Paul Nakasone) were busy dealing with the response to Ukraine.

However, the Government’s submission includes not only the Government’s memorandum but also one or more supporting declarations from officials of the U.S. intelligence community. The Government’s review of potentially discoverable material is ongoing, and these officials cannot finalize their declarations until that review is complete.

Moreover, recent world events in Ukraine have further delayed the Government’s review and the officials’ preparation of the supporting declaration(s). As a result, the Government respectfully submits that a modest two-week adjournment request to its CIPA Section 4 filing deadline is appropriate and would not impact any other deadlines, to include the currently scheduled trial date

Effectively, this request moved the CIPA deadline from a week before Durham’s classified discovery deadline to a week after; yet Durham just committed, once again, to finalizing his CIPA 4 submission almost a week before his classified discovery deadline in the Danchenko case.

That’s important because Durham overpromised when he said he could finish a CIPA filing before the discovery deadline. Durham filed a supplement to his CIPA 4 notice on May 7 (nine days before trial) that, unless Judge Cooper ruled orally at a closed hearing last week, remains outstanding. That’s not entirely unusual in a case that relies on classified information, but if Cooper were to rule this classified information was necessary for Sussmann’s defense, it would give Sussmann no time to actually prepare to use it.

Durham cited the Ukraine response again on March 22, a month after Russia launched its failed attempt to take Kyiv, when he asked for an extension on his classified discovery deadline.

However, recent world events in Ukraine have contributed to delays in the production of classified discovery. The officials preparing and reviewing the documents at the FBI and intelligence agencies are heavily engaged in matters related to Ukraine.

Importantly, these people focusing on keeping us safe from Russian aggression rather than, as Durham is, making us safe for Russian aggression, are different than the people cited in the Sussmann case. These aren’t senior officials, but instead those “preparing and reviewing the documents at the FBI and intelligence agencies.” That’s not William Burns, that’s FBI counterintelligence agents, among others.

In last week’s request for an extension, Durham didn’t mention Ukraine, but his reference to “overseas activities” suggests the response to Ukraine remains the problem.

However, recent world events continue to contribute to delays in the processing and production of classified discovery. In particular, some of the officials preparing and reviewing the documents at the FBI and intelligence agencies continue to be heavily engaged in matters related to overseas activities.

Unsurprisingly, Danchenko asked Trenga to require Durham to provide some kind of explanation for why “overseas activities,” probably Ukraine, continue to delay classified discovery in a case criminalizing an attempt to fight Russia’s attack on democracy in 2016.

Moreover, the Special Counsel has failed to adequately explain how “recent world events” (Dkt. 48 at 2) have specifically made it impossible for him to meet his discovery obligations. While it seems unlikely that the same government officials charged with declassifying discovery are also responding to events overseas, it certainly is possible. But, even if that is the case, the Special Counsel must offer more explanation than he has, especially in light of the fact that his prior motion to extend the discovery deadline was based on the events in Ukraine, and the ongoing nature of that conflict must or should have been considered when he requested the May 13 deadline.

Sadly, Trenga didn’t order up an explanation for why this delay, probably Ukraine-related, is causing so many difficulties for Durham’s prosecution of Danchenko.

KleptoCapture threatens at least one and possibly up to three key Durham figures

One reason I would have liked Trenga to force Durham to explain how a dog named Putin ate his classified homework is because the public response to Russia’s attempt to conquer Ukraine has already implicated three figures who are key to Durham’s case. While I need to update it, this post attempts to capture everything that the US government and some partners have done since the expanded invasion.

Dmitry Peskov

Perhaps the response least damaging to Durham’s case — but one that will affect discovery — involves Dmitry Peskov. As I explained in this post, Durham made Peskov’s relationship with Chuck Dolan and Olga Galkina a key part of his indictment against Danchenko.

In his role as a public relations professional, [Dolan] spent much of his career interacting with Eurasian clients with a particular focus on Russia. For example, from in or about 2006 through in or about 2014, the Russian Federation retained [Dolan] and his then-employer to handle global public relations for the Russian government and a state-owned energy company. [Dolan] served as a lead consultant during that project and frequently interacted with senior Russian Federation leadership whose names would later appear in the Company Reports, including the Press Secretary of the Russian Presidential Administration (“Russian Press Secretary-I”), the Deputy Press Secretary (“Russian Deputy Press Secretary-I”), and others in the Russian Presidential Press Department.

[snip]

In anticipation of the June 2016 Planning Trip to Moscow, [Dolan] also communicated with [Peskov] and Russian Deputy Press Secretary-I, both of whom worked in the Kremlin and, as noted above, also appeared in the Company Reports.

