OpSec Confusion on the Oath Keeper Conspiracy

/36 Comments/in , /by

I write a lot about the comms the Oath Keepers used to plan insurrection. There was the post about how they figured out, too late, not to plan an insurrection on Facebook; of the five counts of obstruction on the Oath Keeper indictment released Sunday, two pertain to Facebook. Then there was the post where I cataloged how many social media platforms were described in the last iteration of the indictment against them.

  • A leadership list on Signal they appear to have obtained from either Watkins and/or Kelly Meggs
  • Open channels on Zello, possibly separate ones for each large event
  • Telephony chats and texts, including during January 6
  • MeWe accounts
  • Way too much blabbing on Facebook, followed by a foolish belief they could delete such content
  • Parler for further blabbing
  • Stripe for payment processing (possibly for dues)
  • GoToMeeting for operational planning

The remaining three obstruction charges pertain to this social media activity, one — for Joshua James — specifically describing his attempt to delete and burn the “[S]ignal comms about the op.”

Add hand-written ProtonMail attachments to the toolchest

It turns out I should have included ProtonMail in that list, because both the addresses to which Laura Steele sent her vetting application to join the Oath Keepers on January 3 were ProtonMail addresses, but the government only laid that out in their unsuccessful bid to keep her detained, in an attempt to use its encryption to ascribe to her that operational security.

On the evening of January 3, 2021, Defendant Steele emailed a membership application and vetting form to the Oath Keepers of Florida.4 She copied Defendant Young on the email, and wrote: “My brother, Graydon Young told me to submit my application this route to expedite the process.” Under the section for “CPT Skill Sets (Community Preparedness Team) Experience or Interests,” she checked “Security.” Under “Skillsets,” she wrote: “I have 13 years of experience in Law Enforcement in North Carolina. I served as a K-9 Officer and a SWAT team member. I currently work Private Armed Security for [company name redacted]. I am licensed PPS through the North Carolina Private Protective Services.”

Within 10 minutes, Defendant Steele sent another email, this one directly to Defendant Kelly Meggs’s email account at Proton Mail, again copying Defendant Young. She again attached her application and vetting form, and wrote: “My brother, Graydon Young told me to send the application to you so I can be verified for the Events this coming Tuesday and Wednesday.”

The following day (January 4), Defendant Steele sent the same materials to yet another Oath Keepers email address at Proton Mail. On her email, she copied co-defendants Kelly Meggs and Graydon Young.

4 The email recipient was actually a Florida Oath Keepers account at “protonmail.com.” Proton Mail is housed overseas (in Switzerland) and offers end-to-end encryption. “Even the company hosting your emails has no way of reading them, so you can rest assured that they can’t be read by third parties either.” Mindaugas Jancis, ProtonMail review: have we found the most secure email provider in 2021?, CyberNews, Mar. 4, 2021, at https://cybernews.com/secure-email-providers/protonmail-review.

But Proton is not going to help if one side of a communication is on Gmail or some other email service on which FBI can serve a subpoena. Which may explain how the government obtained this email from the newly indicted Joseph Hackett in the latest superseding.

41. On December 19, 2020, HACKETT sent an email to YOUNG with a subject line “test.” The body of the email stated: “I believe we only need to do this when important info is at hand like locations, identities, Ops planning.” The email had a photo attached; the photo showed cursive handwriting on a lined notepad that stated: “Secure Comms Test. Good talk tonight guys! Rally Point in Northern Port Charlotte at Grays if transportation is possible. All proton mails. 7 May consider [a rally point] that won’t burn anyone. Comms – work in progress. Messages in cursive to eliminate digital reads. Plans for recruitment and meetings.”

7 Based on the investigation, “proton mails” appears to refer to the company “ProtonMail,” which offers encrypted email services.

I’ve not seen anything that suggests the government has obtained Proton Mails from the Oath Keepers conducted entirely on the platform; that may have to wait until someone involved decides to cooperate. But I’m not sure how writing the most sensitive messages on what sounds like dead tree paper before sending it adds to the security.

DOJ’s selective understanding of encryption

One of the more aggravating pieces of confusion in the new indictment, however, comes not from the alleged conspirators but from the government.

The last item in a list of Manner and Means employed in the conspiracy is the use of “secure and encrypted communications.”

Using secure and encrypted communications applications like Signal3 and Zello4 to develop plans and later communicate during the January 6 operation.

The first overt act describes Stewart Rhodes laying out what I am calling the “Antifa foil” on a GoToMeeting meeting.

At a GoToMeeting5 held on November 9, 2020, PERSON ONE told those attending the meeting, “We’re going to defend the president, the duly elected president, and we call on him to do what needs to be done to save our country. Because if you don’t guys, you’re going to be in a bloody, bloody civil war, and a bloody – you can call it an insurrection or you can call it a war or fight.”

As a result, the following footnotes appear on the bottom of the same page.

3 Signal is an encrypted messaging service.

4 Zello is an application that emulates push-to-talk walkie-talkies over cellular telephone networks. Zello can be used on electronic communication devices, like cellular telephones and two-way radios.

5 GoToMeeting is an online meeting site that allows users to host conference calls and video conferences via the Internet in real time.

Start with Zello: It can be secure. But it wasn’t, as used by the Oath Keepers, the day of the insurrection, because it was an open channel. Indeed, the reason we know about it is because journalist Micah Loewinger was following along in real time. Plus, anything saved onto a phone will be accessible once the phone is compromised, just like Signal will. (From the discovery letters shared with the Oath Keepers — the most recent of which is over a month old — the government appears to have initially relied on WNYC’s published versions of the Zello chats. But this superseding indictment includes time stamps from Watkins’ Zello exchanges, which suggests they’ve obtained a more reliable copy since then.

Signal, DOJ says, is encrypted. I have no problem with that. But they started compromising the Signal chats as soon as they exploited Jessica Watkins’ phone. And the latest indictment seems to rely on the exploitation from another of the more involved participants — it’s where the new details on the Quick Reaction Force come from (here’s my rough capture of the communications we’ve seen referenced to date).

What I find annoying is that, after treating Signal and Zello as super spooky applications, DOJ then treats GoToMeeting like a normal tool, just “an online meeting site that allows users to host conference calls and video conferences via the Internet in real time.”

But it is also end-to-end encrypted and has a number of other security features that are necessary for its use by mainstream businesses and health care providers. That said, it is centralized and probably responds eagerly to legal process, which is the distinction DOJ really intends by this. That is, it’s not encryption that makes the use of these apps a useful marker of a conspiracy, it’s decentralized security, security that the Oath Keepers didn’t use with Zello the day of the insurrection. Plus, for a conspiracy indictment, as opposed to other criminal charges, the use of G2M suggests a bureaucratization that should be more useful to prove the case.

In any case, with this fourth indictment, DOJ added content from G2M that was probably meant to be secure: Stewart Rhodes’ “Antifa foil” comments. An initial production of G2M had been provided to defendants by April 9, with a second attempt on April 23. So it may be that it has taken some time to reconstruct whatever full production they might receive from the various Oath Keeper accounts.

The money is the metadata

That said, it is amusing seeing the conspirators try to add a layer of security to the already secure ProtonMail while they’re laying a trail of travel plans that knots them all up into a network. Here are just some of the fleshed out details from the indictment:

79. On January 4, 2021, HARRELSON and DOLAN departed Florida together in a vehicle rented by DOLAN and traveled to the Washington, D.C., metropolitan area.

[snip]

82. On January 4, 2021, PERSON TEN checked into the Hilton Garden Inn in Vienna, Virginia. The room was reserved and paid for using a credit card in PERSON ONE’s name.

[snip]

85. On January 5, 2021, PERSON ONE and MINUTA separately traveled to the Washington, D.C., metropolitan area and checked into the Hilton Garden Inn in Vienna, Virginia.

[snip]

90. KELLY MEGGS paid for two rooms, each for two people, at the Comfort Inn Ballston from January 5-6, 2021. The rooms were reserved under the name of PERSON THREE.

90. KELLY MEGGS paid for two rooms, each for two people, at the Comfort Inn Ballston from January 5-6, 2021. The rooms were reserved under the name of PERSON THREE.

91. KELLY MEGGS also booked two rooms at the Hilton Garden Inn in Washington, D.C., from January 5-7, 2021. KELLY MEGGS paid for both of the rooms, using two different credit cards.

[snip]

93. HACKETT paid for a room at the Hilton Garden Inn in Washington, D.C., from January 5-7, 2021. The room was booked in the name of PERSON SIXTEEN.

[snip]

95. MINUTA, using his personal email address and his personal home address, reserved three rooms at the Mayflower Hotel in Washington, D.C., under the names of MINUTA, JAMES, and PERSON TWENTY. A debit card associated with PERSON FIFTEEN was used to pay for the room reserved under MINUTA’s name. A credit card associated with JAMES was used to pay for the room reserved under JAMES’s name.

Kelly Meggs, by paying for what appears to be the QRF room and another for Person 3 to tend the weapons, would tie the Floridians staying in the DC Hilton Garden with a group coming from at least three states at the Ballston Comfort Inn (and that’s before you consider the surveillance footage that shows others dropping off weapons). Minuta, by reserving three rooms at the Mayflower, would tie Joshua James, Person Twenty, and Person Fifteen to the group, including Minuta, staying at the Vienna Hilton Garden, which includes Rhodes and Person Ten. And there’s at least one known payment — from some unidentified person to James’ wife — that doesn’t show up here.

Post 9/11, it’s hard to hide hotel travel, especially retroactively, after engaging in a terrorist attack, but it doesn’t help that the Oath Keepers didn’t compartment their network at all. So all the encrypted messaging and meeting apps in the world could not hide that this was a network that spanned (thus far, but I’m holding out hope they’ll roll out the first Mississippi defendants any day!) at least seven states.

Update: I’ve taken out a reference to the Ohioans walking Isaacs back to a hotel in DC. They did separate early but it was not to take him back. Thanks to Benny Bryant for the correction.

Share this entry

Latex Gloves Hiding Evidence of Conspiracies: On the Unknown Adequacy of the January 6 Investigation

/27 Comments/in , /by

Since I’ve acquired new readers with my January 6 coverage and since the financial stress of COVID is abating for many, it seems like a good time to remind people this is not a hobby: it is my day job, and I’d be grateful if you support my work.

Update, 6/2: As this post lays out, Hodgkins’ plea was indeed just a garden variety plea. During the hearing he explained the latex gloves. He carries a First Aid kit around all the time and saw Joshua Black’s plastic bullet wound (though he didn’t know Black and didn’t name him in the hearing) and put gloves on in preparation to provide medical assistance. After Black declined his help, he took the latex gloves off.

On Wednesday, June 2, insurrectionist Paul Allard Hodgkins will plead guilty, becoming just the second of around 450 defendants to publicly plead guilty (particularly given the number of people involved, there may be — and I suspect there are — secret cooperation pleas we don’t know about).

NOTICE OF HEARING as to PAUL ALLARD HODGKINS: A Plea Agreement Hearing is set for 6/2/2021, at 11:00 AM, by video, before Judge Randolph D. Moss. The parties shall use the same link for connecting to the hearing.(kt)

This could be the first of what will be a sea of plea deals, people accepting some lesser prison time while avoiding trial by pleading out. But there’s one detail that suggests it could be more, that suggests Hodgkins might have knowledge that would be sufficiently valuable that the government would give him a cooperation deal, rather than just a plea to limit his prison time.

