The Sordid Second Season of the Robert Menendez Bribery Series

There’s a really sordid aspect regarding the timing of the indictment of Robert Menendez unveiled yesterday. Its timeline starts in February 2018, when Nadine Arslanian first starts dating the senior Senator from New Jersey. That was just weeks — possibly days! — after the last bribery case against Menendez ended.

So weeks after DOJ decided not to retry Menendez on his first bribery case, a then-unemployed woman, Nadine Arslanian, started dating the disgraced Senator and, within weeks of that, she alerted an Egyptian friend, Wael Hana, that she was dating him. That set off the most alarming — but probably not the stongest — part of the case: that Menendez was feeding Egypt information and ultimately set up a back channel with an Egyptian intelligence official, meeting at his home in Egypt in October 2021. Those are alarming allegations, but not allegations as clearly tied to financial payoffs to Menendez as some other things.

It’s like some TV producer decided to renew a series for a second season based off an entirely new story line slapped on the older story. “I know! We’ll throw a woman in the mix!”

Aside from that 2021 trip, much of the Egyptian influence operation happened before Nadine and Menendez were married in October 2020. For much of the period, Nadine complained she wasn’t being paid (in a no-work job at Hana’s Halal company). And some of the meetings between Menendez and the Egyptians would not be that far outside the norm for a Senate Foreign Relations Member, much less the Chair. The trip to Egypt, probably accidentally, was made official, giving Menendez legal cover for it. And the seeming bribery immediately upon his return — like a lot of the other payments in this period — came from a long-time Menendez fundraiser, Fred Daibes, or from a Hana associate, Jose Uribe, not directly from Hana.

In other words, this story appears to start with Nadine’s friends exploiting the access she got through her relationship with Menendez. That, as alleged, is largely her corruption. And to prove the corruption, DOJ will need to prove that the payments she only belatedly got were not part of a legitimate job. It’s sketchy as hell. It raises questions about Foreign Agent laws (especially for Hana). But at least as presented in the indictment, that’s not the strongest evidence, certainly not against Menendez.

The stuff that more directly implicates Menendez is his intervention in several criminal investigations, first in the case of an Uribe associate, then in the case of Daibes, Menendez’ longtime fundraiser. Menendez allegedly tried to intervene with prosecutors to help an Uribe associate beat a state charge, and Daibes beat a federal charge, but as described, both cases resolved in probation plea deals without his interference having any effect.

The items DOJ claims must be forfeited as fruits of the crime provide a sense of how much more Daibes allegedly paid Menendez than Hana:

  • The Menendez’ residence in Englewood Cliffs (this may have originally belonged to Nadine, in which case the forfeiture stems from mortgage payments of $23,000 IS EG Halal made on the residence in July 2019)
  • The $75,000 2019 Mercedes C300 José Uribe paid for starting in 2019, which the Menendez’ tried to make look like a loan retroactively in July 2022; it’s not clear — and DOJ doesn’t say — whether the Mercedes was payoff for the Egyptian influence or for Menendez’ attempt to influence the prosecution of Uribe’s associate
  • $486,461 in cash, some of which bore Daibes’ DNA or fingerprints, one envelope of which had Menendez’ DNA, some of which was stashed in a Menendez jacket
  • $79,760 in cash seized in Nadine’s safe deposit box
  • 2 1-KG bars of gold seized on June 16, 2022; these — and at least two others that Nadine sold for around $120,000 in March 2022 — likely came from Daibes
  • 11 1-ounce bars of gold seized on June 16, 2022; these were likely what remained of 22 ounces total, originally valued at around $39,600, purchased by Hana after some meetings with Egyptian officials on June 23, 2021
  • An account tied to Strategic International Business Consultants, which Nadine formed in June 2019 after IS EG Halal got its monopoly and to which IS EG Halal paid three $10,000 payments in August, September, and November 2019

So the Mercedes (worth $75,000) at least appears to be payoff for Menendez’ efforts to help an Uribe associate beat a state case. As noted, the indictment says prosecutors shielded the investigative team from Menendez’ interference, but Uribe and the associate nevertheless had a celebratory dinner with Menendez attributing his legal good fortune to Menendez.

Because the roughly $100,000 in payments from Hana — with the exception of the one-ounce gold bars — came through IS EG Halal, DOJ will need to prove that Nadine’s no-work job really wasn’t a job or at least not a legal one.

The bulk of the payments, around $720,000 in cash and gold (the indictment also references checks not itemized here), came from Daibes. While he had financial ties to Hana, he also had a long-lasting relationship as a fundraiser for Menendez, and DOJ doesn’t lay out when the money came in. Given the extent of that relationship, Menendez’ intervention with the US Attorney’s office (and his equivocations about supporting Phil Sellinger’s appointment) are corrupt as hell but not unusual for Washington.

After all, Attorney General Garland only got confirmed after assuring Lindsey Graham and other Senators that he would continue the politically influenced criminal investigations into Hunter Biden and (by John Durham) of Hillary Clinton and her associates. And the entire House GOP is continuing such demands to this day, in part because their Sugar Daddy, Donald Trump, demands it.

There has to be something more to the Daibes’ money, something not laid out in this indictment. Particularly given that there are no campaign finance allegations, DOJ has not ruled out that Menendez was just on a regular take from Daibes. It simply doesn’t account for the amount of money Daibes allegedly gave Menendez, nor does it tie that money to specific quid pro quos.

(Daily Beast reports that Daibes has or had ties with the Italian mafia.)

Similarly, there must be more explanation to the Daibes’ plea deal. This indictment suggests that Sellinger’s First AUSA, Vikas Khanna, rebuffed Menendez’ efforts to intervene in the Daibes case, just like NJ state prosecutors rebuffed his efforts to intervene in the case of the Uribe associate who nevertheless attributed his plea to Menendez. The NJ USAO only belatedly clarified that Sellinger was recused and the plea had been approved by Khanna on the day of the indictment. And it’s hard to explain the repeated continuances of Daibes’ sentencing, first in September 2022, then in December 2022, then in March 2023, then in July 2023; sentencing for Daibes and his co-defendant is currently set for October 23, 2023. The sentencing submissions submitted in August 2022 remain sealed. If Daibes started cooperating in this case after the June 2022 searches of the other co-defendants, it might make sense, but there’s no hint of that.

Likewise, there’s no ready explanation for why SDNY is prosecuting this instead of NJ USAO. Rather than any mention that this got referred from one of those NJ offices, which is what you would hope happened if a politician attempted to influence a prosecution, the indictment establishes venue in fairly tangential acts (marked in blue in the timeline below): Two dinners Menendez and Nadine had in Manhattan, the loan payments Uribe arranged through a bank in the Bronx, and a text Nadine sent on September 5, 2019.

Finally, it’s not clear whether this investigation arose out of an investigation — perhaps for being a foreign agent, which inexplicably is not included in this indictment — into Hana, which led up to the search of his phone in November 2019 but which doesn’t appear to have alarmed anyone, or out of further scrutiny of Daibes.

Or maybe, after the prosecution failed the last time, DOJ Public Integrity (which was heavily involved in the first prosecution of Menendez) just kept watching, knowing he’d stumble again.

Some of the overt acts in this indictment — most notably when Menendez provided sensitive information about embassy staffing to the Egyptians — happened more than five years ago, so they’re only included as part of a conspiracy that continued for years after that. But I wouldn’t rule out that we get more clarity about all this money in a superseding indictment.

Update: Added the detail that the June 21, 2021 meeting with Egypt’s Intelligence head pertained to Egypt’s role in the Jamal Khashoggi assassination.

Timeline

Below, I’ve bolded key payments (there are other payments that DOJ does not date in the indictment). I’ve marked in pink the engagement and marriage of Nadine and Menendez, which may change the legal import of Nadine’s actions with Menendez. I’ve marked the acts that SDNY uses to establish venue in blue.

April 1, 2015: DOJ indicts Menendez and longterm associate, Salomen Melgen.

June 27, 2016: US v McDonnell decision.

July 17, 2017: Menendez moves to dismiss in light of US v McDonnell decision.

August 2017: State Department withholds $195 million in military support for Egypt and cancels $65.7 million in other financing.

November 16, 2017: Jury hangs in Salomon Melgen trial.

January 19, 2018: DOJ notices intent to retry case.

January 24, 2018: Judge William Walls grants Menendez’ Rule 29 motion on 7 of 18 counts.

January 31, 2018: DOJ moves to dismiss first bribery case.

February 2018: Nadine Arslanian, at the time unemployed, starts dating Menendez.

Early 2018: Nadine tells Hana she is dating Menendez.

March 2018: Menendez meets with Egyptian Official-1, Nadine, and Hana, without his professional staffers, in his DC Senate office and discusses foreign military funding.

April 2018: Uribe tells Hana that “the deal is to kill and stop all investigation”‘ of associate investigated for insurance fraud.

May 6, 2018: After meeting with Nadine and Hana (location uncertain), Menendez seeks out number and nationality of peoeple working at US Embassy in Cairo.

May 7, 2018: Menendez texts details of Embassy staffing to Nadine, who forwarded it to Hana, who forwarded it to Egyptian Official-2.

May 2018: Menendez has fancy dinner with Hana after which Hana texts Egyptian Official-1 that “the ban on small arms and ammunition to Egypt has been lifted.”

May 2018: Nadine gets Menendez to ghost write letter asking other Senators to release $300 million hold. He sends ghost-written letter to her via personal email; she sends it to Hana. Both delete the email.

Several months after March 2018: Nadine expresses hope that Egypt “replace him,” meaning Hana. 

June 30, 2018: Menendez, Nadine, and Hana meeting in Manhattan restaurant. 

July 2018: After meeting with Egyptian Official-1 set up by Nadine and Hana, Menendez tells Nadine he will sign off on $99 million sale to Egypt, stating that they have had such arms for many years and use them for counterterrorism in the Sinai.

October 30, 2018: Fred Daibes charged by US Attorney for obtaining loans under false pretenses.

December 2018: Nadine has car accident and starts complaining to Hana that she does not have a car.

January 27, 2019: Menendez, Nadine, and Hana meet at dinner (Uribe was invited but did not attend), after which Hana starts sending Nadine texts about Uribe associate’s criminal case. Nadine deleted those messages.

January 29, 2019: After reviewing texts with Nadine (which both deleted), Menendez attempts to pressure Official-2 to resolve the prosecution of Uribe’s associate. Official-2 does not intervene.

February 3, 2019: Nadine texts Hana, “I’m so excited to get a car next week !!”

2018 to 2019: Hana’s halal firm, which had no revenue, did not deliver on payments promised to Nadine.

March 12, 2019: Nadine and Uribe speak for 21 minutes, after which Uribe texts, “I am real. I will stand by my word.”

March 27, 2019: Uribe directs Nadine to a Mercedes dealer, after which she sends Menendez pictures to help pick a color.

April 2019: Uribe associate resolves case with guilty plea that was more favorable than prosecutors’ initial plea offer.

April 3, 2019: Nadine texts dealer saying Uribe told her to pick up car on April 5.

April 3, 2019: Uribe tells associate, “I need 15k cash this afternoon.”

April 4, 2019: Nadine texts Menendez that she’s going “to meet Jose for five minutes;” in the parking lot of a restaurant, he hands her $15,000 in cash.

April 5, 2019: Nadine uses the $15,0000 as a down payment to get the Mercedes, paying the rest with a loan based on false financing claims.

