May 26, 2022 / by 

 

The Visibility of FBI’s Close Hold: John Durham Will Blame Michael Sussmann that FBI Told Alfa Bank They Were Investigating

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs of transcripts. But if you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations. This coverage reflects the culmination of eight months work. 

According to an exchange at the end of they day yesterday, John Durham’s team plans to introduce “a hundred” exhibits through their paralegal acting as a summary witness today.

My understanding is that the defense objects to the PowerPoint presentation style of the process. But, again, we think it just streamlines it in terms of — the alternative is to have to put literally a hundred exhibits in through Ms. Arsenault one at a time.

Given the exhibits from Monday, I assume Durham will throw a bunch of Fusion documents at the jury in an attempt to insinuate, once again, that Michael Sussmann shared with the press that the FBI was investigating the Alfa Bank anomaly.

The coming onslaught of Fusion documents

I say that because Mark Hosenball wrote the FBI for comment at 1:33PM on October 5, 2016, attaching the Mediafire package, asking for comment and noting that, “it has been suggested to me that this information and scenario is under careful investigation by the FBI.”

Hosenball’s email to the FBI puts it right at the beginning (in red, below) of the known universe of Fusion emails we’ve seen from that day, the timestamps of which Durham has repeatedly tried to obscure. (Maybe while paralegal Kori Arsenault is on the stand, Sussmann’s team can ask her why Durham’s exhibits misleadingly don’t correct for UTC.)

That said, there’s still a Hosenball email unaccounted for in which he shared one of the publicly available links to Tea Leaves packaged data. It’s quite possible that email precedes Seago’s question to Fritsch, which is currently the earliest email in the list, asking whether one of the i2p sites hosting the data was safe. See this post for background.

5:23PM (likely 1:23?): Seago to Fritsch, Is this safe?

1:31PM: [not included] Fritsch to Hosenball email with Alfa Group overview

1:32PM: Fritsch sends Isikoff the September 1, 2016 Alfa Group overview (full report included in unsealed exhibit)

1:33PM: Hosenball to FBI, “careful investigation by the FBI”

1:33PM [not included] Fritsch to Hosenball, “that memo is OTR — tho all open source”

1:35/1:36PM: Hosenball replies, “yep got it, but is that from you all or from the outside computer experts?”

1:37PM: Fritsch responds,

the DNS stuff? not us at all

outside computer experts

we did put up an alfa memo unrelated to all this

1:38PM: [not included] Hosenball to Fritsch:

is the alfa attachment you just sent me experts or yours ? also is there additional data posted by the experts ? all I have found is the summary I sent you and a chart… [my emphasis]

1:41PM: [not included] Fritsch to Hosenball:

alfa was something we did unrelated to this. i sent you what we have BUT it gives you a tutanota address to leave questions.  1. Leave questions at: [email protected]

1:41PM: [not included] Hosenball to Fritsch:

yes I have emailed tuta and they have responded but haven’t sent me any new links yet. but I am pressing. but have you downloaded more data from them ?

1:43PM: [not included] Fritsch to Hosenball, “no”

1:44PM: Fritsch to Lichtblau:

fyi found this published on web … and downloaded it. super interesting in context of our discussions

[mediafire link] [my emphasis]

2:23PM: [not included] Lichtblau to Fritsch, “thanks. where did this come from?”

2:27PM: [not included] Hosenball to Fritsch:

tuta sent me this guidance

[snip]

Since I am technically hopeless I have asked our techie person to try to get into this. But here is the raw info in case you get there first. Chrs mh

2:32PM: Fritsch to Lichtblau:

no idea. our tech maven says it was first posted via reddit. i see it has a tutanota contact — so someone anonymous and encrypted. so it’s either someone real who has real info or one of donald’s 400 pounders. the de vos stuff looks rank to me … weird

6:33PM (likely 2:33PM): Fwd Alfa Fritsch to Seago

6:57PM (like 2:57PM): Re alfa Seago to Fritsch

7:02PM (likely 3:02): Re alfa Seago to Fritsch

3:27PM: [not included] Fritsch to Hosenball cc Simpson: “All same stuff”

3:58PM: [not included] Hosenball to Fritsch, asking, “so the trumpies just sent me the explanation below; how do I get behind it?”

4:28PM: [not included] Fritsch to Hosenball, “not easily, alas”

4:32PM: Fritsch to Hosenball, cc Simpson:

Though first step is to send that explanation to the source who posted this stuff. I understand the trump explanations can be refuted.

So I assume that Durham will argue that Fusion must have passed on the information that the FBI was investigating — and they may have! (though none of the currently public emails reflect that — and suggest that was all part of Michael Sussmann’s devious plan on September 19.

When, under threat of prosecution, an attempt to prevent politicization turns into an attempt to hide political bias

That’s where things will get interesting. One key dispute in this case is why one keeps secrets. Durham wants to argue that keeping secrets can only serve a political purpose.

Sussmann will argue that keeping secrets facilitates national security interests.

Sussmann will show that everyone at the FBI recognized the value, to the FBI, of stalling a newspaper article about a potentially important threat so the FBI could covertly investigate it. All the more so during election season when — investigation after investigation into the Russian investigation has shown — the FBI was, if anything, being too careful in an attempt to avoid impacting Trump’s political fortunes, even while Jim Comey was tanking Hillary’s campaign. According to Sussmann’s own sworn testimony — testimony that Durham didn’t bother testing before charging Sussmann — allowing the FBI the opportunity to do that was the reason Sussmann shared the Alfa Bank anomaly with the FBI. Durham wants to imprison Sussmann for giving the FBI that heads up, arguing that because he hid his purported clients, it led the FBI to open a Full Investigation more quickly than they otherwise would have (even though, as Sussmann’s team has demonstrated, the FBI did nothing that would have required a Full Investigation in the short period during which they investigated).

A key part of that story Durham wants to tell — needs to tell, given all the evidence that the FBI perceived this to be a DNC-related tip — is that some of his key villains were attempting to hide the perceived political nature of the tip, rather than ensuring the integrity of the investigation itself (or possibly, but I’m still working on this, protecting the identity of a CHS).

Central to that narrative is the changing testimony of FBI Agent Ryan Gaynor — his stated reasons for refusing to let the case agents in Chicago interview either Sussmann or Georgia Tech professor David Dagon. In an interview on October 30, 2020 (a week after Durham had been granted Special Counsel status), Gaynor explained that he had intervened to make sure agents couldn’t conduct interviews that would have led to a more robust investigation to ensure the integrity of the investigation.