Hodgkins is one of the people who made it to the Senate floor and started rifling through papers there, which by itself has been a locus of recent investigative interest. But he is an utterly generic rioter, wearing a Trump shirt and carrying a Trump flag. According to an uncontested claim in his arrest affidavit, he told the FBI he traveled to the insurrection from Florida alone, by bus. Because the only challenge he made to his release conditions — to his curfew — was oral, and because the prosecutor in his case hasn’t publicly filed any notice of discovery (which would disclose other kinds of evidence against him), there’s nothing more in his docket to explain who he is or what else he did that day, if anything.

But one thing sticks out about him: before he started rifling through papers in the Senate, he put on latex gloves.

It’s not surprising he had gloves. During the pandemic, after all, latex gloves have been readily available, and I’ve wandered around with gloves in my jacket pocket for weeks. But he did show the operational security to put them on, when all around him people were just digging in either bare-handed or wearing the winter or work gloves they had on because it was a pretty cold day.

There’s just one other instance I know of where someone at the insurrection showed that kind of operational security (though there is one person identified by online researchers by the blue latex gloves he wore while playing a clear organizational role outside the Capitol). When one of the guys that Riley June Williams was with started to steal Nancy Pelosi’s laptop, Williams admonished him, “dude, put on gloves” and threw black gloves (which may or may not be latex) onto the table for him to use.

There’s no reason to believe there’s a tie (as it happens, Williams had a status hearing last week where her conditions were loosened so she can look for work). There is a cybersecurity prosecutor, Mona Sedky, who is common to both cases, which sometimes indicates a tie, but she is also on cases against defendants who have no imaginable tie to Williams. But Hodgkins exhibited the kind of operational security that, otherwise, only other people who seemed to be operating from some kind of plan exhibited.

My point is not that there’s a tie, but that we don’t know whether there’s something more interesting about Hodgkins, and we might not even learn whether there is on Wednesday, in significant part because if there is one, prosecutors may not want to share that information publicly.

And I think, particularly in the wake of Republicans’ successful filibuster of a January 6 Commission and discussions of whether there will be any real accountability, that’s a useful illustration about the limits of our ability to measure the efficacy of the investigation right now. Paul Hodgkins could be (and probably is) just some Trump supporter who hopped on a bus, or his latex gloves could be the fingerprint of a connection to more organized forces.

With that said, I’d like to talk about what we can say about the investigation so far, and where it might go.

Last week, when I read this problematic and in several areas factually erroneous attempt to describe the attack in military terms, I realized that readers new to my work may not understand what I do.

I cover a range of things, but when I cover a legal case, I cover the legal case as a means to understand what prosecutors are seeing. That’s different than describing the alleged crime itself; particularly given the flood of defendants, I’m not, for example, reading through scraped social media accounts from before the attack to understand what was planned in the semi-open in advance. But reading the filings closely is one way to understand where the criminal investigation might go and the chances it will be successfully prosecuted and if so how broadly the prosecution will reach.

I’m not a lawyer, though I’ve got a pretty decent understanding of the law, especially the national security crimes I’ve covered for 17 years. But my background in corporate documentation consulting and comparative literature (plus the fact that I don’t have an editor demanding a certain genre of writing) means I approach legal cases differently than most other journalists. For the purposes of this post, for example, my academic expertise in narrative theory makes me attuned to how prosecutors are withholding information and focalizing their approach to preserve investigative equities (or, at times, hide real flaws in their cases). Prosecutors are just a special kind of story-teller, and like novelists and directors they package up their stories for specific effects, though criminal law, the genre dictated by court filings, and prohibitions on making accusations outside of criminal charges impose constraints on how they tell their stories.

One of the tools prosecutors use, both in a legal sense and a story-telling one, is conspiracy. The problematic military analysis, linked above, totally misunderstood that part of my work (as have certain Russian denialists looking for a way to attack that doesn’t involve grappling with evidence): when I map out the conspiracies we’re seeing in January 6, I’m not talking about the overarching conspiracy that made it successful, how the entire event was planned. Rather, I’m observing where prosecutors have chosen to use that tool — by charging four separate conspiracies against Proud Boys that prosecutors are sloppily treating as one, and charging (as of yesterday) sixteen members of the Oath Keepers in a single conspiracy — and where they haven’t, yet — for a set of guys who played key roles in breaching the East door and the Senate chamber who armed themselves and traveled together. As that set of guys shows, prosecutors aren’t limited to using conspiracy with organized militias, and I expect we’ll begin to see some other conspiracies charged against other networks of insurrectionists. It’s virtually certain, for example, that we’ll see some conspiracies charged against activists who first organized together in local Trump protests; I expect we’ll see conspiracies charged against other pre-existing networks (like America First or QAnon or even anti-vaxers who used those pre-existing networks to pre-plan their role in the insurrection).

Conspiracies are useful tools for prosecutors for several purposes. For example, a conspiracy charge can change what you need to prove: that the conspiracy was entered into and steps taken, some criminal, to achieve the conspiracy, rather than the underlying crime. It can used to coerce cooperation from co-conspirators and enter evidence at trial in easier fashion. And it’s the best way to hold organizers accountable for the crimes they recruit others to commit.

If Trump, or even his flunkies, are going to be held accountable for January 6, it will almost certainly be through conspiracy charges built up backwards from the activities at the Capitol. I am agnostic on whether they will be, but it’s not as far a reach as some might think. This handy guide to conspiracy law that Elizabeth de la Vega laid out during the Mueller investigation provides a sense of why that is.

Conspiracy Law – Eight Things You Need to Know.

One: Co-conspirators don’t have to explicitly agree to conspire & there doesn’t need to be a written agreement; in fact, they almost never explicitly agree to conspire & it would be nuts to have a written agreement!

Two: Conspiracies can have more than one object- i.e. conspiracy to defraud U.S. and to obstruct justice. The object is the goal. Members could have completely different reasons (motives) for wanting to achieve that goal.

Three: All co-conspirators have to agree on at least one object of the conspiracy.

Four: Co-conspirators can use multiple means to carry out the conspiracy, i.e., releasing stolen emails, collaborating on fraudulent social media ops, laundering campaign contributions.

Five: Co-conspirators don’t have to know precisely what the others are doing, and, in large conspiracies, they rarely do.

Six: Once someone is found to have knowingly joined a conspiracy, he/she is responsible for all acts of other co-conspirators.

Seven: Statements of any co-conspirator made to further the conspiracy may be introduced into evidence against any other co-conspirator.

Eight: Overt Acts taken in furtherance of a conspiracy need not be illegal. A POTUS’ public statement that “Russia is a hoax,” e.g., might not be illegal (or even make any sense), but it could be an overt act in furtherance of a conspiracy to obstruct justice.

We know that Trump and his flunkies shared the goal of the conspiracies that have already been charged: to prevent the certification of the vote. Trump (and some of his flunkies) played a key role in one of the manner and means charged in most of the conspiracies: To use social media to recruit as many people as possible to get to DC. Arguably, Mike Flynn played another role, in setting the expectation of insurrection.

What’s currently missing is proof (in court filings, as opposed to the public record) that people conspiring directly with Trump were also conspiring directly with those who stormed the Capitol. But we know the White House had contact with some of the conspirators. We know that organizers like Ali Alexander and Alex Jones likewise had ties to both conspirators and Trump’s flunkies (an Alex Jones producer has already been arrested). We know that Flynn had other ties to QAnon (which is why I’ll be interested if the government ever claims QAnon had some more focused direction with respect to January 6). Most of all, Roger Stone has abundant ties with people already charged in the militia conspiracies, and was at the same location as some of the Oath Keepers before they raced to the Capitol in golf carts to join the mob. If Trump or his flunkies are held accountable, I suspect it will go through conspiracies hatched in Florida, and the overlap right now between the Oath Keeper and Proud Boys conspiracies are in Floridians Kelly Meggs and Joe Biggs. But if they are held accountable, it will take time. It’s hard to remember given the daily flow of new defendants, but complex conspiracies don’t get charged in four months, and it will take some interim arrests and a number of cooperating witnesses to get to the top levels of the January 6 conspirators, if it ever happens.

This post, which is meant to be read in tandem with this one, assesses developments in the last week or so in the Oath Keepers conspiracy case.

Share this entry

The Rudy Giuliani Warrants Likely Go Up To the Andrii Derkach Meeting

/in , , , /by

For a variety of reasons, I’d like to look at the probable scope of the Rudy Giuliani warrants. I believe the warrant obtained on April 21 probably goes up to, but not far beyond, the meeting Rudy had with Andrii Derkach on December 5, 2019.

This post is based in part on what Rudy Giuliani, Victoria Toensing, and Lev Parnas have telegraphed about these warrants. None of these people are reliable, but Rudy and Toensing, at least, are clearly trying to share information with potential co-conspirators and therefore would want to be accurate. And whether or not the redaction fail in Parnas’ letter was intentional, I believe Parnas was trying to maximize the discomfort that these warrants might pose to powerful people (Parnas knows the targets and dates of the warrants, but it’s not clear whether he knows the date ranges). The post also includes claims from the government response to Parnas’ request for access to the Rudy and Toensing content; the government is reliable but still obviously hiding stuff.

Per Parnas, he knows of three warrants targeting Rudy:

  • A November 4, 2019 warrant targeting Rudy’s iCloud and email accounts
  • An April 13, 2021 warrant obtaining historical and prospective cell site information from Rudy (and Toensing)
  • An April 21, 2021 warrant targeting what ended up being 18 devices from Rudy

Here’s what these letters claim about the warrants:

  • The November 4, 2019 warrant “commences when Mayor Giuliani began to represent Donald Trump”
  • The start date of the November 4, 2019 warrant was “the commencement of Giuliani’s representation of former President Donald Trump”
  • Rudy believes the iCloud warrant obtained “communications with, and on behalf of, the sitting President, containing material relating to the impending impeachment”
  • The date range for the April 21, 2021 warrant began “three months later than the iCloud account”
  • The end date for the April 21, 2021 warrant went “56 days” later than the iCloud warrant
  • The warrant required Apple turn over “subscriber and payment information, device information and settings, transactional records, address book information, call history and voicemails, text message content, email content, photos and videos, documents, search and web histories, third-party application data, location date and iOS device backups” (this is boilerplate, but most people don’t understand how comprehensive a cloud warrant, to Apple or Google, can be)
  • The government showed probable cause that the iCloud account included evidence of “22 USC §§612 and 618 [FARA], 18 USC §951 [Foreign Agent], 18 USC §2 [Abetting], and 18 USC §371 [Conspiracy to defraud the US]”
  • Two days after the warrants targeting Rudy and Toensing, SDNY obtained a warrant targeting Yuri Lutsenko; later warrants targeted two other Ukrainians, Roman Nasirov and Alexander Levin
  • The treatment of information pertaining to someone Toensing represents (possibly, but not definitely, Dmitro Firtash) was more limited in her later warrant
  • Parnas believes that some of the information (though he doesn’t specify whether from the November 2019 or the April 2021 search) would include information “that may have been deleted”
  • Parnas believes that the warrants obtained “the communications immediately following the defendants’ arrest” on October 10, 2019
  • The 2019 returns do not contain any evidence relating to Parnas’ campaign finance charges and no non-duplicative statements from Parnas about Fraud Guarantee

Particularly given the way DOJ removed Parnas and Igor Fruman’s influence peddling for Yuri Lutsenko in their September 17, 2020 superseding indictment, it is virtually certain that this investigation involves, at a minimum, the ultimately successful Lutsenko-backed efforts to get Marie Yovanovitch fired in 2019.

