How Trump’s Search Worked, with Nifty Graphic

 

I did a really rough, overly-simplified graphic explaining what we know about Trump’s search.

Round-edged boxes above are documents. Ovals are physical objects. Grey boxes are the boxes that documents were contained in. Turquoise represents documents that were not known to be classified or otherwise proof of any crime except (possibly, but not necessarily) a violation of the Presidential Records Act. The other colors for documents show various kinds of criminal evidence that a document might represent.

The search warrant authorizes the seizure of evidence that Trump:

  • Retained classified documents he’s not authorized to have
  • Took government documents he was obligated under the Presidential Records Act to turn over to the Archives
  • Obstructed investigations and government functions by destroying or concealing evidence

But the search method permits agents to take documents marked as classified, the boxes they’re in (with everything else in the boxes), and other boxes stored in the same place.

Any physical documents with classification markings, along with any containers/boxes (including any other contents) in which such documents are located, as well as any other containers/boxes that are collectively stored or found together with the aforementioned documents and containers/boxes;

Agents were allowed to search any part of Mar-a-Lago that Trump or his staff could access, but two locations we know they searched were his office and a storage closet (which I’ve indicated by two separate boxes, above).

Here are things that were seized that might have been found in Trump’s office (indicated above by the top horizontal black box):

  • A leatherbound box (that long horizontal grey box in the graphic)
    • Top Secret/SCI documents in that box
    • Everything else in that box
    • Trump’s diplomatic passport
  • Photo albums
  • An Executive Grant of clemency for Roger Stone
    • Information in that executive grant of clemency about the President of France
  • A handwritten note
  • Other documents that include privileged information which may be evidence of obstruction

Here are things that were seized that might have been in that storage closet (indicated above by the bottom horizontal black box):

  • Boxes with Top Secret documents and everything else in the boxes
  • Boxes with Secret documents and everything else in the boxes
  • Boxes with Confidential documents and everything else in the boxes
  • All the other boxes stored with the boxes with classified documents
  • Boxes that happen to include Trump’s expired passports
  • Boxes that include privileged documents which may be evidence of obstruction

At least some of the agents that did the search were a filter team, which means they’re agents who are not part of the primary investigative team. Before any agents from the primary investigative team looked at the materials, these filter agents sorted through the evidence and determined what documents were privileged or what boxes included privileged information. Everything that was deemed unprivileged seems to have been inventoried on what I’ve called the “CLASS receipt” signed by a Special Agent. (See these two posts for further discussions of the two receipts.) Those are marked by the lefthand green box above.

Then, it appears that someone else (possibly the Supervisory Special Agent) reviewed those privileged documents and identified any that could be seized anyway — either because they included classified documents, or because they were proof of obstruction. According to a Fox News report, those were all inventoried on what I’ve called the “SSA receipt.” That seems to indicate that anything privileged, regardless of where it was discovered (for example, if it was in the leatherbound box, as I showed above), was seized and inventoried separately. I’ve bolded those in my list above and marked them with the righthand green box.

So the process for Trump’s search likely looked like this:

  1. Is it a government document dated January 20, 2017 to January 20, 2021? If no, go to step 2; if yes, go to step 3
  2. Is it classified, in a box w/classified, or a closet with classified?
  3. If yes, is it privileged?
  4. If no, then put in CLASS inventory
  5. If yes, is it proof of obstruction?
  6. If yes, then put it in the SSA inventory

Since the seizure, agents appear to have at least started the scope review — the process of sorting through which materials are proof that Trump stole classified information, documents otherwise covered by the Presidential Records Act, or proof of obstruction. The stuff that is not covered in the investigative scope, the FBI will return to Trump.

The first such items — his current diplomatic passport and two expired ones — were returned yesterday. Those likely were seized because they were stored in a box that either contained classified documents or were stored in a closet with other boxes that contained classified documents. Above, I’ve suggested that Trump’s diplo passport may have been seized in that leatherbound box where he allegedly kept TS/SCI documents, and I’ve shown how the other passports may have been in a box of documents that were in the storage closet with other boxes which had classified documents.

emptywheel Trump Espionage coverage

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

18 USC 793e in the Time of Shadow Brokers and Donald Trump

[from Rayne] Other Possible Classified Materials in Trump’s Safe

Trump’s Stolen Documents

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

[from Peterr] Merrick Garland Preaches to an Overseas Audience

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

Merrick Garland Calls Trump’s Bluff

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

[from Rayne] Expected Response is Expected: Trump and Right-Wing DARVO

DOJ’s June Mar-a-Lago Trip Helps Prove 18 USC 793e

The Likely Content of a Trump Search Affidavit

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

Some Likely Exacerbating Factors that Would Contribute to a Trump Search

FBI Executes a Search Warrant at 1100 S Ocean Blvd, Palm Beach, FL 33480

The ABCs (and Provisions e, f, and g) of the Espionage Act

Trump’s Latest Tirade Proves Any Temporary Restraining Order May Come Too Late

How Trump’s Search Worked, with Nifty Graphic

Trump’s Latest Tirade Proves Any Temporary Restraining Order May Come Too Late

At 12:49ET yesterday, the head of DOJ’s espionage section, Jay Bratt, informed Trump’s lawyers that the Agents who conducted the search of Mar-a-Lago had seized two expired passports and his still-active diplomatic passport; he invited someone to come get them after 2.

Later in the day, the former President went on his shitty website and claimed that the FBI, which attempted to return the passports within a week, had “stole” them.

Not long after, Norah O’Donnell tweeted that DOJ was not in possession of Trump’s passports.

In response, Trump’s spox Taylor Budowich accused O’Donnell of Fake News. He screencapped the Bratt letter to Trump’s lawyers showing that when the FBI discovered the passport, they made efforts to return them, effectively confirming O’Donnell’s statement that by the time of Trump’s tweet, the passports had been retrieved.

Given the way the warrant was written, there’s an easy explanation for how the FBI could have seized the passports. As I laid out in more detail here, the search worked from classified documents outward. The FBI was permitted to take any box that had a classified document in it, and any boxes stored where boxes storing classified documents were stashed.

Any physical documents with classification markings, along with any containers/boxes (including any other contents) in which such documents are located, as well as any other containers/boxes that are collectively stored or found together with the aforementioned documents and containers/boxes;

So if Trump stored his diplo passport in the leather-bound box where he stored the TS/SCI documents he stole, the FBI would have taken it under the search protocols. The same would happen if his expired passports were in a box in the storage closet where he stored his other stolen classified documents.

As the FBI explained in a statement, this is how it works.

In executing search warrants, the FBI follows search and seizure procedures ordered by courts, then returns items that do not need to be retained for law enforcement purposes.

And because Trump is a privileged white collar criminal suspect, he was lucky enough to get things that are out of scope immediately, rather than months later.

Unsurprisingly, then, Trump took an example of the FBI being diligent and used it to gin up outrage.

Worse for him, he is wasting his time.

As I noted Sunday, in response to similar searches implicating Donald Trump, lawyers filed for a Temporary Restraining Order within days.

I have been waiting all week for a docket to spring up with a Trump motion for a Temporary Restraining Order stalling any access to these files.

For comparison, the docket on a similar challenge from Michael Cohen in 2018 was created just 4 days after the search of his residences, and the discussions about the search began that same day.

On the same day as the seizures (April 9, 2018), the undersigned counsel requested in writing that the U.S. Attorney’s Office for the SDNY return all of the seized property and allow Mr. Cohen and his attorneys the opportunity to screen the materials for privilege, produce any relevant, non-privileged documents to the government, and provide a log of any documents withheld on privilege grounds. Id., ¶ 32, Ex. A. On Wednesday, April 11, 2018, the government responded by letter, rejecting defense counsel’s proposal and informing defense counsel that the government would begin to review the materials at noon on Friday, April 13, 2018. Id. ¶ 33, Ex. B. Accordingly, Mr. Cohen hereby moves for immediate injunctive and equitable relief seeking the opportunity to have his counsel review the seized documents in the first instance, before any review by any law enforcement personnel, for privilege and responsiveness, and, if the Court believes it necessary, for the appointment of a Special Master to supervise that review process.

Trump moved to intervene that same day, April 13, just four days after the seizures.

In the case of the search on Rudy’s phones, SDNY itself asked for a Special Master the next day (though Trump never intervened).

There have to be similar discussions going on now. There just have to be. Trump’s paucity of lawyers — and the conflict posed by the possibility that Evan Corcoran, his most competent current defense attorney, may be conflicted out by dint of having signed an affirmation that Trump turned over all his classified documents in June — cannot explain a full week delay.

But thus far, in spite of every media outlet and their mother filing motions to unseal the search affidavit itself, no one has started pushing to unseal an inevitable fight over access to the seized material. (Again, by comparison, the NYT filed to intervene the day the Cohen warrant docket was made public.)

There’s no sign of that happening here yet.

As of now, there are at most two unexplained sealed filings on the warrant docket.

Except they’re probably all accounted for: According to the government’s opposition to unsealing the warrant affidavit, Docket 57 contains all the other releasable materials (such DOJ’s own motion to seal), and the two prior entries are likely a motion to seal that filing and permission to do so. Each initially sealed docket entry in this docket has included two other sealed entries before it.

And time is running out for the Donald.

Contrary to what certain journalists have concluded from an email from Bratt that said, “the filter agents seized three passports belonging to President Trump,” that doesn’t mean a filter team currently working found the passports (though I assume a filter team may review materials seized under the SSA receipt a second time). It means that filter agents were used to do the search, as was reported contemporaneously. And now case agents — the people who determine which items are within scope of the investigation and which “items [] do not need to be retained for law enforcement purposes” — appear to be making scope determinations.

DOJ only needs to identify a single classified document to charge the former President under the Espionage Act. And given the way that Trump is ginning up outrage and attacks on FBI agents (which the government cited in explaining the need to keep the affidavit sealed), charging him with a single count indictment describing (hypothetically) the nuclear codes might be a good way to shut everyone up. They could use that to offer Trump a plea deal to lesser charges while they catalog other documents that each could bear a separate 10-year sentence.

If they’ve already singled out Trump’s passports, they surely are processing the stolen classified documents that could expose Trump to years in prison.

And Trump’s still at the manufactured outrage stage of his defense.