[snip]

Additionally, on or about July 13, 2016, [Galkina] sent a message to a Russia-based associate and stated that [Dolan] had written a letter to Russian Press Secretary-1 in support of [Galkina]’s candidacy for a position in the Russian Presidential Administration.

On March 3, the State Department added Peskov to the sanctions list under a 2021 Executive Order President Biden signed, in part, to target those who (among other things), “undermine the conduct of free and fair democratic elections and democratic institutions in the United States and its allies and partners.” On March 11, Treasury added Peskov’s family members to the sanctions list. The package used to sanction Peskov would have been the product of intelligence reports circulated within the US government.

While the legal reason Peskov was sanctioned pertained to his official role in the Russian government (and the lavish lifestyles his family enjoys even with his civil service salary), State also described Peskov as “the chief propagandist of the Russian Federation.” That, by itself, would be unremarkable. But if — as even Durham alludes — Peskov had a role in feeding Galkina disinformation for the Steele dossier, particularly if he crafted disinformation to maximally exploit Michael Cohen’s secret call with Peskov’s office in January 2016, that could be a part of the sanctions package against Peskov. If it were, then it would be centrally important discovery for Danchenko.

Oleg Deripaska

Then there’s Oleg Deripaska. This post lays out in depth the reasons why Danchenko would have reason to demand information on Deripaska’s role in the dossier, including:

  • Evidence about whether Oleg Deripaska was Christopher Steele’s client for a project targeting Paul Manafort before the DNC one
  • All known details of Deripaska’s role in injecting disinformation into the dossier, up through current day
  • Details of all communications between Deripaska and Millian

Given his blissful ignorance of the actual results of the Mueller investigation and the DOJ IG Carter Page investigation, Durham was always going to have a nasty discovery surprise in complying with such requests. Plus, a search last October of two Deripaska-related properties made clear that the most likely source of disinformation in the dossier was under aggressive criminal investigation for sanctions violations.

A recent Bloomberg story reported that that criminal investigation has now been moved under and given the prioritization of the KleptoCapture initiative started in response to the Ukraine war.

Deripaska has been sanctioned since 2018 for his ties to Vladimir Putin, and the seizures at a Washington mansion and New York townhouse linked to him predate the invasion of Ukraine. But the investigation of Deripaska’s assets is now part of an escalating U.S. crackdown on ultra-rich Russians suspected of laundering money and hiding assets to help finance Putin’s regime.

The raids were key steps to unearth information that may determine whether — and how — Deripaska moved money around. Among the mishmash of items taken from the New York and Washington properties were half a dozen works of fine art, sunglasses, hiking boots, housewares, financial records, telephone bills and other documents, according to the people, who asked not to be identified because the investigation hasn’t been made public.

The Deripaska inquiry is now part of a special U.S. Department of Justice task force dubbed “KleptoCapture,” according to New York federal prosecutor Andrew Adams, who is heading up the group.

“As Russia and its aggression continues, we have our eyes on every piece of art and real estate purchased with dirty money,” Deputy Attorney General Lisa Monaco said at a recent news conference.

If DOJ plans on indicting Deripaska — for sanctions violations and anything else on which the statute of limitations has not expired — they might delay discovery cooperation with Durham until they do so. And if such a hypothetical indictment mentioned Deripaska’s role in facilitating the 2016 election interference and/or successful efforts to exploit the dossier to undermine the Russian investigation, it might make Durham’s charges against Danchenko unsustainable, even if he is able to otherwise fulfill his discovery requirements. Durham’s theory of prosecution is that Danchenko is the big villain that led to FBI confusion over the dossier, but Deripaska seems to have had a far bigger role in that.

Sergei Millian

Finally, there’s Sergei Millian, who happened to meet with Deripaska in 2016 at an event, the St. Petersburg International Economic Forum, that played a key role in the election operation.

In the same week Millian met Deripaska, a bunch of cybersecurity experts first started looking for evidence of Russian hacking in DNS data and Igor Danchenko was in Moscow meeting with Chuck Dolan and his other named Steele dossier sources.

As the DOJ IG Report and declassified footnotes make clear, FBI opened a counterintelligence investigation into Millian in October 2016. All the evidence indicates that the investigation did not arise from Crossfire Hurricane and, given that Millian’s ID was hidden in the dossier reports shared with NYFO on their way to HQ, and given that other information on Millian was fed into DC, not NY, was probably predicated completely independent of Crossfire Hurricane.