April 7, 2019: Egyptian government official informs Hana he’ll become sole certifier for halal imports.

April 8, 2019: Nadine texts Menendez, “seems like halal went through. It might be a fantastic 2019 all the way around.”

Spring 2019: Egypt grants Hana’s halal company, IS EG Halal, exclusive monopoly on certifiying meat exported from the US to Egypt as halal.

April and May 2019: USDA complains to Egypt about monopoly grant to IS EG Halal.

May 2019: Uribe starts paying off Nadine’s loan, via an associate’s Bronx business account, keeping his name out of it.

May 3, 2019: Uribe causes associate to pay off Nadine’s loan through bank in the Bronx.

May 21, 2019: Menendez, Hana, and Egyptian Official-3 meet twice, the second time at steakhouse in DC. They discuss human rights issue. Hana requests Menendez’ intervention on USDA objections to IS EG Halal monopoly.

May 22 and 23, 2019: Hana provides Nadine information on USDA objections. She texts them to Menendez, and later deletes them.

May 23, 2019: Menendez intervenes with USDA Official-1, asking him to stop interfering with IS EG Halal’s monopoly. Official-1 did not accede to demand, but IS EG Halal kept monopoly.

June 2019: Nadine forms Strategic International Business Consultants, LLC, explaining to a relative she would use it to get paid. “Every time I’m in a middle person for a deal I am asking to get paid and this is my consulting company.”

July 2019: After mortgage company moves to foreclose on Nadine, IS EG Halal pays $23,000 to bring Nadine’s mortgage current. As part of those discussions, Nadine said, “When I feel comfortable and plan the trip to Egypt [Hana] will be more powerful than the president of Egypt.” [DOJ does not allege Menendez was part of this discussion.]

July 2019: A New Jersey detective asks to interview Uribe’s associate, leading Menendez to attempt to intervene again.

July 31, 2019: Uribe contacts Nadine saying “We need to move fast” … “We can stop this.” Nadine responds that she will “address itfirst thing tomorrow morning or tonight depending on when he is home.” Menendez does Google search on State agency employing insurance fraud investigator.

August 30, 2019: IS EG Halal pays Nadine $10,000.

September 3, 2019: Uribe texts Nadine saying, “Please don’t forget about me. I will never forget about you” … “I need peace.”

September 4, 2019: Menendez sets up meeting with NJ prosecutor for September 6.

September 5, 2019: Menendez, Nadine, and Uribe meet at Nadine’s house.

September 5, 2019: Nadine sends Uribe a text sent through cell tower in Manhattan.

September 6, 2019: Prosecutor meets with Menendez, Menendez informs Uribe the meeting was “very positive.”

September 9, 2019: Egyptian Official-3 texts Hana relaying that a State Department official told an Egyptian diplomatic official that “Senator Menendize put a hold on a billion $ of usaid to Egypt before the recess !!!!” Hana attempted to contact Nadine, then forwarded the Egyptian text to Daibes, who called Menendez and then responded that it wasn’t true.

September 2019: Menendez offered to provide assistance to Hana and Egypt during official trip to India, then later meets with Daibes, Hana, and Egyptian Official-3.

September 2019: Nadine complains to Daibes that Hana had not paid her. Daibes responds, “Nadine I personally gave Bob a check for September.”

September 2019: Nadine texts Menendez complaining that Hana has not left her an envelope, referencing a meeting Menendez had with senior Egyptian officials “last Saturday.” Nadine called Daibes.

September 21, 2019: Menendez, Hana, Daibes, and Egyptian Official-4 meet at restaurant in Manahattan.

September 28, 2019: IS EG Halal pays Nadine $10,000.

October 2019: Menendez and Nadine get engaged.

October 29, 2019: Uribe texts Nadine for an update. Menendez calls Uribe, after which he tells Nadine he is “a very happy person.”

After October 29, 2019: Menendez, Nadine, Uribe, and associate have celebratory dinner.

November 5, 2019: Uribe texts Nadine about automatic payments for Mercedes Benz.

November 5, 2019: IS EG Halal pays Nadine $10,000.

November 9, 2019: Uribe sets up automatic payments through another trucking company, ultimately paying $30,000 in addition to the cash down payment.

November 2019: Search of Hana’s cell phone reveals thousands of text messages with Hana, many of which she had deleted.

March 2020: Nadine texts Egyptian Official-3 and offers to help, then setting up meeting with “the general,” after which Menendez intervenes to pressure State to increase its engagement on Grand Ethiopian Renaissance Dam.

October 2020: Menendez, Nadine, Egyptian Official-3 ,and Egyptian Official-4 meet for dinner in Edgewater, NJ.

October 2020: Menendez and Nadine get married.

December 2020: Menendez and Nadine have dinner meeting with Egyptian Official-3.

December 2020: Menendez meets with US Attorney candidate and complains about prosecution of Fred Daibes. US Attorney candidate tells Menedez he might have to recuse. Menendez told US Attorney candidate he would not recommend him.

Early 2021: IS EG Halal delivers two exercise machines and air purifier to Menendez home.

May 2, 2021: Advisor intervenes with US Attorney candidate about recusing, tells Menendez “you’ll be comfortable with what he says.” Menendez recommends candidate. After confirmation, he recuses.

June 21, 2021: Nadine and Egyptian Official-4 organized meeting between Menendez and Egyptian Intelligence Head Abbas Kamel, in advance of meeting with other Senators that day. Both Nadine and Menendez alert Egyptian Official-4 that other Senators were going to raise a human rights issue. Per this thread (ThreadReader is down right now but it’s here) and this Isikoff story, the human rights issue was Egypt’s involvement in the execution of Jamal Khashoggi.

June 23, 2021: Hana purchases 22 one ounce gold bars, each worth $1,800. Two were found at Menendez residence in June 2022 search.

October 2021: Nadine arranges trip for her and Menendez to Egypt, originally planned as unofficial visit. When a SFRC took steps that made it an official visit, Egyptian Official-4 said he might lose his job. During the trip, Menendez had meeting at home of Egyptian Official-5 (the intelligence official).

October 17, 2021: Driver for Fred Daibes picks up the Menendezes from trip to Egypt; the next day Menendez searches, “how much is one kilo of gold worth.”

December 23, 2021: Daibes’ trial adjourned. Daibes asks about Menendez’ shoulder injury. Nadine responds that Menendez is fixated on trial date. Daibes sent recliner to Menendez.

December 2021 through February 2022: Menendez asks Advisor to ask why US Attorney recused himself.

January 2022: Menendez sends Nadine a link about military sales to Egypt totally $2.5 billion; Nadine forwards ot Hana, saying that Menendez had to sign off on it.

January 21, 2022: Menendez called NJ US Attorney and asked for First AUSA name.

January 22, 2022: Menendez complains to Daibes that his attorney has not been aggressive enough.

January 24, 2022: Nadine has two calls with Daibes’ driver. “Christmas in January.” Thousands in cash with Daibes’ DNA later found at residence. 

January 29, 2022: Menendez searches for “kilo of gold price.”

January 31, 2022; Menendez calls First AUSA, then calls Daibes.

March 2022: Menendez asks Advisor to bring up Daibes at lunch with US Attorney, Advisor declines to do so.

March 30, 2022: Nadine thanks Daibes, then sells 2 1-KG gold bars to jeweler, each worth $60,000.

March 31, 2022: Two 1-KG gold bars Nadine provided to jeweler sold in Manhattan.

April 2022: Daibes pleads guilty to plea agreement providing probationary sentence. Sentencing has been continued repeatedly since plea.

June 2022: Federal agents approach Menendez, Nadine, and Uribe, after which Menendez pays Nadine $23,000 and Nadine pays Uribe $21,000.

June 16, 2022: Search discovers:

  • 2 1-KG gold bars
  • 9 1-ounce gold bars
  • 10 envelopes of cash, each with 10s of 1000s of dollars, bearing Daibes’ fingerprints, one which included fingerprints of Menendez

July 14, 2023: Sentencing for Daibes and co-defendant reset, for fourth time, for October 23, 2023.

September 21, 2023: DOJ amends sentencing agreement to note that Phil Sellinger was recused and Vikas Khanna oversaw the Daibes prosecution.

September 21, 2023: Indictment

The Menendez Indictment: “how much is one kilo of gold worth” … “kilo of gold price”

The latest indictment of Robert Menendez almost seems like a personal challenge to Clarence Thomas, to see if there are bribes of a public official that Thomas and his cronies on the Supreme Court won’t find a way to deem constitutional.

After all, what if Thomas is getting gold bars on the side from his “friends,” as Menendez is alleged to have been?

The short version, though, is that after Menendez’ last corruption prosecution, Nadine Arslanian started dating then married Menendez. And he started doing favors for some of her friends, Wael Hanna and Fred Daibes, who had ties to Egypt, including sharing non-public information with Egyptian officials and helping Hanna secure the monopoly on halal certification for meat imported into Egypt.

The indictment alleges a lot of breath-taking stupidity on Menedez’ part, including twice searching for the price of gold after doing something incriminating.

On or about October 17, 2021, ROBERT MENENDEZ and NADINE MENENDEZ, a/k/a “Nadine Arslanian,” the defendants, returned from Egypt as described in paragraph 29.f, landing at John F. Kennedy International Airport. Upon their arrival, a driver for FRED DAIBES, the defendant (“DAIBES’s Driver”), picked up MENENDEZ and NADINE MENENDEZ from the airport and drove them to their home in New Jersey. The next day, MENENDEZ performed a web search for “how much is one kilo of gold worth.” As discussed herein, multiple gold bars provided by DAIBES were found during the court-authorized June 2022 search of MENENDEZ and NADINE MENENDEZ’s residence.

[snip]

d. On or about January 24, 2022, DAIBES’s Driver exchanged two brief calls with NADINE MENENDEZ. NADINE MENENDEZ then texted DAIBES, writing, “Thank you. Christmas in January.” DAIBES’s Driver’s fingerprints were later found on an envelope containing thousands of dollars of cash recovered from the residence of MENENDEZ and NADINE MENENDEZ in New Jersey. This envelope also bore DAIBES’s DNA and was marked with DAIBES’s return address. In or about the early afternoon of January 24, 2022— i.e., approximately two hours after NADINE MENENDEZ had texted DAIBES thanking him and writing “Christmas in January”—MENENDEZ called Official-4, in a call lasting for approximately 15 seconds. This was MENENDEZ’s first phone call to Official-4. On or about January 29, 2022—i.e., several days after NADINE MENENDEZ had texted DAIBES, thanking him and writing “Christmas in January”—MENENDEZ performed a Google search for “kilo of gold price.”

When the FBI searched Menendez’ home last year, they found over $100,000 in gold bars, as well as $480,000 in cash.

The gold bars and some of the envelopes had the fingerprints of their alleged co-defendants.

Some of these allegations will be harder to prove. Some will be easier to pin on Nadine, unless and until one of the spouses flips on the other.

But Menendez, who escaped justice the last time DOJ tried to prosecute him for his corruption in 2015, certainly seems to have pressed his luck.

Paul Manafort Remains a Bigger Scandal than Hunter Biden

I haven’t had the time to dig into Gary Shapley’s purported whistleblower claims about the case against Hunter Biden, which several US Attorneys have already disputed.

My read, thus far, matches Andrew Prokop’s: after IRS investigators tried to take steps during a pre-election prohibition period last year, someone in their vicinity leaked to Devlin Barrett, as right-wingers do every pre-election period. That led Delaware US Attorney David Weiss to (justifiably) remove the suspected leakers from the case. As other right wing officials have before, they then ran to Congress and belatedly claimed whistleblower status.