Update: Corrected time of Bratt’s email, which was shown with MDT.

emptywheel Trump Espionage coverage

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

18 USC 793e in the Time of Shadow Brokers and Donald Trump

[from Rayne] Other Possible Classified Materials in Trump’s Safe

Trump’s Stolen Documents

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

[from Peterr] Merrick Garland Preaches to an Overseas Audience

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

Merrick Garland Calls Trump’s Bluff

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

[from Rayne] Expected Response is Expected: Trump and Right-Wing DARVO

DOJ’s June Mar-a-Lago Trip Helps Prove 18 USC 793e

The Likely Content of a Trump Search Affidavit

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

Some Likely Exacerbating Factors that Would Contribute to a Trump Search

FBI Executes a Search Warrant at 1100 S Ocean Blvd, Palm Beach, FL 33480

The ABCs (and Provisions e, f, and g) of the Espionage Act

Trump’s Latest Tirade Proves Any Temporary Restraining Order May Come Too Late

The ABCs (and Provisions e, f, and g) of the Espionage Act

When Donald Trump wrote the Acting Archivist to give Kash Patel and John Solomon access to what they have since claimed were his Presidential Archives, he made a point of emphasizing that neither had been convicted of the crime that would disqualify them from accessing the records archived in official government archives at 700 Pennsylvania Avenue and elsewhere: “a crime that involves reviewing, retaining, removing, or destroying NARA records.”

Both individuals meet the requirements for access to records under 36 C.F.R. § 1270.44(a)(4).

That is, as far as we know, true. Neither has been convicted of a crime specifically involving access to the Archives.

But Solomon has long been publicly implicated in an investigation into a Dmitry Firtash-linked attempt to funnel Trump Russian-provided dirt. And The Hill’s review of his work included many details that might allow DOJ to treat him as something other than a journalist in that investigation.

As for Kash, at least in April 2021, he was reportedly under investigation for leaking classified information, something that might have led the government to strip his clearance if they hadn’t already.

Both would be wildly inappropriate people to give preferential access to Trump’s Presidential archives. But they nevertheless would qualify under statute.

But Trump wasn’t writing to give Kash and Solomon access to his Archives. His letter explicitly stated he was giving them access to, “Presidential records of my administration.” A week ago, the FBI carted away 27 boxes of “Presidential records of [Trump’s] administration” that had not been properly turned over to the custody of the Archives for safe keeping.

Those details from Trump’s letter, plus new reporting on the events of June, adds to the possibly that this letter was an attempt to retroactively justify access to classified records that, in addition to documents pertaining to the Russian investigation, also likely included even more sensitive documents.

In a largely insipid storyline of the search, Christina Bobb described the WaPo about DOJ’s request after touring the storage closet in which Trump was hoarding classified documents differently than previous, anonymous explanations that likely also come from her.

Bobb told The Post that the group toured the storage facility, opening boxes and flipping through the records inside. She said Justice Department officials indicated they did not believe the storage unit was properly secured, so Trump officials added a lock to the facility.

By description, that’s not (as earlier reported) a request that Trump buy a bigger lock. It almost certainly was a reminder that classified information must be stored according to certain guidelines. DOJ’s letter probably even included a citation to 20 CFR § 2001.43, which describes (among other things) the standard of lock that must be used to store classified documents (italicized below).

(a) General. Classified information shall be stored only under conditions designed to deter and detect unauthorized access to the information. Storage at overseas locations shall be at U.S. Government-controlled facilities unless otherwise stipulated in treaties or international agreements. Overseas storage standards for facilities under a Chief of Mission are promulgated under the authority of the Overseas Security Policy Board.

(b) Requirements for physical protection–

(1) Top Secret. Top Secret information shall be stored in a GSA-approved security container, a vault built to Federal Standard (FED STD) 832, or an open storage area constructed in accordance with Sec. 2001.53. In addition, supplemental controls are required as follows:

(i) For GSA-approved containers, one of the following supplemental controls:

(A) Inspection of the container every two hours by an employee cleared at least to the Secret level;

(B) An Intrusion Detection System (IDS) with the personnel responding to the alarm arriving within 15 minutes of the alarm annunciation. Acceptability of Intrusion Detection Equipment (IDE): All IDE must be in accordance with standards approved by ISOO. Government and proprietary installed, maintained, or furnished systems are subject to approval only by the agency head; or

(C) Security-In-Depth coverage of the area in which the container is located, provided the container is equipped with a lock meeting Federal Specification FF-L-2740.

(ii) For open storage areas covered by Security-In-Depth, an IDS with the personnel responding to the alarm arriving within 15 minutes of the alarm annunciation.

(iii) For open storage areas not covered by Security-In-Depth, personnel responding to the alarm shall arrive within five minutes of the alarm annunciation.

(2) Secret. Secret information shall be stored in the same manner as Top Secret information or, until October 1, 2012, in a non-GSA-approved container having a built-in combination lock or in a non-GSA-approved container secured with a rigid metal lockbar and an agency head approved padlock. Security-In-Depth is required in areas in which a non-GSA-approved container or open storage area is located. Except for storage in a GSA-approved container or a vault built to FED STD 832, one of the following supplemental controls is required:

(i) Inspection of the container or open storage area every four hours by an employee cleared at least to the Secret level; or

(ii) An IDS with the personnel responding to the alarm arriving within 30 minutes of the alarm annunciation.

(3) Confidential. Confidential information shall be stored in the same manner as prescribed for Top Secret or Secret information except that supplemental controls are not required.

(c) Combinations. Use and maintenance of dial-type locks and other changeable combination locks.

(1) Equipment in service. Combinations to dial-type locks shall be changed only by persons authorized access to the level of information protected unless other sufficient controls exist to prevent access to the lock or knowledge of the combination. Combinations shall be changed
under the following conditions:

(i) Whenever such equipment is placed into use;

(ii) Whenever a person knowing the combination no longer requires access to it unless other sufficient controls exist to prevent access to the lock; or

(iii) Whenever a combination has been subject to possible unauthorized disclosure.

(2) Equipment out of service. When security equipment is taken out of service, it shall be inspected to ensure that no classified information remains and the combination lock should be reset to a standard combination of 50-25-50 for built-in combination locks or 10- 20-30 for combination padlocks.

(d) Key operated locks. When special circumstances exist, an agency head may approve the use of key operated locks for the storage of Secret and Confidential information. Whenever such locks are used, administrative procedures for the control and accounting of keys and locks shall be included in implementing regulations required under section 5.4(d)(2) of the Order. [my emphasis]

This section of 32 CFR Parts 2001 and 2003 gets cited in search warrant affidavits for 18 USC 793e; here’s how it appeared, for example, in Reality Winner’s search warrant:

32 C.F.R. Parts 2001 and 2003 regulate the handling of classified information. Specifically, 32 C.F.R. § 2001.43, titled “Storage,” regulates the physical protection of classified information. This section prescribes that Secret and Top Secret information “shall be stored in a GSA-approved security container, a vault built to Federal Standard (FMD STD) 832, or an open storage area constructed in accordance with § 2001.53.” It also requires periodic inspection of the container and the use of an Intrusion Detection System, among other things.

In Trump’s search warrant, a similar paragraph or one following it would include language about how, when the head of DOJ’s Espionage division, Jay Bratt, went and inspected Trump’s storage facility storing documents classified at least at the Secret level on June 3, he found some easily picked lock from WalMart or whatever it was on the door.

Given that the email Bratt sent Trump on June 8 did not say, buy a new lock but instead said, you’re not complying with the requirements for storing classified information, it may also have made a request for proof that someone with clearance at the Secret level was coming to check his stash of documents every 4 hours (see the language bolded above). A refusal to provide that proof voluntarily (because Trump wasn’t complying) may explain why DOJ subpoenaed Trump for such information, reportedly on June 22. Or they may have had other reason to worry, such as Kash Patel’s claims, made on May 4, to have specific knowledge of which documents Trump had returned (which, if Kash’s clearance got stripped when he was under investigation for leaking, he would have no legal basis to know).

But DOJ did subpoena Trump for two months of security footage. And it turned out to show people moving documents in and out of the closet seemingly in conjunction of requests for DOJ.

The Justice Department also subpoenaed surveillance footage from Mar-a-Lago recorded over a 60-day period, including views from outside the storage room. According to a person briefed on the matter, the footage showed that, after one instance in which Justice Department officials were in contact with Mr. Trump’s team, boxes were moved in and out of the room.

That activity prompted concern among investigators about the handling of the material. It is not clear when precisely the footage was from during the lengthy back-and-forth between Justice Department officials and Mr. Trump’s advisers, or whether the subpoena to Mr. Trump seeking additional documents had already been issued.

Given that Trump had no reason to expect that DOJ would ask to see this storage closet on June 3, the moving of boxes may reflect an effort to hide the classified documents from the lawyer who affirmed there were no classified documents there, rather than an effort to hide them from DOJ (in which case the lawyer in question, possibly the suddenly-silent Evan Corcoran, would be in a legal conflict with Trump and might be forced to testify against him).

Which brings us to what is still a chicken-and-egg moment, which might be any of the following:

  • Trump refused to provide surveillance video voluntarily knowing it wouldn’t show compliance with the CFR but would show damning information, which led DOJ to subpoena it, which led to the discovery of uncleared people accessing classified materials (a violation of 18 USC 793f or g, in addition to the violation of 793e)
  • A Trump lawyer realizing the email about CFR compliance meant Trump was in trouble and needed to cover his tracks
  • DOJ finding other reason to be concerned, such as the Kash comments from May seeming to reflect personal knowledge of Trump’s classified documents or Trump’s letter to the Archives reflecting plans to give two people about whom DOJ would have particularized security concerns access to “Presidential records of my administration”

Like I said, thus far it’s a chicken-and-egg thing, but all these things came to a head in late June.

Ultimately, on June 19, Trump filed paperwork that provides the appearance of official access for Kash and Solomon, and (reportedly on June 22), DOJ served a subpoena asking for records showing who had entered and exited the closet. On June 22, so by reports, the same day that Trump got the subpoena but three days after Trump gave Kash the access, Kash went public with his claim to be accessing Trump’s records at the Archive, which is not what the letter asks for.