In addition, we learned that [Millian] was at the time the subject of an open FBI counterintelligence investigation. 302 We also were concerned that the FISA application did not disclose to the court the FBI’s belief that this sub-source was, at the time of the application, the subject of such an investigation. We were told that the Department will usually share with the FISC the fact that a source is a subject in an open case. The OI Attorney told us he did not recall knowing this information at the time of the first application, even though NYFO opened the case after consulting with and notifying Case Agent 1 and SSA 1 prior to October 12, 2016, nine days before the FISA application was filed. Case Agent 1 said that he may have mentioned the case to the OI Attorney “in passing,” but he did not specifically recall doing so. 303

301 As discussed in Chapter Four, [Millian] [redacted]

302 According to a document circulated among Crossfire Hurricane team members and supervisors in early October 2016, [Millian] had historical contact with persons and entities suspected of being linked to RIS. The document described reporting [redacted] that [Millian] “was rumored to be a former KGB/SVR officer.” In addition, in late December 2016, Department Attorney Bruce Ohr told SSA 1 that he had met with Glenn Simpson and that Simpson had assessed that [Millian] was a RIS officer who was central in connecting Trump to Russia.

303 Although an email indicates that the OI Attorney learned in March 2017 that the FBI had an open case on [Millian], the subsequent renewal applications did not include this fact. According to the OI Attorney, and as reflected in Renewal Application Nos. 2 and 3, the FBI expressed uncertainty about whether this sub‐source was Person 1. However, other FBI documents in the same time period reflect that the ongoing assumption by the Crossfire Hurricane team was that this sub‐source was [Millian].

Plus, Mueller found plenty on Millian to raise separate issues of concern.

Given several other counterintelligence cases developed in NYFO, the predication likely had more to do with Russia’s effort to use cultural and other diaspora groups as a way to covertly extend Russian influence.

And in fact, Millian’s group — the Russian American Chamber of Commerce — has already made a cameo appearance in one such prosecution, that against Elena Branson, a complaint that was rolled out in the same week as the sanctions against Peskov.

a. On or about January 30, 2013, BRANSON received an email from an individual using an email address ending in “mail.ru.” Based on my review of publicly available information, I have learned that this individual was a Senior Vice President of the Russian American Chamber of Commerce in the USA. This email had the subject line “Problem.” and the text of the email included, among other things, a portion of the FARA Unit’s website with background on FARA. In response, BRANSON wrote, in part, “I am interested in the number of the law, its text in English[.]” The sender then responded with “Lena, read …” and copied into the email background on FARA and portions of the statute.

This awareness and flouting of registration requirements is the kind of thing that often features in prosecutions for 18 USC 951 violations. And, at least in the case of Branson, the statute of limitations can extend so long as the person in question continues to play a role in US politics, though in Branson’s case, she only fled the country 18 months ago.

If the FBI believed Millian was an unregistered foreign agent who fled to avoid an investigation in 2017, his ongoing involvement in efforts to gin up an investigation into the investigation — particularly claims that, even according to Durham, misinterpreted facts his own prosecutors filed and thereby contributed to death threats against witnesses in the investigation — then it wouldn’t rule out an investigation into Millian himself, an investigation that would have preceded Durham’s reckless reliance on him (or rather, Millian’s unvetted Twitter feed) as a star witness against Danchenko.

Even Millian’s public claim (albeit one offered by someone the FBI considers an embellisher) that he called the White House directly to elicit this investigation could be of interest.

We can now say with great certainty that Durham didn’t check the most obvious sources of evidence against key players involved in the Steele dossier, such as DOJ IG’s backup files in the Carter Page investigation that is the primary focus of Durham’s Danchenko indictment. That makes it highly likely he never bothered to see whether other parts of DOJ considered key players in the Steele dossier to be actual threats to democracy.

One of those key players is undoubtedly Oleg Deripaska. And the renewed focus on Russian influence operations may expand beyond that.

Scene-Setter for the Sussmann Trial, Part One: The Elements of the Offense

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

In the first of what will be a number of “scene-setters” for the Michael Sussmann trial next week, Devlin Barrett makes two significant errors. First, he misrepresents what Sussmann said in a text to James Baker on September 18, 2016.

In a text message setting up the meeting, Sussmann claimed he was not representing any particular client in bringing the matter to the FBI’s attention.

Here’s what the text says:

Jim – it’s Michael Sussmann. I have something time-sensitive (and sensitive) I need to discuss. Do you have availibilty [sic] for a short meeting tomorrow? I’m coming on my own – not on behalf of a client or company – want to help the Bureau. Thanks.

[I’m unclear whether the misspelling of “availability” is Sussmann’s or Durham’s.]

The distinction between “representing” and “on behalf of” will be a core issue litigated in this trial (as I’ll lay out below), which makes Barrett’s sloppiness affirmatively misleading.