The purported whistleblowers claim that investigative steps — pertaining to allegations about conduct after Biden left the Obama White House — were slow-walked in 2020, during Bill Barr’s tenure as Attorney General. The most serious claim made by the purported whistleblowers is that US Attorneys appointed by Joe Biden refused to file charges against Hunter in the venues where they occurred — MDCA and DC. Merrick Garland, David Weiss, and Matthew Graves have all denied that.

But even if that allegation is true, even if Weiss continues to investigate and substantiates some foreign influence peddling (at this point, limited to 2017, a time when Biden was not in office), the allegations against Hunter Biden would still be far less scandalous than the Paul Manafort case. That’s true because the scale of Manafort’s tax crimes were far worse. That’s true because Manafort has confessed to his foreign influence crime. And that’s true because Trump pardoned Manafort after his former campaign manager lied to investigators about what he did with (since confirmed) Russian agent, Konstantin Kilimnik, during and after the 2016 campaign.

Here’s my understanding of the comparison. The claims against Hunter, in bold, reflect the two Informations docketed as part of the plea deal. All but the pardon TBDs in his case reflect allegations from the so-called whistleblowers that remain unresolved.

Note: I have not listed “lied to protect the president” for Hunter because, as far as I am aware, the President’s son has not made sworn statements to law enforcement — true or false — about matters affecting his father. Manafort did make false statements about matters implicating Trump during his breached cooperation with Robert Mueller’s prosecutors.

A whole pack of DC journalists have chased the IRS allegations, like six year olds do a soccer ball, but with perhaps less consideration of what they’re chasing. They’re doing that even as Trump’s pardons remain largely unreviewed since he announced his run. This manic response to contested IRS claims reflects a choice. Just not a justifiable journalistic one, given the contested allegations to date.

Paul Manafort sources

Millions in tax avoidance: On August 21, 2018, an EDVA jury convicted Manafort of filing false tax returns each year from 2010 to 2014. On September 14, 2018, Manafort pled guilty to tax crimes spanning from 2006 through 2015. Between 2010 and 2014, he failed to report over $15M in income on FBAR.

FARA component: On September 14, 2018, Manafort pled guilty to serving as an unregistered foreign agent from 2006 through 2015.

Money laundering: On September 14, 2018, Manafort pled guilty to laundering over $6.5M in payments, from 2006 through 2016, as part of his FARA scheme.

Bank fraud: In August 21, 2018, an EDVA jury convicted Manafort of two counts of bank fraud, totalling $4.4M. On September 14, 2018, Manafort admitted to over $25M more in bank fraud.

Conspiracy with foreign spy: On September 14, 2018, Manafort pled guilty to a conspiracy to witness tamper with Konstantin Kilimnik. In a 2021 sanctions filing, Treasury stated as fact that Kilimnik is a Russian Intelligence Services agent.

Joint Defense Agreement with President: Before Manafort pled guilty, Rudy Giuliani confirmed that Manafort was part of a Joint Defense Agreement with the President.

Lied to protect President: On February 13, 2019, Amy Berman Jackson ruled that Manafort had breached his plea agreement by — among other things — lying about what he did in an August 2, 2016 meeting with Konstantin Kilimnik at which he described how the campaign planned to win swing states.

Intervention from Attorney General: On May 13, 2020, Manafort was given COVID release to home confinement, even though his prison was at that point low risk and his case did not meet the criteria laid out by Bureau of Prisons. He served less than two years of an over seven year sentence in prison.

Pardoned: On December 23, 2020, Trump pardoned Manafort.

Hunter Biden sources

Hundreds of thousands in tax avoidance: In both 2017 and 2018, Hunter failed to pay full taxes on $1.5M in income ($3M total).

Gun possession: For 11 days in 2018, Hunter possessed a gun in violation of a prohibition on gun ownership by an addict.

Update: Just to give a sense of scale, in his Ways and Means interview, Whistleblower X tried to explain how big the scale of Hunter Biden’s graft was by noting that he and his associates, over five years, got $17.3M.

But Manafort was doing more than that himself.

Where the Trump Investigations Stand: The January 6 Conspiracies

As noted in this post, I started to write short summaries of where the three main investigations into Trump stand, but they turned into posts. So I’m posting them serially. I wrote about the Georgia investigation here and the stolen documents investigation here.

On Thursday, Mike Pence testified to the January 6 grand jury for over five hours. Many commentators have suggested — and I agree — that was one of the last major testimonial steps Jack Smith would need to take before deciding whether and if so how to charge Trump for inciting a mob to threaten to assassinate his Vice President.

But — in addition to Smith’s efforts to obtain recordings from Rudy Giuliani and others that former Fox producer Abby Grossberg has in her possession (which are going to make great evidence at trial) — there are still a few pieces that Smith’s prosecutors seem to be working on.

The most important of those may be continued appellate uncertainty regarding the law that Smith is likely to use to charge Trump and others in conjunction with January 6, obstruction of the vote certification, 18 USC 1512(c)(2), a charge successfully used against dozens of other January 6 defendants already. The DC Circuit will have a hearing on that, in an appeal former Virginia cop Thomas Robertson made of his obstruction conviction, on May 11.

To understand its import, let me explain how I think the various things Smith is investigating fit together. I think it likely that, in addition to some charges relating to the obstruction of this or the January 6 Committee’s investigation, Smith’s team is pursuing:

  • Conspiracy to defraud the United States for submitting fake elector certificates to the Archives (18 USC 371)
  • Obstruction of the vote certification and conspiracy to obstruct (18 USC 1512(c)(2) and (k))
  • Conspiracy to commit wire fraud (18 USC 1343; 1349)
  • Aiding and abetting assault (18 USC 111(b) and 2)

This differs from the January 6 Committee’s referrals in that I’ve included wire fraud, for which they provided abundant evidence, in an appendix, but did not include in their referrals. Also, I believe Smith would charge conspiracy tied to January 6 under 1512(k) rather than 371, as DOJ has been doing for over a year, not least because it provides stiffer sentences and more flexibility at sentencing. And I’ve suggested DOJ might use aiding and abetting of Michael Fanone’s assault based off Amit Mehta’s ruling addressing it and the evidence DOJ used in the Ed Badalian trial. I think that’s more likely than a charge for incitement of insurrection (18 USC 2383) unless DOJ built upwards off of still-hypothetical guilty verdicts in the Proud Boys case, but it might take time. I frankly think adding seditious conspiracy charges would be more likely than incitement of insurrection, if one spent the time to build up the intervening case, but that’s highly unlikely for constitutional reasons.

The way these three main charges — conspiracy to defraud tied to the fake elector certificates, conspiracy to obstruct the vote certification, and wire fraud — intersect likely provide some prosecutorial tools for the same reason that some Georgia Republicans are now turning on other ones.

While the fake electors case may seem like a slam dunk, the criminal exposure it presents is quite uneven.

Part of that stems from the fact that the extent to which a fake certificate was fraudulent is tied to state law about the requirements for elector ascertainment. On December 9, 2020, campaign lawyer Kenneth Cheesebro wrote down (!!) where such efforts would be less and more problematic.

Many of the States contested by the Trump team had laws that specified requirements for electors to validly cast and transmit their votes—and the December 9, 2020, memo recognized that some of these criteria would be difficult, if not impossible, for the fake electors to fulfill. (As described later, most were not fulfilled.) For example, Nevada State law required that the secretary of state preside when Presidential electors meet,16 and Nevada Secretary of State Barbara Cegavske, a Republican, had already signed a certificate ascertaining the Biden/Harris electors as the authorized, winning slate.17 Several States also had rules requiring electors to cast their votes in the State capitol building, or rules governing the process for approving substitutes if any original proposed electors from the November ballot were unavailable. As a result, Chesebro’s December 9, 2020, memo advised the Trump Campaign to abide by such rules, when possible, but also recognized that these slates could be “slightly problematic in Michigan,” “somewhat dicey in Georgia and Pennsylvania,” and “very problematic in Nevada.”18

That memo marks the moment when Trump’s official campaign lawyers like Justin Clark and Matt Morgan started to distance themselves from the campaign efforts, to be replaced by Rudy Giuliani and his band of merry warriors.

Something similar happened at the states, as smarter people insulated themselves from this stupid legal move. The fake electors in New Mexico and Pennsylvania included caveats that likely protects them from legal exposure; in other states (notably, Wisconsin) the fake electors credibly believed that the certificates would only be used if a court ruled that there was some remaining legal dispute. Fourteen fake electors refused to participate, several of whom had very useful things to say about its dubious legality even to the January 6 Committee.

While there’s lots of documentary record reflecting that Trump approved the plan, proving his knowledge of the legal problems with the fake certificates themselves would likely require witnesses who saw him do so after having been advised of the legal sketchiness of it all (that may have been among the things the two Pats, Philbin and Cipollone, were asked about in their grand jury testimony in December). To include Trump in these charges, you need witnesses. His call to Brad Raffensberger and his assent to a lawsuit using numbers known to be dodgy are related; his pressure on electors to participate is part of the same conspiracy; but to charge him with the conspiracy itself you need those direct witnesses (in addition to the two Pats, Jason Miller, Rudy, Mark Meadows, Epshteyn, and John Eastman are likely those witnesses).

By last June, the subpoenas DOJ sent out asking for communications with those deeply implicated reflected this differential exposure. So do the phone seizures of Mike Roman and Epshteyn in September, both of whom were key gatekeepers of this process. This post shows how the investigation proceeded from there. In other words, the parts of the fake elector investigation we can see reflect awareness from before the first J6C hearing that the scam implicated differential legal exposure.

That kind of differential exposure is the same thing that Fani Willis is using to secure cooperating witnesses in Georgia.

While I’ll come back to it, the same kind of differential exposure exists with the wire fraud case. Just as one example, while Justin Clark claims to have distanced himself from the obviously illegal fake elector scam, he remained in Trump’s employ as he spent the money earned from making false claims about voter fraud between November and January. He already would have had an incentive to provide evidence to prosecutors that he had no part of the fake electors scheme. His incentive to do so increases to the extent that he benefitted from fraudulent fundraising and spending.

But first I want to explain one thing Smith may be waiting on: A clear sense of how the DC Circuit will define “corrupt purpose” under 18 USC 1512(c)(2).

If he charges it, Smith will likely prove that Trump obstructed the vote certification by:

  • Asking Mike Pence to take action to delay the certification that Trump had been told was illegal (Greg Jacob, Mark Short, the two Pats, and Pence are witnesses to this, all of whom have now made Executive Privilege-waived grand jury appearances)
  • Falsely leading the mob to believe that Pence could take that action (changes Trump made to his speech, about which Stephen Miller was likely asked by the grand jury this month, and his tweets are evidence of this)
  • After Pence refused to take that action, using the mob to try to pressure him to take it anyway or to otherwise disrupt the certification (DOJ has spent two years obtaining evidence that this was, in fact, why many people rioted, with specific evidence tied to Danny Rodriguez)

Contrary to what a million TV lawyers have told you, to prove obstruction, Smith won’t have to prove Trump knew he lost. DOJ has repeatedly won convictions of other January 6 defendants who tried to use that as a defense.

DOJ will need to prove he had corrupt purpose in attempting to obstruct the vote certification. And what that means in the DC Circuit won’t be decided until after May 11.