This JustSecurity timeline is enormously helpful for reviewing the entanglements between Parnas and Fruman with Lutsenko (as well as the other events that SDNY is likely interested in). Rudy formally became Trump’s lawyer in April 2018, though there were discussions about him (and Toensing and her spouse Joe DiGenova) joining the team in March 2018, after John Dowd quit. Parnas and Fruman made their first pitch to Trump to fire Yovanovitch on April 30, 2018. In May and June, Parnas and Fruman heavily lobbied Pete Sessions to help get Yovanovitch fired. Then in August 2018, Fraud Guarantee hired Rudy. That puts the likely start dates of Rudy’s warrants sometime between March 20 and April 17, 2018 (for the iCloud warrant), and between mid-June and July or August 2018 (for the device warrant).

Depending on how narrowly the investigation is scoped on Yovanovitch, there are three likely end dates for the iCloud warrant: sometime between April 25 and May 6, 2019, when the effort to fire Yovanovitch succeeded, on October 10, when Parnas and Fruman are arrested, or on November 4, or whatever “present” day Apple complied with the warrant (the gag was issued days later so there may have been a delay in obtaining that approval).

I think one of the later dates is far more likely. That’s because Rudy continued to chase the same effort in Ukraine after Yovanovitch was fired. Plus, the most likely explanation for how SDNY was able to get warrants and a non-disclosure order for the November 2019 warrants against Rudy and Toensing is that they had proof, obtained on October 21, 2019, that Parnas had unsuccessfully attempted to delete information from his own iCloud account. And Rudy, who knows the date ranges of the warrant, claims that it obtained information, “containing material relating to the impending impeachment,” which, if true, would entirely rule out a May 6 end date.

Parnas believes the first warrant extended beyond his October 10 arrest. But it’s not entirely clear whether he knows the date range of the warrants. The government response explained they gave him material from him they had been withholding under a non-disclosure order relating to the investigation in which Rudy is a subject (that is, the Lutsenko campaign) on January 28. But in response to Parnas’ request for materials “immediately following” his arrest, the government got coy about whether they exist in the November 2019 returns (the only ones they have reviewed yet).

For similar reasons, the request for communications by Giuliani and Toensing “immediately following the defendants’ arrests” and “subsequent to” Parnas’s provision of information to the House Intelligence Committee are not subject to disclosure. (Def. Letter at 3.) Not only do these communications have nothing to do with the Government’s case-in-chief, but even if Parnas was entitled to discovery relating to his selective prosecution claim—and he plainly is not—these communications would not even be relevant to such a defense because, to the extent they exist, they post-date the defendants’ arrest.

Besides, there’s a more logical reason to expect that the November 2019 warrants ended on the day of Parnas’ arrest, October 10: because that’s consistent with SDNY’s investigation being limited to its original scope and the entirety of the investigation into Andrii Derkach being at EDNY, as NYT reported is the case.

On December 3, 2019, Rudy met in Budapest with Lutsenko. On December 4, he flew to Kyiv to meet with Derkach, the meeting that begins the relationship that EDNY has ownership of.

A 56-day extension on an end date in response to a November 4 warrant would be December 31, a logical end date for a warrant, but one that would encompass the aftermath of the Derkach meeting scoped to EDNY. Whereas a 56-day extension to an October 10 end date would take you to December 5: through the Derkach meeting associated with the Lutsenko one, but not any further.

That would also be inclusive of communications relating to the pending impeachment (which Rudy says would have been included in the iCloud return), but would be more protective of Rudy’s conversations with Trump as impeachment drew nearer.

Share this entry

Lev Parnas Failed to Delete His iCloud Content Just before DOJ Got a Secret Warrant for Rudy Giuliani’s iCloud Content

/9 Comments/in , , , /by

The government has known that Lev Parnas attempted to delete some or all of his iCloud content since shortly after October 21, 2019 — 2 weeks before it obtained covert warrants for Rudy Giuliani and Victoria Toensing’s iCloud accounts.

On January 17, 2020 (note the date on the letter has the wrong year) — the same day Jeffrey Rosen issued a memo prohibiting any DOJ personnel from expanding the scope of any investigation involving Ukraine without his and Richard Donoghue’s approval — Parnas asked to modify his protective order so he could share materials seized from his iCloud on that October date with the House Intelligence Committee for their impeachment investigation.

In a memo objecting to that request, the government noted that Parnas was perfectly free to download his own iCloud and share it with HPSCI — and asserted he had already done so.

Additionally, to the extent Parnas seeks to produce his own texts, emails, photographs or other materials, he should have access to the content stored on his iCloud account through other means: he can simply download his own iCloud account and produce it to HPSCI (and in fact, it appears he has already done so)

Parnas needed to ask the government, however, because he had deleted some of the material after the government had already obtained a preservation order for his account, meaning the government had the content but Parnas no longer did.

The materials at issue include records that, as far as the Government knows, were never in Parnas’s possession. For instance, the data produced by Apple includes deleted records (which may only exist because of the Government’s preservation requests), account usage records, and other information to which a subscriber would not necessarily have access.

The government asked for Parnas to identify the previously deleted chats he wanted to share with Congress so his co-defendants could raise privilege concerns.

To the extent that Parnas has deleted materials from his iCloud account, the Government is willing to work with counsel to ensure that Parnas can produce his own materials that are responsive to the Congressional request to HPSCI. To that end, the Government respectfully submits that Parnas’s counsel should identify for the Government any specific chats, emails, photographs, or other content Parnas is unable to access from his iCloud currently, but which exist within the discovery that has been produced to him and in his view are responsive to the Congressional subpoena. Requiring Parnas to specifically identify these materials would also permit his co-defendants to raise any concerns with respect to their privilege or privacy interests prior to the materials’ release.

“Tell us which of these texts you attempted to delete you think are the most incriminating to Rudy,” they effectively invited Parnas to explain back in early 2020, as the filter team would have just started wading through Rudy’s already seized iCloud content.

Parnas’ failed attempt to delete sensitive content that would be pertinent to the impeachment inquiry puts Rudy’s wails of outrage that the government successfully persuaded Judge Paul Oetken that if they didn’t obtain this content covertly, it might get deleted in a very different light.

In addition, in the original warrant for the iCloud account, there is a nondisclosure order based upon an allegation made to the issuing Court, that if Giuliani were informed of the existence of the warrant, he might destroy evidence or intimidate witnesses. Such an allegation, on its face, strains credulity. It is not only false, but extremely damaging to Giuliani’s reputation.

Indeed, DOJ may well have been seeking information that Parnas had successfully deleted elsewhere. Parnas seems to think that’s what happened. In his request to get access to the stuff seized from Rudy’s phone, he states that the newly disclosed materials “likely” include communications involving him “that may have been deleted.”

The seized evidence will also likely contain a number and variety of communications between Giuliani and Toensing and Parnas that are directly discoverable under Fed. R. Crim. P. 16, evidence of any conversations between Giuliani, Toensing, and others, including Parnas, that may have been deleted, communications between Giuliani, Toensing and others about the defendants and how to address their prior relationships, the arrests, and the unfolding investigation, communications between Giuliani and Toensing and others with potential Government witnesses, including communications about the defendants, the offenses charged, and the witnesses’ potential disclosures and characterizations of alleged fraud-loss computations.

Meanwhile, the government made an interesting observation in their original request for a Special Master.

Based on the Government’s investigation to date, given the overlap in date range and because certain materials, including certain emails and text messages, were backed up to the iCloud accounts that were searched pursuant to these prior warrants, the Government expects that some, but not all, of the materials present on the electronic devices seized pursuant to the Warrants could be duplicative of the materials seized and reviewed pursuant to the prior warrants.

After admitting the government expects significant overlap between what they got in 2019 and what they got in April because “certain materials” were backed up to the cloud, the government notes that “not all” of what they expect to be on the devices will be duplicative. Some of the new material will pertain to a slightly different date range on the searches. But another cause would be if Rudy and Toensing deleted stuff that could be obtained from their phone.

The investigative team has gotten deep enough in the iCloud material seized in 2019 to identify files that they know existed but were deleted from the iCloud backup, which might be recoverable from a device.

Rudy, in a “doth protest too much” theme in his letter insists he didn’t delete anything but if he did he wasn’t under subpoena anyway.

Despite these two warnings that the SDNY was seeking permission to apply for a search warrant for his electronic devices and because he had no guilty conscience, Giuliani took no steps to destroy evidence or wipe the electronic devices clean. Since Giuliani was not under subpoena, he had no legal obligation to preserve that evidence, but he did so because he is an innocent man who did nothing wrong.

[snip]

Again, all of this took place without Mayor Giuliani or his counsel having any idea that a year and a half prior, the Giuliani iCloud was the subject of a warrant. Giuliani and his counsel were both aware, because of the prominent leaks to the media, of the failed attempts in November of 2020 and again in January of 2021, to gain the required Justice Department permission to search a lawyer’s office and residence. If Giuliani was inclined, there was ample notice and time to destroy evidence.

Aside from mentioning the basis for the covert warrants, Toensing didn’t address whether any data got destroyed.

Whatever exigent circumstances the Government asserted to instead justify covert and overt search warrants in this instance were satisfied when the information was secured and preserved. The information should now be returned to Ms. Toensing and her counsel for a privilege and responsiveness review under the supervision of a Special Master. Moreover, the Government should disclose what seized information it has already reviewed and whether and what information it has provided to the case team.

She just wants everything back so she can restart the process, along with some kind of indication of what the government has already seen.

Rudy, similarly, wants to know what the government knows.

Lastly, Giuliani is entitled to the production of Apple’s entire search warrant return production, as well as the material previously deemed non-privileged and responsive and relevant to the 2019 Search Warrant by the “filter” team.

But Judge Paul Oetken, who found cause for the non-disclosure order back in 2019, was thoroughly unimpressed with all these claims about whether things might have been deleted. As he noted, the search is done.

Moreover, the review of the 2019 warrant returns is now largely complete. And any pre-indictment suppression motion would be premature at this juncture.

Rudy and Toensing can complain if they get charged.

Share this entry

In [Legal] Defense of the Nazi

/6 Comments/in , /by

The biggest known investigative fuck-up in the January 6 investigation thus far was when the FBI raided the home of Marilyn and Paul Hueper believing that Marilyn was a woman that the FBI suspects, based off surveillance video, may have been part of stealing Nancy Pelosi’s laptop. The Hueper’s claims about their actions on January 6 don’t seem to be entirely forthright, but Marilyn has made a solid case that the FBI mistook her for the woman in question.

I think the FBI did have probable cause for that search, but I also think the FBI did not use available tools — most notably the Google and GeoFence warrants they’ve used in many other cases — that should have been able to exclude Marilyn as the suspect.

I think it likely that DOJ has made an error, of another sort, with Nazi sympathizer Timothy Hale-Cusanelli, detaining him for four months based off a mistaken belief he played a more important role in January 6 violence than he did.