The problem, though, is that Trump was no longer an original classification authority after January 20 — even his own clearance would be limited! So while he could give Kash and Solomon monitored, privileged access at the Archives (because, while they were both security concerns, they had never been convicted of stealing records from the Archives), Trump had no authority to give them access to the Presidential records at his golf resort, because they included classified records that neither had clearance to access much less a need to know.

Here are all the ways that 18 USC 793 of the Espionage Act add to someone’s liability if they share classified information with people not entitled to receive it,

(d)Whoever, lawfully having possession of, access to, control over, or being entrusted with any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, or note relating to the national defense, or information relating to the national defense which information the possessor has reason to believe could be used to the injury of the United States or to the advantage of any foreign nation, willfully communicates, delivers, transmits or causes to be communicated, delivered, or transmitted or attempts to communicate, deliver, transmit or cause to be communicated, delivered or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it on demand to the officer or employee of the United States entitled to receive it; or

(e)Whoever having unauthorized possession of, access to, or control over any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, or note relating to the national defense, or information relating to the national defense which information the possessor has reason to believe could be used to the injury of the United States or to the advantage of any foreign nation, willfully communicates, delivers, transmits or causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee of the United States entitled to receive it; or

(f)Whoever, being entrusted with or having lawful possession or control of any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, note, or information, relating to the national defense, (1) through gross negligence permits the same to be removed from its proper place of custody or delivered to anyone in violation of his trust, or to be lost, stolen, abstracted, or destroyed, or (2) having knowledge that the same has been illegally removed from its proper place of custody or delivered to anyone in violation of its trust, or lost, or stolen, abstracted, or destroyed, and fails to make prompt report of such loss, theft, abstraction, or destruction to his superior officer—

Shall be fined under this title or imprisoned not more than ten years, or both.

(g) If two or more persons conspire to violate any of the foregoing provisions of this section, and one or more of such persons do any act to effect the object of the conspiracy, each of the parties to such conspiracy shall be subject to the punishment provided for the offense which is the object of such conspiracy. [my emphasis]

Note, I included 18 USC 793d, but I think that under the Presidential Records Act, Trump no longer had authorization to store those documents. I included it because, if Trump pushed the point, he could be charged under that statute instead of 793e.

Both before and, especially, since this has blown up, Kash Patel and John Solomon have been the loudest purveyors of false claims that this is about classified information. Both were insisting in July, for example, that they knew that all the Russian-related documents Trump tried to declassify in the last minutes during which he still had authority had in fact been declassified and remained declassified. Kash, especially, knows that the Espionage Act is not about classified information anyway, but instead National Defense Information.

I still don’t think that these events are primarily about Kash and Solomon. But I think Trump’s efforts to have them continue to purvey false claims that he had not actually been implicated with improper ties to Russia may have led him to do stupid things that expanded his own (and their) liability under the Espionage Act.

DOJ could have written the warrant to convey that Trump was only under investigation for 18 USC 793e, the most obvious clause covering his refusal to give documents back. They did not. And all the people around Trump should be more worried about their own legal liability right now than spreading false claims that any attempt by Trump to declassify National Defense Information could change his legal exposure.

emptywheel Trump Espionage coverage

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

18 USC 793e in the Time of Shadow Brokers and Donald Trump

[from Rayne] Other Possible Classified Materials in Trump’s Safe

Trump’s Stolen Documents

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

[from Peterr] Merrick Garland Preaches to an Overseas Audience

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

Merrick Garland Calls Trump’s Bluff

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

[from Rayne] Expected Response is Expected: Trump and Right-Wing DARVO

DOJ’s June Mar-a-Lago Trip Helps Prove 18 USC 793e

The Likely Content of a Trump Search Affidavit

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

Some Likely Exacerbating Factors that Would Contribute to a Trump Search

FBI Executes a Search Warrant at 1100 S Ocean Blvd, Palm Beach, FL 33480

The ABCs (and Provisions e, f, and g) of the Espionage Act

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

Yesterday, I observed that the FBI gave the former President two different receipts for the search on his golf resort.

There’s the one consisting of five boxes and a separate category, “Documents,” not associated with any boxes, signed by the Supervisory Special Agent. There are no classified documents described. I’ll refer to that as the SSA Receipt in this post.

Then there’s the one that consists of 27 items, mostly boxes, many with sub-items, which are often descriptions of the kinds of classified documents contained in the box or the leather case they were seized in. It was signed by a Special Agent. I’ll refer to that as the CLASS Receipt in this post.

I suggested that one explanation for providing Trump two separate receipts might be if the SSA receipt covered evidence showing Trump violated 18 USC 1519, destruction, alteration, or falsification of records in Federal investigations, and the CLASS receipt covered evidence showing Trump violated 18 USC 793, retaining national defense information under the Espionage Act. I argued the two receipts would cover evidence responsive to crimes that might be charged in different venues, DC for the obstruction charge and SDFL for the Espionage charge.

The third statute on Trump’s warrant, 18 USC 2071, removal of official records would cover everything covered by the Presidential Records Act and would generally backstop everything seized under the other two statutes. It covers both. Consider it an umbrella charge.

Today Trump, in the form of a post on Truth Social and related stories shared to Trump-friendly media, has confirmed I’m right that there’s significance to the two separate receipts.

Trump-friendly outlets have explained that “the former president’s team was informed” that the materials seized via what I’ve called the SSA receipt “contain information covered by attorney-client privilege” but that DOJ “opposed Trump lawyers’ request for the appointment of an independent, special master to review the records.”

The FBI seized boxes containing records covered by attorney-client privilege and potentially executive privilege during its raid of former President Trump’s Mar-a-Lago home, sources familiar with the investigation told Fox News, adding that the Justice Department opposed Trump lawyers’ request for the appointment of an independent, special master to review the records.

Sources familiar with the investigation told Fox News Saturday that the former president’s team was informed that boxes labeled A-14, A-26, A-43, A-13, A-33, and a set of documents—all seen on the final page of the FBI’s property receipt —contained information covered by attorney-client privilege.

[snip]

Sources told Fox News that some records could be covered by executive privilege, which gives the president of the United States and other officials within the executive branch the authority to withhold certain sensitive forms of advice and consultation between the president and senior advisers.

I believe there must be some truth to this because if Trump were making completely unsubstantiated claims, he would have made it more generally, claiming that all the boxes must include attorney-client privileged material. Furthermore, Trump’s claims to have watched the search via CCTV notwithstanding, it is highly unlikely Trump has CCTV coverage of his own office, bedroom, and a random storage closet such that he would know what’s in box A-14 (and so on the SSA receipt) versus what’s in box A-15 (which was on the CLASS receipt). Someone who knows the outcome of the search told Trump that one set, but not the other, has materials that are attorney-client privileged. That has to come from the government.

That doesn’t mean my larger hypothesis — that one receipt covered violations of the Espionage Act and the other covered obstruction — has been vindicated. On the contrary, DOJ may simply have chosen to put all records that include an attorney-client claim on a separate receipt so that, if Trump obtains a competent lawyer and demands the Special Master review he’s making a half-hearted request for now, DOJ can move forward with all the other evidence without a 9-month delay like the Special Master review of Rudy Giuliani’s phones necessitated. It would be a clever way of dealing with a very sensitive legal issue.

But I don’t think it’s as simple as that either. Bizarrely, Trump knows something about those boxes such that he’s trying to claim Executive Privilege, in addition to attorney-client privilege.

It’s a nonsense claim, legally. Probably every single box seized last Monday has materials covered by Executive Privilege in them, because every single box would include communications directly with Trump. But there is absolutely no basis for any EP claim for a single thing seized from Mar-a-Lago because the Presidential Records Act underlying the seizure is designed, specifically and especially, to make sure all the EP materials are preserved for history. It’s one of the reasons his refusal to turn over the materials that the Archives were asking for specifically is so insanely stupid, because it gave FBI no choice but to come seize this stuff. Trump’s not making an EP claim to try to delay DOJ’s access to the 27 items, which are mostly boxes, on the CLASS receipt. So he must have learned something about the materials itemized in the SSA receipt to which, in a frantic and transparently silly effort, he’s trying to delay DOJ’s access.

Trump’s announcement that the material on the SSA receipt seems to rule out another possible explanation for the SSA receipt I had been pondering, that it covered the materials that were particularly sensitive from a national security perspective, such as the information on nuclear weapons.

And it doesn’t rule out my hypothesis that that material was seized in the obstruction investigation. Indeed, in two ways, it might corroborate my hypothesis.

There are two theories of the 1519 charge. One, which NYU’s Ryan Goodman is championing, suspects it is about the investigation into Mar-a-Lago, criminalizing the effort in June to withhold materials. If that were the significance of the 1519 charge, separating out the communications between lawyers and NARA and DOJ might make sense, since those would be communications into this investigation. That said, there’d be no basis for an EP claim for any of that, since it all post-dated Trump’s ouster. And as soon as DOJ confirmed that some classified material had been knowingly withheld in June when his lawyers told DOJ that it was all turned over, there’d be a crime-fraud exception for those materials.

My theory of the 1519 charge — that it arose out of NARA’s discovery that Trump had attempted to destroy materials subpoenaed in past and present investigations — would similarly be likely to have attorney-client privileged documents. Take a few examples:

  • One thing Trump is likely to have withheld is the Perfect Transcript between him and Volodymyr Zelenskyy, which is something Congress was entitled to get during impeachment. That transcript was hidden from Congress by White House lawyer John Eisenberg, among other lawyers, thereby according the transcript a weak privilege claim, but one easily overcome by the obstructive nature of the choice to withhold it.
  • Another set of things we know were withheld from several investigations were documents showing sustained communications with Russia that should have been turned over by the Trump Organization. The most provable of those were the communications between Michael Cohen and Dmitri Peskov’s office in January 2016 (Mueller got his own copy via Microsoft). There’s probably correspondence regarding an invite Russian Deputy Prime Minister Sergei Prikhodko extended to Trump to attend Putin’s St. Petersburg Economic Forum in June 2016. The Trump Organization did not produce to SSCI the copy of Paul Manafort’s Securing the Victory email he sent to Rhona Graff. The subpoena response on all these issues was handled by Trump’s corporate lawyers, Alan Futerfas and Alan Garten, and so would be privileged — but also crime-fraud excepted — evidence that Trump obstructed various Russian investigations.
  • While one draft of Trump’s termination letter to Jim Comey was ultimately turned over to Mueller (after reports that the only extant copy was one preserved by DOJ lawyers), the Mueller Report narrative surrounding it makes it clear that Trump and Stephen Miller worked over several drafts before the one shared with others. Those earlier drafts were likely not turned over, in part because White House Counsel lawyers advised Trump that these drafts should “[n]ot [see the] light of day.” Again, that’s legal advice, but also proof of documents that were illegally withheld from the Mueller investigation.
  • I don’t want to even imagine what advice from Rudy Giuliani that Trump has withheld from various investigations, particularly pertaining to January 6. Most of that would be (shitty) legal advice. If it was also withheld from proper investigations, though, it’d also be proof of obstruction under 18 USC 1519.