This post provides both a summary of the debate as it existed in January. This post describes how a DC Circuit panel of Florence Pan, Justin Walker, and Greg Katsas ruled that 1512(c)(2) does apply to the vote certification and that obstruction can extend beyond documentary obstruction. It also explains how none of the three of them could agree on what “corrupt purpose” means, from which some January 6 defendants have tried to argue (unsuccessfully in at least two cases) that Walker’s preferred meaning should apply.

Wildly simplified, the three main definitions of what corrupt purpose might mean are:

  • Corrupt benefit
  • Using otherwise illegal means, which in the case of other January 6 defendants has meant trespass or assault
  • Aiming to obtain an unlawful benefit

On May 11, a DC Circuit panel including Pan, Poppy Bush appointee Karen Henderson, and Obama appointee Cornelia Pillard will consider whether former Virginia cop Thomas Robertson had the corrupt purpose required to be convicted of obstruction. As part of that, they’ll decide whether the earlier ruling decided the issue of what corrupt purpose is, and if not, what it is.

As I wrote, to the extent that Smith has proof Trump knew the fake elector certificates were fraudulent, 1512 should apply to Trump in every imaginable case, far more easily than it does with rioters. The attempted delivery of the fake elector certificates to Pence constitutes a documentary attempt to obstruct the vote certification. Trump’s illegal request to Pence, as well as the knowingly fraudulent lawsuit in Georgia and the effort to pressure Raffensperger, to say nothing of any incitement or aid-and-abet liability in the assaults, are illegal means he used to stop the vote certification. And Trump, more than anyone else involved in efforts to obstruct the vote certification on January 6 was seeking an unlawful personal benefit, the ability to remain in power for another term. Mitch McConnell protégé Walker clearly laid out that basis for that case in his concurring opinion in Fischer.

But former Trump White House counsel Katsas didn’t necessarily view the continued election of Donald Trump to be such an advantage, at least not for those accused of assault before him. He sought a stricter definition of “financial, exculpatory, or professional” gain.

Which brings me (back) to the wire fraud investigation, something that DOJ has been investigating since at least September and in which CNN reported DOJ got cooperators after January 6.

[T]he financial investigation has sought information about Trump’s post-election Save America PAC and other funding of people who assisted Trump, according to subpoenas viewed by CNN. The financial investigation picked up steam as DOJ investigators enlisted cooperators months after the 2021 riot, one of the sources said.

Wire fraud charges would closely resemble the successful Build the Wall prosecution for which Steve Bannon’s co-conspirators just got four year sentences (he was pardoned in for it in one of Trump’s last pardons but faces trial for the same scam in New York State in November). It would follow a similar wire fraud investigation of Sidney Powell that dates back to before September 2021.

If you think of these three prongs of the investigation, the wire fraud prong serves two purposes. First, many of the people who were witnesses but not subjects of the events leading up to January 6 might be subjects of the wire fraud investigation. As I noted, it may provide a tool to get cooperators.

Just as importantly, even under the most constrained definition of corrupt purpose for obstruction, grifting off false claims of election fraud would qualify.

That is, for Trump, a prosecutor should be able to prove corrupt purpose regardless of any conceivable standard that the DC Circuit or even a conservative SCOTUS would adopt, because he attempted to obstruct the vote certification so that he could remain President after losing the election.

But even if you don’t believe getting Trump elected provides an unlawful benefit to his supporters (or, to put it another way, disqualifying the votes of 81 million other Americans so yours counts more), disseminating false claims about voter fraud to get rich and then cashing in on that Big Lie for years afterwards is a different kind of corrupt purpose, the kind of financial corrupt purpose that Katsas is looking for.

If you riled up tens of thousands of Trump supporters who went on to attack the Capitol just so you could benefit financially, you’ve realized the kind of corrupt financial benefit from the riot that would seem to meet Katsas’ most constrained definition of corrupt purpose.

So it’s not just that the wire fraud part of the investigation is a crime that should, like all the other ways Trump and his flunkies have exploited his credulous followers, be prosecuted. It’s a important complement to the two other conspiracies, both because it’s likely to motivate more cooperators, but also because it helps to prove corrupt purpose for all the people who profited off the fraud.

And that may have an impact on the timing.

As I’ve noted, Trump should qualify under the definition of corrupt purpose no matter what the DC Circuit decides, though some of his flunkies might not. And so on top of whatever continued investigation Smith has to do on the wire fraud prong, he may want to wait until at least after that hearing before he makes final charging decisions.

Lots of people are impatient that neither Trump nor his flunkies have been charged thirty months after their crimes. But the likely charge hasn’t even been defined yet.

Links

Where the Trump Investigations Stand: Georgia

Where the Trump Investigations Stand: Stolen Documents

Where the Trump Investigations Stand: The January 6 Conspiracies

How the Government Proved Their Case against John Podesta’s Hacker

We’re almost seven years past the hack of the DNC, and self-imagined contrarians are still clinging to conspiracy theories about the attribution of that and related hacks. In recent weeks, both Matt Taibbi and Jeff Gerth dodged questions about the attribution showing Russia’s role in the hack-and-leak by saying that the Mueller indictment of twelve GRU officers would never be tested in court (even while, especially in Gerth’s case, relying on unsubstantiated claims in John Durham indictments from his two failed prosecutions).

And while’s it’s likely true that DOJ will never extradite any of those twelve men to stand trial, DOJ did successfully convict one of their co-conspirators on a different hack: the hack-and-trade conspiracy involving Vladimir Klyushin and accused John Podesta hacker, Ivan [Y]Ermakov.

(The Mueller indictment and Ermakov’s second US indictment, for hacking anti-doping agencies, transliterated his name with a Y, the Boston one does not.)

That trial provides a way to show how DOJ would prove the 2018 indictment if one of the twelve men charged ever wandered into a jurisdiction with an extradition treaty with the US.

As laid out at trial, between 2018 and 2020, the co-conspirators hacked two securities filing agencies, Toppan Merrill and Donnelly Financial, to obtain earnings statements in advance of their filing, then traded based off advance knowledge of earnings. Klyushin was one of seven people (two charged in a separate indictment, three who were clients of Klyushin’s company M-13) who did the trading. Ermakov didn’t trade under his own name. He may have been compensated for Klyushin’s side of the trades with a Moscow home and a Porsche. But at least as early as May 9, 2018, forensic evidence introduced at trial shows, an IP address at which Ermakov’s iTunes account had just gotten updates was used to steal some of the filings.

Ermakov did not show up in a courtroom in Boston to stand trial and Klyushin has launched a challenge to his conviction that rests entirely on a challenge to venue there. But the jury did convict Klyushin on the hacking charge along with the trading charges, meaning a jury has now found DOJ proved Ermakov’s hacking beyond a reasonable doubt.

And they did it using the same kind of evidence cited in the Mueller indictment.

The crime scene

Start with the crime scene: the servers of the two filing agencies victimized in the hack-and-trade, Toppan Merrill and Donnelly Financial.

According to the trial record, neither figured out they had been hacked on their own. As the FBI had tried to do for months beforehand in the case of the DNC, a government agency, the SEC, had to tell them about it. The SEC had seen a number of Russians making big, improbable stock trades from clients of the two filing agencies, all in the same direction, and wanted to know why. So it sent subpoenas to both companies.

As the DNC did with CrowdStrike in 2016, both filing agencies hired an outside incident response contractor — Kroll Cyber in the case of Toppan Merrill, Ankura in the case of Donnelly Financial — to conduct an investigation.

The lead investigators from those two contractors were the first witnesses at trial. Each explained how they had been brought in in 2019 and described what they found as they began investigating the available logs, which went back six months, a year, and two years, depending on the type and company. The witness from Kroll described finding signs of hacking in Toppan Merrill’s logs:

The Ankura witness described how they first found the account of employee Julie Soma had been compromised, then used the IP addresses associated with that compromise to find other employees whose accounts were used to download reports or other unauthorized activity.

In sum, the two incident response witnesses described providing the FBI with the forensic details of their investigation — precisely the same thing that CrowdStrike provided to FBI from the DNC hack. There’s not even evidence that they shared a full image of the filing agencies’ servers (though an FBI agent described going back to Donnelly to search for the domain names behind the intrusions that Kroll had found at Toppan Merrill), which was one of the first conspiracy theories about the DNC hack Republicans championed: that the FBI failed to adequately investigate the DNC hack because it didn’t insist on seizing the actual victim servers during the middle of an election.

The forensic evidence wasn’t the only evidence submitted at trial from the crime scene. One after another of the employees whose credentials had been misused testified. Each described why they normally accessed customer records, if at all, how and when they would normally access such records, and from what locations they might access corporate servers remotely, including their use of the corporate VPN. Julie Soma — the Donnelly employee whose credentials were used most often to download customer filings — described that she would never have done what was done in this case, download one after another filing from Donnelly customers in alphabetical order.

Q. Would you ever go from client to client and alphabetically access those types of documents?

A. No.

Both interview records from the Mueller investigation (one, two, three) and documents from the Michael Sussmann case show that the FBI did similar interviews in the DNC hack. The Douglass Mackey trial, too, featured witnesses describing how the Hillary campaign identified that attack on the campaign as well.

In proving their case against John Podesta’s hacker, DOJ presented witness testimony that eliminated insiders as the culprit.

Fingerprinting

Having established the forensic data tied to intruders through the incident response contractors, prosecutors then called FBI agents as witnesses to describe how — largely through the use of IP addresses obtained using subpoenas or pen registers and the materials found in the suspects’ iCloud accounts — they tied Klyushin’s company, M-13, to both the hacking and the trading.

The trading was fairly easy: the co-conspirators accessed the two online brokers used to execute the trades under their own names and from IP addresses tied to M-13. An SEC witness described in detail how trades always shortly followed hacks but preceded the public filing of earnings statements.

Tying M-13 to the hacking took a few more steps.

For the hacking conducted via the domains Kroll identified, the FBI first found the account that registered the domains. Each was registered under a different name, but each of the names were based on a Latvian-based email service and used similar naming conventions. Each had been accessed from the same set of 3 IP addresses.

For IPs that Kroll identified, the FBI found BitLaunch servers created by an account in the name of Andrea Neumann, which was controlled from one of the same IP addresses that had registered the domain names. The FBI got search warrants to obtain images of those BitLaunch servers.

Another IP address used to steal filings, several FBI agents explained, was from an Italian-run VPN, AirVPN. The FBI used a pen register to show that someone accessed AirVPN from the M-13 IP address during the same period when the AirVPN IP was stealing records from the filing companies. The FBI also showed that Klyushin had accessed his bank at the same time from that same IP address. The FBI also showed that eight common IP addresses had accessed Ermakov’s iTunes account and the AirVPN IP address (in this case, the access was not at the same time because the FBI only had a pen register on the VPN for two months in 2020). While FBI witnesses couldn’t show that the specific activity tied to an AirVPN IP at the victim companies tied back to M-13, they did show that both Klyushin and Ermakov routinely used AirVPN.

Plus there were the filing thefts — noted above — that were done on May 9, 2018 using the same IP address that, four minutes earlier, had downloaded an Apple update from Ermakov’s iTunes account. As I’ve noted repeatedly, before Ermakov was first indicted by Mueller, he had already left a smoking gun in the servers at Donnelly in the form of IP activity that the FBI obtained over a year later inside the US.