Second, Barrett serially accepts Durham’s framing — that the cybersecurity researchers who started identifying the Alfa Bank anomaly months before Rodney Joffe ever talked to Michael Sussmann were doing “campaign research.”

The two-week trial will delve into the murky world of campaign research, lawyers and the role the FBI played in that election, as Trump and Hillary Clinton vied for the presidency, and federal agents pursued very different investigations surrounding each of them.

[snip]

Prosecutors signaled this week that they plan to call a host of current and former law enforcement officials to describe how the FBI pursued the Alfa Bank accusations, and to paint Sussmann as part of a “joint venture” that included Joffe, Clinton’s campaign, research firm Fusion GPS and cybersecurity experts.

[snip]

Cooper, however, has limited how deeply Durham’s team may go into the particulars of any alleged joint venture among Democratic operatives, ruling that he will not allow “a time-consuming and largely unnecessary mini-trial to determine the existence and scope of an uncharged conspiracy to develop and disseminate the Alfa Bank data.”

Barrett does this in spite of the fact that Durham has repeatedly said the only evidence he has supporting his joint venture conspiracy theory (even assuming it were illegal) is billing records. While Barrett cites the gist of Cooper’s ruling excluding Durham’s unsubstantiated claims of a “joint venture,” he doesn’t quote Cooper noting that, “some evidence suggests that Fusion GPS employees had no connection to the gathering or compilation of the Alfa Bank data.” Effectively, an experienced DOJ reporter has fallen for Durham’s use of unsubstantiated materiality claims to frame a prosecution that didn’t charge the underlying conspiracy. That’s a real disservice to readers who don’t know the difference between uncharged materiality claims and a charged conspiracy.

So here’s my effort to explain to newbies what the trial is about. Durham has to prove that:

  • Michael Sussmann said what Durham claims Sussmann did to James Baker on September 19, 2016
  • What he said was a lie
  • The alleged lie was material to the functioning of the FBI

Durham has to prove that Sussmann said what Durham claims he did on September 19, 2016

From the start, Durham has been uncertain what lie Sussmann told. As Sussmann pointed out in a motion for a bill of particulars right from the get-go, at various points in the indictment, Durham claimed that Sussmann’s lie was:

  • “that he was not doing his work on the aforementioned allegations ‘for any client'” (one)
  • “that he was not acting on behalf of any client” (one, two)
  • that he was not “acting on behalf of any client conveying particular allegations concerning a Presidential candidate” (one)

That is, repeatedly in the indictment, Durham was conflating the “work” of chasing down the allegations (which is not at issue in this prosecution at all) with the meeting where Sussmann shared those allegations with the FBI. The last formulation is what Durham charged, but as we’ll see, unless Durham supersedes this indictment today, he may have problems with that formulation as well.

Almost six months after Durham charged Sussmann for lying about sharing allegations on September 19, he got rock-solid proof — a text from Sussmann to Baker that Durham only found because Sussmann kept asking Durham to go back and look for these records — that Sussmann said, he was “coming on my own – not on behalf of a client or company – want to help the Bureau,” on September 18.

That rock-solid proof actually presents two problems for Durham. First, it raises the possibility that, even if the jury decides this was a lie, Durham can only prove Sussmann said it on September 18, not September 19. But the text also suggests what Sussmann may have meant by “on behalf of:” who benefits. He was not seeking a benefit for a client, he was trying to benefit the FBI.

That interpretation is consistent with what Sussmann said under oath in 2017, and it is an interpretation that Durham did not test before he charged Sussmann.

I was sharing information, and I remember telling him at the outset that I was meeting with him specifically, because any information involving a political candidate, but particularly information of this sort involving potential relationship or activity with a foreign government was highly volatile and controversial. And I thought and I remember telling him that it would be a not-so-nice thing ~ I probably used a word more stronger than “not so nice” – to dump some information like this on a case agent and create some sort of a problem. And I was coming to him mostly because I wanted him to be able to decide whether or not to act or not to act, or to share or not to share, with information I was bringing him to insulate or protect the Bureau or — I don’t know. just thought he would know best what to do or not to do, including nothing at the time.

And if I could just go on, I know for my time as a prosecutor at the Department of Justice, there are guidelines about when you act on things and when close to an election you wait sort of until after the election. And I didn’t know what the appropriate thing was, but I didn’t want to put the Bureau or him in an uncomfortable situation by, as I said, going to a case agent or sort of dumping it in the wrong place. So I met with him briefly and

[snip]

so I told him this information, but didn’t want any follow-up, didn’t ~ in other words, I wasn’t looking for the FBI to do anything. I had no ask. I had no requests. And I remember saying, I’m not you don’t need to follow up with me. I just feel like I have left this in the right hands, and he said, yes. [my emphasis]

As has been explained over and over, Jim Baker’s testimony about what Sussmann said to him on September 19 (as opposed to what Sussmann texted him on September 18) has been all over the map:

Durham will argue that he got Baker’s testimony to match what he, Durham, claims to be sure is the truth by refreshing his memory with notes that Bill Priestap and Trisha Anderson took, the former when Baker told him about the meeting immediately afterwards and the latter in circumstances that are less clear.