In other words, aside from the documents Trump tried to rip up or eat or flush, many of Trump’s known violations of 18 USC 1519 would involve lawyers directly. Virtually every investigation into Trump was stymied by improper decisions by lawyers. And those withheld documents would once have been privileged, but they’d also be solid proof of obstruction.

And if Trump had reason to believe that DOJ, after predicating an investigation on all the evidence Trump had tried to rip up or eat or flush evidence, had sought and seized all the attorney-client protected materials that had insulated Trump from consequences for his past actions, it might explain one of the biggest puzzles from the last week. For some reason, Trump has worked far harder to obscure that this obstruction investigation exists than that he’s under investigation for a crime with the word “Espionage” in the title. For some reason, Trump is more afraid of the obstruction investigation than the Espionage Act investigation.

One possible explanation for that is that he fears the other secrets he’s been keeping more than proof that he stole a bunch of otherwise innocuous Top Secret documents.

Perhaps the most interesting thing about this latest complaint — first voiced on the 7th day after the search — is it shows that DOJ is in contact with someone presenting themself as Trump’s lawyer.

That’s not surprising. DOJ informed Trump of the search. Even for a simple criminal case into attempting to steal the election (assuming Trump could find someone who would confess to be his lawyer), DOJ would want to have discussions about how to proceed.

In this case, however, the crimes under investigation include, at a minimum, violations of the Espionage Act. DOJ always tries to find a way to resolve those from the get-go, because prosecutions about stolen classified information are always damaging to the equities you’re trying to protect. That’s all the more true in the unprecedented case where the suspect is the former President. At a minimum, DOJ likely has or will float Trump the offer of an offramp like an 18 USC 2701 guilty plea if he cooperates to tell the government about the whereabouts of all the classified documents he stole.

And if what Trump is trying to hide in the obstruction investigation is even more damning, as his behavior suggests it might be, DOJ might actually have enough leverage to make Donny to consider such an offer.

Still, the legal quiet has been making me nervous. I have been waiting all week for a docket to spring up with a Trump motion for a Temporary Restraining Order stalling any access to these files.

For comparison, the docket on a similar challenge from Michael Cohen in 2018 was created just 4 days after the search of his residences, and the discussions about the search began that same day.

On the same day as the seizures (April 9, 2018), the undersigned counsel requested in writing that the U.S. Attorney’s Office for the SDNY return all of the seized property and allow Mr. Cohen and his attorneys the opportunity to screen the materials for privilege, produce any relevant, non-privileged documents to the government, and provide a log of any documents withheld on privilege grounds. Id., ¶ 32, Ex. A. On Wednesday, April 11, 2018, the government responded by letter, rejecting defense counsel’s proposal and informing defense counsel that the government would begin to review the materials at noon on Friday, April 13, 2018. Id. ¶ 33, Ex. B. Accordingly, Mr. Cohen hereby moves for immediate injunctive and equitable relief seeking the opportunity to have his counsel review the seized documents in the first instance, before any review by any law enforcement personnel, for privilege and responsiveness, and, if the Court believes it necessary, for the appointment of a Special Master to supervise that review process.

Trump moved to intervene that same day, April 13, just four days after the seizures.

In the case of the search on Rudy’s phones, SDNY itself asked for a Special Master the next day (though Trump never intervened).

There have to be similar discussions going on now. There just have to be. Trump’s paucity of lawyers — and the conflict posed by the possibility that Evan Corcoran, his most competent current defense attorney, may be conflicted out by dint of having signed an affirmation that Trump turned over all his classified documents in June — cannot explain a full week delay.

But thus far, in spite of every media outlet and their mother filing motions to unseal the search affidavit itself, no one has started pushing to unseal an inevitable fight over access to the seized material. (Again, by comparison, the NYT filed to intervene the day the Cohen warrant docket was made public.)

So for whatever reasons, a full week has elapsed since a lawful search executed on the golf resort of the former President and the first we’re learning about legal discussions — aside from NYT’s revelation that Trump made a veiled threat against Merrick Garland on Thursday — is Trump’s complaint covering just the documents that don’t seem to implicate the Espionage Act.

Something has caused that discussion to remain sealed. And that, by itself, is remarkable.

Update: As klynn reminds in comments, another document that the Trump White House altered was the MemCon of the meeting between Trump and Sergey Lavrov in which he gave the Russians highly sensitive intelligence. I laid out what we know of that alteration, the fall-out, and Mueller’s investigation into it here. If my theory about the SSA receipt is right, that any remaining unaltered record of the meeting found at MAL would be on the SSA receipt. Except the alterations, in this case, are not yet known to involve an attorney, so would not be attorney-client privileged.

emptywheel Trump Espionage coverage

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

18 USC 793e in the Time of Shadow Brokers and Donald Trump

[from Rayne] Other Possible Classified Materials in Trump’s Safe

Trump’s Stolen Documents

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

[from Peterr] Merrick Garland Preaches to an Overseas Audience

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

Merrick Garland Calls Trump’s Bluff

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

[from Rayne] Expected Response is Expected: Trump and Right-Wing DARVO

DOJ’s June Mar-a-Lago Trip Helps Prove 18 USC 793e

The Likely Content of a Trump Search Affidavit

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

Some Likely Exacerbating Factors that Would Contribute to a Trump Search

FBI Executes a Search Warrant at 1100 S Ocean Blvd, Palm Beach, FL 33480

[Photo: National Security Agency, Ft. Meade, MD via Wikimedia]

18 USC 793e in the Time of Shadow Brokers and Donald Trump

Late last year, a Foreign Affairs article by former Principal Deputy Director of National Intelligence Sue Gordon and former DOD Chief of Staff Eric Rosenbach asserted that the files leaked in 2016 and 2017 by Shadow Brokers came from two NSA officers who brought the files home from work.

In two separate incidents, employees of an NSA unit that was then known as the Office of Tailored Access Operations—an outfit that conducts the agency’s most sensitive cybersurveillance operations—removed extremely powerful tools from top-secret NSA networks and, incredibly, took them home. Eventually, the Shadow Brokers—a mysterious hacking group with ties to Russian intelligence services—got their hands on some of the NSA tools and released them on the Internet. As one former TAO employee told The Washington Post, these were “the keys to the kingdom”—digital tools that would “undermine the security of a lot of major government and corporate networks both here and abroad.”

One such tool, known as “EternalBlue,” got into the wrong hands and has been used to unleash a scourge of ransomware attacks—in which hackers paralyze computer systems until their demands are met—that will plague the world for years to come. Two of the most destructive cyberattacks in history made use of tools that were based on EternalBlue: the so-called WannaCry attack, launched by North Korea in 2017, which caused major disruptions at the British National Health Service for at least a week, and the NotPetya attack, carried out that same year by Russian-backed operatives, which resulted in more than $10 billion in damage to the global economy and caused weeks of delays at the world’s largest shipping company, Maersk. [my emphasis]

That statement certainly doesn’t amount to official confirmation that that’s where the files came from (and I’ve been told that the scope of the files released by Shadow Brokers would have required at least one more source). But the piece is as close as anyone with direct knowledge of the matter — as Gordon would have had from the aftermath — has come to confirming on the record what several strands of reporting had laid out in 2016 and 2017: that the NSA files that were leaked and then redeployed in two devastating global cyberattacks came from two guys who brought highly classified files home from the NSA.

The two men in question, Nghia Pho and Hal Martin, were prosecuted under 18 USC 793e, likely the same part of the Espionage Act under which the former President is being investigated. Pho (who was prosecuted by Thomas Windom, one of the prosecutors currently leading the fake elector investigation) pled guilty in 2017 and was sentenced to 66 months in prison; he is processing through re-entry for release next month. Martin pled guilty in 2019 and was sentenced to 108 months in prison.

The government never formally claimed that either man caused hostile powers to obtain these files, much less voluntarily gave them to foreign actors. Yet it used 793e to hold them accountable for the damage their negligence caused.

There has never been any explanation of how the files from Martin would have gotten to the still unidentified entity that released them.

But there is part of an explanation how files from Pho got stolen. WSJ reported in 2017 that the Kaspersky Anti-Virus software Pho was running on his home computer led the Russian security firm to discover that Pho had the NSA’s hacking tools on the machine. Somehow (the implication is that Kaspersky alerted the Russian government) that discovery led Russian hackers to subsequently target Pho’s computer and steal the files. In response to the WSJ report, Kaspersky issued their own report (here’s a summary from Kim Zetter). It acknowledged that Kaspersky AV had pulled in NSA tools after triggering on a known indicator of NSA compromise (the report claimed, and you can choose to believe that or not, that Kaspersky had deleted the most interesting parts of the files obtained). But it also revealed that in that same period, Pho had briefly disabled his Kaspersky AV and downloaded a pirated copy of Microsoft Office, which led to at least one backdoor being loaded onto his computer via which hostile actors would have been able to steal the NSA’s crown jewels.

Whichever version of the story you believe, both confirm that Kaspersky AV provided a way to identify a computer storing known NSA hacking tools, which then led Pho — someone of sufficient seniority to be profiled by foreign intelligence services — to be targeted for compromise. Pho didn’t have to give the files he brought home from work to Russia and other malicious foreign entities. Merely by loading them onto his inadequately protected computer and doing a couple of other irresponsible things, he made the files available to be stolen and then used in one of the most devastating information operations in history. Pho’s own inconsistent motives didn’t matter; what mattered was that actions he took made it easy for malicious actors to pull off the kind of spying coup that normally takes recruiting a high-placed spy like Robert Hanssen or Aldrich Ames.