Q. Okay. So you remember telling the government that you believed that the agents in Chicago would have been biased by Mr. Sussmann’s perception of the issue — the source’s perception of the issue if they had interviewed him before they got all of the data and analyzed it?

A. Yes.

Q. Okay. And that’s because, at the time, you believed the DNC was the source of the information itself. Right?

A. That’s because, at the time, I believed that he was a DNC attorney associated with the Democratic party and it would be potentially highly-biasing information.

Q. And you told the government, if you had provided the identity of the DNC as the source of the information, they would have known there was possible political motivation. rignt?

A. I recall that exact statement.

Shortly after he gave this testimony, prosecutors took a break, and told his lawyer they were moving towards treating Gaynor as a subject of, rather than just a witness in, the investigation.

Q. Okay. Well, at or around the time you were talking about passing along the source’s name or not, you took a break in the meeting. Do you remember taking breaks during the meeting?

A. I do.

Q. And do you remember when you broke at that point that the government told your attorney that your own status in the investigation had changed. Do you remember hearing that?

A. So I didn’t hear that, but when my attorney came back in, he advised me that my status was in jeopardy.

After that, Gaynor went back, looked at two sets of scribbled notes (Gaynor, because he remains at FBI, was able to review his notes, unlike a number of other Durham witnesses), and decided that now that he thought about it, Jonathan Moffa had actually instructed him to keep a close hold on Sussmann’s identity. It wasn’t his decision anymore, it was Moffa’s, and the dastardly Peter Strzok was in on it. Once Gaynor testified that way, he became a — to Andew DeFilippis, anyway — credible witness again.

Q. Okay. And when you told the government there was a close hold, were you told that your status changed back to being a witness?

A. At the conclusion of the interview, once I had gone over all of the material that I brought and walked through what I had reconstructed and what I could recollect after doing so, I was informed that my status had changed, yes.

Q. Changed back to being a witness?

A. To a witness, yes.

Q. So you go into meeting one being told you are a witness, telling them you decided not to share the agents’ names among other things. Then you are told you are a subject facing criminal charges, potentially. You come back. You tell them about a close hold, and you go back to being a witness; is that right?

Politico may have been the only outlet that described this fairly shocking testimony.

These conflicting claims about the purported reasons to keep Sussmann’s identity (as opposed to the investigation itself) a secret are important background to that Hosenball email on October 5, which I suspect Durham will use to claim that the Democrats were leaking about the investigation.

Starting almost immediately after getting the investigation, Chicago case agents started asking to interview the source, variously defined to be either Sussmann or the person who wrote the white paper. Gaynor kept pushing the agents to go review the logs again — though the file memorializing the contents of what it describes as a single thumb drive (Sussmann shared two) was not written up until October 4. But then, by October 5 (the same day that Hosenball asked the FBI for comment, albeit this report comes in four hours later), FBI had learned from one of their confidential human sources that David Dagon had a role in the white paper and he — and the FBI’s own source! — would be going public pushing the credibility of the allegations.

In that email, newbie agent Allison Sands explained that they were going to contact Dagon.

So, among other things, on the same day Hosenball writes in reflecting an awareness that there was an ongoing investigation, the FBI hears from a CHS who says he or she has already been talking with David Dagon and was going public backing the claims (though this source was speaking to the WaPo, not Reuters).

Note that, as of that date, the FBI still hadn’t received logs from Listrak.

By the time Allison Sands wrote that email, it appears from Lync messages that like others probably haven’t been noticed to reflect UTC time zone, had already contacted Rodney Joffe’s handler to contact Dagon.

Fun with missing Bates stamps

Side note. There are actually two versions of the notes that purportedly caused Gaynor to change his mind about there being a close hold and on what source that close hold was on. There’s Defense Exhibit 524, which has a slew of Bates stamps, and 7 redactions.

And then there’s a page from Government Exhibit 279, which appears between a page with Bates stamp SC-6454 and one with Bates stamp SC-6456, which has no Bates stamp at all (and lacks the protective order stamp that appears on the other pages of the exhibit).

That version of the exhibit has just four redactions, one of which is smaller. The unredacted bits on the exhibit reveal discussions of the informant and recognition that the statements of the informant “likely triggered” the press attention.

Incidentally, Durham’s team took an entire day to upload this set of exhibits. I’m wondering if the exhibit that was viewed by Gaynor and entered into evidence actually looked like this one does.

Calling the agent of a foreign agent to ask for comment

There’s one other thing going on. On the stand, Gaynor spent a great deal of time explaining about how important it was to hide an investigation — particularly from anyone who might have a partisan interest — during an election.

Except for all the talk of a close hold, the FBI wasn’t holding this very close. They were stomping around to a bunch of sources asking for data logs, even before they had checked what was on (one of) the thumb drives that Sussmann had dropped off. They fairly demonstrably were stomping around before they understood what they should be looking for.

They also were calling Mandiant, which was working for Alfa Bank, which by October 19 when they were formally interviewed discovered Alfa Bank had no logs, but which knew of the investigation by October 5.

Q. Uh-huh. You testified about the reasons why you’d want to keep it covert, you wouldn’t want to do anything that could affect the election so close to the election. Right?

A. Yes.

Q. The FBI, as part of the Alfa-Bank investigation, talked to a number of different individuals outside of the FBI to acquire information, to get you information so that you could investigate the allegations. Right?

A. Yes.

Q. Okay. You spoke to people at Central Dynamics?

A. Yes, and I believe the investigative team documented in the email that I saw that they had done it in a manner to attempt to avoid it outing the allegation.

[snip]

A. I’m sorry?

Q. And how is that that they could conduct an interview with a third party in a way that the third party wouldn’t tell other people about it?

A. They described it in a manner that they had obfuscated what their direct interest was.

Q. So from the Central Dynamics’ perspective, they didn’t know what you were looking at?

A. That is what I had in the email chain, yes. n

Q. But you testified that the FBI interviewed Mandiant as part of the investigation. Correct?

A. Yes. My understanding there is that was a private liaison relationship that occurred.

Q. Mandiant — just to be clear — Alfa-Bank itself hired Mandiant to analyze whether there was a secret communications channel. Correct?

A. Yes.

Q. So Alfa-Bank paid Mandiant to look into whether there was a secret communications channel. Right?

A. Yes.

Q. And Alfa-Bank obviously had a relationship with Mandiant that was put at issue by hiring Mandiant. Right?

A. Yes.

Q. Okay. So the FBI went to Alfa-Bank’s paid consultant and asked them for their view on the allegation. Correct?

A. I believe the FBI had a prior relationship with one of the employees, and they utilized that in the field. Plus, I don’t think the Bureau would violate policy on a sensitive investigative matter when the Chief Division Counsel of the office is involved. So I would assume that they did that in a manner that they did not feel would be alerting or go to the media.