Hale-Cusanelli was arrested on January 15, three days after a co-worker of his, who was already an NCIS informant, alerted the FBI that Hale-Cusanelli took part in the riots and had, in the past, espoused fairly extreme white supremacist views. On January 14, the informant recorded Hale-Cusanelli describing giving hand signals to the mob and taking a flag that Hale-Cusanelli described as a “murder weapon” to destroy.

Hale-Cusanelli’s arrest warrant, which charged him with the misdemeanor trespassing charges everyone gets charged with along with a civil disorder charge, included no video from the day of the attack. When the government indicted him, they added obstruction charges and abetting.

When the FBI arrested Hale-Cusanelli, he admitted in an interview that he gave hand and voice signals — which could be no more than waving people forward — to encourage others to “advance” past cops. But the government’s primary basis to keep him jailed, when they first succeeded in doing so back in January, seems to have been that, once you cut him off from the military network he worked in as a Navy contractor, he was bound to turn to war.

Releasing Defendant from custody will only reinforce his belief that his cause is just. Given his impending debarment from Naval Weapons Station Earle, and his potential Administrative Separation from the U.S. Army Reserve, Defendant’s release will likely leave him with nowhere to go and nothing to do except pursue his fantasy of participating in a civil war. If nothing else, the events of January 6, 2021, have exposed the size and determination of right-wing fringe groups in the United States, and their willingness to place themselves and others in danger to further their political ideology. Releasing Defendant to rejoin their fold and plan their next attack poses a potentially catastrophic risk of danger to the community.

When they made a more substantive (and successful) argument he should remain detained, they focused on two things: his choice of a third party guardian was also an extremist who had helped him try to game reporting from the Navy on his extremism, and his extremism itself, including that he groomed to look like Hitler.

They also argued that Hale-Cusanelli poses a threat to the informant who IDed him.

Hale-Cusanelli is appealing his detention. But both he and his attorney, Jonathan Zucker, are getting fed up. Last week, Zucker submitted a motion asking to be replaced, but also claiming that he has received nothing in discovery about what Hale-Cusanelli did at the Capitol.

The parties were last before the court on May 12, 2021. At that time the defense expressed concern to the court regarding the paucity of discovery in this case. To date the prosecution has disclosed the defendant’s custodial interview, a surreptitiously recorded conversation between the defendant and a cooperating witness who was wearing a recording device provided by law enforcement, two portions of text messages between the defendant and two other civilians. The prosecution has provided nothing else, particularly no evidence regarding what defendant did on January 6 either outside or inside the Capitol. Nor any other evidence regarding the defendant’s activity in relation to the charged offenses. 1

1 Defendant advises that other defendants have disclosed to him that other defendants indicated they received discovery of recordings from inside the Capitol where defendant has been seen peacefully walking in the hallways.

Yesterday, the government responded. AUSA Kathryn Fifield claimed that most of what Zucker had said was not accurate.

The bulk of Defendant’s representations to the Court regarding discovery—both in terms of what they have received and government’s response to their requests—are not accurate. To date, the government has provided the most substantial portions of the government’s evidence. That includes the CHS recordings in which Defendant makes substantial admissions regarding his criminal conduct on January 6, Defendant’s custodial interview in which Defendant makes substantial admissions regarding his criminal conduct on January 6, and a partial extraction of Defendant’s cellular phone. The partial extraction includes the extraction report and the native files, including chats, videos, and photos. Defense counsel has confirmed with the undersigned that they have access to these materials on USAfx. Further, the government separately provided Capitol CCTV video capturing Defendant inside the Capitol building on January 6 and reports of interviews conducted by NCIS. Defense counsel confirmed receipt of these materials with prior government counsel. Thus, Defendant is already in possession of the evidence most relevant to detention proceedings and to Defendant’s conduct on January 6, and has been in receipt of these materials since before the last status hearing on May 12, 2021.

She described how, because of the technical issues that occur every time the government shares large volume electronic files with defense attorneys, Zucker still doesn’t have the full content of Hale-Cusanelli’s phone.

But the accompanying discovery summary in fact seems to confirm what Zucker has said: he has received no or next to no surveillance video of his client in the Capitol, and what he has gotten appears to pertain primarily to a different person he represents (Zucker also represents Jerod Wade Hughes and Thomas Webster, and did represent Dominic Pezzola for a period).

Video recording of custodial interview of Defendant Hale-Cusanelli produced via USAfx on February 22, 2021.

Bulk report of interviews conducted by NCIS produced via email on March 7, 2021.

Report of interview conducted by NCIS of Sergeant John Getz produced via email on March 8, 2021.

Partial extraction of Apple iPhone – includes Cellebrite Extraction Report (PDF 1209 pages) and native files most relevant to Defendant’s detention proceedings and conduct on January 6, 2021. Produced via USAfx on March 11, 2021.

Capitol Surveillance CCTV produced via USAfx in connection with another defendant represented by defense counsel on March 31, 2021. Upon information and belief, you confirmed receipt of this video with prior government counsel. Reproduced in the USAfx folder for this case on May 25, 2021. The Government has designated these files Highly Sensitive under the Protective Order issued in this case.

CHS video and audio recordings produced via USAfx on May 7, 2021. The Government has designated these files Sensitive under the Protective Order issued in this case. Cellebrite Extraction Report (PDF 63073 pgs): iPhone 6s (A1633), MSISDN 7328105132, ISMI 310120163205040. Produced via USAfx on May 7, 2021.

Full extraction of Defendant’s Apple iPhone produced on encrypted zip drive on or about April 28, 2021, on Blu Ray discs on or about April 28, 2021, and on defense counsel’s hard drive on or about May 25, 2021.

One of the main images in an earlier detention memo from inside the Capitol is indexed to Pezzola, so that may be the discovery in question.

This guy has absolutely loathsome views. But they are views protected by the First Amendment — and also views shared by a goodly percentage of the other January 6 defendants, many of them out on personal recognizance. The others who, like Hale-Cusanelli, were of particular concern to the government because they held clearance on January 6 also engaged in physical assault — and Freddie Klein was released even after that. As I noted, the government spent two months confirming details of active duty Marine, Major Christopher Warnagiris’ far more important conduct from the day before arresting him, and then let him out on personal recognizance.

While the government has provided evidence that he did intend to obstruct the vote count, nothing in his conduct from the day substantiates the civil disorder challenge. Yesterday, Fifield asked for two more months to find that evidence.

This seems like a mistake that the government is simply doubling down on. But if you haven’t found more compelling evidence after four months, what are the chances you will?

Share this entry

The Manafort Unsealing and Konstantin Kilimnik

/3 Comments/in , , /by

Earlier this week, the court unsealed the filings in Paul Manafort’s case pertaining to his breach determination. I’ve put most of the filings below.

Much of what has been unsealed is not new. Because Manafort’s attorneys failed to actually redact their first response, the five topics about which the government claimed he lied were clear from early on, which made sussing out the rest possible. As one example, here’s a post from close to the end of the process that laid out a lot of what we knew and did not know.

That said, in part because of some big gaps in the Manafort docket, and in part because of the government’s increasing outspokenness about Konstantin Kilimnik, I want to lay out what has been released in significant fashion and what hasn’t.

When the WaPo first asked for this material, the government said no because of “ongoing investigations” and the privacy of uncharged people. When the parties came up with proposed redactions in July 2020, per a subsequently filed ABJ order, the redactions served to hide grand jury information and uncharged individuals; that is, the ongoing investigations were done. Then the WaPo pointed out several things that might be grand jury information, but should be released anyway, including people who have since been charged, including Greg Craig and Roger Stone by name, and grand jury information made public by Mueller.

Petitioner recognizes that grand jury proceedings are confidential under Rule 6(e) but asserts that “at least some” of the grand jury material in this matter should be unsealed because it has become public. Supp. Mem. at 12–13 (noting particularly the inadvertent disclosure of allegations that the defendant transferred presidential campaign polling data to Konstantin Kilimnik in the summer of 2016); see also Reply at 11 (noting certain information was made public in the March 2019 report of Special Counsel Robert Mueller). Petitioner also asserts that some of the individuals whose names and information were sealed in the court documents because they were not charged with any crimes had since been indicted. See Reply at 1 & n.2 (noting the indictments of Roger Stone and Gregory Craig).

Upon consideration of the parties’ arguments, the joint submission of the government and defendant Manafort, the applicable law, and the privacy interests of individuals who have not been charged, the Court finds that some of the information sought by petitioner may be unsealed but that some must remain sealed to protect grand jury materials and the identities or identifying information of uncharged individuals.

That’s what should be unsealed: people who have not been charged or stuff that’s not grand jury information.

As you can see below, virtually the only area where significantly new information was provided pertained to Manafort’s relationship with Kilimnik, starting with the August 2, 2016 meeting and extending for two years. That makes the delay in release (which admittedly could be COVID related) of particular interest: in that time, FBI released a wanted poster for Kilimnik with a $250,000 reward, and then Treasury stated as fact, just weeks before this release, that Kilimnik had, indeed, shared polling data and campaign strategy with Russian intelligence officers. In addition, as shown below, there are big unexplained gaps in the numbering of the docket, suggesting sealed filings (I had thought it related to the forfeiture, and it still might, but most of that was moved to a different docket).

FBI Agent Jeffrey Weiland’s declaration (here’s the original), laying out the five matters about which Manafort lied, is the best way to track what kinds of things have been unsealed or not. Here are the five topics about which Manafort lied, with a summary of what got newly unsealed in each:

Payment to Wilmer Hale: Manafort engaged in some kind of dodgy accounting to get money to pay his lawyers, who represented Manafort until August 2017. The investigation into this allegation was unsealed (along with other investigations that had been dropped) by September 2020. About the only thing that is newly released in all this is that Wilmer Hale was the firm in question, which would seem to be either an uncharged corporate entity or grand jury information that got publicly released.

Manafort’s efforts to protect Konstantin Kilimnik in the witness tampering conspiracy: In 2018, Kilimnik and Manafort were charged for conspiring to hide aspects of their Hapsburg project by trying to coach witnesses. The names of those former Hapsburg project associates, Alan Friedman and Eckart Sager, were redacted in the original and remain redacted.

Interactions with Kilimnik: In addition to trying to downplay Kilimnik’s role in the witness tampering conspiracy, Manafort was not forthcoming about the August 2, 2016 meeting with Kilimnik (though by the end of the breach agreement, Manafort had proven that prosecutors had misunderstood what happened with a printout of polling data that day), and he blatantly lied about their ongoing meetings about a Ukraine “peace” deal. This is where the most new material was released.

Some of this was already released in the Mueller Report. But there are passages that include information beyond the Mueller Report, both in Rick Gates filings (which also were released to BuzzFeed), or — for example — in this passage from a Manafort filing.

The OSC contends that Mr. Manafort lied about his meeting with Mr. Kilimnik and [redacted: probably Georgiy Oganov] January 2017. (Doc. 464 at 14-15, ¶33-35). In particular, the OSC alleges that in one interview Mr. Manafort stated [redacted] did not present a plan for peace at the meeting or ask Mr. Manafort for anything and, subsequently, Mr. Manafort said that he discussed a peace plan during the meeting. Contrary to the OSC’s allegations, these statements are not inconsistent. First, during the interview, Mr. Manafort noted that while [redacted] did not present a peace plan or ask for anything, they did discuss Ukraine, in general, and Eastern Ukraine and Crimea, in particular.