In the aftermath of the Shadow Brokers investigation, the government’s counterintelligence investigators may have begun to place more weight on the gravity of merely bringing home sensitive files, independent of any decision to share them with journalists or spies.

Consider the case of Terry Albury, the FBI Agent who shared a number of files on the FBI’s targeting of Muslims with The Intercept. As part of a plea agreement, the government charged Albury with two counts of 793e, one for a document about FBI informants that was ultimately published by The Intercept, and another (about an online terrorist recruiting platform) that Albury merely brought home. The government’s sentencing memo described the import of files he brought home but did not share with The Intercept this way:

The charged retention document relates to the online recruitment efforts of a terrorist organization. The defense asserts that Albury photographed materials “to the extent they impacted domestic counter-terrorism policy.” (Defense Pos. at 37). This, however, ignores the fact that he also took documents relating to global counterintelligence threats and force protection, as well as many documents that implicated particularly sensitive Foreign Intelligence Surveillance Act collection. The retention of these materials is particularly egregious because Albury’s pattern of behavior indicates that had the FBI not disrupted Albury and the threat he posed to our country’s safety and national security, his actions would have placed those materials in the public domain for consumption by anyone, foreign or domestic.

And in a declaration accompanying Albury’s sentencing, Bill Priestap raised the concern that by loading some of the files onto an Internet-accessible computer, Albury could have made them available to entities he had no intention of sharing them with.

The defendant had placed certain of these materials on a personal computing device that connects to the Internet, which creates additional concerns that the information has been or will be transmitted or acquired by individuals or groups not entitled to receive it.

This is the scenario that, one year earlier, was publicly offered as an explanation for the theft of the files behind The Shadow Brokers; someone brought sensitive files home and, without intending to, made them potentially available to foreign hackers or spies.

Albury was sentenced to four years in prison for bringing home 58 documents, of which 35 were classified Secret, and sending 25 documents, of which 16 were classified Secret, to the Intercept.

Then there’s the case of Daniel Hale, another Intercept source. Two years after the Shadow Brokers leaks (and five years after his leaks), he was charged with five counts of taking and sharing classified documents, including two counts of 793e tied to 11 documents he took and shared with the Intercept. Three of the documents published by The Intercept were classified Top Secret.

Hale pled guilty last year, just short of trial. As part of his sentencing process, the government argued that the baseline for his punishment should start from the punishments meted to those convicted solely of retaining National Defense Information. It tied Hale’s case to those of Martin and Pho explicitly.

Missing from Hale’s analysis are § 793 cases in which defendants received a Guidelines sentence for merely retaining national defense information. See, e.g., United States v. Ford, 288 F. App’x 54, 61 (4th Cir. 2008) (affirming 72-month sentence for retention of materials classified as Top Secret); United States v. Martin, 1:17-cr-69-RDB) (D. Md. 2019) (nine-year sentence for unlawful retention of Top Secret information); United States v. Pho, 1:17-cr-00631 (D. Md. 2018) (66-month sentence for unlawful retention of materials classified as Top Secret). See also United States v. Marshall, 3:17-cr-1 (S.D. TX 2018) (41-month sentence for unlawful retention of materials classified at the Secret level); United States v. Mehalba, 03-cr-10343-DPW (D. Ma. 2005) (20-month sentence in connection with plea for unlawful retention – not transmission – in violation of 793(e) and two counts of violating 18 U.S.C. 1001; court departed downward due to mental health of defendant).

Hale is more culpable than these defendants because he did not simply retain the classified documents, but he provided them to the Reporter knowing and intending that the documents would be published and made available to the world. The potential harm associated with Hale’s conduct is far more serious than mere retention, and therefore calls for a more significant sentence. [my emphasis]

Even in spite of a moving explanation for his actions, Hale was sentenced to 44 months in prison. Hale still has almost two years left on his sentence in Marion prison.

That focus on other retention cases from the Hale filing was among the most prominent national references to yet another case of someone prosecuted during the Trump Administration for taking classified files home from work, that of Weldon Marshall. Over the course of years of service in the Navy and then as a contractor in Afghanistan, Marshall shipped hard drives of classified materials home.

From the early 2000s, Marshall unlawfully retained classified items he obtained while serving in the U.S. Navy and while working for a military contractor. Marshall served in the U.S. Navy from approximately January 1999 to January 2004, during which time he had access to highly sensitive classified material, including documents describing U.S. nuclear command, control and communications. Those classified documents, including other highly sensitive documents classified at the Secret level, were downloaded onto a compact disc labeled “My Secret TACAMO Stuff.” He later unlawfully stored the compact disc in a house he owned in Liverpool, Texas. After he left the Navy, until his arrest in January 2017, Marshall worked for various companies that had contracts with the U.S. Department of Defense. While employed with these companies, Marshall provided information technology services on military bases in Afghanistan where he also had access to classified material. During his employment overseas, and particularly while he was located in Afghanistan, Marshall shipped hard drives to his Liverpool home. The hard drives contained documents and writings classified at the Secret level about flight and ground operations in Afghanistan. Marshall has held a Top Secret security clearance since approximately 2003 and a Secret security clearance since approximately 2002.

He appears to have been discovered when he took five Cisco switches home. After entering into a cooperation agreement and pleading guilty to one count of 793e, Marshall was (as noted above) sentenced to 41 months in prison. Marshall was released last year.

Outside DOJ, pundits have suggested that Trump’s actions are comparable to those of Sandy Berger, who like Trump stole files that belong to the National Archives and after some years pled guilty to a crime that Trump since made into a felony, or David Petraeus, who like Trump took home and stored highly classified materials in unsecured locations in his home. Such comparisons reflect the kind of elitist bias that fosters a system in which high profile people believe they are above the laws that get enforced for less powerful people.

But the cases I’ve laid out above — particularly the lesson Pho and Martin offer about how catastrophic it can be when someone brings classified files home and stores them insecurely, no matter their motives — are the background against which career espionage prosecutors at DOJ will be looking at Trump’s actions.

And while Trump allegedly brought home paper documents, rather than the digital files that Russian hackers could steal while sitting in Moscow, that doesn’t make his actions any less negligent. Since he was elected President, Mar-a-Lago became a ripe spying target, resulting in at least one prosecution. And two of the people he is most likely to have granted access to those files, John Solomon and Kash Patel, each pose known security concerns. Trump has done the analog equivalent of what Pho did: bring the crown jewels to a location already targeted by foreign intelligence services and store them in a way that can be easily back-doored. Like Pho, it doesn’t matter what Trump’s motivation for doing so was. Having done it, he made it ridiculously easy for malicious actors to simply come and take the files.

Under Attorneys General Jeff Sessions and Bill Barr, DOJ put renewed focus on prosecuting people who simply bring home large caches of sensitive documents. They did so in the wake of a costly lesson showing that the compromise of insecurely stored files can do as much damage as a high level recruited spy.

It’s a matter of equal justice that Trump be treated with the same gravity with which Martin and Pho and Albury and Hale and Marshall were treated under the Trump Administration, for doing precisely what Donald Trump is alleged to have done (albeit with far fewer and far less sensitive documents). But as the example of Shadow Brokers offers, it’s also a matter of urgent national security.

Obstruction: The Two-Receipt Search of the Former President’s Golf Resort

There are two separate receipts for the search of Mar-a-Lago signed, in the same minute, by Trump lawyer Christina Bobb.

There’s the one consisting of five boxes and a separate category, “Documents,” not associated with any boxes, signed by the Supervisory Special Agent. There are no classified documents described. I’ll refer to that as the SSA Receipt in this post.

Then there’s the one that consists of 27 items, mostly boxes, many with sub-items, which are often descriptions of the kinds of classified documents contained in the box or the leather case they were seized in. It was signed by a Special Agent. I’ll refer to that as the CLASS Receipt in this post.

Bobb signed them both at 6:19PM, so unless she’s a shitty lawyer, these receipts were presented to her together as one running receipt.

Whatever else the FBI is, their searches are methodical. They come in, secure the location, serially take pictures of the rooms being searched (so the criminal suspects don’t claim evidence was planted, as criminal suspects are wont to do), label the things to be searched, start sorting through items according to a search protocol to see if they’re covered by the warrant, then inventory the things being seized. In this case, there would have been another part of the process to make sure no attorney-client privileged materials were seized.

In the search of Trump’s house, at least 73 boxes appear to have been labeled (based on the highest box label number), but just 26 boxes were seized.

By all appearances, these two receipts stem from the same methodical search. For example, the documents listed as item 4 on SSA receipt are in the same overall inventory as everything else, but appear out of sequence. They likely bear some proximal relation to low-item numbers in the CLASS receipt — things like the Roger Stone clemency and the binders of photos. Perhaps they were all found in Trump’s office or residence. But they are on the SSA receipt.

The series of box labels crosses both receipts. For example, it appears that boxes A-14 and A-13, which appear in the SSA receipt, were labeled in close proximity and time as boxes A-12 and A-15, which are among the lowest numbered boxes on the CLASS receipt. But they got listed on the SSA receipt, where all boxes appear together as the final five items on the combined inventory, items 29 through 33.

I’d like to talk more about the search, but first let me spoil the punchline: One likely (though not the only) explanation for the two receipts has to do with the venue in which Trump’s suspected crimes were committed and therefore the ultimate destination of the seized materials, with the SSA receipt materials being sent to DC as evidence of 18 USC 1519 and the CLASS receipt materials being kept in Miami as evidence of multiple violations of the Espionage Act that occurred at Mar-a-Lago.

But let’s go back.

I believe this warrant is the totality of the search on Trump’s mansion. While File411 suspects there’s another warrant (or two), I don’t believe those authorize a search of Trump’s house, not least because Judicial Watch has only asked to unseal one, and Trump’s people will have told them what they wanted unsealed. Merrick Garland referred to unsealing the documents relating to Trump’s house, and I’d be surprised if he played word games to hide further search materials when Trump would literally have receipts to call out any such obfuscation. That doesn’t rule out that the other warrants identified by File411 were related searches, perhaps of locations where Trump’s stolen documents may have been moved, but I believe we’re looking at the totality of the physical search at Mar-a-Lago. Update, August 15: DOJ has now confirmed that this is an entirely separate ongoing investigation. Remember that lots of January 6 suspects live in Florida, so it could be something like that or an entirely different type of crime.