In fact, much of the evidence used to prove this case (particularly establishing the close relationship between the conspirators) came from Apple, including WhatsApp chats saved in Klyushin and other co-conspirators’ iCloud accounts. We know Mueller used the same source of evidence. In March of this year, emails stolen by hacktivists revealed, Apple informed another of the GRU officers charged in the DNC hack that the FBI had obtained material from his Apple account in April 2018, in advance of the Mueller indictment.

The indictment likely also relied on warrants served on Google, especially on Ermakov’s account. The Mueller indictment (as well as the later anti-doping one) attributes much of the reconnaissance conducted in advance of the hacks to Ermakov: the names of some victims; information on the DNC, the Democratic Party, and Hillary; how to use PowerShell (which would be used against Toppan Merrill); and CrowdStrike’s reporting on GRU tools. If he did this research via Google, it would all be accessible with a warrant served on the US tech company.

The getaway car

One pervasive conspiracy theory about the Mueller indictment stems from testimony that Shawn Henry gave to the House Intelligence Committee in December 2017, describing that Crowdstrike did not see the data exfiltrated from the DNC servers. Denialists claim that is proof that the information was never exfiltrated by the GRU hackers. The conspiracy theory is ridiculous in any case, since there were so many other Russian hacks involving so many other servers, including servers run by Google and Amazon that had a different kind of visibility on the hack (something that Henry alluded to in his testimony), and since the indictment describes that the DNC hackers destroyed logs to cover their tracks.

But the Klyushin trial featured testimony about a tool used in the hack-and-trade conspiracy that has a parallel in the DNC hack: the AMS panel, hidden behind an overseas middle server, which the Mueller indictment described this way:

X-Agent malware implanted on the DCCC network transmitted information from the victims’ computers to a GRU-leased server located in Arizona. The Conspirators referred to this server as their “AMS” panel. KOZACHEK, MALYSHEV, and their co-conspirators logged into the AMS panel to use X-Agent’s keylog and screenshot functions in the course of monitoring and surveilling activity on the DCCC computers. The keylog function allowed the Conspirators to capture keystrokes entered by DCCC employees. The screenshot function allowed the Conspirators to take pictures of the DCCC employees’ computer screens.

[snip]

On or about April 19, 2016, KOZACHEK, YERSHOV, and their co-conspirators remotely configured an overseas computer to relay communications between X-Agent malware and the AMS panel and then tested X-Agent’s ability to connect to this computer. The Conspirators referred to this computer as a “middle server.” The middle server acted as a proxy to obscure the connection between malware at the DCCC and the Conspirators’ AMS panel. On or about April 20, 2016, the Conspirators directed X-Agent malware on the DCCC computers to connect to this middle server and receive directions from the Conspirators.

[snip]

For example, on or about April 22, 2016, the Conspirators compressed gigabytes of data from DNC computers, including opposition research. The Conspirators later moved the compressed DNC data using X-Tunnel to a GRU-leased computer located in Illinois.

In the hack-and-trade conspiracy, the hackers set up a similar structure, using the servers given names like “developingcloud” and “finshopland” as reverse proxies, with a final server behind them all executing orders on the hacked servers at Toppan Merrill (and the implication is, Donnelly, though the forensics came from Toppan Merrill via Kroll). The “computers numbered 1 through 7” in what follows are the servers identified by Kroll stealing earnings filings from Toppan Merrill.

A. So this is a digital depiction of the servers that I examined on the right there, so they each have a number on them, 1 through 9.

Q. Let me focus you first on the computers numbered 1 through 7. Do you see them there?

A. Yes.

Q. Are they kind of in a sideways V configuration?

A. Yes.

Q. Okay. And what do computers 1 through 7 show on this Exhibit DDD?

A. They functioned as gatekeepers for the furthest machine to the right, server number 8.

Q. And when you say “gatekeeper,” is there a technical term for that?

A. Yes. So the technical term is a “reverse proxy.”

Q. Can you explain to the jury, in a easy for me to understand way, what a reverse proxy or gatekeeper is in this chart, 1 through 7.

A. Yes. So in this chart, it would function — so the seven that are in that V formation, they would pass traffic to server number 8, if it was coming from an infected machine; and if it was something else, it would send the traffic to some other website.

This structure would have made it impossible for Toppan Merrill to understand the source or function of the anomalous traffic on its servers because any attempt to do so would be redirected away from the control server.

But not the FBI, because they obtained images of the servers with a warrant.

The forensic witness describing this structure showed, command by command, that the forensic clues identified by Kroll on the Toppan Merrill servers were controlled via that final server running PowerShell (the same tool that Mueller alleged Ermakov researched during the DNC hacks in 2016).

Q. And is there something on this log that you found that tells you the name of the program that was running on the victim’s computer at Toppan Merrill?

A. Yes, the process name line, and that reads rdtevc.

Q. And is process another name for computer program?

A. Yes.

Q. So this is a log that shows that a program named RDTEVC was running on a Toppan Merrill computer, right?

A. Yes.

Q. But it’s stored in the hacker computer?

[snip]

Q. And what does PowerShell do? You can call it anything, right? You can call it RDTEVC?

A. That’s probably a randomly chosen name.

Q. But no matter what it’s called, what does it do?

A. So it allows it to be remotely controlled and accessed.

Q. Allows what to be remotely controlled and accessed?

A. The infected machine.

The same forensic expert explained that he didn’t find any downloads of stolen files.

But he also explained why.

He had also found secure tunnels, readily available but similar in function to a proprietary GRU tool Crowdstrike found in the DNC server. As he described, these would be used to transfer data in encrypted form, making it impossible to identify the content of the data while it was in transit.

Q. Mr. Uitto, are you familiar with the concept of exfiltration?

A. Yes.

Q. Big word, but what does it mean?

A. It means to steal data, take data.

Q. And in your review, did you find evidence — you told Mr. Nemtsev you didn’t find evidence of the taking of data from the victim computers to these particular hacker servers; is that right?

A. That’s right, but I did see secure tunnels that were created.

Q. So when you say there were secure tunnels, were you able to tell what was going through those secure tunnels?

A. No.

Q. Those were encrypted, right?

A. Yes.

Q. So you actually don’t know whether or not there was financial information in those tunnels?

A. That’s correct.

Q. Or sports scores or anything?

A. That’s correct.

Q. It’s encrypted.

A. Yes.

[snip]

Q. What role does encryption serve in this hacker architecture?

[snip]

A. Yes, so it can be used to hide data or information.

Q. So if it’s encrypted, we can’t know what’s being passed?

To prove the hack, you would have to — and FBI did, in both cases — prove that the stolen data made it to the end point.

This testimony is important for more than explaining where you’d need to look to find proof of a hack (at the end points). It shows the import of understanding not just the crime scene and those end points, but the infrastructure used to control the hack and exfiltrate the data. With both the hack-and-trade conspiracy and the hack of the DNC, the FBI got forensics about the victim from the incident response contractors, but they obtained the data from these external servers directly, with warrants.

The denialists looking for proof in the DNC server were focused on just the crime scene, but not what I’ve likened to a getaway car, one to which the FBI had direct access but Crowdstrike did not.

Follow the money

Another specialized kind of fingerprint prosecutors used to prove the case against Klyushin parallels the one in the Mueller indictment (and, really, virtually all hacking cases these days): the cryptocurrency trail. As the Mueller indictment explained, the hackers who targeted the DNC used the same cryptocurrency account to pay for different parts of their infrastructure, thereby showing they were all related.

The funds used to pay for the dcleaks.com domain originated from an account at an online cryptocurrency service that the Conspirators also used to fund the lease of a virtual private server registered with the operational email account [email protected]. The dirbinsaabol email account was also used to register the john356gh URL-shortening account used by LUKASHEV to spearphish the Clinton Campaign chairman and other campaign-related individuals.

[snip]

For example, between on or about March 14, 2016 and April 28, 2016, the Conspirators used the same pool of bitcoin funds to purchase a virtual private network (“VPN”) account and to lease a server in Malaysia. In or around June 2016, the Conspirators used the Malaysian server to host the dcleaks.com website. On or about July 6, 2016, the Conspirators used the VPN to log into the @Guccifer_2 Twitter account. The Conspirators opened that VPN account from the same server that was also used to register malicious domains for the hacking of the DCCC and DNC networks.

By following the money, prosecutors were able to show the jury how these pieces of infrastructure fit together.

In the case of the hack-and-trade, the conspirators did nothing fancy to launder the cryptocurrency used in the operation. The servers obtained in the name of Andrea Neumann were paid using three successive cryptocurrency accounts, each with different names but accessed from the same IP address. The third name was Wan Connie. An interlocked Wan Connie email account had been accessed from M-13’s IP address. So while the cryptocurrency itself couldn’t tie the conspirators to the hack, the interlocked infrastructure did.

The conspiracy

To prove the hack, prosecutors at trial showed how the FBI had used evidence from the crime scene, the “getaway” car, the money trail, and evidence obtained at the end point from iCloud accounts to tie the hack back to Ermakov personally and M-13 more generally. The biggest smoking gun came from matching the IP addresses to which Ermakov got his iTunes updates to the infrastructure used in the hack (or, in the case of the May 9, 2018 thefts, directly to someone exploiting Julie Soma’s stolen credentials.

All that was left in the Klyushin case was proving the conspiracy, showing that Klyushin and others had used this stolen information to make millions by trading in advance of earnings announcements. This would be the functional equivalent of tying the records stolen from Democrats (and some Republicans) to their release via Guccifer 2.0, dcleaks, and WikiLeaks.

At Klyushin’s trial, the government proved the conspiracy via two means: an SEC analyst presented a bunch of coma-inducing analysis showing how the trades attributed to online brokerage accounts that Klyushin and others had in their own names lined up with the thefts. The analyst explained that odds of seeing those trading patterns would be virtually impossible.

More spectacularly, prosecutors introduced Klyushin’s role with a bunch of pictures establishing that he was “besties” with Ermakov (and, eventually, that there were unencrypted and encrypted communications, along with a picture of Klyushin’s yacht, sent via Ermkaov to two guys in St. Petersburg who didn’t work for M-13 but who were making the same pattern of trades); I looked at some of that evidence here. One picture found in Klyushin’s account showed Ermakov, crashed on a chair, wearing an M-13 sticker, taken in the same period as some of the logs provided by Kroll showed hacking activity. About the only thing the FBI found in Ermakov’s iCloud account was the online brokerage account used to execute the insider trading, in Klyushin’s name, but that tied him to the trading side of the conspiracy.

As their trades began to attract attention, Ermakov and another M-13 employee attempted to craft cover stories, evidence of which prosecutors found via Apple. Prosecutors even introduced Threema chats in which Ermakov told Klyushin, his boss, not to share details about their trading clients or he might end up a defendant in a trial.

He did.

And at that trial, prosecutors were able to prove a hacking conspiracy against Klyushin using evidence and victim testimony from the crime scene, but also from other data readily available with a subpoena or warrant inside the US.

Update: Tweaked language describing secure tunnels.

“$$$$$$:” Josh Dawsey Comes Full Circle on Trump’s Fundraising Corruption

I’m going to share something I’ve been laughing to myself about for months, since before I wrote this post on how the financial aspect of Jack Smith’s investigation would be a way to break through the otherwise formidable wall of lawyer-witnesses between investigators and Trump’s crimes.

There’s a reason why the fundraising aspect of Trump’s Big Lie has been accessible to investigators, even beyond the fact that there’s boatloads of financial evidence available with a subpoena. That’s because reporters, including Josh Dawsey, were able to track Trump’s fundraising in real time back in 2020, and when they saw what he was doing, they asked the Director of Communications for Trump’s campaign, Tim Murtaugh, about it.