The Priestap notes say four things:

  • Represent DNC, Clinton Foundation etc
  • Been approached by prominent cyber people
  • NYT, Wash Post, or WSJ on Friday
  • [Written slantways for reasons Priestap could not explain] said not doing this for any client

The Anderson notes say two things:

  • No specific client but group of cyber academics talked with him about research
  • Article this Friday, NYT/WPost [the notes fade out]

None of those notes say “on behalf of,” Anderson’s don’t address whether Sussmann offered up the claim or not, and Priestap seems to have written “not doing this for any client” after the fact, as if it wasn’t part of Baker’s initial telling.

None of those notes make it clear what part of the information Baker passed on came from the meeting itself and what part came from the text he had received the day before (and indeed, Priestap’s slantways note may suggest the detail about a client could have come later). Durham only has a refreshed memory of what Baker knew by September 19, not which parts he learned on September 18 and which he learned on September 19.

Literally six months after indicting Sussmann, Durham gave him different sets of notes recording how Andy McCabe explained the allegations to Dana Boente on March 6, 2017.

One set, from Tashina Gauhar’s notes, says this:

“Attorney” Brought to FBI on behalf of his client

Also advised others in media > NYT

Another set, from Mary McCord’s notes, says this:

First brought to FBI att by atty

[snip]

Attorney brought to Jim Baker + d/n say who client was. Said computer researchers saw the [activity?]. Said media orgs had the info, including NY Times.

These notes admittedly reflect what the FBI came to understand, possibly in the September 19 meeting, possibly hours after the September 19 meeting, possibly days, possibly months. But as McCord recorded it, the emphasis remained on the computer researchers and the NYT. That emphasis is important for materiality questions.

Durham has to prove what Sussmann said was a lie

Next, Durham has to prove that what Sussmann said was an intentional lie.

Probably, Durham will use the formulation Sussmann sent in his September 18 text, “I’m coming on my own – not on behalf of a client or company – want to help the Bureau,” since that’s the only thing he has real proof of. This is why Sussmann tried to nail down Durham on what “on behalf of” shortly after being charged. Because it could mean, “on the orders of,” “for a client I am retained by,” or “seeking some benefit or ask for.”

But Sussmann’s explanation, “want to help the Bureau,” tied as it is to some benefit for the FBI, presents new problems for Durham. As noted above, that’s precisely what Sussmann said in sworn testimony back in 2017, when he had no reason to believe there would ever be a special prosecutor checking his claims and at a time he no longer had that text to check. Sussmann framed it in terms of giving the FBI maximal flexibility during campaign season.

Importantly, Sussmann did take steps to help the Bureau, by (with Joffe’s assent), helping the FBI kill the story the NYT was close to publishing. Which is another thing Sussmann described when he testified under oath in 2017 and another thing Durham didn’t bother to investigate before indicting.

I just wanted to tell you about a phone call that I had with him 2 days after I met with him, just because I had forgotten it When I met with him, I shared with him this information, and I told him that there was also a news organization that has or had the information. And he called me 2 days later on my mobile phone and asked me for the name of the journalist or publication, because the Bureau was going to ask the public — was going to ask the journalist or the publication to hold their story and not publish it, and said that like it was urgent and the request came from the top of the Bureau. So anyway, it was, you know, a 5-minute, if that, phone conversation just for that purpose.

Along with the September 18 text showing Sussmann told Baker he wanted to help the FBI, there were several texts reflecting that when Baker asked Sussmann for the name of the outlet that was reporting on the Alfa Bank allegations, Sussmann told Baker he had to ask someone before sharing the name.

Those text messages include, among other things, texts indicating that Mr. Sussmann asked to meet with Mr. Baker in September 2016 not on behalf of a client but to help the Bureau; texts indicating that Mr. Sussmann told Mr. Baker he had to check with someone (i.e., his client) before giving him the name of the newspaper that was about to publish an article regarding the links between Alfa Bank and the Trump Organization; and other texts, including a copy of a tweet that then-President Trump posted regarding Mr. Sussmann.

Then, Sussmann and Baker spoke on the phone several times on September 21 and 22.

Mr. Sussmann and Mr. Baker also had several phone conversations over the course of that week, including on Wednesday, September 21 and on Thursday, September 22.