The warrant authorizes the FBI to search Trump’s office (the narcissist appears to have renamed it the 45 Office but it has been referred to as the bridal suite), all storage rooms (the one that Trump’s lawyers showed Jay Bratt when he visited in June is not identified by name), and anywhere else Trump or his staff might have stashed boxes or documents. We know from reports that that included Trump’s personal residence, but the FBI didn’t call it out by name. Curiously, the FBI made clear that when it said the search did not include spaces occupied by guests or other residents, they mean “currently,” as if there’s a room someone recently vacated that is of interest.

Attachment B, which describes the items to be searched for, is one of the things that may explain the two receipts. It starts by listing three crimes: 18 USC 793 (Gathering, transmitting or losing defense information, which is part of the Espionage Act), 18 USC 2071 (Concealment, removal, or mutilation [of official records] generally), and 18 USC 1519 (Destruction, alteration, or falsification of records in Federal investigations).

Despite the fact that every single leak to the press about the scope of the warrant claimed that two crimes were listed, “mishandling classified information” and the Presidential Records Act, those leaks were all false. The former was a transparent attempt to avoid saying the word “Espionage” and the latter is not listed on the warrant as a crime being investigated at all (though I would bet a great deal of money that it features prominently in the affidavit). 18 USC 2071, in this context, may serve as a proxy, criminalizing the removal of records covered by PRA. And one of the four bullets describing materials that can be seized, bullet c,  stems from PRA: “Any government and/or Presidential Record created between January 20, 2017, and January 20, 2021.” Because it would cover items implicated in the two other crimes, National Defense Information and evidence from Federal investigations, that bullet point serves as a larger umbrella in this search. If Trump tries to claim he declassified the items seized in the Espionage Act investigation, for example, the government will be able to say they still seized them lawfully given that bullet point and the inclusion of 18 USC 2071, because to still be at Mar-a-Lago at this point, they would have had to have been removed improperly from government control.

There are two bullet points scoping out materials relating to the Espionage count. Bullet point b authorizes the seizure of information about the storage of NDI or classified information.

Information, including communications in any form, regarding the retrieval, storage, or transmission of national defense information or classified material.

If Trump or his flunkies are charged under the Espionage Act, DOJ will have to rebut the claims being floated by Kash Patel and John Solomon that Trump declassified this material. One way to do that is to show that Trump or his lawyers instructed staffers to treat certain materials as if it was classified. If, for example, Trump put up post-it notes on his storage room saying “Danger: Sekrits. Keep Out,” it would prove that he was telling others to treat the documents with care. I’m only partly joking. We know there were efforts to prevent uncleared staffers from looking at classified information. Obtaining written proof of such instructions is one of the ways DOJ would prove that Trump did know this stuff remained classified. Even if those efforts were only enforced by his lawyers — the same lawyers who failed to turn over these materials in response to subpoena — it will be powerful evidence that those documents were being treated as if they remained classified.

The other bullet point authorizing evidence covered by the Espionage Act reminds me of Borges’s writings on classification.

Any physical documents with classification markings, along with any containers/boxes (including any other contents) in which such documents are located, as well as any other containers/boxes that are collectively stored or found together with the aforementioned documents and containers/boxes.

Effectively, this allows the FBI to seize documents with classification markings and then work out from there, seizing the box containing the document marked as classified, as well as the contents of the closet that a box containing a classified document was in. It’s fairly easy to understand why the FBI wrote it this way (and it may be tailored to overcome the justifications Trump made over the course of 18 months to try to retain certain materials). The President looks at — and in many cases, generates — a whole slew of things that are considered highly classified, but in a form that wouldn’t have classification marks on it, especially if he never shared it with a staffer. If Trump took notes with his Sharpie on a cocktail napkin during a phone call directly with Mohammed bin Salman, for example, it would not include classification marks, but it might be highly classified. So this bullet point allows FBI to seize stuff being treated the same way as documents that do have formal classification markings, which government classification experts can then apply the appropriate classification to.

How this might have worked in practice appears on the CLASS receipt. The second-most interesting item on the list (after the Roger Stone clemency that seems to have some tie to the French President) is the leather box in which the only documents inventoried as TS/SCI were stored.

Not all of these documents are TS/SCI; the inventory even notes that some are just classified. But given the way the warrant is written, the FBI was permitted to seize the entire box, which appears to contain Donald’s precious treasures, even if some of the documents in there are not labeled as classified. It may be that witnesses told the FBI of the existence of this box so the FBI knew to look for it. By seizing the entire box, the FBI would get things that might be even more sensitive than the TS/SCI stuff, but that don’t bear markings, like that hypothetical cocktail napkin with notes of Trump’s secret calls with MbS.

The thing is, these categories overlap. There may have led to some triage onsite about how to classify seized documents. I suggested that item 4 — documents — may have been stored with items 1 through 7 in Trump’s office or residence. If so, they could have been seized by proximal location. But they’re inventoried on the other receipt for some reason, potentially even taken out of a box or that leather case and seized separately as individual documents.

Similarly, boxes A-13 and A-14 were likely stored in close proximity to box A-15, which includes at least some Secret Documents, and box A-16, which includes at least some Top Secret Documents. So they could have been seized under the logic of proximity. But like item 4, they’re on a different receipt.

Which brings me to the final bullet describing the scope of the search (and back to my working hypothesis for the two different receipts, that the SSA receipt covers evidence of obstructive acts committed in DC). It authorizes the seizure of evidence of the destruction of records.

Any evidence of the knowing alteration, destruction, or concealment of any government and/or Presidential Records, or of any documents with classification markings.

This language comes right out of the obstruction statute, though leaves out the reference to “investigation[s] or proper administration:”

Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both.

This part of the warrant, not the reference to the Espionage Act, was the biggest secret of the week. I was not surprised that anonymous sources from the Trump camp soft-pedaled the word “Espionage.” It’s why I was pushing for pressure on Trump to release the warrant. It’s what I believed Trump most wanted to hide.

But remarkably, Trump’s leakers were hiding this part of the warrant even more aggressively. In the entire week of post-search coverage, there was never a hint that obstruction was on the warrant, too. The “Expert Explainers” gaming out what crimes might be on the warrant completely missed obstruction. I did too.

We shouldn’t have. The coverage of the Archives’ referral of Trump to DOJ described his destruction of evidence even more prominently than it did his theft of classified documents.

The National Archives and Records Administration has asked the Justice Department to examine Donald Trump’s handling of White House records, sparking discussions among federal law enforcement officials about whether they should investigate the former president for a possible crime, according to two people familiar with the matter.

The referral from the National Archives came amid recent revelations that officials recovered 15 boxes of materials from the former president’s Mar-a-Lago residence in Florida that were not handed back in to the government as they should have been, and that Trump had turned over other White House records that had been torn up. Archives officials suspected Trump had possibly violated laws concerning the handling of government documents — including those that might be considered classified — and reached out to the Justice Department, the people familiar with the matter said.

[snip]

Trump’s years-long defiance of the Presidential Records Act, which requires the preservation of memos, letters, notes, emails, faxes and other written communications related to a president’s official duties, has long raised concerns among historians and legal observers. His penchant for ripping up official documents was first reported by Politico in 2018, but it has drawn new scrutiny in recent weeks because of a House select committee’s investigation of the Jan. 6, 2021, attack on the U.S. Capitol.

The Washington Post reported late last month that some of the White House records the National Archives turned over to the committee appeared to have been torn apart and then taped back together. The Post later found — and the Archives confirmed — that officials had recovered 15 boxes of presidential records from Mar-a-Lago.

As described, by the time of its criminal referral, the Archives had already found that documents that were responsive to the January 6 Committee’s investigation (and so, derivatively, DOJ’s investigation of Trump personally) had been “altered, destroyed, or mutilated.” DOJ would have started this investigation knowing that Trump had attempted to destroy evidence implicating him in January 6 (though we actually have evidence of him attempting to destroy or alter evidence pertinent to other criminal investigations, too).

By description, when Trump tried to destroy evidence, he did so immediately, in the heat of the moment, in the White House. For that reason, and because the known federal investigations — his attempted coup on January 6, but also his ties to Russia, his coercion of Ukraine, even his inauguration graft — were all predicated in DC, the investigation into Trump’s obstruction of those investigations would be in DC too. That’s why I hypothesize that FBI may have inventoried everything and then, when compiling a final inventory to share with Trump, they distinguished between the suspected crimes that would have been committed in Florida, by storing classified information improperly and refusing to return it to the Federal government, and the suspected crimes that would have been committed in DC when — on January 20 or before, including between January 6 and January 20 — Trump ripped up, flushed, burned, or tried to eat incriminating evidence.

Unless Trump were to waive venue (which he would never do), any prosecution of Trump under the Espionage Act would happen in SDFL, because that’s where he illegally retained classified information after the government asked him to give it back. But any prosecution of Trump for obstruction would happen where the investigations he obstructed were and where he ripped up evidence, in DC.

Item 4, documents, might just be documents that bore visible signs of destruction that had some identifiable tie to January 6 or some other known investigation. They could even be classified! The obstruction bullet point includes classified documents! But they would have been seized, first and foremost, because they were evidence that Trump was trying to impede an investigation or some other government function by destroying evidence.

That has one more big implication, which may be why Trump’s team tried so hard to hide that FBI was looking for evidence of obstruction. There were also leaks (including leaks from the government side) that nothing on this search warrant pertains to January 6. Technically that’s true. Obstruction of the vote certification and conspiracy to defraud the government, the most obvious crimes covering Trump’s conduct leading up to and on January 6, aren’t on the warrant. But as that coverage of the original referral we all forgot to read makes clear, January 6 is at least one of the investigations that Trump is being investigated for obstructing. If the evidence of obstruction is being boxed up and sent back to DC where such an investigation would be predicated, then the evidence would thereby become available to investigators, both for evidence of Trump’s obstruction of an investigation, but also for evidence of Trump’s conduct as well.

Oh. And if Trump were found to have obstructed an investigation into conspiracy by destroying evidence, it might extend the statute of limitations on that conspiracy.