Q. Mr. Gaynor, the FBI in this investigation went to Alfa-Bank’s paid consultant and asked them for their views of the allegations. correct?

A. Yes.

Q. And Alfa-Bank’s paid consultant could have told Alfa-Bank. Correct?

A. Yes.

Q. And could have told the press for all you know. Correct?

A. Yes. And I don’t know how Chicago mitigated that.

Q. And is it your testimony that going to Alfa-Bank, the Russian bank that is the focus of this investigation, and asking their paid consultant for their views on the matter wasn’t going to overt?

A. Again, I don’t know how Chicago mitigated that issue.

[snip]

Q. Did you ever have a conversation with anybody at headquarters about whether to provide the names of the source to the Chicago agents?

A. Yes. There was a conversation about the close hold, as I mentioned, although it wasn’t correctly, I guess, documented between Pete Strzok, myself and Mr. Moffa at some point during that time period.

[snip]

Q. And the reason that you say no one talked to him is because, as of that point, October 6th, you had already concluded that there was nothing to these allegations. Right?

A. As of October 5th, evening of October 5th, we had come to a pretty solid conclusion that these allegations did not have merit and there wasn’t a national security threat.

Q. Are you aware that the agents first interviewed Alfa-Bank’s paid consultant, Mandiant, merely two weeks later on October 19th?

A. So I’m aware that we had information from Mandiant as of October 5th that they had looked at this allegation and found that it didn’t have merit. And then I’m also aware that there was an interview that was conducted later, October 19th or so, when I was made aware of it, yes.

A text between Allison Sands and Scott Hellman reflects the FBI had contact with Alfa Bank by October 4.

It appears that contact occurred in London — a place where Mark Hosenball has strong source ties since the time in 1976 when he got expelled for reporting on Northern Ireland.

In other words, Gaynor’s currently operative stance is that case agents couldn’t contact David Dagon — much less Rodney Joffe, who had business ties with the FBI — to find out what was going on, because that would present a conflict.

But it was okay for the FBI to contact the agent of the subject of the investigation overtly.

Agent Gaynor belatedly rediscovers the Mediafire package

Incidentally, when that original request for comment from Hosenball came in, it got transferred to people in the cyber division, then shared with the investigative team. In response, the senior-most person on that team sent it to Peter Strzok. Strzok forwarded it, at 3:02 on October 5, to Ryan Gaynor.

On October 13, just over a week after he had originally received it, Gaynor sent the Mediafire package to the case team, noting that the observations in it reflected actions taken in response to their investigation, but asking for their technical opinion.

He included Moffa and Joe Pientka on that email.

But not Strzok, who knew he had received it 8 days earlier.

OTHER SUSSMANN TRIAL COVERAGE

Scene-Setter for the Sussmann Trial, Part One: The Elements of the Offense

Scene-Setter for the Sussmann Trial, Part Two: The Witnesses

The Founding Fantasy of Durham’s Prosecution of Michael Sussmann: Hillary’s Successful October Surprise

With a Much-Anticipated Fusion GPS Witness, Andrew DeFilippis Bangs the Table

John Durham’s Lies with Metadata

emptywheel’s Continuing Obsession with Sticky Notes, Michael Sussmann Trial Edition

Brittain Shaw’s Privileged Attempt to Misrepresent Eric Lichtblau’s Privilege

The Methodology of Andrew DeFilippis’ Elaborate Plot to Break Judge Cooper’s Rules

Jim Baker’s Tweet and the Recidivist Foreign Influence Cheater

That Clinton Tweet Could Lead To a Mistrial (or Reversal on Appeal)

John Durham Is Prosecuting Michael Sussmann for Sharing a Tip on Now-Sanctioned Alfa Bank

Apprehension and Dread with Bates Stamps: The Case of Jim Baker’s Missing Jencks Production

Technical Exhibits, Michael Sussmann Trial

Jim Baker’s “Doctored” Memory Forgot the Meeting He Had Immediately After His Michael Sussmann Meeting

The FBI Believed Michael Sussmann Was Working for the DNC … Until Andrew DeFilippis Coached Them to Believe Otherwise


The FBI Believed Michael Sussmann Was Working for the DNC … Until Andrew DeFilippis Coached Them to Believe Otherwise

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs of transcripts. But if you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations. This coverage reflects the culmination of eight months work. 

There’s accumulating evidence that at least some people — including some key decision-makers — believed the FBI believed that the Alfa Bank tip came from the DNC — and that Andrew DeFilippis has engaged in a lot of coaching to try to make that evidence go away.

The first time FBI Agent Ryan Gaynor testified to John Durham about the investigation into the Alfa Bank anomaly in October 2020, he told prosecutors that the DNC was the source of the allegation.

Q. Okay. So in your first meeting with the government, you — this is October of 2020, correct?

A. Yes.

Q. You told them multiple times that you believed that the Democratic National Committee was the source of the allegations of connections between Alfa-Bank and Russia, correct?

A. Correct, which was wrong.

Q. Okay. But you said that you thought the Democratic party itself was who provided the information, correct?

A. I did say that in the meeting.

That’s even what he has written down in a briefing document he kept in Fall 2016.

At the end of that October 2020 interview, prosecutors threatened Gaynor with prosecution.

His more recent testimony, starting for the first time on May 13, was that Sussmann was representing himself. The reason he now remembers that to be true goes to the heart of Durham’s materiality: it would have mattered if Sussmann was representing the DNC, so he must have been representing himself.

Q. Okay. I want to ask you, first, about testimony that you gave today where you said that when Mr. Moffa told you that Mr. Sussmann was a DNC attorney, you said, “I understood that to mean that he had been affiliated with the Democratic party but that he had come representing himself on the Alfa-Bank allegations.” Do you remember giving that testimony?

A. That was my take-away.

Q. And you gave that testimony that I just read?

A. Yes; that he was a DNC attorney, but that my take-away from that discussion was that he wasn’t there representing the DNC.

Q. When you were asked, “When Mr. Moffa said Mr. Sussmann was an attorney for the DNC, what impression did you come away with?” what did you understand that to mean? And your answer was: “I understood that to mean that he had been affiliated with the Democratic party, but that he had come representing himself,” right?