Kilimnik has been charged. But not — as far as is public — for this stuff.

Another DOJ investigation: Little new is unredacted in a passage that describes the investigation in another district that Manafort first told a damning story to, and then reneged on that story: but what is unredacted is actually key. First, a footnote that must modify the overview section links to Michael Cohen’s Criminal Information. Given the timing, the issue in question is probably the effort to buy off Karen McDougal. Another filing describes that the information implicated Senior Administration Officials, which would seem to rule out Don Jr or Cohen himself, so must implicate Trump himself and, likely, Kushner. (I’ll return to this, because other discussions of this implicate a Roger Stone email to Manafort.)

Manafort’s Contact with the Administration: This section also remains largely the same with one big exception: it describes that some lobbying he was helping people do targeted Department of Labor and pertained to ERISA. That contact has nothing to do with Igor Fruman (with whom Manafort does have ties) and Lev Parnas, who were beginning to sidle up to Trump in this period. ABJ ruled that the government hadn’t proven their case on this point, and the ERISA focus sure helps make that case.

Documents

Exhibit 1. Government’s Submission in Support of its Breach Determination: 461 (675)

Exhibit 2. Defendant Paul J. Manafort Jr.’s Response to the Special Counsel’s Submission in Support of its Breach Determination: 470 (676)

Exhibit 3. Weiland Declaration in Support of the Government’s Breach Determination and Sentencing: 477 (677)

Exhibit 4. Defendant Paul J. Manafort, Jr.’s Reply to the Special Counsel’s Declaration and Exhibits in Support of its Breach Determination: 481 (678)

Exhibit 5. Transcript of Sealed Hearing Hld before Judge Amy Berman Jackson on 2/4/2019

Exhibit 6. Defendant Paul J. Manafort, Jr.’s Post Hearing Memorandum: 502 (679)

Exhibit 7. Government’s Supplement to the Record in Response to Defendant Manafort’s Post Hearing Memorandum: 507 (680)

Exhibit 8. Transcript of Sealed Hearing Held Before Judge Amy Berman Jackson on 2/13/2019

Exhibit 9. Government’s Sentencing Memorandum: 528 (681)

Exhibit 10. Government’s Supplemental Memorandum with Respect to the Court’s February 13, 2019 Ruling: 533/537 (682)

Exhibit 11. Defendant Paul J. Manafort’s Reply and Motion to Reconsider Based on the Special Counsel’s Supplemental Memorandum With Respect to the Court’s February 13, 2019 Ruling: 538 (683)

Exhibit 12. Minute Order on March 1, 2019

The Manafort docket is here and the docket for the WaPo effort that liberated the files is here.

Timeline

March 7, 2019: WaPo moves to release the documents

March 13, 2019: Manafort sentencing

March 19, 2019: Michael Dreeben, still on the Mueller team, moves for a short extension until the release of the Mueller Report

March 25, 2019: Post-sentencing DC USAO replaces Mueller team with Deborah Curtis, Zia Faruqui, Jonathan Kravis

March 27, 2019: DC USAO, having inherited the case, moves for another short extension

April 15, 2019: Jonathan Kravis opposes an immediate unsealed, in part on account of “ongoing investigations,” and asks for an abeyance until October 15, 2019

December 6, 2020: ABJ orders Manafort and the government to see whether documents can be unsealed

January 5, 2020: Kravis asks for a 60-day deadline to review the documents

February 11, 2020: In response to Barr’s interference in Stone case, Kravis and all other Stone prosecutors quit

March 3, 2020: Molly Gaston takes over and submits a joint motion for a further 60 day delay

April 28, 2020: Citing COVID, parties submit joint motion for further 30 day delay

June 2, 202: Parties submit joint motion for further 30 day delay

June 23, 2020: FBI releases Wanted poster for Konstantin Kilimnik offering $250,000 for his arrest

July 20, 2020: Parties submit sealed redactions, asking to keep “information from grand jury proceedings protected by Federal Rule of Criminal Procedure 6(e) or [that is] is necessary to protect the privacy interests of certain individuals” sealed

August 19, 2020: FBI releases second package of Kilimnik wanted materials

October 13, 2020: DC USAO replaces Zia Faruqui after he becomes a magistrate judge, with Arvind Lal

April 15, 2021: Treasury states as fact that Kilimnik shared polling data and campaign strategy with Russian intelligence

May 21, 2021: ABJ orders release, protecting only grand jury information and identities that have not been charged

Share this entry

“Purge:” Gordon Sondland Probably Just Won Himself Another Subpoena

/36 Comments/in , , , /by

Since we’re talking about people avenging themselves for being targeted by Trump’s corruption, I wanted to look the lawsuit Gordon Sondland filed the other day against the State Department and/or Mike Pompeo in his private capacity. Sondland says that Pompeo promised to reimburse what has amounted to $1.8 million in legal fees for testifying in Trump’s first impeachment, but that Pompeo reneged on that promise. So the suit is explicitly about getting reimbursed.

Maybe the lawsuit will work, as he ostensibly intends, or maybe the government will declare immunity.

But there are several details of his suit that will — and probably were designed (especially in the wake of the news that Rudy Giuliani had his devices seized) to win Sondland an invitation to testify in SDNY, which may have the effect of expanding their existing investigation into Rudy into the cover-up.

First, Sondland says that Pompeo promised to reimburse his legal fees twice. And while Sondland describes others besides Pompeo at State who knew about it, the promise itself was made orally.

On October 16, 2019, Pompeo again reaffirmed that the Indemnity Undertaking was made with his knowledge and approval. Ambassador Sondland spoke with Pompeo via conference call from the Washington, D.C. office of his Private Counsel, who were also in attendance and listening on speakerphone. Pompeo promised without any qualification that the State Department would reimburse Ambassador Sondland the fees and costs of Private Counsel in full. Ambassador Sondland and his Private Counsel understood Pompeo to be stating that he had the authority to bind the Government to such an agreement. Ambassador Sondland relied on Pompeo’s promise and reasonably believed that he had the authority to bind the Government to such an agreement. The Under Secretary for Management and the Counselor to the Secretary of State also confirmed that Ambassador Sondland would be reimbursed in full.

I find it remarkable Pompeo would commit State without putting something in writing, and find it just as remarkable that a successful businessman like Sondland wouldn’t insist on having it in writing. Unless there was an understanding they would not put it in writing.

Sondland describes being “purged” after he testified truthfully, something that will help him make the case the decision not to reimburse him was political retaliation.

During the meeting with the Counselor to the Department of State, Ambassador Sondland stated that he had no intention of leaving his position in the near future. Instead, Ambassador Sondland mentioned that he might consider stepping down in the summer of 2020 to return to lead his businesses, and he wanted to give his colleagues notice to permit a proper transition. In response, he was advised that while the Administration appreciated his testimony, the Administration wanted to purge everyone remotely connected to the Impeachment trial. Accordingly, the Counselor to the Department of State asked for Ambassador Sondland’s resignation. In response, Ambassador Sondland said he would consider that proposal, but asked about his attorneys’ fees. The Counselor to the Department of State told Ambassador Sondland to speak with the Under Secretary for Management, who would take care of his attorneys’ fees. Later that day, Ambassador Sondland confirmed he would not resign because he did not do anything improper. After that, everything changed. Ambassador Sondland did not receive his attorneys’ fees, notwithstanding the promises from the State Department that the attorneys’ fees would be paid.

Sondland describes that he didn’t have access to any of the underlying materials to help prepare, which will at the very least help him explain his first, less-truthful testimony.

As Ambassador Sondland prepared for a second round of testimony, the Department of State continued to restrict Ambassador Sondland’s access to materials essential to his preparation

But it will also support a inference that he was asked to participate in a cover-up of what really happened.

Then there are details that Sondland didn’t necessarily need to include, such as when and how he learned about the whistleblower complaint and how he met with Kurt Volker and Pompeo to discuss the complaint.

22. On September 25, 2019, Ambassador Sondland and Pompeo attended the eighteenth annual Transatlantic Dinner. Ambassador Sondland was the only U.S. ambassador in attendance, which hosted the NATO Secretary General, the EU High Representative for Foreign and Security Policy, and foreign ministers from Europe and Canada. During the dinner, Ambassador Sondland received an urgent phone call from The White House alerting him that his name appeared in a whistleblower complaint received by the Office of the White House Counsel.

23. The following day, September 26, 2019, Ambassador Sondland and Pompeo met to discuss the whistleblower complaint with Ambassador Kurt Volker, United States Special Representative for Ukraine.

When Rudy complained about having his phone seized, he said that he was just cooperating in State Department investigations. Now, a former State Department participant has let it be known that State really didn’t want the full story of what happened to come out.

I’d say SDNY will find it hard to pass up that testimony.

Share this entry

Steve Bannon’s Mueller and Mueller Aftermath Interviews, with Backup

/in /by

Given the release of the backup materials to several Steve Bannon interviews in the BuzzFeed FOIA, I wanted to pull together the known interviews Steve Bannon did as part of the Mueller investigation and its aftermath. I’ve discussed Bannon’s interviews and grand jury appearance here and here; I discussed how White House scripted his HPSCI testimony — specifically to deny discussion sanctions — here. I did a similar post pulling together Mike Flynn’s interviews here.

Bannon’s Mueller-related materials have been released in waves, all in ways that (I suspect) were designed to keep as much of his testimony as possible hidden for as long as possible. His first interview on February 12, 2018, which pertains to Mike Flynn-related events and obstruction generally, was released in February 2020, as Flynn’s prosecution was blowing up. His second interview, on February 14, 2018, was released in three releases. DOJ released it with a bunch of other Stone-related interviews just before the rat-fucker’s trial started in November 2019, thereby hiding much of those interviews under the pre-trial gag (though this release did include back-up). Then, five pages were released in March 2020, effectively withholding under a DOD deliberative exemption stuff that had earlier been withheld under a referral/consult withholding. Finally, six pages originally withheld under the Stone trial gag were re-released in June 2020, after Billy Barr had blown up that prosecution. Bannon’s third known interview, on October 26, 2018, was released among the last batches, on October 1, 2020. A four-page interview that occurred before Bannon’s January 18, 2019 grand jury appearance has never been released, but the proffer for it was released on December 2, 2019, after it had been revealed at trial. Bannon had at least one more interview before Stone’s trial (I suspect on July 26, 2019) that has likewise never been released; but we know he reverted to his lies again in it. Early this month, DOJ released backup relating to the first and third interview.