We’ll learn more details at the trial, but we know that Baker and Bill Priestap called the NYT and got them to kill the story.

One reason this is important is because — as Sussmann’s attorney noted in a recent hearing — this is the opposite of what Sussmann would have done if he was working on behalf of the campaign.

We expect there to be testimony from the campaign that, while they were interested in an article on this coming out, going to the FBI is something that was inconsistent with what they would have wanted before there was any press. And in fact, going to the FBI killed the press story, which was inconsistent with what the campaign would have wanted.

The decision to go to the FBI contravened Hillary’s best interest.

The other reason those exchanges are important is because, as Sussmann pointed out, the best explanation for how Andy McCabe (that “top of the Bureau” that decided to take steps to kill the story) came to learn that Sussmann did have a client was via those exchanges.

The FBI could not have come to that belief based on conversations they had with Mr. Sussmann after his phone calls with Mr. Baker the week of September 19, 2016, because the FBI chose not to interview Mr. Sussmann about the information he provided to Mr. Baker, and the FBI chose not to ask Mr. Sussmann about or interview the cyber experts whom Mr. Sussmann identified as the source of the information he shared with the FBI.

Indeed, that timeline may explain why Baker’s memories about this are so inconsistent: because what Sussmann told him on September 18, what he told him on September 19, and what he told him on September 21 have all blended into one.

In any case, though, the best evidence suggests the FBI probably learned Sussmann had a client within three days of the time Sussmann first brought the allegations to the FBI (because that was the last he spoke with the FBI). That undermines Durham’s claim that Sussmann was hiding some big conspiracy. Within days, he appears to have made it obvious he did have a client.

Durham has to prove the alleged lie was material to the functioning of the FBI

I’m not going to get too far into the work Durham will have to do to prove that Sussmann’s lie — if he can prove what Sussmann said, if he can prove Sussmann said it on September 19 and not September 18, and if he can prove it really was a lie — had the ability to affect the decisions the FBI could have made.

Sussmann has many ways to attack Durham’s materiality argument. He’ll do so by proving:

  • FBI knew he represented the Democrats (indeed, that’s what Priestap’s notes say)
  • FBI knew of his ties to Joffe
  • His characterization that this came from cybersecurity experts was true
  • After the Franklin Foer piece was published, a separate FBI Agent attempted to open an investigation (showing what would have happened if Sussmann had not shared the information and just let NYT publish)

If I were him, I would also point to all the evidence (including from the March 2017 notes) that what most mattered to the FBI was not whom his client was but that the NYT was going to publish this.

But, given the timeline laid out by Sussmann’s texts and calls with James Baker, I’d make one more point. All the evidence suggests that FBI knew he had a client by September 22 — probably by September 21.

The FBI Agents who will describe the steps they took will apparently describe making a second call to Cendyn on September 23.

That is, the timeline will show that FBI learned Sussmann had a client before they even spoke to Cendyn a second time.

If Sussmann’s client or clients mattered, the FBI learned about them so early in the process that it would not have affected the overall investigation.

Durham’s tactical retreat

I know a lot of people think Durham has a slam-dunk case with that September 18 text, but that’s simply not the case — though as always, you never know what a jury is going to decide.

But I think that Durham is already planning a tactical retreat.

As Sussmann noted in a recent filing summarizing conflicting views on jury instructions, Durham’s indictment describes Sussmann’s alleged lie this way:

[O]n or about September 19, 2016, the defendant stated to the General Counsel of the FBI that he was not acting on behalf of any client in conveying particular allegations concerning a Presidential candidate, when in truth, and in fact, and as the defendant knew well, he was acting on behalf of specific clients, namely, Tech Executive-1 and the Clinton Campaign.

Never mind that Durham characterized the allegations as pertaining to “a Presidential candidate,” which presents other problems for Durham, he has also accused Sussmann of lying about having two clients.

Mr. Sussmann proposes modifying the last sentence as follows, as indicated by underlining: Specifically, the Indictment alleges that, on or about September 19, 2016, Mr. Sussmann, did willfully and knowingly make a materially false, fictitious, and fraudulent statement or representation in a matter before the FBI, in violation of 18 U.S.C. § 1001(a)(2), namely, that Mr. Sussmann stated to the General Counsel of the FBI that he was not acting on behalf of any client in conveying particular allegations concerning Donald Trump, when, in fact, he was acting on behalf of specific clients, namely, Rodney Joffe and the Clinton Campaign.5 The government objects to the defense’s proposed modification since it will lead to confusion regarding charging in the conjunctive but only needing to prove in the disjunctive.