A. So he’s affiliated with the Democratic party because he was a DNC attorney.

Q. And your impression was he had come representing himself?

A. My take-away from that meeting, what I recall, is that I did not believe that he was there representing the DNC specifically because, had he been, that would have been information that would have impacted it.

This is a tautology: If Sussmann had been representing the DNC it would have mattered so it must be the case that Gaynor believed he was not representing the DNC. It also happens to be the central argument of DeFilippis’ materiality claim.

Meanwhile, Scott Hellman — Durham’s star cyber witness — received a text from his boss, Nate Batty (with whom he compared notes before his first interview with Durham), referring to the white paper as a “DNC report” on September 21, 2016, two days after Jim Baker received the materials.

Michael Sussmann lawyer Sean Berkowitz asked Hellman about that the other day. At first, Hellman expressed surprise about that text.

Q. All right. And then, with respect to Stranahan, he asks you and Nate to write a report about the — write a summary of the DNC report. Correct? That’s what it says?

A. That’s what it says in this chat, yes.

Q. And did you understand, sir, that the information had come from a DNC, meaning Democratic National Committee, source?

A. I did not understand that, no.

Q. Did you know what Nate Batty knew about it?

A. I don’t think he knew anything about it.

Q. Did you call up Tim and say, what a second. This is a DNC report? That’s political motivation.

A. No.

Q. Didn’t do anything or it didn’t occur to you?

A. The first time I saw this was two years ago when I was being interviewed by Mr. DeFilippis, and I don’t recall ever seeing it. I never had any recollection of this information coming from the DNC. I don’t remember DNC being a part of anything that we read or discussed.

Q. Okay. When you say, the first time you saw it was two years ago when you met with Mr. DeFilippis, that’s not accurate. Right? You saw it on September 21st, 2016. Correct?

A. It’s in there. I don’t have any memory of seeing it.

Later in Berkowitz’ cross-examination he returned to the text. He asked how it could be that a white paper from a DNC lawyer could be referred to as a DNC report.

Q. And although you were surprised to see it today, it appears that at least somebody, such as Mr. Batty was aware and you were aware that somebody was calling this white paper a DNC report. Correct?

A. I was not aware that anybody was calling it a DNC report, and I don’t believe Mr. Batty knew that either.

Q. But you saw the link message. Right?

A. I did see the link message, yes.

Berkowitz asked Hellman how it could be that he would see a reference to a DNC report and not take from that it was a DNC report. Hellman describes “the only explanation that … was discussed” — which is that it was a typo.

Q. What’s your explanation for it?

A. I have no recollection of seeing that link message. And there is — have absolutely no belief that either me or Agent Batty knew where that data was coming from, let alone that it was coming from DNC. The only explanation that popped or was discussed was that it could have been a typo and somebody was trying to refer to DNS instead of DNC.

Q. So you think it was a typo?

A. I don’t know.

Q. When you said the only one suggesting it — isn’t it true that it was Mr. DeFilippis that suggested to you that it might have been a typo recently?

A. That’s correct.

Q. Okay. You didn’t think that at the time. Right?

A. I did not. I had never seen it or had any memory of seeing it ever before it was put in front of me.

With some prodding, Hellman admitted that when he referred to “discussing explanations,” he meant doing so with Andrew DeFilippis. This exchange was, quite literally, Berkowitz eliciting Hellman to provide an answer that DeFilippis thought up — one necessary to sustain DeFilippis’ narrative — without, at first, admitting it was DeFilippis’ opinion of what the truth must be.

So after DeFilippis threatened Gaynor with prosecution, he came to remember something other than what the note, tying the white paper to DNC lawyer Michael Sussmann, that he used to “refresh his memory” said.

And when faced with the possibility, two years or maybe six after the fact, that Scott Hellman’s epically shitty analysis of the white paper could have been influenced by being told that it was a DNC white paper, Hellman offered up the explanation that DeFilippis offered him.

At least twice, then, under coaching from Durham’s lead prosecutor, key witnesses have come to believe something other than what the documentary evidence suggests.

The fact that DeFilippis has twice coached witnesses to deny any understanding at FBI that this was a DNC tip — whether it was a DNC tip or not — is really telling. That’s because DeFilippis has to try to pitch a nearly unsustainable position: how his single witness to Sussmann’s alleged crime, Jim Baker, can in 2016 have told Bill Priestap the following:

Q. I think you testified yesterday that by this time you were at least generally aware that Mr. Sussmann represented the DNC in connection with hacks; is that right?

A. That’s correct.

Q. And what, if anything, did you say to Mr. Priestap about that?

A. I think I told him like, okay, this is who Michael is. He’s represented the Democratic party in the Russian hack that we were also investigating and/or the Hillary Clinton Campaign. So just, again, to orient Bill to who Michael was. I mean, that’s a serious credential in terms of being a cyber security expert. And then to explain: But in this case he said he’s not appearing on behalf of them. In this case he’s coming in as a good citizen.

And then, in 2018, have told Jim Jordan the following:

Q. Mr. Jordan then says: “And he was representing a client when he brought this information to you or just out of the goodness of his heart? Someone gave it to him and he brought it to you?”

A. In that first interaction, I don’t remember him specifically saying that he was acting on behalf of a particular client.

Q. Did you know at the time that he was representing the DNC in the Clinton campaign?

A. I can’t remember. I had learned that at some point. I don’t, as I said — as I think I n said last time, I don’t specifically remember when I learned that — excuse me — so I don’t know that I had that in my head when he showed up in my office. I just can’t remember.

Q. Did you learn that shortly thereafter if you didn’t know it at the time?

And then testify last week this way.

Q. Okay. Number two, did you know on the September 19th, 2016 meeting that Mr. Sussmann had been representing Hillary For America’s campaign and the DNC in connection with the hack investigation. Did you know that on September 19th when he met with you?

A. Sitting here today, I think the answer is, yes, I did know that by that point in time.

Q. I’ve written down, “yes, DNC and HFA and hack”. I want to be really clear. You’re not saying that he said that in the meeting. correct?

A. Correct.

Q. And you’re not saying he said he was there on behalf of them? You’re just saying that in your mind you knew that he had been acting as a lawyer for those two entities in connection with the hack. Correct?

It’s not just a question of whether Baker will be a credible witness, though his wildly changing claims about the DNC are among the reasons why his testimony is not credible.

It’s also that Durham wants to point to Sussmann’s failure, a year earlier in a Congressional hearing, to offer up his ties with the Democrats as proof he was lying. But Durham is treating Baker’s failure to do so in the same situation as an innocent mistake. For his single witness to be credible, DeFilippis has to find a way to excuse Baker’s failure to offer that up in a far more direct question while pointing to Sussmann’s failure to offer it up as proof of guilt.