January 16, 2018: HPSCI Interview [link]

February 12, 2018: Flynn’s December 29, 2016 calls and aftermath, Trump’s anger with Flynn

[first release]

[210802 release]

Attendees: James Quarles, Michael Dreeben, Andrew Goldstein, Elizabeth Prelogar

Entered: June 13, 2018

Topics:

  • How the transition worked, including Bannon’s role in foreign policy and the choice of Secretary of State
  • Bannon’s views on Russian outreach and Russian investigation
  • Problems with Mike Flynn and KT McFarland
  • The trip to Mar-a-Lago
  • The initial ICA briefing and the Steele dossier
  • Bannon’s claims about when he first learned about sanctions discussion
  • Sally Yates’ meeting
  • Discussions of Flynn’s firing
  • Shinzo Abe visit
  • Bannon’s efforts to get on the NSC
  • Trump’s dinner with Comey and the Yates notification
  • Details of Burr sharing details about the Senate investigation
  • Comey’s May 3 SJC testimony
  • Bannon’s relationship with Kushner
  • Bannon’s (lack of) role in firing Comey
  • Kislyak/Lavrov meeting
  • Lestor Holt interview

Backup:

  • 12/29/16 Russian Hacking Obama email
  • 12/30/16 email referring back to 12/29/16 meeting
  • 12/31/16 Bannon email giving McFarland an “attagirl”
  • 12/29/16 Transition statement on sanctions
  • 2/13/2017 Daily caller interview
  • Possibly article on Trump ordering IC heads to lie
  • Document including claim that, “During transition you had an IT guy do email search of trump servers and discovered Jared met with Anbang and Qataris to raise money for 666 Fifth. You viewed the email that connected the dots. Those meetings left Jared exposed to Comey.”
  • Document claiming that firing Comey was Kushner’s idea
  • Talking points on firing Comey
  • Email inquiry from reporter saying, “I hear DJT is pissed at Jared. POTUS has told people he blames Jared for Comey and Manafort.”

February 14, 2018: Trump’s views on Russian coverage, Sessions’ recusal, Trump’s request of Don McGahn, Prince’s relationship with Bannon, his purported silence about Dmitriev, Bannon’s deleted messages

[201102 First release]

[200302 release with DOD reprocessing 23-27]

[200630 Post-Stone declassification release 31-36]

[210802 Post Trump decassification release]

Attendees: Quarles, Dreeben, Goldstein, Zelinsky, Prelogar.

Entered: June 26, 2018

Topics:

  • Sessions recusal
  • Comey’s purported conflicts
  • Response to disclosure of June 9 meeting
  • Early relationship with Trump
  • Debate prep
  • Erik Prince
  • George Nader
  • How he met Stone

Backup:

February 15, 2018: Second HPSCI Interview [link]

October 26, 2018: Prince and Dmitriev, Mueller’s alleged conflicts [link]

[210802 second release]

Attendees: James Quarles, Jeannie Rhee, Andrew Goldstein, Aaron Zelinsky, Zainab Ahmad (second half)

Entered: June 29, 2019

Topics:

  • Stone’s boasts about Julian Assange
  • October 4, 2016 press conference (b7A)
  • Stone as Trump whisperer (b7A)
  • What Stone claimed Assange had (b7A)
  • Bannon’s conversation with Stone on October 4, 2016 (b7A)
  • Several people on the campaign Bannon claimed not to remember (b7A)
  • Andrea Preate’s presence at Trump Tower on October 7, 2016 (relevant to her text to Stone, “well done”
  • Stone’s efforts to get donors
  • 2 b7A paragraphs
  • Jerome Corsi
  • 2010 conversation with Trump about running for President where Stone came up
  • Meeting with Stone in early December 2016 that Trump didn’t want to have
  • Someone Bannon fired from Breitbart (probably one character too short to be Lee Stranahan, possibly Chuck Johnson)
  • Several b7A topics, including email referencing Polish prime minister
  • 6 paragraphs b5
  • Bannon’s surprise about Flynn and his concern that he would be investigated for FARA
  • Bannon’s claim not to remember meeting with Prince in January 2017
  • September 8, 2016 text from Prince
  • Business card from Russian who wanted to meet Trump (probably Dmitriev)
  • Bannon read Prince’s testimony to HPSCI, thought he should have hired a lawyer
  • Bannon again denies he and Prince discussed the Dmitriev meeting
  • b5
  • Bannon denies deleting his texts with Prince from his blackberry
  • Bannon met with Foresman through Mark Burnett
  • Bannon’s phone guy in LA
  • Discussion of conflicts of interest
  • 2 b5
  • Bannon mocking the claim Mueller had conflicts
  • Bannon claims it was not an effort to get rid of Mueller
  • 7b5
  • Bannon denies discussing with Jared Kushner injecting money into the campaign (the $10 million bribe from Egypt)
  • Bannon claims all his messages prior to February 23, 2017 were deleted
  • Chuck Johnson and Wesearchr (b7A, not first reference to Johnson), including reference to Stone

Backup:

January 19, 2019: Discussions of WikiLeaks [link to proffer]

Attendees [from trial testimony]: Andrew Goldstein

Unknown date (likely July 26, 2019), pre-Stone trial

November 8, 2019: Stone Trial Testimony [link]

Prosecutor: Michael Marando

Topics:

  • Stone’s claims of relationship with WikiLeaks
  • Private conversations before Bannon joined the campaign
  • Relationship with Erik Prince, Ted Malloch
  • Roger Stone was access point to WikiLeaks

Exhibits:

Share this entry

You Cannot Discuss Disinformation and the Steele Dossier without Discussing Oleg Deripaska

/21 Comments/in , , /by

The New York Times’ Barry Meier is the latest person to become part of the disinformation project associated with the Steele dossier, while claiming to critique it.

Before I explain why, let me lay out some very basic facts about the Steele dossier about which anyone deigning to comment on it at this point should be expected to exhibit basic awareness.

It is a fact that, starting in 2014 and continuing at least through at least February 2017, Christopher Steele used his relationship with DOJ’s Organized Crime expert, Bruce Ohr, to encourage ties between Oleg Deripaska and the US government. That included brokering a meeting between Ohr and Deripaska in 2015, and several communications in 2016 before Fusion GPS hired Christopher Steele to investigate Trump. It included Steele’s meeting with Ohr on July 30, 2016, at which Steele provided Ohr information on Russian doping, details from his reporting for the DNC, and news about Deripaska’s lawsuit against Paul Manafort. On December 7, 2016 — the day before Deripaska associate Konstantin Kilimnik would renew his pitch to Paul Manafort on a plan to carve up Ukraine — Ohr even suggested that Deripaska would be a useful source to reveal Manafort and Trump’s corruption. Just as Steele was working with the DNC via an attorney client, Steele was working with Deripaska via one or more attorney client. Like Manafort, Steele was under financial pressure in this period, and so was eager to keep Deripaska’s attorneys as a client. This post and this post provide a summary of their exchanges over that year.

It is a fact that Steele’s primary subsource, Igor Danchenko, described that in March 2016, Steele tasked Danchenko to find out what he could learn about Paul Manafort’s corruption and his ties to Ukraine (though Danchenko had little success). When asked about the client for this work, Danchenko, “had no inclinations as to why, or for whom, Steele was asking about Manafort.”

It is a fact that the DOJ Inspector General Report on Carter Page provided evidence to suggest an associate of Oleg Deripaska — and so we should assume Oleg Deripaska himself — learned of Steele’s dossier on Donald Trump by early July 2016, which would have been after just the first report had been completed.

Ohr told the OIG that, based on information that Steele told him about Russian Oligarch 1, such as when Russian Oligarch 1 would be visiting the United States or applying for a visa, and based on Steele at times seeming to be speaking on Russian Oligarch l’s behalf, Ohr said he had the impression that Russian Oligarch 1 was a client of Steele. 210 We asked Steele about whether he had a relationship with Russian Oligarch 1. Steele stated that he did not have a relationship and indicated that he had met Russian Oligarch 1 one time. He explained that he worked for Russian Oligarch l’s attorney on litigation matters that involved Russian Oligarch 1 but that he could not provide “specifics” about them for confidentiality reasons. Steele stated that Russian Oligarch 1 had no influence on the substance of his election reporting and no contact with any of his sources. He also stated that he was not aware of any information indicating that Russian Oligarch 1 knew of his investigation relating to the 2016 U.S. elections. 211

210 As we discuss in Chapter Six, members of the Crossfire Hurricane team were unaware of Steele’s connections to Russian Oligarch 1. [redacted]

211 Sensitive source reporting from June 2017 indicated that a [person affiliated] to Russian Oligarch 1 was [possibly aware] of Steele’s election investigation as of early July 2016.

This means that Deripaska’s associate probably learned of the dossier project before Steele met with Ohr on July 30 to share — along with information on Russian doping — information about Deripaska’s lawsuit against Manafort and the first tidbits from Steele’s dossier reporting.

It is a fact that in the same month, early June 2017, that the Intelligence Community found evidence that an Oleg Deripaska associate had learned of the dossier project, the Intelligence Community found evidence that two people with ties to Russian intelligence learned of the dossier project.

According to the Supervisory Intel Analyst, the cause for the discrepancies between the election reporting and explanations later provided to the FBI by Steele’s Primary Sub-source and sub-sources about the reporting was difficult to discern and could be attributed to a number of factors. These included miscommunications between Steele and the Primary Sub-source, exaggerations or misrepresentations by Steele about the information he obtained, or misrepresentations by the Primary Sub-source and/or sub-sources when questioned by the FBI about the information they conveyed to Steele or the Primary Sub-source. 342

342 In late January 2017, a member of the Crossfire Hurricane team received information [redacted] that RIS [may have targeted Orbis; redacted] and research all publicly available information about it. [redacted] However, an early June 2017 USIC report indicated that two persons affiliated with RIS were aware of Steele’s election investigation in early [sic] 2016. The Supervisory Intel Analyst told us he was aware of these reports, but that he had no information as of June 2017 that Steele’s election reporting source network had been penetrated or compromised.

The Intelligence Community has identified two associates of Deripaska — Konstantin Kilimnik and Victor Boyarkin (through both of whom Manafort’s reports on the Trump campaign were funneled) — who have ties to Russian intelligence, so it’s possible that this early June 2017 intelligence is actually the same report, showing that a Manafort associate who had ties to Russian intelligence had learned of the dossier.

It is also a fact that Natalia Veselnitskaya, who because she was also a Fusion GPS client, was by far the most likely person to learn of a project conducted by Fusion GPS (possibly through Ed Baumgartner, who was working both the Fusion project with Veselnitskaya and the one with the DNC), also has ties to Russian intelligence.

It is a fact that when DOJ’s Inspector General entertained with the Crossfire Hurricane team the possibility that the Steele dossier had been injected with disinformation, DOJ IG envisioned Oleg Deripaska running that effort.

Priestap told us that the FBI “didn’t have any indication whatsoever” by May 2017 that the Russians were running a disinformation campaign through the Steele election reporting. Priestap explained, however, that if the Russians, in fact, were attempting to funnel disinformation through Steele to the FBI using Russian Oligarch 1, he did not understand the goal. Priestap told us that

what he has tried to explain to anybody who will listen is if that’s the theory [that Russian Oligarch 1 ran a disinformation campaign through [Steele] to the FBI], then I’m struggling with what the goal was. So, because, obviously, what [Steele] reported was not helpful, you could argue, to then [candidate] Trump. And if you guys recall, nobody thought then candidate Trump was going to win the election. Why the Russians, and [Russian Oligarch 1] is supposed to be close, very close to the Kremlin, why the Russians would try to denigrate an opponent that the intel community later said they were in favor of who didn’t really have a chance at winning, I’m struggling, with, when you know the Russians, and this I know from my Intelligence Community work: they favored Trump, they’re trying to denigrate Clinton, and they wanted to sow chaos. I don’t know why you’d run a disinformation campaign to denigrate Trump on the side. [brackets original]

I have laid out the evidence that Oleg Deripaska was playing both sides in 2016, taking steps to make Manafort more vulnerable legally and financially even as his deputy Kilimnik was using Manafort’s vulnerability to swap campaign information for a plan to carve up Ukraine and financial salvation. The same post shows how every single report in the dossier could serve key Russian purposes, both associated with the 2016 operation and more generally (though I’m not arguing the entire dossier was disinformation). If the dossier was disinformation, it would taint a great number of anti-Russian experts, from Steele to the FBI to others in the US government.