4 Authority: Indictment.

5 Authority: Indictment.

Durham’s language about “conjunctive” versus “disjunctive” will likely be the matter for heated debate next week. Particularly in the wake of Cooper’s decision that the materials from the researchers won’t come in as evidence, Durham seems to be preparing to prove only that Sussmann lied about representing Hillary, and not about Joffe. Sussmann, meanwhile, seems to believe that Durham will have to prove that his alleged lie was intended to hide both alleged clients.

The problem with Durham’s fall-back position is that if Sussmann really were representing Hillary at that FBI meeting, he wouldn’t have killed the NYT story that would have helped her campaign.

Update: Corrected date on Sussmann’s HPSCI interview, which was 2017.

Thirty Months after Disputing Michael Horowitz, Durham’s Team Suggests They’ve Never Looked at the Evidence

In Michael Sussmann’s filing explaining that he couldn’t include highly exculpatory notes — written by Tashina GausharMary McCord, and Scott Schools — from a March 6, 2017 meeting in his motion in limine because John Durham had provided them to him too late to include, Sussmann claimed that the files were not among those for which Durham had gotten permission to provide late.

The Special Counsel neglects to mention that these handwritten notes were buried in nearly 22,000 pages of discovery that the Special Counsel produced approximately two weeks before motions in limine were due. Specifically, the Special Counsel produced the March 2017 Notes as part of a March 18, 2022 production. The Special Counsel included the March 2017 Notes in a sub-folder generically labeled “FBI declassified” and similarly labeled them only as “FBI/DOJ Declassified Documents” in his cover letter. See Letter from J. Durham to M. Bosworth and S. Berkowitz (Mar. 18, 2022). And although the Special Counsel indicated on a phone call of March 18, 2022 that some of the 22,000 pages were documents that made references to “client,” he did not specifically identify the March 2017 Notes or otherwise call to attention to this powerful exculpatory material in the way that Brady and its progeny requires.

[snip]

[T]he Special Counsel has also failed to explain why this powerful Brady material was produced years into their investigation, six months after Mr. Sussmann was indicted, and only weeks before trial.3

Sussmann was wrong.

When Durham got an extension to his discovery deadlines, he got special permission to turn over (among other things) materials from DOJ IG at a later date.

DOJ Office of Inspector General Materials. On October 7, 2021, at the initiative of the Special Counsel’s Office, the prosecution team met with the DOJ Inspector General and other OIG personnel to discuss discoverable materials that may be in the OIG’s possession. The Special Counsel’s office subsequently submitted a formal written discovery request to the OIG on October 13, 2021, which requested, among other things, all documents, records, and information in the OIG’s possession regarding the defendant and/or the Russian Bank-1 allegations.

[I]n January 2022, the OIG informed the Special Counsel’s Office for the first time that it would be extremely burdensome, if not impossible, for the OIG to apply the search terms contained in the prosecution team’s October 13, 2021 discovery request to certain of the OIG’s holdings – namely, emails and other documents collected as part of the OIG’s investigation. The OIG therefore requested that the Special Counsel’s Office assist in searching these materials. The Government is attempting to resolve this technical issue as quickly as possible and will keep the defense (and the Court as appropriate) updated regarding its status.

In the pre-trial hearing on Monday, Andrew DeFilippis explained that the files came from DOJ IG (and therefore were subject to that later discovery deadline).

We located those statements in the notes in February or early March, when we received a huge production from the DOJ Inspector General’s office. As soon as we noticed that in the notes, we put them on very rapid declassification at the FBI and turned them over to the defense about a week later.

DeFilippis offered an unconvincing excuse for burying belatedly provided Brady material two layers deep in file folders without specific notice. He described the decision to flag the materials as an internal Government decision, which is an odd description unless Michael Horowitz’s office — or those involved in declassifying the records — forced the decision:

We then, speaking internally as the Government, decided it would be important to flag those notes for the defense. And so the day that we produced them, we got on a call. We wanted to be in a position to flag it in a way that we didn’t just put it in the end of a paragraph of a discovery letter. We flagged for the defense that we were going to be producing notes and that that included notes in which the word “client” appeared. And we told them that we thought that would be relevant to them.

[snip]

Let me just say that there was absolutely no effort by the Government to delay here or to hide these in a large production. That is precisely why we got on a phone call and flagged it for the defense.

It’s almost like DeFilippis was hoping this would get no notice.

I can understand why. I’ve described how astounding it was that Durham did not go looking for evidence from DOJ IG until — by Durham’s own telling — October 7, more than two weeks after indicting Sussmann (and likely not long enough before indicting Igor Danchenko to learn key details that undermine at least one charge against him).