He has to do so to defend his prosecutorial decisions, too. Given how much stake DeFilippis has placed on Baker sharing with Priestap that he knew Sussmann represented the Democrats, it makes it far less credible that Baker didn’t knowingly lie to Jordan. Especially given the way Baker responded to a Berkowitz question, suggesting that perhaps he hadn’t been truthful with Jordan, but instead was “careful.”

Q. And when you gave voluntary information to Congress, you understood that you were under oath?

A. I don’t think I was under oath, but I understood that it’s a crime to make false statements to Congress.

Q. So you tried to be as careful as you could. Correct?

A. I tried to be as careful as I could in that environment, yes, sir.

Q. You tried to be as truthful as you could?

A. (No response)

Q. Tried to be as truthful as you could?

A. Yes, sir.

Sussmann’s team is going to argue that there are a long list of people against whom there is far better evidence for false statements or perjury charges than him, with the single difference being that the other people were willing to tell the storytale DeFilippis is using prosecutorial resources to tell. And the first person on that list — it makes me sick to my stomach to say — is Jim Baker.

Finally, it’s a matter of materiality. DeFilippis has to find a way for it to be the case that his single witness knew when he met with Sussmann that Sussmann was a DNC lawyer (because Bill Priestap’s notes reflect that), but didn’t view that to be material to everything that happened next.

And the only way to sustain that rickety narrative is to ensure that no one else — not even the people using documentary proof reflecting a belief that this was a DNC report to refresh faded memories — understood that the white paper came from the DNC.

Thus far, Sussmann’s cross-examination has elicited evidence that at least three witnesses changed their testimony after interviews with DeFilippis, adopting a “memory” that conflicts with the documentary record with regards to whether the FBI believed the white paper to be associated with the DNC.

OTHER SUSSMANN TRIAL COVERAGE

Scene-Setter for the Sussmann Trial, Part One: The Elements of the Offense

Scene-Setter for the Sussmann Trial, Part Two: The Witnesses

The Founding Fantasy of Durham’s Prosecution of Michael Sussmann: Hillary’s Successful October Surprise

With a Much-Anticipated Fusion GPS Witness, Andrew DeFilippis Bangs the Table

John Durham’s Lies with Metadata

emptywheel’s Continuing Obsession with Sticky Notes, Michael Sussmann Trial Edition

Brittain Shaw’s Privileged Attempt to Misrepresent Eric Lichtblau’s Privilege

The Methodology of Andrew DeFilippis’ Elaborate Plot to Break Judge Cooper’s Rules

Jim Baker’s Tweet and the Recidivist Foreign Influence Cheater

That Clinton Tweet Could Lead To a Mistrial (or Reversal on Appeal)

John Durham Is Prosecuting Michael Sussmann for Sharing a Tip on Now-Sanctioned Alfa Bank

Apprehension and Dread with Bates Stamps: The Case of Jim Baker’s Missing Jencks Production

Technical Exhibits, Michael Sussmann Trial

Jim Baker’s “Doctored” Memory Forgot the Meeting He Had Immediately After His Michael Sussmann Meeting


Jim Baker’s “Doctored” Memory Forgot the Meeting He Had Immediately After His Michael Sussmann Meeting

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs of transcripts. But if you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations. This coverage reflects the culmination of eight months work. 

One of key piece of evidence to John Durham’s prosecution against Michael Sussmann are the notes that Bill Priestap took reflecting Baker saying that Sussmann, “said not doing this for any client.”

On the stand, Priestap remembered nothing about this meeting.

Baker, though, claims he remembers a bunch of things.

In response to Sean Berkowitz’s attempt to pin down his testimony the other day, Baker said that his meeting with Sussmann was thirty minutes long. That’s not actually a direct memory, it seems. It is one reconstructed, Baker says, from calendars and the chain of custody document.

Q. How long was the meeting?

A. Which meeting?

Q. September 19th, 2016

A. About 30 minutes.

Q. How sure are you of that?

A. I’m going from the calendar entries and the entries on that chain of custody document.

Q. Okay. Not from your memory? You’re looking at documents?

A. I remember it was a short meeting. I would view a 30-minute meeting as a short meeting.

The chain of custody document shows that Baker took possession of the thumb drives at 2:30PM on September 19, 2016.

There are problems with relying on the chain of custody document to reconstruct your memory though, because it was, itself, reconstructed after the fact, the next day. One FBI agent discussing this process even joked that this amounted to “doctoring” the chain of custody — and with it, six years later, doctoring Baker’s current memory.

Baker professes to be slightly more certain about his meeting with Priestap, at which he relayed what had happened in the meeting with Sussmann. Baker “immediately or very close afterwards” called Priestap and told him what happened in the meeting.

Q. Okay. Now, taking us back to our time period, 15 we’ve left you getting the information from Mr. Sussmann on the 19th, and you immediately or very close afterwards called Mr. Priestap?

A. Yes, sir.

And the meeting was ten or fifteen minutes long.

Q. How long was the conversation with Mr. Priestap?

A. I don’t think it was a very long conversation. Ten minutes, maybe, fifteen minutes, something like that.

That’s a problem for Durham’s narrative. That’s because according to Baker’s own calendar, he had a meeting immediately after the one with Sussmann. The meeting with Sussmann ended at 2:30, his calendar showed, which is what the “doctored” chain of custody document says. Immediately after that he had a meeting with someone named Rich.

In fact, per his calendar, Baker was busy straight through until 4PM (though it’s unclear from Baker’s calendar precisely when the meeting with Rich happened). And the first Deputies Committee meeting after his meeting with Sussmann — which is the best explanation for Trisha Anderson’s notes — happened the next day, on September 20.

I haven’t yet seen how Sussmann’s lawyers got this into evidence yesterday (I’m still working through the morning transcript). But it’s possible that Baker never refreshed his memory with this calendar.

That’s because this calendar was extracted from Baker’s Samsung phone by DOJ Inspector General’s Office back in 2018. This is the phone that Durham had been told about in real time in 2018 (when Durham was investigating Baker for something else), but nevertheless didn’t think to look for the phone before charging Sussmann, and so only found it four months after the indictment.

When confessing all this confusion to Judge Cooper (as I explained in this post), Durham explained he hadn’t taken the basic investigative step of reviewing the contents of Baker’s phone before charging Sussmann because his memory didn’t go back four whole years — or even two, which is when Durham started interviewing Baker in this investigation.