If you’re going to write about the Steele dossier at all in 2021, you should exhibit some familiarity with these facts. All the more so if you’re going to talk about whether it was disinformation.

But NYT’s Barry Meier doesn’t do that. Last week, Meier published an excerpt from his book on private intelligence services. The entire excerpt uses the Steele dossier as the exemplar of what can go wrong when private intelligence services sell information collection to clients and also share that information with journalists. I don’t disagree that the dossier was a shit-show, but then I’ve been warning about that for four years now.

As part of Meier’s proof of the shoddy product in the dossier, Meier astoundingly quotes Natalia Veselnitskaya, without clearly explaining that when he says Veselnitskaya “worked alongside” Glenn Simpson, he meant she thought highly enough of his services to employ him.

Over dinner in Moscow in 2019, Natalia Veselnitskaya, a Russian lawyer who met with Donald Trump Jr. at Trump Tower during the 2016 campaign, offered her take on the matter. Ms. Veselnitskaya had worked alongside Mr. Simpson when she represented a Russian-owned real estate firm called Prevezon Holdings and said she regarded him as a skilled investigator. As for Mr. Steele and the dossier, she had nothing but contempt.

“If you take this fake stuff for real, then you just have to be brave enough to believe, to completely dismiss all your special services, all your intelligence staff,” she said rapidly through an interpreter. She suggested how odd it was that all those people and agencies “were never able to find out what that talented person found out without ever leaving his room.”

Ms. Veselnitskaya was embroiled in her own legal drama. The Justice Department had indicted her in connection with her work for Prevezon, a charge she denied. Still, she raised an issue that reporters who embraced the dossier had blown past: How did Christopher Steele know more about Donald Trump and Russia than the C.I.A. or MI6?

One basic piece of evidence that the dossier had been compromised was that neither Simpson nor Steele ever figured out Veselnitskaya had floated a quid pro quo directly to Trump’s son — sanctions relief for dirt — with Manafort in attendance. But Meier apparently doesn’t think that Veselnitskaya was the proof that she said Steele missed. That is, he apparently doesn’t even understand — perhaps because he knows so little about what the Mueller investigation actually revealed? — that he’s being trolled by Veselnitskaya and that troll is offered up as proof that Christopher Steele is uniquely vulnerable to getting fooled by spooked up Russians.

That’s Meier’s one piece of primary evidence against the dossier. Otherwise, Meier explains, investigative journalists like himself rely on primary sources.

Investigative journalists normally rely on court records, corporate documents and other tangible pieces of evidence.

But he recites the kind of understanding of Igor Danchenko you’d get from reading right wing propaganda about him, rather than the Danchenko’s interview itself which showed ways that the DOJ IG Report did not faithfully report on the Danchenko interview (and indeed, had to make a significant correction), or, frankly, all the other problems with the DOJ IG Report.

Meier relies on a series that Erik Wemple did, for which he says, “most journalists [Wemple] contacted either defended their work or ignored his inquiries.” Meier doesn’t mention that not only did I not ignore Wemple, but I told him (twice, I think, both for an early inquiry about Chuck Ross’ reporting on the dossier and for his later series) that to the extent the dossier was disinformation, Ross and Wemple had become part of that effort. That is, Meier may not know, but Wemple himself is guilty of what Meier accuses others of, ignoring inconvenient details that undermine his narrative.

Craziest still, Meier relies on the claims of Matt Taibbi, who has harbored outright conspiracy theories about 2016, and whose own “reporting” on the Russian investigation consistently relies on, and usually misrepresents, secondary sources rather than the primary texts.

In an article for Rolling Stone, Matt Taibbi cast the media’s handling of the dossier as a replay of a press disaster: the reporting before the Persian Gulf war, which claimed that Saddam Hussein had weapons of mass destruction. “The W.M.D. affair showed what happened when we don’t require sources to show us evidence, when we let political actors use the press to ‘confirm’ their own assertions,” Mr. Taibbi wrote. “Are we never going to own up to this one?”

On its own, Meier’s piece is a performance of the problems he complains about: relying on unreliable sources and apparent ignorance of the public record.

But it gets crazier still once you consider the response Glenn Simpson and Peter Fritsch posted to Meier’s work. Along with pointing to some inaccuracies in Meier’s attacks on them and some disclosures Meier should have made, they reveal that Fusion GPS played a bit part in the August 2016 NYT story on Manafort that led to his ouster from the Trump campaign.

By the time of the Democratic National Convention in July, we had been researching Trump for some 10 months — work that began for Republicans and was later continued for Democrats. On July 25, 2016, we met on the sidelines of the convention in Philadelphia with two ofthe Times’ top editors, Dean Baquet and Matt Purdy, to share information about our Trump-Russia research.

Among the topics we discussed was Paul Manafort’s prior work for Ukrainians backed by Putin. The next day, at Purdy’s request, we sent the Times a pile of public record documents that supported a conclusion that Manafort was in a compromised position in relation to Moscow, including records that showed he owed millions of dollars to Deripaska.

Purdy connected us with two of his top reporters. Barry Meier was also assigned to the story. He was having a hard time locating the Virginia court records we’d mentioned to Purdy and Baquet and reached out to Simpson and a colleague for help.

Fusion helped Meier find the records, and they featured prominently in the Times story published two weeks later, proving a vital link connecting Manafort and Deripaska:

After that story, Meier even went back to Fusion for any information they had on Deripaska.

The most important takeaway from the dossier is the way it served as a tool in Oleg Deripaska’s two-sided game that turned Paul Manafort into an easy target. And it turns out that way back in 2016, Meier (and Fusion, in yet another undisclosed way) was part of this two-sided game.

Update: The partially sealed documents in Manafort’s docket are being released today. This Rick Gates 302 shows how closely the August 2 meeting tied Deripaska’s efforts to increase Manafort’s legal and financial woes — the lawsuit — with the delivery of detailed information about how to win the campaign.

Share this entry
Snowden

Insurance File: Glenn Greenwald’s Anger Is of More Use to Vladimir Putin than Edward Snowden’s Freedom

/105 Comments/in , , , , /by

Glenn Greenwald risks making his own anger more valuable to Vladimir Putin than Edward Snowden’s freedom.

When WikiLeaks helped Snowden flee Hong Kong eight years ago, both WikiLeaks and Snowden had the explicit goal of using Snowden’s successful flight from prosecution to entice more leakers.

In his book, Snowden described that Sarah Harrison and Julian Assange’s goal in helping him flee Hong Kong was to provide a counterexample to the draconian sentence of Chelsea Manning.

People have long ascribed selfish motives to Assange’s desire to give me aid, but I believe he was genuinely invested in one thing above all—helping me evade capture. That doing so involved tweaking the US government was just a bonus for him, an ancillary benefit, not the goal. It’s true that Assange can be self-interested and vain, moody, and even bullying—after a sharp disagreement just a month after our first, text-based conversation, I never communicated with him again—but he also sincerely conceives of himself as a fighter in a historic battle for the public’s right to know, a battle he will do anything to win. It’s for this reason that I regard it as too reductive to interpret his assistance as merely an instance of scheming or self-promotion. More important to him, I believe, was the opportunity to establish a counterexample to the case of the organization’s most famous source, US Army Private Chelsea Manning, whose thirty-five-year prison sentence was historically unprecedented and a monstrous deterrent to whistleblowers everywhere. Though I never was, and never would be, a source for Assange, my situation gave him a chance to right a wrong. There was nothing he could have done to save Manning, but he seemed, through Sarah, determined to do everything he could to save me. That said, I was initially wary of Sarah’s involvement. But Laura told me that she was serious, competent, and, most important, independent: one of the few at WikiLeaks who dared to openly disagree with Assange. Despite my caution, I was in a difficult position, and as Hemingway once wrote, the way to make people trustworthy is to trust them.

[snip]

It was only once we’d entered Chinese airspace that I realized I wouldn’t be able to get any rest until I asked Sarah this question explicitly: “Why are you helping me?”

She flattened out her voice, as if trying to tamp down her passions, and told me that she wanted me to have a better outcome. She never said better than what outcome or whose, and I could only take that answer as a sign of her discretion and respect.

It’s not just Snowden’s impression, though, that WikiLeaks intended to make an example of him. The superseding indictment against Assange cites several times when Assange invoked WikiLeaks’ role in Snowden’s successful escape to encourage others (including CIA Systems Administrators like Joshua Schulte, who had a ticket to Mexico when the FBI first interviewed him and seized his passports) to go do what Snowden did. British Judge Vanessa Baraitser even included one of those speeches in paragraphs distinguishing what Assange is accused of from legal journalism. And as early as 2017, public reporting said that WikiLeaks’ assistance to Snowden was what changed how DOJ understood WikiLeaks and why it began to consider prosecuting Assange. It wasn’t Trump that led DOJ to stop treating Assange as a journalist, it was Snowden.

According to Snowden’s own words, he shared WikiLeaks’ goal of setting an example to inspire others. In an email that Snowden must have sent Bart Gellman weeks before the exchange between him and Harrison above, Snowden described steps he took to give other leakers (this may be Gellman’s paraphrase), “hope for a happy ending.”

In the Saturday night email, Snowden spelled it out. He had chosen to risk his freedom, he wrote, but he was not resigned to life in prison or worse. He preferred to set an example for “an entire class of potential whistleblowers” who might follow his lead. Ordinary citizens would not take impossible risks. They had to have some hope for a happy ending.

To effect this, I intend to apply for asylum (preferably somewhere with strong internet and press freedoms, e.g. Iceland, though the strength of the reaction will determine how choosy I can be). Given how tightly the U.S. surveils diplomatic outposts (I should know, I used to work in our U.N. spying shop), I cannot risk this until you have already gone to press, as it would immediately tip our hand. It would also be futile without proof of my claims—they’d have me committed—and I have no desire to provide raw source material to a foreign government. Post publication, the source document and cryptographic signature will allow me to immediately substantiate both the truth of my claim and the danger I am in without having to give anything up. . . . Give me the bottom line: when do you expect to go to print?

Citizenfour also quotes Snowden describing how he hoped that proof that his “methods work[]” would encourage others to leak.

If all ends well, perhaps the demonstration that our methods worked will embolden more to come forward.

Snowden’s “methods” don’t work — they certainly haven’t for Daniel Hale, Reality Winner, or Joshua Schulte. But for each, Snowden played at least some role (there is ambiguity about how Schulte really felt about Snowden) in inspiring them to ruin their lives with magical thinking and inadequate operational security.

One of Snowden’s “methods” appears to entail quitting an existing job and then picking another at an Intelligence Community contractor with the intent of obtaining documents to leak. Snowden did this at Booz Allen Hamilton, and his book at least suggests the possibility he did that with his earlier job in Hawaii.