Heck, Dawsey even wrote a story on December 1, 2020, over a month before the Big Lie led to an insurrection, reporting on this scam.

President Trump’s political operation has raised more than $170 million since Election Day, using a blizzard of misleading appeals about the election to shatter fundraising records set during the campaign, according to people with knowledge of the contributions.

The influx of political donations is one reason that Trump and some allies are inclined to continue a legal onslaught and public relations blitz focused on baseless claims of election fraud, even as their attempts have repeatedly failed in court and as key states continue to certify wins for President-elect Joe Biden.

Much of the money raised since the election is likely to go into an account for the president to use on political activities after he leaves office, while some of the contributions will go toward what is left of the legal fight.

[snip]

The donations are purportedly being solicited for the Official Election Defense Fund, whose name is featured prominently atop the Trump campaign’s website.

There is no such account, however. The fundraising requests are being made by the Trump Make America Great Again Committee, a joint fundraising effort of the Trump campaign and the Republican National Committee. As of Nov. 18, that committee also shares its funds with Save America, a new leadership PAC that Trump set up in early November and that he can use to fund his activities after the presidency.

Dawsey appears to have gotten no response from Murtaugh.

What happened with his inquiry instead — along with one Politico’s Maggie Severns sent on November 11 and a follow-up question CNN’s Jeremy Diamond sent on November 24 — is that Murtaugh, who could have no conceivable attorney client privilege, sent the query to Justin Clark, who otherwise would have attorney-client privilege, along with a bunch of other senior campaign officials, to ask whether they should “still ignore” press inquiries about the fundraising.

In the case of Dawsey’s email, they said things like this to each other:

On Nov 30, 2020, at 7:03 PM, Tim Murtaugh <[email protected]> wrote:

I side with no comment. He’s going to write about the split and if we say stuff about legal expenses it will serve to highlight the argument that the fundraising pitch is misleading.

From: Jason Miller <jmi[email protected]> Sent: Monday, November 30, 2020 7:24 PM

To: Tim Murtaugh <[email protected]> Cc: Sean Dollman <[email protected]>; Justin Clark <[email protected]>; Bill Stepien <[email protected]>

Subject: Re: [EXTERNAL]$$$$$$

Fair points. Sean -what are the reporting deadlines for these respective entities -12/15? It will be tougher to dodge such answers after reporters can find it themselves.

[snip]

Re: [EXTERNAL]$$$$$$

We should talk tomorrow about whether to just announce this by press release like we would any other fundraising announcement. If we have the numbers we can discuss how the breakdown among entities needs to be messaged. Also key, as Jason pointed out, that POTUS is on board with how it will be described. [my emphasis]

In response to Dawsey’s query back on November 30, 2020, Murtaugh, Clark, Jason Miller, CFO Sean Dollman, and Campaign Manager Bill Stepien exchanged emails recognizing that the fundraising pitch they were using was misleading, strategizing how they were going to continue to distract journalists from the misleading aspect of their pitches after they had to disclose their fundraising, and noting that they were going to ask Trump if he was comfortable with them fluffing journalists on how they were misleading small donors.

And Murtaugh, because he had no conceivable privilege in these exchanges, sent this exchange to the January 6 Committee and, I assume, to DOJ when they subpoenaed him.

That’s why I find it hilarious that Dawsey, in a report on a new set of subpoenas sent out in March that follow ones sent in December or November and September, wonders whether prosecutors will find the same kind of damning evidence that Trump’s campaign knew they were engaged in fraud as the Steve Bannon Build the Wall fraud did.

It’s unclear whether prosecutors will find similar kinds of evidence to support an indictment in this case.

I’m pretty sure they’ll find it, because that evidence has your name on it, Josh! One way Jack Smith will prove that Trump’s people knew they were lying to the rubes sending in their spare cash is by showing how panicked the campaign was when people like Dawsey started to ask about it.

WaPo suggests the subpoenas he describes disclose “the breadth of Smith’s investigation” and claims this prong of the investigation follows the release of the January 6 Committee Report.

The special counsel’s increased interest in fundraising follows the December release of the final report of the House select committee that investigated the Jan. 6 attack, which concluded that the Trump campaign and Republican National Committee’s joint fundraising operation brought in $250 million between the November election and Jan. 6, sending as many as 25 emails to supporters each day, many claiming that the election had been “rigged” or that Democrats had tried to steal the presidency and urging people to join the “Trump Army.” The Trump campaign sent several emails on Jan. 6 itself, including one declaring, “TODAY. This is our LAST CHANCE … The stakes have NEVER been higher. President Trump needs YOU to make a statement and publicly stand with him and FIGHT BACK.”

But not only have other outlets been reporting on it, CNN reported in December that this financial prong of the probe (which like NYT, they reported in September) had been going on, at that point, for a year, though the PAC prong of it may have post-dated the J6C presentation of this scam last June.

Another top prosecutor, JP Cooney, the former head of public corruption in the DC US Attorney’s Office, is overseeing a significant financial probe that Smith will take on. The probe includes examining the possible misuse of political contributions, according to some of the sources. The DC US Attorney’s Office, before the special counsel’s arrival, had examined potential financial crimes related to the January 6 riot, including possible money laundering and the support of rioters’ hotel stays and bus trips to Washington ahead of January 6.

In recent months, however, the financial investigation has sought information about Trump’s post-election Save America PAC and other funding of people who assisted Trump, according to subpoenas viewed by CNN. The financial investigation picked up steam as DOJ investigators enlisted cooperators months after the 2021 riot, one of the sources said.

That may be why Merrick Garland has been saying the investigation was following the money since October 2021, at which point the similar fraudulent fundraising investigation into Sidney Powell was reported by … the Washington Post.

The investigation into fundraising fraud is important by itself for the (outside) possibility it’ll lead Trump’s supporters to turn on him for cheating them. It could help to prove that Trump’s efforts to obstruct the vote certification on January 6 were “corrupt” by any definition of the term that the DC Circuit will ultimately adopt. But it likely also serves as a useful prosecutorial tool not just because it had a public-facing aspect that resulted in non-privileged conversations like the one above, but also because a goodly number of Trump people who weren’t implicated in the actual election theft were involved and cognizant of the financial fraud.

Trump Organization’s Other New York State Case

[NB: check the byline, thanks. /~Rayne]

Because we’re running in excess of 500 comments across the last three threads about Donald Trump’s indictment and arraignment in Manhattan, I want to post another thread for more discussion.

I’ll remind you now I’m not a lawyer and I don’t have either Marcy’s holographic memory or her skills at fine reading, nor bmaz’s experience representing criminal defendants.

But I want to bring up a couple subjects we haven’t discussed which are related to D.A. Alvin Bragg’s criminal suit against Trump.

First, only one member of the emptywheel community made a passing reference to Trump’s post-arraignment speech. They didn’t mention Trumps’ threats.

Yes, that’s plural Trumps, because Donnie Jr. and Eric posted in social media a photo of New York Supreme Court Justice Juan Merchan and his daughter on the day of his father’s arraignment. They targeted Merchan’s daughter for having worked for Kamala Harris’ campaign.

You’ll recall in July 2020 that U.S. District Court for the District of New Jersey Judge Esther Salas’ family members were attacked at their home – her husband was shot three times and her son shot and killed. The attacker was an aggressive anti-feminist who killed himself shortly after the attack on Salas’ family. He had been able to locate Salas’ home using her personal information publicly available online.

Last November, Congress passed the Daniel Anderl Judicial Security and Privacy Act of 2021, named after Salas’ son, to protect the personal information about judges on the internet.

Trump himself attacked Judge Merchan verbally in his speech from Mar-a-Lago after returning from his arraignment. He’d been strongly cautioned against threatening speech during his arraignment, but he fulminated anyhow about Merchan being a “Trump-hating judge with a Trump-hating wife and family,” repeating the same disparaging remarks he’d made earlier the same day over social media. He also targeted Merchan’s daughter.

Apart from the obvious potential incitement to violence the Trumps attempted against Judge Merchan and his family, was this a move to manipulate the Manhattan case?

Being a state jurist, Merchan and his family are not protected by the federal Judicial Security and Privacy Act. But I wonder if these threats made online and on an interstate basis were intended not just to influence the judge or D.A. Alvin Bragg.

Are there potential federal repercussions?

~ ~ ~

Secondly, the emptywheel community and the legal commentariat at large have sifted through Trump’s indictment and the statement of facts. The amount of related discussion across social media has been exhausting.

However community member c-i-v-i-l shared a link to a thread by University of Texas Professor of Law Lee Kovarsky which checked me short and made me rethink the 34 count indictment.

You can catch the thread on the Wayback Machine at this Internet Archive link (I won’t make you go to Elmo’s House of Doge Nazi Bar for this).

What gave me pause was Kovarsky’s analysis of preemption and the matrix of possible underlying crime(s) which Bragg did not disclose but underpin the charges Bragg filed against Trump.

Here’s what the matrix looked like, with Not-Trump = Pecker, Cohen, etc. according to Kovarsky:

(1) federal tax law violation by Trump (2) federal tax law violation by Not-Trump
(3) state tax law violation by Trump (4) state tax law violation by Not-Trump
(5) federal election law violation by Trump (6) federal election law violation by Not-Trump
(7) state election law violation by Trump (8) state election law violation by Not-Trump

Kovarsky made a lot of sense to a non-lawyer like me as he pointed out where others’ arguments about preemption are weak and what’s most likely as a preemption.

And then it clicked, all the tumblers fell into place.

In my uneducated opinion, the underlying crime isn’t one which can be preempted by federal law.

It’s a crime which has been prosecuted by the state of New York already.

It’s a crime which has already been prosecuted by the Manhattan D.A.

It’s a crime which explains the narrow emphasis on business records and falsification of the same, and a crime which relied on falsified business records.

And the crime looked like this:

These are counts for which Trump Organization and its CFO (TO CFO) was already convicted and is now serving time in Rikers Island.

It’s the April 2017 and April 2018 tax returns and related supporting documentation filed based on falsified business records for which TO CFO Allen Weisselberg has already been charged.

But so has the Trump Organization – the same organization which was responsible for the financial records of Donald J. Trump Revocable Trust, and the financial records of Donald J. Trump.

This January both Trump Corporation and the Trump Payroll Corporation were assessed a total of $1.6 million in fines for their tax fraud as part of Trump Organization.

Again, I’ll remind you I’m not a lawyer, don’t even play one on TV, though I’ve done bookkeeping for several small businesses in my career and worked for a lawyer and CFO. I’ve shared my speculation here knowing I’m going to get a drubbing from my partner in (im)moderation bmaz.

I don’t even know if I can muster much defense of my own argument here except that Weisselberg’s case is one which hasn’t been discussed much at all since Tuesday morning.

Yet it was reported on March 30 that Weisselberg had “dumped” his Trump-funded lawyer Nicholas Gravante or that the Trump organization had fired Weisselberg’s lawyer. Gravante was apparently too willing to let Weisselberg talk with Bragg’s office.

Weisselberg is now represented by Seth L. Rosenberg who was a former member of the Manhattan D.A.’s office; Rosenberg has been with Clayman & Rosenberg LLP since 1986.

The late shuffle of attorneys could be a sign that it is the tax fraud for which Trump Org has already been charged that is the predicate to Trump’s 34-count indictment.