Paragraph 10(a)(ii) states: “[I]n early January 2022, the Special Counsel’s Office learned for the first time that the OIG currently possesses two FBI cellphones of the former FBI General Counsel to whom the defendant made his alleged false statement, along with forensic reports analyzing those cellphones.” Id. The Government wishes to provide some additional context for this statement.

After reviewing the Special Counsel’s Office’s public filing, the DOJ Office of Inspector General (“OIG”) brought to our attention based on a review of its own records that, approximately four years ago, on February 9, 2018, in connection with another criminal investigation being led by then-Acting U.S. Attorney Durham, an OIG Special Agent who was providing some support to that investigation informed an Assistant United Attorney working with Mr. Durham that the OIG had requested custody of a number of FBI cellphones. OIG records reflect that among the phones requested was one of the two aforementioned cellphones of the thenFBI General Counsel. OIG records further reflect that on February 12, 2018, the OIG Special Agent had a conference call with members of the investigative team, including Mr. Durham, during which the cellphones likely were discussed. OIG records also reflect that the OIG subsequently obtained the then-FBI General Counsel’s cellphone on or about February 15, 2018. Special Counsel Durham has no current recollection of that conference call, nor does Special Counsel Durham currently recall knowing about the OIG’s possession of the former FBI General Counsel’s cellphones before January 2022. [my emphasis]

Durham forgot that he knew about the phone.

And because he forgot that he knew about the phone until it was too late, it’s not actually clear whether Baker’s reconstructed memory has faced the fact that he could not have had a 30 minute meeting with Sussman followed by a 10 minute call with Priestap and still made his 2:30PM meeting with Rich.

And given that both Baker and Priestap have testified, it’s probably too late to doctor a new memory to explain this all.

OTHER SUSSMANN TRIAL COVERAGE

Scene-Setter for the Sussmann Trial, Part One: The Elements of the Offense

Scene-Setter for the Sussmann Trial, Part Two: The Witnesses

The Founding Fantasy of Durham’s Prosecution of Michael Sussmann: Hillary’s Successful October Surprise

With a Much-Anticipated Fusion GPS Witness, Andrew DeFilippis Bangs the Table

John Durham’s Lies with Metadata

emptywheel’s Continuing Obsession with Sticky Notes, Michael Sussmann Trial Edition

Brittain Shaw’s Privileged Attempt to Misrepresent Eric Lichtblau’s Privilege

The Methodology of Andrew DeFilippis’ Elaborate Plot to Break Judge Cooper’s Rules

Jim Baker’s Tweet and the Recidivist Foreign Influence Cheater

That Clinton Tweet Could Lead To a Mistrial (or Reversal on Appeal)

John Durham Is Prosecuting Michael Sussmann for Sharing a Tip on Now-Sanctioned Alfa Bank

Apprehension and Dread with Bates Stamps: The Case of Jim Baker’s Missing Jencks Production

Technical Exhibits, Michael Sussmann Trial


Technical Exhibits, Michael Sussmann Trial

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs of transcripts. But if you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations. This coverage reflects the culmination of eight months work. 

Most of my coverage during the Michael Sussmann trial will be trial related, describing what witnesses and exhibits say about the case.

But there are good reasons to question the conduct of the investigation — and that’s a topic a lot of people have independent interest in. So I wanted to start a running post on technical issues.

If there’s a link that doesn’t work, it probably means I’ve forgot to set permissions to public (some of this needs redaction before posting). Leave a comment or tweet me at @emptywheel.

FBI investigation

160922: Scott Hellman/Nate Batty assessment

160923: Electronic Communication opening investigation

160923: EC plus all three shared documents

160926: Ryan Gaynor notes (includes details on election protection efforts)

161004: Kyle Steere document contents thumb drives

161005: Investigative update from Allison Sands

Includes:

  • FBI conclusion on changing DNS records
  • FBI’s response to David Dagon’s defense
  • Logs from Cendyn, with Listrak still to come
  • Barracuda reference
  • Discussion of Tor node

161007: Sands Draft FD-1023 CHS Report

170118: Sands Closing Memo

Materials shared with FBI

White paper

DNS logs

62 pages of DNS logs

Trump Who Is

9 IP Addresses

15 Trump mail domains

160919 Expert White Paper

Joffe data requests (postdates original data in white paper)

160820: Antonokakis to DeJong requesting data (including dcleaks)

List of IP addresses

Alfa Bank script

160915: DeJong shares results with Joffe

170718: DeJong to Joffe: I have four jobs that look for Trump

Posts related to technical issues

The Methodology of Andrew DeFilippis’ Elaborate Plot to Break Judge Cooper’s Rules


John Durham Is Prosecuting Michael Sussmann for Sharing a Tip on Now-Sanctioned Alfa Bank

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

During his cross-examination of Jim Baker, Michael Sussmann’s lawyer Sean Berkowitz introduced the Electronic Communication that opened the investigation pertaining to the Alfa Bank anomaly. He did so, ostensibly, to show that when DeFilippis elicited Jim Baker to explain the predication of investigations, Baker claimed not to remember that an investigation into the Alfa Bank anomaly had been opened, and claimed not to remember that the EC erroneously said the investigation was a referral from DOJ.

Q. And you were aware, though, because the government showed you a document, that a particular file number here was opened up, correct?

A. I don’t — did I see that? I don’t remember seeing that yesterday.

Q. Let’s show — I don’t think they showed it to you yesterday. They showed it to you in one of your preparation exhibits.

A. Okay. Okay.

Baker should have known it because he was shown the Electronic Communication during an interview with Durham, but he had forgotten it on the stand. So this appeared to be yet another attempt to show Baker’s hot-and-cold running memory.

When Berkowitz moved to enter it into evidence, DeFilippis noted it was a government exhibit, suggesting they weren’t hiding it (even though they hadn’t shown it to Baker on the stand). Probably they would have introduced it when Alfa Bank case agent Allison Sands testifies, probably Monday.

But introducing it with Baker gave Sussmann an opportunity to lay out several huge problems with Durham’s case against him and ensure that DeFilippis has to deal with this EC with Sands.

First, there’s this: When the FBI opened an investigation into this anomaly, they considered it an investigation into Alfa Bank.

This was an investigation into Alfa Bank. Not an investigation into Donald Trump.

In the part of the EC that explains why they opened it, they repeat, again, that it’s an investigation into Alfa Bank. But they also opened it because the FBI was still trying to figure out what Trump associate got an advance heads up that the Russians were going to intervene to hurt Hillary. But even in the context of the fact that one of the agents investigating Crossfire Hurricane had been pulled back to Chicago to work on this investigation, the investigation was not into biological human Donald Trump, it was into corporate human Trump Organization.