I wrote a long thread yesterday about how Trump epically fucked up by giving DOJ grave reasons to come search his home. DOJ would never have searched Mar-a-Lago for materials Trump withheld in violation of the PRA. They probably would never have searched MAL for evidence he withheld regarding January 6. But Trump kept refusing to turn over classified information DOJ knew he had, some of it reportedly incredibly sensitive. Trump dared Merrick Garland to come get those classified documents. And in so doing, Donald J. Trump gave the FBI urgent reason to come into his home to seize — along with at least 11 boxes containing classified documents — the evidence about January 6 and other investigations that is so sensitive Trump tried to destroy it before refusing to turn it over to the Archives.

Trump’s Stolen Documents

As you know doubt know, the Trump warrant released pursuant to order has been released.

It consists of:

  • A one-page warrant
  • The short Attachment A describing Mar-a-Lago
  • The Attachment B describing the various things for which the FBI can search
  • Two, potentially separate, search returns, one signed by the Supervisory Special Agent and the other signed by the Special Agent

Combined, the inventory may look like this:

  • 1) Roger Stone clemency
    • 1A) Information about the President of France (seemingly tied to the Stone clemency)
  • 2) Leatherbound box of documents
    • 2A) Various classified/TS/SCI documents
  • 3) Potential Presidential Record
  • 4) Documents
  • 5) Binder of photos
  • 6) Binder of photos
  • 7) Handwritten note
  • 8) Box labeled A-1
  • 9) Box labeled A-12
  • 10) Box labeled A-15
    • 10A) Miscellaneous Secret Documents
  • 11) Box labeled A-16
    • 11A) Miscellaneous Top Secret Documents
  • 12) Box labeled A-17
  • 13) Box labeled A-18
    • 13A) Miscellaneous Top Secret Documents
  • 14) Box labeled A-27
    • 14A) Miscellaneous Confidential Documents
  • 15) Box labeled A-28
    • 15A) Miscellaneous Secret Documents
  • 16) Box labeled A-30
  • 17) Box labeled A-32
  • 18) Box labeled A-35
  • 19) Box labeled A-23
    • Confidential Document
  • 20) Box labeled A-22
  • 21) Box labeled A-24
  • 22) Box labeled A-34
  • 23) Box labeled A-39
    • 23A) Miscellaneous Secret Documents
  • 24) Box labeled A-40
  • 25) Box labeled A-41
    • 25A) Miscellaneous Confidential Documents
  • 26) Box labeled A-42
    • 26A) Miscellaneous Top Secret Documents
  • 27) Box labeled A-71
  • 28) Box labeled A-73
    • 28A) Miscellaneous Top Secret Documents
  • 29) Box labeled A-14
  • 30) Box labeled A-26
  • 31) Box labeled A-43
  • 32) Box labeled A-13
  • 33) Box labeled A-33

I’m going to come back to this. But some big questions I have right now are:

  • Does the more cryptic receipt compiled by the Supervising Special Agent represent a separate subclass of documents, perhaps tied to more sensitive crimes?
  • Is there really a tie between a clemency document from Trump and the French President (presumably, but not definitely, Emanuel Macron)?
  • Do the boxes not shown to include classified information include documents of particular interest, or were they just collected under the search protocol?

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

On June 22, Kash Patel announced that he had just been made a representative for Trump at the National Archives. (h/t to Suburban Gal for these links)

I can tell you now that I am now officially a representative for Donald Trump at the National Archives. And I’m going to march down there — I’ve never told anyone this, because it just happened, and I’m going to identify every single document that they blocked from being declassified at the National Archives.

The next day, Kash described that that letter, making him Trump’s representative to the Archives, “just came in, literally before I came on the show” the day before.

[Update, August 15] Trump had informed the Archives three days earlier, on June 19, that Kash and Solomon would be added to his list of representatives.

As it happens, June 22 is also the same day that the FBI sent a subpoena to Mar-a-Lago for surveillance footage.

On June 22, the Trump Organization, the name for Mr. Trump’s family business, received a subpoena for surveillance footage from cameras at Mar-a-Lago. That footage was turned over, according to an official.

According to a John Solomon column that was actually the first to report details of this purported cooperation in June, the subpoena specifically asked for surveillance videos covering the room where Trump had stashed his stolen documents.

Around the same time, the Trump Organization, which owns Mar-a-Lago, received a request for surveillance video footage covering the locker and volunteered the footage to federal authorities, sources disclosed.

On June 24, two days after DOJ sent a subpoena for the surveillance footage, Betsy Woodruff Swan reported that it wasn’t just Kash who had been given privileged access to Trump’s Archives. Solomon had also been made Trump’s representative at the Archives.

That seeming coincidence — that the FBI formally asked for surveillance videos showing who had accessed Trump’s stash of stolen records on the same day that Kash and Solomon were officially added to the list of those who represented Trump’s interests with the Archives — may raise the stakes of Trump’s legal exposure significantly.

That’s because if Trump deliberately allowed people not permitted access to classified documents or his negligence allowed people to remove such documents, it would trigger other parts of the Espionage Act than the one that prohibits someone from stealing classified documents and refusing to give them back (and all are covered by the warrant).

(d)Whoever, lawfully having possession of, access to, control over, or being entrusted with any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, or note relating to the national defense, or information relating to the national defense which information the possessor has reason to believe could be used to the injury of the United States or to the advantage of any foreign nation, willfully communicates, delivers, transmits or causes to be communicated, delivered, or transmitted or attempts to communicate, deliver, transmit or cause to be communicated, delivered or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it on demand to the officer or employee of the United States entitled to receive it; or

[snip]

(f)Whoever, being entrusted with or having lawful possession or control of any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, note, or information, relating to the national defense, (1) through gross negligence permits the same to be removed from its proper place of custody or delivered to anyone in violation of his trust, or to be lost, stolen, abstracted, or destroyed, or (2) having knowledge that the same has been illegally removed from its proper place of custody or delivered to anyone in violation of its trust, or lost, or stolen, abstracted, or destroyed, and fails to make prompt report of such loss, theft, abstraction, or destruction to his superior officer—
Shall be fined under this title or imprisoned not more than ten years, or both.

Neither of these men would have been authorized to access classified documents, if they did, after January 20, 2021.

Solomon, of course, has come under scrutiny for his role as a mouthpiece for Russian-backed attacks on Joe Biden. While DOJ was not known to have obtained a warrant on him by April 2021, much could have happened after that.

Kash Patel did have the top levels of clearance until Trump left office. But at least by April 2021, Kash was reported to be under investigation for leaking classified information.

Patel repeatedly pressed intelligence agencies to release secrets that, in his view, showed that the president was being persecuted unfairly by critics. Ironically, he is now facing Justice Department investigation for possible improper disclosure of classified information, according to two knowledgeable sources who requested anonymity because of the sensitivity of the probe. The sources said the investigation resulted from a complaint made this year by an intelligence agency, but wouldn’t provide additional details.

Once that investigation was predicated, Kash would have been stripped of clearance, if he hadn’t already been.

Which means both the men that Trump picked to dig through his documents would pose grave security concerns.

And Kash, at least, is the single witness claiming — belatedly, starting in May — that Trump declassified this information. Before much of this became public, Kash claimed Trump had declassified it all, but just not marked it as declassified.

“Trump declassified whole sets of materials in anticipation of leaving government that he thought the American public should have the right to read themselves,” Patel told Breitbart News in a phone interview.

“The White House counsel failed to generate the paperwork to change the classification markings, but that doesn’t mean the information wasn’t declassified,” Patel said. “I was there with President Trump when he said ‘We are declassifying this information.’”

“This story is just another disinformation campaign designed to break the public trust in a president that lived on transparency. It’s yet another way to attack Trump and say he took classified information when he did not,” he added.

At the point he made those claims, in May, Kash demonstrated extensive familiarity with the content of that first batch of stolen classified documents that had been stashed at Mar-a-Lago for a year.

Patel did not want to get into what the specific documents were, predicting claims from the left that he was disclosing “classified” material, but said, “It’s information that Trump felt spoke to matters regarding everything from Russiagate to the Ukraine impeachment fiasco to major national security matters of great public importance — anything the president felt the American people had a right to know is in there and more.”

If Kash knows that first-hand — if Kash knows that because Trump let him wade through Top Secret documents he was no longer cleared to access — then Trump may have additional criminal liability.

Update: After a week of bullshit excuses, Trump — via John Solomon — is now offering a new bullshit excuse: That Trump had a standing order that everything he back to the residence in the White House was declassified. The claim is mostly interesting because Solomon — who wasn’t even at the White House! — is feeding it up.

Update: Added link to June 19 request.

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

I want to look at three ways that Attorney General Merrick Garland and DOJ spoke of Trump yesterday using language that acknowledges the possibility he will be indicted.

They were subtle, but consistent references based in DOJ’s policy, one Garland’s DOJ has adhered to inflexibly, about avoiding discussion of any suspect unless they have been charged.

First there was Garland’s statement. It was short, clocking in at fewer than 500 words.

Remarkably, it adhered to DOJ guidelines prohibiting the naming of uncharged individuals (though the motion to unseal did name Trump). Rather than referring to Donald J. Trump by name, the Attorney General referred to him, exclusively, as “the former President,” just as Tom Barrack’s charging documents do.

Garland reminded that everyone is entitled to the presumption of innocence.

All Americans are entitled to the evenhanded application of the law, to due process of the law, and to the presumption of innocence.

But the Attorney General also said that his DOJ is, using the present tense to describe an investigation of the man who used to be President, “applying the law evenly, without fear or favor.”

Faithful adherence to the rule of law is the bedrock principle of the Justice Department and of our democracy.

Upholding the rule of law means applying the law evenly, without fear or favor. Under my watch, that is precisely what the Justice Department is doing.

Applying the law evenly means that if someone steals classified documents and stores it in their basement, they get charged for it. And the invocation of “fear and favor” even as an attack against the Cincinnati FBI office was still being resolved suggests that the actuality of violence will not deter charges, if they are warranted.

After saying that (and rigorously adhering to rules about releasing the name of uncharged persons), Garland suggested that there “will” come a time when he will be able to, under the same rules, provide a more fulsome explanation.