The government justified the draconian sentence that it had negotiated with Winner’s lawyers, in part, by claiming that she premeditated her leak.

Around the same time the defendant took a job with Pluribus requiring a security clearance in February 2017, she was expressing contempt for the United States, mocking compromises of our national security, and making preparations to leak intelligence information

Along with evidence Winner researched The Intercept’s SecureDrop before starting at her new job, the government supported this claim by pointing to three references Winner made to Snowden as or shortly after she started at Pluribus, including texts in which Winner told her sister she was on Assange and Snowden’s side the day the Vault 7 leak was revealed. That was still two months before she took the files she would send to The Intercept.

Had Hale gone to trial, the government would have shown that Hale discussed serving as a source for Jeremy Scahill by May 30, 2013, the day before he left NSA, and discussed Snowden — and hanging out with the journalists reporting on him — the day Snowden came forward on June 9. Then, on July 25, Hale sent Scahill a resume showing he was looking for counterterrorism or counterintelligence jobs. In December, Hale started the the job at Leidos where he would print out the files he sent to The Intercept.

You can think these leaks were valuable and ethical without thinking it a good idea to leave a months-long trail of evidence showing premeditation on unencrypted texts and social media.

Similarly, one of Snowden’s “methods” was to claim he had expressed concerns internally, but was ignored, a wannabe whistleblower stymied by America’s admittedly failed support for whistleblowers, especially those at contractors.

In the weeks before Snowden left NSA, he made a stink about some legal issues and NSA’s training programs (about how FISA Section 702 interacted with EO 12333) that he subsequently pointed to as his basis for claiming to be a whistleblower. The complaint was legit, and one NSA department actually did take notice, but it was not a formal complaint; indeed, it was more a complaint about US law. But his complaint had nothing to do with the vast majority of the documents that have been published based off his files, to say nothing of the far greater set of documents he took. And he made the complaint long after having prepared for months to steal vast amounts of files.

Similarly, Joshua Schulte wrote two emails documenting purported concerns about CIA security, one to a colleague less than a month before he left, which he didn’t send, and then, on his final day, one to CIA’s Inspector General that he falsely claimed was unclassified, a copy of which he was seen taking with him when he packed up. In the first search warrant for Schulte’s house obtained on March 13, 2017, less than a week after the initial Vault 7 release, the FBI had already found those emails and deemed Schulte’s treatment of them as suspect. And when they found a copy of the classified letter to the IG stashed in his headboard, it gave them cause to seize Schulte’s passports on threat of arrest. Snowden’s “methods” didn’t deliver Schulte a “happy ending;” they made Schulte’s apprehension easier.

To the extent Schulte could be shown to be following Snowden’s “methods” (again, that question was not resolved at his first trial) it would be a fairly damning indictment of those methods, since this effort to create a paper trail as a whistleblower was such an obvious attempt to retroactively invent cover for leaks for which there was abundant evidence Schulte’s motivation was spite and revenge. Maybe that’s why someone close to Assange explicitly asked me to stop covering Schulte’s case.

Had Daniel Hale gone to trial, the government undoubtedly would have used the exhibits showing that Hale had never made any whistleblower claims in any of the series of government jobs where he had clearance as a way to push back on his claim of being a whistleblower, though Hale was outspoken about his criticisms of the drone program before he took most of the files he shared with The Intercept. Indeed, given the success of Hale’s earlier anti-drone activism, his case raises real questions about whether leaking was more effective than Hale’s frank, overt witness to the problems of the drone program.

Worse still, Snowden’s boasts about his “methods” appear to have made prosecutions more likely. An early, mostly-sealed filing in Hale’s case, reveals that the government set out to investigate whether Hale was The Intercept’s source because they were trying to figure out whom Snowden had “inspired” to leak.

Specifically, the FBI repeatedly characterized its investigation in this case as an attempt to identify leakers who had been “inspired” by a specific individual – one whose activity was designed to criticize the government by shedding light on perceived illegalities on the part of the Intelligence Community.

That explains why the government required Hale to allocute to being the author of an essay in a collection of Hale’s leaked documents involving Snowden: by doing so, they obtained sworn proof that Hale is the person Snowden and Glenn Greenwald were discussing, while the two were sitting in Moscow, in the closing sequence of Citizenfour. In the scene, Glenn flamboyantly wrote for Snowden how this new leaker and The Intercept’s journalist were communicating, what appears to be J-A-B-B-E-R. That stunt for the camera would have tipped the government off, in cinema release just two months after they had raided Hale’s home, to look for and reconstruct Hale’s Jabber communications with Jeremy Scahill, which they partly succeeded in doing.

Rather than being means to a “happy ending,” then, prosecutors have found Snowden’s “methods” useful to pursuing increasingly draconian prosecutions of people inspired by him.

And now, after Snowden and Greenwald failed to persuade Trump to pardon Snowden, Assange — and in a secondary effort — The Intercept’s sources (perhaps, like Assange, they find the association with Schulte counterproductive, because they didn’t even try to get him pardoned, even though Trump himself almost bolloxed that prosecution), Snowden is left demanding pardons on Twitter for the people he set out to convince leaking could have a “happy ending.”

By associating these leaks with someone being protected by Russia so that — in Snowden’s own words — he could encourage more leaks, Snowden only puts a target on these people’s back, making a justifiable commutation of Winner’s sentence less likely (Winner is due to get out on November 23, two days before the most likely time for Joe Biden to even consider commuting her sentence).

I’m grateful for Snowden’s sacrifices to release the NSA files, but his efforts to lead others to believe that leaking would be easy was bound to, and has, ended badly.

If Vladimir Putin agreed to protect Snowden in hopes that he would inspire more leakers to release files that help Russia evade US spying (as Schulte’s leak did, at a time when the US was trying to understand the full scope of what Russia had done in 2016), the US prosecutorial focus on Snowden-related leakers undermines his value to Putin, probably by design. As that happens, Snowden might reach the moment that observers of his case have long been dreading, the moment when Putin’s utilitarian protection of Snowden will give way to some other equally utilitarian goal.

This is all happening as Putin adjusts to dealing with Joe Biden rather than someone he could manipulate by (at the very least) feeding his narcissism, Donald Trump. It is happening in the wake of new sanctions on Russia, in response to which Putin put US Ambassador John Sullivan on a plane to deliver some message, in person, to Biden. It is happening as Biden’s response to the Colonial Pipeline attack, in which ransomware criminals harbored by Putin shut down US critical infrastructure for fun and profit, includes noting that he and Putin will meet in person soon, followed by the unexplained disabling of the perpetrators in the wake of the attack.

Meanwhile, even as Snowden is of less and less use to Putin, Glenn Greenwald’s utility continues to grow. Snowden, for example, continues to speak out about topics inconvenient to Putin, like privacy. The presence in Russia of someone like Snowden with his own platform and international credibility may become increasingly risky for Putin given the success of protests around Alexei Navalny.

Greenwald, by contrast, seems to have dropped all interest in surveillance and has instead turned many of his grievances — even his complaint that former NSA lawyer Susan Hennessey will get a job in DOJ’s National Security Division, against whom one can make a strong case on privacy grounds — into a defense of Russia. Greenwald spends most of his time arguing that a caricature that he labels “liberals” and another caricature that he labels “the [American] Deep State,” followed closely by another caricature he calls “the  [non-right wing propaganda] Media,” are the most malignant forces in American life. In his rush to attack “liberals,” “the Deep State,” and “the Media,” Greenwald has coddled the political forces that Putin has found useful, including outright racists and other right wing extremists. By the end of the Trump presidency, Greenwald was excusing virtually everything Trump did, up to and including his attempted coup based on the utter denigration of democratic processes. In short, Greenwald has become a loud and important voice in support of the illiberalism Putin favors, to say nothing of Greenwald’s use of a rhetoric unbound by facts.

That Greenwald spends most of his days deliberately inciting Twitter mobs is just an added benefit, to those who want to weaken America, to Greenwald’s defense of fascists.

Most of us who used to know Greenwald attribute his Russian denialism and his apologies for Trump at least partly to his desire to free Snowden from exile. Yet Greenwald’s tantrums, because of their value to Putin, may have the opposite effect.

Stoking Greenwald’s irrational furor over what he calls “liberals” and “the Deep State” and “the Media” would actually be a huge incentive for Putin to deal Snowden to the US, in maximally symbolic fashion. There is nothing that could light up Greenwald’s fury like Putin bringing Snowden to a summit with Biden, wrapped up like a present, to send back on Air Force One. (That’s an exaggerated scenario, but you get my point.)

Plus, if Putin played it right, such a ceremonial delivery of Snowden might just achieve the completion of the Snowden operation, the public release of all of the files Snowden stole, not just those that one or another journalist found to have news value.

The Intelligence Community has, over the years, said a bunch of things about Snowden that were outright bullshit or, at least, for which they did not yet have evidence. But one true thing they’ve said is that Snowden took a great many files that had no imaginable privacy value. Even from a brief period working in the full archive aiming to answer three very discrete questions about FISA, I believe that to be true. While some (including Assange) pressured Snowden and others to release all these files, Snowden instead ensured that journalists would serve a vetting role, and after some initial fumbling, The Intercept did a laudable job of keeping those files safe. So up to now, the fact that Snowden took far more files than any privacy concern — even privacy concerns divorced from all question of nationality — could justify may not have mattered.

But as far as I know there are still full copies out there and Russia would love to spin up Glenn Greenwald’s fury so much he would attempt to burn down his caricature of “The Deep State” in retaliation — much like Schulte succeeded in badly damaging the CIA — by releasing his set.

I believe Russia has been trying to do this since at least 2016.

To be very clear, I’m not claiming that Greenwald is taking money from or is any way controlled by Russia. I am very much not claiming that, in part because it wouldn’t be necessary. Why pay Greenwald for what you can get him to do for free?

And while I assume Greenwald would respect Snowden’s stated wishes and protect the files, like Trump, Greenwald’s narcissism and resentment are very, very easy buttons to push. Greenwald has been heading in this direction without pushing. It would be child’s play to have people friendly to Russia’s illiberal goals (people like Steve Bannon or Tucker Carlson) exacerbate Greenwald’s anger at “the Deep State” to turn it into the frenzy it has become.

Meanwhile, custody of Edward Snowden would be a very enticing dangle for Putin to offer Biden as a way to reset Russia’s relationship with the US. One cannot negotiate with Putin, one can only adjust the points of leverage over each other and hope to come to some stable place, and Snowden has always been at risk of becoming a bargaining chip in such a relationship. By turning Snowden over to the US to be martyred in a high profile trial, Putin might wring the last bit of value out of Snowden. All the better, from Putin’s standpoint, if Greenwald were to respond by releasing the full Snowden set.

For the past four years, Greenwald seems to have believed that if he sucked up to Putin and Trump, he’d win Snowden’s freedom, as if either man would ever deal in good faith. Instead, I think, that process has had the effect of making Greenwald more useful to Russia than Snowden is anymore. And at this point, Greenwald seems to have lost sight of the likelihood that his belligerent rants may well make Snowden less safe, not more.

Update: According to the government sentencing memo for Hale, they didn’t write up the statement of offense, Hale did.

Hale pled guilty without any plea agreement, and submitted his own Statement of Facts. Def.’s Statement of Facts, Dkt. 197 (“SOF”).

Share this entry