Based on the information above, FBI Chicago has predicated a Full Counterintelligence investigation into the activities of ALFA BANK, in order to conduct further investigation regarding the extent and nature of the network communications between ALFA BANK and the TRUMP ORGANIZATION. This investigation will attempt to determine the validity of the information that was provided by the third-party entity, and to assess whether or not pose a threat to either the TRUMP ORGANIZATION, or United States national security.

In addition, FBI investigation [redacted] [CROSSFIRE HURRICANE] was predicated based on an allegation that a member of the TRUMP campaign had received a suggestion from the Russian Government, indicating that the Russian government could assist the TRUMP campaign with an anonymous release of information during the campaign, which would be a detriment to the HILLARY CLINTON campaign. Investigation in [redacted] has surfaced additional ties between the TRUMP campaign team and the Russian government.

Investigation of the communications between the Russian ALFA BANK and the TRUMP ORGANIZATION could provide additional insight about the connections between the TRUMP ORGANIZATION and Russia, and help to determine whether those ties pose a threat to United States national security.

This matter is being treated as a Sensitive Investigative Matter based on the fact that the TRUMP ORGANIZATION is affiliated with a current U.S. Presidential candidate. As such, FBI Chicago requests that FBIHQ/NSLB coordinate with the US DEPARTMENT OF JUSTICE to provide all appropriate notifications required by the DIOG.

So it was sensitive because it related to Trump Organization, and only through that corporate human, to the biological human who was a presidential candidate. Even there, the EC at least envisioned, appropriately, that Trump might be a victim of this, as he would be if someone were trying to infiltrate the campaign or his company.

And in fact, Durham’s own evidence supports the predication against Alfa. The script that Durham falsely suggested (he will be disproven on this point later) were the basis for the research in the technical white paper was focused on Alfa Bank.

There is another that includes the anomalous mail server in question, right next to dcleaks — a query that may well have returned data on Roger Stone’s pre-public searches on the domain, and in any case, since this was entered as a government exhibit, should have obliged Durham to turn over details of these Stone searches.

It’s only a request from July 2017 — probably in conjunction with Dan Jones’ attempt to chase down this anomaly — that the searches were called “Trump query jobs,” and even there, one was focused on Alfa Bank.

The FBI viewed this as an investigation into Alfa Bank, and Joffe’s data requests actually reinforce that.

That creates three problems for Durham.

First, on redirect, DeFilippis got his star cyber agent Scott Hellman, to offer up this explanation for why he found the white paper crap when the counterintelligence people saw something more. It’s about the data, his star witness said.

Q. Now the counterintelligence division, when they look at information like this, are they looking at it with an eye towards the same issues or different issues from the cyber division?

A. Um, I think they’d probably be looking at it from the same vantage point, but if you’re not — you don’t have experience looking at technical logs, you may not have the capability of doing a review of those logs. You might rely on somebody else to do it. And perhaps counterintelligence agents are going to be thinking about other investigative questions. So I guess it would probably be a combination of both.

Never mind that the evidence shows that Hellman didn’t look closely at the data, which caused him to make a false claim in his own assessment of it. He should know that this tied in with the investigation into whom, in Trump’s camp, got advance notice that Russia was going to attack Hillary, because he was on an email that his boss, Nate Batty, sent laying out how the guy investigating George Papadopoulos had been called back to Chicago to also look at this.

Curtis has been working (TDY) the election issues and has been called back by CD to work matters related to this white paper. CG had a copy of the white paper I forwarded to you from CD channels, and was inquiring as to whether ECOU 1 had any logs or other data from the referenced server.

Sure, maybe his comment about “other investigative questions” covers Hellman here. But the reason CD looked at this differently is because they were hunting for the Trump associate who got advance notice of the hack-and-leak. Hellman knows that.

Another problem this creates for Durham is that — as laid out here — he accused Michael Sussmann of lying about sharing allegations about “a Presidential candidate.”

As Sussmann noted in a recent filing summarizing conflicting views on jury instructions, Durham’s indictment describes Sussmann’s alleged lie this way:

[O]n or about September 19, 2016, the defendant stated to the General Counsel of the FBI that he was not acting on behalf of any client in conveying particular allegations concerning a Presidential candidate, when in truth, and in fact, and as the defendant knew well, he was acting on behalf of specific clients, namely, Tech Executive-1 and the Clinton Campaign.

Never mind that Durham characterized the allegations as pertaining to “a Presidential candidate,” which presents other problems for Durham, he has also accused Sussmann of lying about having two clients.

Mr. Sussmann proposes modifying the last sentence as follows, as indicated by underlining: Specifically, the Indictment alleges that, on or about September 19, 2016, Mr. Sussmann, did willfully and knowingly make a materially false, fictitious, and fraudulent statement or representation in a matter before the FBI, in violation of 18 U.S.C. § 1001(a)(2), namely, that Mr. Sussmann stated to the General Counsel of the FBI that he was not acting on behalf of any client in conveying particular allegations concerning Donald Trump, when, in fact, he was acting on behalf of specific clients, namely, Rodney Joffe and the Clinton Campaign.5 The government objects to the defense’s proposed modification since it will lead to confusion regarding charging in the conjunctive but only needing to prove in the disjunctive.

4 Authority: Indictment.

5 Authority: Indictment.

Durham’s language about “conjunctive” versus “disjunctive” will likely be the matter for heated debate next week. Particularly in the wake of Cooper’s decision that the materials from the researchers won’t come in as evidence, Durham seems to be preparing to prove only that Sussmann lied about representing Hillary, and not about Joffe. Sussmann, meanwhile, seems to believe that Durham will have to prove that his alleged lie was intended to hide both alleged clients.

At least the people who opened this investigation didn’t see these allegations to pertain to Donald Trump, biological human They viewed them, first and foremost, as an allegation about Alfa Bank, and secondarily as an allegation about corporate human, Trump Organization.

This distinction will show up over and over again in the next week.

Finally, this goes to materiality. There was no way FBI was going to take allegations that might explain who got advance notice of the hack-and-leak attack on Hillary and not see if it answered that question. Durham wants to complain that this got opened as a Full Investigation when the allegations weren’t that strong. They weren’t! But the reason why it got opened as a Full Investigation is because Crossfire Hurricane had already been opened as a Full Investigation looking for the unknown subject who had gotten a heads up on Russia’s attack plans,

Sussmann has both Jonathan Moffa (who is included on this opening EC) and Michael Horowitz slotted as witnesses next week. He explicitly said that Moffa will address materiality and, depending on how things go, Horowitz’s determination that CH was properly predicated as a Full Investigation might become an issue as well.