Federal law, longstanding Department rules, and our ethical obligations prevent me from providing further details as to the basis of the search at this time.

[snip]

This is all I can say right now. More information will be made available in the appropriate way and at the appropriate time.

That description — the appropriate way, the appropriate time — is the way DOJ always refers to speaking through indictments.

There’s a third, less surprising instance of this in the motion to unseal. In a footnote to an argument in the body of the motion in favor of a First Amendment right of access to court filings, it notes there’s no 11th Circuit ruling on whether that right extends to sealed search-warrant affidavits “at the preindictment stage.” (Bart Gellman made this observation yesterday.)

2 In addition, the First Amendment provides a basis for the press and the public’s “right of access to criminal trial proceedings.” Chicago Tribune Co., 263 F.3d at 1310. However, this Circuit has not addressed whether the First Amendment right of access applies to sealed search warrant materials. See, e.g., Bennett v. United States, No. 12-61499-CIV, 2013 WL 3821625, at *3 (S.D. Fla. July 23, 2023) (“this Court has found no Eleventh Circuit decisions addressing whether a First Amendment right of access extends to sealed search-warrant affidavits, particularly at the preindictment stage”).

This is normal language in all fights over unsealing search warrants, one we’re seeing in the fight to unseal the Project Veritas warrants in SDNY, among others. DOJ will rely on it heavily come Monday, when it makes a bid for more time before unsealing the affidavit itself.

But like Garland’s own language, it describes this search as one not to collect information Trump forgot to return, but one conducted at a preindictment phase. That envisions at least the possibility of a time when the calculus about providing more information might be different because the former President would have been indicted.

I’m pointing to this language not as a guarantee that Trump will be indicted. And I don’t think Garland is saying that either. For example, he might also approve the release of information at such time that this investigation is closed.

But particularly the language that Garland used is language that lays the groundwork for the possibility that the former President of the United States might, because DOJ was “applying the law evenly,” be indicted.

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

After Merrick Garland called Trump’s bluff yesterday, multiple outlets reported that DOJ was looking for documents relating to nuclear weapons.

Classified documents relating to nuclear weapons were among the items FBI agents sought in a search of former president Donald Trump’s Florida residence on Monday, according to people familiar with the investigation.

[snip]

Material about nuclear weapons is especially sensitive and usually restricted to a small number of government officials, experts said. Publicizing details about U.S. weapons could provide an intelligence road map to adversaries seeking to build ways of countering those systems. And other countries might view exposing their nuclear secrets as a threat, experts said.

It’s unclear whether this information is coming from investigators trying to demonstrate what a no-brainer this search was, people who’ve otherwise seen the Attachment listing items to seize, or from Trump’s camp in an effort to pre-empt damage from when this will be released. With few exceptions, most details made public about the search thus far have come from Trump’s side.

But the report that FBI showed probable cause to believe Trump was hoarding a document or documents pertaining to nukes has several significant legal and political implications.

First, it makes it far more likely that Trump has violated, and can be proven to have violated, part of the Espionage Act, 18 USC 793.

In my post describing the likely content of an affidavit justifying a search of the former President, I noted that somewhere in there, the FBI would have had to anticipate and rule out the possibility that Trump simply declassified these documents which, if Trump could prove it, would render the documents simply stolen documents covered by the Presidential Records Act.

  • Some explanation of why DOJ believes that these documents weren’t actually declassified by Trump before he stole them

But the fact that these are nuclear documents, under the Atomic Energy Act, Trump cannot declassify them by himself. They’re “restricted documents,” the one kind of document that’s true of. Here are threads by Kel McClanahan and Cheryl Rofer explaining the distinctions — even Chelsea Manning weighed in! As McClanahan likened it, nuclear documents are protected by two padlocks, and Trump only had the legal key to one of those padlocks.

So by showing probable cause that Trump had stolen at least one document pertaining to nuclear weapons, FBI would accomplish that task: Trump could not claim to have declassified any such documents, because he cannot have declassified them by himself.

Now consider how it impacts Trump’s exposure under the Espionage Act. As I laid out here, to prove someone violated the Espionage Act, you don’t actually prove they were refusing to return classified information; you prove they had what is called “National Defense Information.” Even if Trump claimed to have declassified the documents, if the Agency in question (here, likely DOD or DOE) still believed the information to be classified and still treated as such, it could still qualify as NDI. But ultimately, a jury gets to decide whether something is NDI or not. One key difference between the first and second Joshua Schulte trials, for example, is that DOJ relied not on expert testimony to prove that he leaked or was trying to leak NDI, but rather on the logic of why the government would want to keep information about its assets secret. I thought it was one of the areas where the second prosecution was vastly more effective than the first.

There are few easier concepts to explain to a juror than that you need to keep information about nuclear weapons safe, and that doing so pertains to the national defense.

Then there’s the backstory. Early in the Trump Administration, there were reports that Trump had a scheme (one that involved all Trump’s sketchiest flunkies, including Mike Flynn) to transfer sensitive nuclear reactor technology to Saudi Arabia. The Oversight Committee conducted an investigation, the results of which, with the hindsight of Mohammed bin Salman’s $2 billion investment in a paper-thin Jared Kushner finance scheme and the Foreign Agent charges against Tom Barrack, look all the more suspect.

In 2017, President Trump’s son-in-law, Jared Kushner, orchestrated a visit to Saudi Arabia as the President’s first overseas trip. Mr. Kushner also met on his own with then-Deputy Crown Prince Mohammed bin Salman, who subsequently ousted his cousin, Mohammed bin Nayef, launched a crackdown against dozens of Saudi royal family members, and reportedly bragged that Mr. Kushner was “in his pocket.”

In October 2018, the brutal murder of Washington Post columnist Jamal Khashoggi was met with equivocation by President Trump and other top Administration officials. This month, the White House ignored a 120-day deadline for a report on Mr. Khashoggi’s killing requested on a bipartisan basis by the Senate Committee on Foreign Relations.

Within the United States, strong private commercial interests have been pressing aggressively for the transfer of highly sensitive nuclear technology to Saudi Arabia—a potential risk to U.S. national security absent adequate safeguards. These commercial entities stand to reap billions of dollars through contracts associated with constructing and operating nuclear facilities in Saudi Arabia—and apparently have been in close and repeated contact with President Trump and his Administration to the present day.

However, experts worry that transferring sensitive U.S. nuclear technology could allow Saudi Arabia to produce nuclear weapons that contribute to the proliferation of nuclear arms throughout an already unstable Middle East. Saudi Crown Prince Mohammed bin Salman conceded this point in 2018, proclaiming: “Without a doubt, if Iran developed a nuclear bomb, we will follow suit as soon as possible.”

When Congress passed the Atomic Energy Act, it imposed stringent controls on the export of U.S. technology to a foreign country that could be used to create nuclear weapons. Under Section 123 of the Act, the U.S. may not transfer nuclear technology to a foreign country without the approval of Congress, in order to ensure that the agreement reached with the foreign government meets nine specific nonproliferation requirements.

[snip]

[W]histleblowers provided new information about IP3 International, a private company that has assembled a consortium of U.S. companies to build nuclear plants in Saudi Arabia. According to media reports, IP3’s only project to date is the Saudi nuclear plan. A key proponent of this nuclear effort was General Michael Flynn, who described himself in filings as an “advisor” to a subsidiary of IP3, IronBridge Group Inc., from June 2016 to December 2016—at the same time he was serving as Donald Trump’s national security advisor during the presidential campaign and the presidential transition. According to the whistleblowers, General Flynn continued to advocate for the adoption of the IP3 plan not only during the transition, but even after he joined the White House as President Trump’s National Security Advisor.

[snip]

Another key proponent of this effort was Thomas Barrack, President Trump’s personal friend of several decades and the Chairman of his Inaugural Committee.

The nuclear energy scheme (which did not involve nuclear weapons, but implicated concerns that the Saudis would develop them) overlaps closely with the scope of the Foreign Agent charges against Barrack (and I don’t rule out that FBI’s focus on such document(s) stems, in part, from Barrack’s upcoming trial). One of the overt acts charged against Barrack, for example, is that he “forced” the Trump White House to elevate the treatment of MbS on a visit to the US in March 2017 beyond that accorded by his rank at the time.

To be sure: There’s not a hint of evidence that the government has reason to believe Trump tried to sell or otherwise share the documents he stole with foreign entities. If the government suspected Trump might do so with Restricted Documents covered by the Atomic Energy Act, it would implicate a different crime, 40 USC 2274, with which Jonathan Toebbe was charged last year for trying to deal such technology to Brazil. Trump has succeeded in obscuring the crimes listed on his warrant (though not all crimes need to be listed on the overt warrant), but if the Atomic Energy Act were implicated, that would be really hard to do (unless this leaked detail is an effort on Trump’s part to prepare for the mention of the Atomic Energy Act on the warrant, though I doubt that’s the case).

So for now, Trump’s past history of attempting to share nuclear technology with the Saudis for the profit of his closest advisors is just background noise: something that makes it all the more concerning he is suspected of stealing such documents. But if the FBI did not find nuclear documents they have reason to believe Trump stole, then that could change quickly.

Finally, there’s a political angle. The press has been absolutely remiss in calling out Republicans for their hypocrisy about classified information — or their irresponsibility in parroting Trump’s complaints about a serious breach investigation. Instead, the press treated the nation’s security as a he-said, she-said fight between political parties.

But the report that the FBI has reason to believe that Trump stole documents about nuclear weapons provides just the kind of horse race angle that seems to be the only thing that vast swaths of journalists can understand anymore. That’s because in 2016, Marco Rubio argued that Trump was “unfit for the Presidency” because we could not give the “nuclear codes of the United States to an erratic individual.”

Indeed, Val Demings, who is in a close fight against Rubio in November’s Senate elections, just made it an issue yesterday, before the nuclear angle became clear.

2016 Marco Rubio scoffed at the notion that someone like Trump should be given access to the nuclear codes. 2022 Marco Rubio — largely because he wants to win Trump’s favor in the election against Demings — doesn’t even want the FBI to investigate whether Trump stole the nuclear codes when he left office.

Perhaps with a horserace angle, the press might finally hold Republicans accountable for their irresponsibility of their efforts to protect Trump here.

image_print