This situation would explain why Bragg would have been reluctant to outline the underlying crime when the 34 counts against Trump were filed and Trump was arraigned. Trump has already been manipulating Weisselberg through the legal representation Trump organization has been providing him; it’s reasonable to assume this is an attempt to throttle Weisselberg’s possible testimony against Trump.

What other crime might have been the predicate upon which the Manhattan D.A.’s charges would have relied if not the tax fraud charges against Trump Organization?

What other underlying crime would avoid preemption?

Trump’s People Have Attempted to Cover Up That He Cheated to Cover Up Cheating in 2016 at Least Six Times

Among the things Trump said in his tweet yesterday complaining that he had been “indicated” is that his criminal prosecution was “a continuing attack on our once free and fair elections.”

Thanks to the former President for reminding us what the charges against him, in part, are about: That he cheated to win.

Whether it would have made a difference or not, Donald Trump believed it sufficiently important to lie to American voters about fucking two women– both Karen McDougal and Stormy Daniels — that both were paid in the last months of his 2016 campaign to prevent voters from finding out.

Paying his former sex partners to hide from voters that he cheated on Melania is not, itself, illegal.

Having corporations pay sex workers for the purpose of benefitting a political campaign is. The company that owned the National Enquirer paid for the first payment, to McDougal; Trump Organization, by reimbursing the payment that Michael Cohen made, eventually paid for the second payment, to Daniels.

The charges brought against Trump in NY reportedly relate, at least in part, to the second payment — to the treatment of the reimbursement to Cohen as a legal retainer rather than a reimbursement for a political donation. That is, the cheapskate billionaire, who could have legally paid off the women himself, allegedly covered up his cover-up.

Trump’s eponymous corporate persons have already been found guilty of serving as personal slush funds. In 2019, he admitted the Trump Foundation had engaged in self-dealing. And last year, a jury convicted Trump Organization of compensating employees via untaxed benefits rather than salary.

The new charges against Trump aren’t so much unprecedented, as they simply charge Trump’s biological person with the same crimes for which his corporate persons have already been convicted.

But there’s more history here, too. On multiple occasions, agents of Donald Trump reportedly engaged in further attempts to cover-up this cover-up.

Trump Organization withheld multiple documents from investigators. Most known documents that were withheld — such as the email showing Cohen had a substantive conversation with a Dmitri Peskov aide during the election — pertain to Russia, but it’s certainly possible they withheld others.

In 2018, in the days after SDNY seized phones that included recordings of conversations about the hush payments, Trump is suspected of floating a pardon to Cohen to keep him quiet, about this and about the impossibly lucrative Trump Tower deal both had lied to hide from voters in 2016.

In an email that day to Cohen, [Robert] Costello wrote that he had spoken with Giuliani.1026 Costello told Cohen the conversation was “Very Very Positive[.] You are ‘loved’. . . they are in our corner. . . . Sleep well tonight[], you have friends in high places.”1027

Cohen said that following these messages he believed he had the support of the White House if he continued to toe the party line, and he determined to stay on message and be part of the team.1028 At the time, Cohen’s understood that his legal fees were still being paid by the Trump Organization, which he said was important to him.1029 Cohen believed he needed the power of the President to take care of him, so he needed to defend the President and stay on message.1030

Cohen also recalled speaking with the President’s personal counsel about pardons after the searches of his home and office had occurred, at a time when the media had reported that pardon discussions were occurring at the White House.1031 Cohen told the President’s personal counsel he had been a loyal lawyer and servant, and he said that after the searches he was in an uncomfortable position and wanted to know what was in it for him.1032 According to Cohen, the President’s personal counsel responded that Cohen should stay on message, that the investigation was a witch hunt, and that everything would be fine.1033

Note that the payments for Cohen’s legal fees — which stopped after he pled guilty — are another expense that Trump Organization may not have accounted for properly.

Later in 2018, during the period where he was feigning cooperation with Mueller’s prosecutors but really just stalling past the midterm elections, Paul Manafort attempted to lie about some aspect of a different investigation

Manafort gave different versions of events surrounding an incident in the summer 2016 that was potentially relevant to the investigation: one version that was more incriminating was given prior to signing the plea agreement (on September 13, 2018), and another that was more benign was made after on October 5, 2018, after his plea. When confronted with the inconsistency by the government and his own counsel, Manafort largely retracted the second version.

A footnote in that discussion cites the Cohen plea, suggesting the 2016 conversations that Manafort lied to prosecutors in an attempt to spin pertained to these hush payments.

83 See United States v. Cohen, 18-cr-602 (S.D.N.Y. 2018); Information, United States v. Cohen, 18-cr602 (S.D.N.Y Aug. 21, 2018) (Doc. 2).

Unlike Cohen, of course, Manafort did get a pardon.

In the months after Cohen’s plea, Main DOJ attempted to interfere in the Cohen investigation repeatedly, as laid out in Geoffrey Berman’s book. They did so first on Rod Rosenstein’s orders, by demanding the SDNY rewrite Cohen’s statement of offense to hide the degree to which Trump ordered the hush payments (Rosenstein’s deputy, Ed O’Callaghan tried to eliminate all reference to Individual-1).

We then sent a copy to Rod Rosenstein, informing him that a plea was imminent. The next day, Khuzami, who was overseeing the case, received a call from O’Callaghan, Rosenstein’s principal deputy.

O’Callaghan was aggressive.

Why the length, he wanted to know. He argued that now that Cohen is pleading guilty we don’t need all this description.

[Robert] Khuzami responded, What exactly are you concerned about? O’Callaghan proceeded to identify specific allegations that he wanted removed, almost all referencing Individual-1.

It quickly became apparent to Khuzami that, contrary to what O’Callaghan professed, it wasn’t the overall length or detail of the document that concerned him; it was any mention of Individual-1.

[snip]

The team was tasked with the rewrite and stayed up most of the night. The revised information, now twenty-one pages, kept all of the charges but removed certain allegations, including allegations that Individual-1 acted “in concert with” and “coordinated with” Cohen on the illegal campaign contributions. The information now alleged that Cohen acted in concert and coordinated with “one or more members of the campaign.” But in the end, everything that truly needed to be in the information was still there.

Then, after Bill Barr came in, he amazingly tried to order SDNY to dismiss the charges against Cohen entirely, the functional equivalent of what he tried with Mike Flynn, undoing a successful criminal prosecution after the fact.

When Barr took over in February 2019, he not only tried to kill the ongoing investigations but—incredibly—suggested that Cohen’s conviction on campaign finance charges be reversed.

Barr summoned Rob Khuzami in late February to challenge the basis of Cohen’s plea as well as the reasoning behind pursuing similar campaign finance charges against other individuals. Khuzami was told to cease all investigative work on the campaign finance allegations until the Office of Legal Counsel, an important part of Main Justice, determined there was a legal basis for the campaign finance charges to which Cohen pleaded guilty—and until Barr determined there was a sufficient federal interest in pursuing charges against others.

Barr had Steven Engel write up an OLC opinion about the charges (which is likely one of the reasons SDNY didn’t charge Trump).

About six weeks later, Khuzami returned to DC for another meeting about Cohen. He was accompanied by Audrey Strauss, Russ Capone, and Edward “Ted” Diskant, Capone’s co-chief. Barr was in the room, along with Steven Engel, the head of the Office of Legal Counsel, and others from Main Justice. A fifteen-page memo, drafted by Engel’s office, had been provided to our team the day before, which they were still analyzing. I learned later that it was an intense meeting.

When SDNY refused to dismiss the case against Cohen, Barr tried to transfer the case to EDNY, under Richard Donoghue, so he could kill it.

 About a week after our office tussled with Barr and Engel, Barr attempted to do just that. Word was passed to me from one of Barr’s deputies that he wanted Richard Donoghue, the US Attorney for the Eastern District of New York (who would later transfer to Main Justice to work under Barr), to take over supervision of anything I was recused from.

At the same time that Barr was trying to cover up that Trump cheated to win in 2016, Republicans on the FEC were joining in the cover-up. After FEC’s General Counsel recommended acting on several complaints about the payments, Republican Commissioners Sean Cooksey and Trey Trainor refused to do so because, they said, Michael Cohen had already been prosecuted for it and, thanks to Trump’s own actions, there was a backlog of other complaints.

Before the Commission could consider the Office of General Counsel’s (“OGC”) recommendations in these matters, Mr. Cohen pleaded guilty to an eight-count criminal information,2 and in connection thereto admitted, among other things, to making an excessive contribution in violation of the Act by making the Clifford payment from his personal funds. 3 The plea hearing transcript includes a step by step review of how U.S. District Judge William Pauley verified the plea, confirming that a federal judge was sufficiently satisfied with the circumstances surrounding the plea deal and the responses given by Cohen at the hearing, including the explanations given by Cohen, count by count, during his allocution.4 Ultimately Mr. Cohen was sentenced to three years in prison and ordered to pay $1.39 million in restitution, $500,000 in forfeiture, and $100,000 in fines for two campaign finance violations (including the payment at issue in these matters) and other charges. In sum, the public record is complete with respect to the conduct at issue in these complaints, and Mr. Cohen has been punished by the government of the United States for the conduct at issue in these matters.

Thus, we concluded that pursuing these matters further was not the best use of agency resources.5 The Commission regularly dismisses matters where other government agencies have already adequately enforced and vindicated the Commission’s interests.6 Furthermore, by the time OGC’s recommendations came before us, the Commission was facing an extensive enforcement docket backlog resulting from a prolonged lack of a quorum, 7 and these matters were already statute-of-limitations imperiled.

This was one of 22 credible campaign finance allegations against Trump that Republicans refused to consider, nothing less than a partisan effort to make the leader of their party immune from all campaign finance rules.

There’s a lot of shite being written about how the indictment of a former President — for actions that stem from cheating to win — will test democracy.

But Trump’s serial cover-ups of his own actions in this and other matters already threaten democracy.

Trump is right: This is about free and fair elections. This is, like most of his allegedly criminal behavior, about his refusal to contest elections fairly. It’s about his corruption of the entire Republican Party, from top to bottom. And it’s about one of at least six times that Trump and his agents have tried to cover up that he cheated to win in 2016.

Pavlov’s Press Corps: Trump Once Again Got Journalists to Willingly Serve as His Incitement Mules

When we left the mainstream Trump press corps on Friday afternoon, they were all focused on the decision by Beryl Howell to rule that some of Evan Corcoran’s testimony in the stolen document case was crime-fraud excepted. Sure, there were journalists using wildly exaggerated descriptions for the uniqueness or surprise of the development. But, on Friday, reporters covering Trump’s legal woes were providing factual descriptions of actual newsworthy developments.

At the time, there was a general awareness that an indictment from Alvin Bragg may come next week, but the focus was the stolen documents investigation, in part because some journalists appear to believe that the crime-fraud ruling was some new sign that Jack Smith believed a crime had been committed.