But this late provision of exculpatory evidence means one of two things:

  • Durham has always had the files, but did such a poor job of looking for it in discovery he didn’t find it in his own files even as he started hunting Michael Sussmann
  • Durham never had these files

The latter is the more likely possibility, which, as a threshold matter, would mean Durham never reviewed key files that DOJ IG had used in high level witness interviews before disputing Michael Horowitz’ conclusion that the investigation was predicated appropriately. Durham is, literally, only reviewing key files three years into his investigation.

Along the way, he’s learning that conspiracy theories he has been chasing for months and years are false.

The revelation that Durham is discovering exculpatory information in DOJ IG’s files is as important to the efforts to blow up the Mike Flynn prosecution two years ago as it is to the Sussmann prosecution. That’s because the Jeffrey Jensen review of the Flynn prosecution and the Durham investigation were believed to be closely aligned. Indeed, I have shown that the handwritten notes from the FBI that Durham will rely on at trial show the same markers of unreliability that documents that were altered in the Flynn case had.

As I explained in this post, Jensen’s documents started with the Bates stamp used throughout the Flynn prosecution.

But after a period of time, they used a Bates stamp with a different typeface, albeit continuing the same series, suggesting someone else was doing the document sharing.

But if they’re drawing on the same source documents, Durham should at least know notes of that meeting exists. Jeffrey Jensen received and relied on at least one set of notes — Jim Crowell’s notes — from the March 6, 2017 meeting. Those notes, along with Tashina Gauhar’s notes of an earlier briefing and all those that got altered, also have the fat typeface.

The Tashina Gauhar notes turned over to Sussmann (and the others turned over) not only are based off a scan of her original notes and have no post-it notes on them, but they bear both Durham’s Bates stamp (SCO-074095), but also one that likely comes from DOJ IG (SCO-FBIPROD_021529).

All of which seems to suggest there was the same cherry-picking that went into the Durham investigation and the Jensen “review.” Neither reviewed — neither could have!! — what really happened. They reviewed selected records and then (in the Jensen review) altered those records to make false claims that the former President used in a debate attack.

I’ll come back to the issue of what appears in the notes Sussmann released that conflicts with the Flynn releases.

But I’m also interested that Durham is stalling on providing other notes from the meeting.

2 The defense has requested that the Special Counsel search for any additional records that may shed further light on the meeting and certain of those requests remain outstanding. To date, the Special Counsel has represented that the only additional notes from attendees at the meeting that he has identified do not reference whether or not Mr. Sussmann was acting on behalf of a client. The absence in those notes of any reference to whether Mr. Sussmann was acting on behalf of a client also raises questions regarding materiality of the charged conduct: if the on behalf of information were truly material to the FBI’s investigation, presumably all note takers would have written it down. [my emphasis]

Durham can’t be withholding notes because they don’t mention Sussmann having a client. That’s because Scott Schools’ notes mention that the Alfa Bank tip came from an attorney, but don’t mention that he was there on behalf of a client (Schools’ notes may have been included because they are the only ones of the three provided that attributed this discussion to Andy McCabe).

There are at least two other sets of notes from this meeting that are known or presumed to exist:

And there were at least three other people present at the meeting known to take notes:

  • Bill Priestap
  • Andy McCabe
  • Dana Boente

Importantly, in Durham’s objection to admitting these notes as evidence, he makes it clear that James Baker (inexcusably as a lawyer) did not take notes of this or any other meeting, but he does not say whether Priestap (or Trisha Anderson) took notes.

Moreover, the DOJ personnel who took the notes that the defendant may seek to offer were not present for the defendant’s 2016 meeting with the FBI General Counsel. And while the FBI General Counsel was present for the March 6, 2017 meeting, the Government has not located any notes that he took there.

If Priestap took notes, one copy should be in Durham’s possession, in the notebook of Priestap’s notes already on Durham’s exhibit list.

DOJ has been trying to prevent anyone from looking at Andy McCabe’s notes for some time.

But one thing that turning over the DOJ IG retained notes for the others will show is whether alterations in the Strzok, Priestap, and McCabe notes were made.

It’ll also make it easy to test why Jensen’s review redacted a date and added one — albeit the correct one — in the Jim Crowell notes.

 

That is, I wonder if Durhams’ reluctance to turn over those materials stems not from any facts about his own investigation, but from an awareness of the cherry-picking — and possibly worse — that having turned over the past one reveals.

Three posts on the altered documents from the Mike Flynn case

The Jeffrey Jensen “Investigation:” Post-It Notes and Other Irregularities (September 26, 2020)

Shorter DOJ: We Made Shit Up … Please Free Mike Flynn (October 27, 2020)

John Durham Has Unaltered Copies of the Documents that Got Altered in the Flynn Docket (December 3, 2020)

image_print