Then, on Saturday morning, on his failing social media platform, the former President tweeted out incitement that included the following, in all caps:

  • An unsubstantiated claim about illegal leaks probably based on Fox News reporting about efforts to prepare for potential violence as a response to a Trump indictment next week
  • An attack on Alvin Bragg’s record on crime
  • A claim Bragg is funded by George Soros, the kind of coded antisemitism Trump is including in virtually all his communications these days
  • An assertion that he would be charged on something that “numerous other prosecutors!” had debunked as a fairy tale
  • An overstatement of the degree to which he is leading in polls and an admission that he is the “former” President
  • A day, Tuesday, when he would be “arrested”
  • A call to “protest,” invoking one of the same cries used to incite a coup attempt on January 6, “take our country back”

The response was almost instantaneous, with one after another journalist screen-capping the tweet in its entirety, some like Kyle Cheney adding no other commentary other than, “🚨 Trumps says he expects to be arrested Tuesday,” with the siren adding to its inflammatory nature. Jonathan Lemire repeated select newsworthy bits — while still including the full screen cap — without mentioning the coded slur on Soros or labeling the entire tweet as obvious incitement; Lemire parroted Trump’s all caps for the purported timing and quoted the incendiary line also associated with January 6.

NEW: Trump is suggesting that he will be ARRESTED ON TUESDAY due to Manhattan DA probe

This is historic: he would be the first former president to be indicted

He urges his supporters to “Protest, take our nation back!”

The absolutely most hysterical tweet magnifying Trump’s words unfiltered came from Jared Holt, a supposed expert on radicalization online, who introduced Trump’s full tweet onto Twitter (where Trump has not tweeted under his own ID since being permitted back on) with the following:

It will be hard to think of a bigger tech moderation failure than if Trump uses the platforms he’s been allowed back onto (FB, YouTube, Twitter) to incite protests again.

As of this morning, Holt’s tweet, along with the screen cap of Trump’s tweet unfiltered, had garnered 230,000 views on Twitter, over 300 RTs and almost 1,700 likes. Lemire’s had garnered 300 quote tweets, almost 600 RTs, over 2,000 likes, and 1.3M views. Cheney’s had garnered 770 quote tweets, 1,200 RTs, 7,400 likes, and 2.6M views.

By publishing such an inflammatory tweet on Truth Social, Trump was rightly calculating that even people like Holt would help to make his unfiltered words go viral on Twitter, as Trump has consistently done during the period when he still remained banned on Twitter.

It’s like Pavlov’s dogs, pure reflexive behavior at this point: The more incendiary Trump’s tweets, the more quickly journalists rush to disseminate them unfiltered on Twitter.

Remarkably, neither Lemire nor Cheney noted the import of the fact that a habitual liar like Trump was only claiming that he expected to be arrested Tuesday, not that he knew he would be.

In its report on the tweet, NYT noted, even in the subhead, that the timing was unclear, but given that at least one more witness is expected to testify on Monday, a Tuesday arrest is unlikely. It further described that Trump’s team was already in discussions about how to minimize the kind of showy arrest Trump was promising on Truth Social. NYT went on to report how Trump’s team simply guessed the date of his arrest.

His indictment by a Manhattan grand jury is expected, but its timing is unclear.

[snip]

Two hours later, a spokesman issued a statement saying that Mr. Trump had not written his post with direct knowledge of the timing of any arrest,

[snip]

Prosecutors working for Mr. Bragg have signaled that an indictment of Mr. Trump could be imminent. But they have not told Mr. Trump’s lawyers when the charges — expected to stem from a 2016 hush money payment to a porn star — would be sought or an arrest made, people with knowledge of the matter said. At least one more witness is expected to testify in front of the grand jury, which could delay an indictment, the people said.

One of the people said that even if the grand jury were to vote to indict the former president on Monday, a Tuesday surrender was unlikely, given the need to arrange timing, travel and other logistics.

The statement from Mr. Trump’s spokesman did not explain how he had landed on Tuesday as an arrest date. One person with knowledge of the matter said that Mr. Trump’s advisers had guessed that it could happen around then, and that someone might have relayed that to the former president.

A lawyer for Mr. Trump, Susan R. Necheles, said that his post had been based on news reports,

CNN, including Kaitlan Collins, who was among the first to help disseminate this incendiary tweet, later reported on the legal discussions going on inside Trump’s camp.

Trump’s defense team is expected to be notified following any possible indictment and then they would engage in negotiations for surrender and an initial appearance.

Another witness is expected to testify Monday before the grand jury investigating the hush money payments, according to a source familiar with the investigation. It is not clear whether this would be the final witness before it votes on a possible indictment.

Trump’s team has said repeatedly that he will not accept an invitation to testify before the grand jury. But multiple sources familiar with his legal team’s thinking says that if there is an indictment, he would negotiate an agreed upon surrender date with the district attorney’s office.

Trump’s team has been huddled all week planning for various scenarios, including Trump traveling to New York as well as having a remote hearing where he stays at Mar-a-Lago, according to sources familiar with the meetings.

Some members of his legal team are advising Trump to ask for a remote appearance for security reasons should an indictment occur but it is unclear if he would agree to that as he has also discussed with his team wanting to give a statement at the courthouse, sources said.

But before it got to those details, CNN described that the tweet was just a political ploy based off a guess about timing.

The former president has been agitating for his team to get his base riled up and believes that an indictment would help him politically, multiple people briefed on the matter told CNN.

[snip]

Joe Tacopina, an attorney for Trump, later said the former president had based his claims on press reports.

“No one tells us anything which is very frustrating. President Trump is basing his response on press reports,” Tacopina said in a statement to CNN.

In other words, the most newsworthy detail in Trump’s tweet (beyond the incitement) — the day he would be charged — was just made up, a guess based off the same information all the rest of us have. It was nevertheless treated as newsworthy by a slew of journalists needing an excuse to disseminate unfiltered incendiary speech on Twitter. And no one has since gone back to amend their original tweets to note that Trump’s claims to know the date of his arrest were a lie.

Trump’s team simply guessed what day he’ll be charged so as to make a call to fight newsworthy enough for kneejerk journalists to help it go viral for him.

It worked.

It works every single fucking time Trump does this.

Every. Single. Time.

And it’s not just the fact that a bunch of journalists served as willing data mules for Trump’s incendiary tweet, bringing it onto Twitter for him and helping it to go viral in unfiltered form.

It’s the other effect the tweet had on reporting about Trump.

First, everyone completely dropped the significant development in a case that even a number of diehard Republicans think has real gravity, Trump’s refusal to return all the classified documents he stole. That story — a burning story late into Friday — utterly disappeared by Saturday morning. Trump is so good at playing the media that he can effectively just dictate what even CNN and MSNBC will cover. And his tweet managed to make that more damaging investigation — an investigation led by a white man rather than a Black one, and so harder to use to mobilize Trump’s most racist followers — completely disappear from coverage. Journalists who had broken key details about the crime-fraud ruling Friday were instead asked to cover Trump’s tweet on the cable shows on Saturday.

And it wasn’t just cable coverage that Trump’s incendiary tweet managed to dictate. One after another politician — Kevin McCarthy, Mike Pence, Elise Stefanik (who released then deleted multiple drafts before hers was sufficiently dripping in obsequious propaganda) — was forced to comment on the made up news that Trump has a date when he’ll be indicted. Even poor Asa Hutchinson, who was trying hard to launch a Presidential run that didn’t define itself entirely in terms of Trump, was forced to answer multiple questions about Trump’s tweet.

In other words, by releasing the tweet, Trump not only made it the sole focus of cable programming, but made it the leading political question of the day. He made the presidential race about him again, exclusively about him. And in the case of McCarthy and Stefanik — both of whom cling to power by ceaselessly performing their obeisance to Trump — made it a matter of loyalty, a political litmus test that Trump supporters and opponents alike would be required to publicly adhere to.

Finally, all this was done without any mention of the actual facts of the case. All this was done in a way guaranteed to short-circuit rational thought — that’s the point.

To be clear, I don’t know all that many people who are sure this is going to be a substantive indictment, and there are real questions about how it is not time-barred. Perhaps Bragg will surprise us, but even many lefties are skeptical about the legal soundness and wisdom of this indictment.

But the substance of it stems from Trump fucking a sex worker.

He fucked a sex worker then paid her to cover it up. And then, in his efforts to cover that up, Trump engaged in some dodgy corporate accounting. There may be other exacerbating factors, like witness intimidation. But this is about trying to cover up the fact that he fucked a sex worker so it wouldn’t harm his chances of becoming President.

This case involves a crime for which, under Jeff Sessions, SDNY prosecuted Trump’s personal lawyer, Michael Cohen. One reason Trump wasn’t prosecuted as a result is that Bill Barr interfered; Barr even tried to force SDNY to reverse Cohen’s prosecution. And when Cohen went to jail because he refused to cover up Trump’s efforts to cover up fucking a sex worker, Trump cut him off, making him a pariah. Trump’s tweet falsely claimed that multiple prosecutors had deemed this case bullshit when instead he means his own Attorney General engaged in breathtaking corruption to protect him from it.

We don’t know what the indictment includes. But we know it involves fucking a sex worker. And all the journalists repeating Kevin McCarthy’s bullshit comments about investigating this investigation, or Mike Pence’s comments about how measly an indictment this would be, are not making them go on the record about whether they think voters should know if someone is spending significant money — several times what most Trump supporters make in a year — to cover up that they fucked a sex worker. Does Mike Pence, that god-fearing Christian, think a man who paid six figures then engaged in financial fraud to cover up that he fucked a sex worker should be President? Let’s ask him.

That’s not happening, in significant part because Trump has gotten journalists to shed all rationality when reporting on this story. The point is to make this about emotion, not facts, and journalists’ immediate instincts accommodated that.

Because Trump went on offensive, the substance of the indictment — however flimsy or not — has been largely absent from any reporting on the case.

Trump has these journalists trained to act reactively, without taking the time first to figure out whether he was again making shit up (as he was in this tweet). He has these journalists trained to mindlessly help him disseminate antisemitic incitement on platforms he’s not a part of, usually without commentary identifying that’s what he’s doing. Trump is so good at exploiting journalists who know better that he has made them participants in his incitement.

And it could well get people killed.

Updated: Added the circulation numbers for the three tweets disseminating Trump’s incitement.

Guo Wengui Arrested

Steve Bannon’s sometime partner Guo Wengui was arrested this morning on a sweeping indictment charging a $1 billion conspiracy, four sets of wire and security fraud charges each tied to a particularly business, as well as other money laundering charges.

It will take (me at least) some time to understand the full scope of the alleged behavior.

But for now, know that SDNY started seizing some of the proceeds of this fraud last year, and will now move to seize the yacht on which Bannon was arrested for his own fraud indictment, as well as some $36K mattresses Guo bought with the proceeds of his alleged fraud.

Update: Dave Weigel reminds that Guo found $75,000 to support CPAC, in spite of his claimed bankruptcy.

And the New Federal State of China, “declared” three years ago by Steve Bannon and exiled Chinese businessman Guo Wengui, made its first CPAC appearance with a $75,000 sponsorship, and two high-tech booths where volunteers handed out leaflets and explained why the battle to destroy the CCP had to be won in America.

That isn’t hyperbole. “The elimination of the Chinese Communist Party is essential in breaking the shackles of slavery imposed on the Chinese people,” Bannon said at the 2020 ceremony launching the NFSC, “and also, in bringing about peace to the international community and all mankind.” Guo, citing “Chinese culture,” pricked his finger and signed the declaration with his blood.

The Bannon-Wengui partnership burst into the headlines before the 2020 election, when Bannon was arrested on Guo’s yacht on charges that were later superseded by a pardon from President Trump. Guo declared bankruptcy last year, claiming that his wealth had dwindled to less than $100,000. But their flashy CPAC presentation, including some advocates who described fleeing China after the 1989 massacre at Tiananmen Square, found a receptive audience, and rhymed with what was happening on the main stage.

image_print