In other words, Durham is going to have to talk about Crossfire Hurricane.

And from there, things could get worse, because we know Durham didn’t provide discovery to allow Sussmann to fully argue these issues.

John Durham is prosecuting Michael Sussmann because he brought allegations to the FBI about a bank that has now been sanctioned as part of an effort to halt Russia’s efforts to dismantle democracies in Ukraine and elsewhere, including the United States. Yet for months, he has claimed that such a tip did grave damage to Donald Trump.

Other Sussmann trial coverage

Scene-Setter for the Sussmann Trial, Part One: The Elements of the Offense

Scene-Setter for the Sussmann Trial, Part Two: The Witnesses

The Founding Fantasy of Durham’s Prosecution of Michael Sussmann: Hillary’s Successful October Surprise

With a Much-Anticipated Fusion GPS Witness, Andrew DeFilippis Bangs the Table

John Durham’s Lies with Metadata

emptywheel’s Continuing Obsession with Sticky Notes, Michael Sussmann Trial Edition

Brittain Shaw’s Privileged Attempt to Misrepresent Eric Lichtblau’s Privilege

The Methodology of Andrew DeFilippis’ Elaborate Plot to Break Judge Cooper’s Rules

Jim Baker’s Tweet and the Recidivist Foreign Influence Cheater

That Clinton Tweet Could Lead To a Mistrial (or Reversal on Appeal)


That Clinton Tweet Could Lead To a Mistrial (or Reversal on Appeal)

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

If you follow coverage of the Michael Sussmann trial anywhere but here and Politico, you would believe that the big news from Friday is that former Hillary campaign manager Robby Mook testified that Hillary personally approved of sharing the Alfa Bank story. As part of that coverage, virtually everyone is also covering the tweet admitted where Hillary focused attention on the Franklin Foer story after it came out.

Here’s how CNN covered it.

Slate published a story on October 31, 2016, raising questions about the odd Trump-Alfa cyber links. After that story came out, Clinton tweeted about it, and posted a news release that said, “This secret hotline may be the key to unlocking the mystery of Trump’s ties to Russia.”

[snip]

Inside the courtroom, prosecutors showed the jury Clinton’s tweet about the Trump-Alfa article from Slate, and Mook read aloud portions of the campaign’s news release about the story. The release was from Jake Sullivan, who is currently President Joe Biden’s national security adviser.

We can only assume that federal authorities will now explore this direct connection between Trump and Russia as part of their existing probe into Russia’s meddling in our elections,” Sullivan said in the release on October 31, 2016, one week before Election Day.

The special counsel team has previously said that the Clinton campaign’s media blitz around the Slate story “is the very culmination of Mr. Sussmann’s work and strategy,” to allegedly gin up news coverage about the Trump-Alfa allegations and then get the FBI to start an investigation.

During the hearing, Twitter users recirculated Clinton’s old post. It caught the eye of billionaire Elon Musk, who has become increasingly vocal about political matters while he tries to buy Twitter, and recently announced his support for the Republican Party. He called the Trump-Alfa allegation “a Clinton campaign hoax” and claimed that Sussmann “created an elaborate hoax.” [my emphasis]

Obviously, the frothy right has made it the center of a frenzy to investigate Hillary herself. Surely it will also lead to an investigation of Jake Sullivan.

The thing is, legally, the part about investigating wasn’t supposed to come into the trial and will be something that, at the very least, Judge Christopher Cooper issues an instruction to the jury on.

This media frenzy was the predictable result of Andrew DeFilippis breaking Cooper’s rules. Again.

Here’s what the tweet, as sent to the jury will look like.

Here’s what the transcript looks like (though I don’t believe the transcript will be sent back to the jury).

Nevertheless, the jury heard it because — just minutes after being instructed not to include the language about the FBI investigation and not to read from the tweet!! — DeFilippis “accidentally” handed Robby Mook the unredacted copy to read, and coached him to continue to read the stuff that was redacted.

Q. And is there any reason why he would be the one to issue a statement like this?

A. You know, Jake’s a pretty highly regarded national security expert.

Q. Okay.

A. So it makes sense that he’s the voice on this.

Q. Could you just read the content of Mr. Sullivan’s statement.

A. Starting with “This could”?

Q. Yes.

A. “This could be the most direct link yet” —

Q. I’m sorry, start at the top.

A. “In response to a new report from Slate showing that the Trump Organization has a secret server registered to Trump Tower that has been covertly communicating with Russia, Hillary For America Senior Policy Advisor Jake Sullivan released the following statement Monday.” Keep going?

Q. Yes.

A. “This could be the most direct link yet between Donald Trump and Moscow. Computer scientists have apparently uncovered a covert server linking the Trump Organization to a Russian-based bank. “This secret hotline may be the key to unlocking the mystery of Trump’s ties to Russia. It certainly seems the Trump Organization felt it had something to hide, given that it apparently took steps to conceal the link when it was discovered by journalists. [my emphasis]

Here’s the bench conference that immediately preceded this exchange, in which DeFilippis made one last bid to enter the tweet into evidence. This language was redacted on first release of the transcript, but got unsealed overnight.

MR. DeFILIPPIS: Your Honor, could we have a quick call? (The following is a bench conference held outside the hearing of the jury)

MR. DeFILIPPIS: Your Honor, the government believes we’ve now laid an adequate foundation for probing into admissibility in connection with the Tweet and press statement that we’ve been talking about.

Mr. Mook has testified that the candidate herself approved a decision to send this to the media. The Tweet and press statement themselves refer to the FBI, and the defense admitted a Tweet during their examination of Mr. Baker.

We don’t think it’s, in light of this testimony, in any way prejudicial or cumulative because it addresses both the FBI issue and the issue of the decision to provide it to the media.

So we would ask that we be able to present the Tweet to Mr. Mook.

MR. BOSWORTH: Your Honor, we object. It remains the case that the — you know, Ms. Clinton is not on the witness stand. Jake Sullivan is not on the witness stand.

Jake Sullivan, weeks after Mr. Sussmann went to the FBI, issued a statement about the Slate article that was published that there’s no evidence that Mr. Sussmann had anything to do with. And that press statement goes into an area that goes beyond anything for which they’ve laid a foundation. And it’s highly prejudicial in that that statement doesn’t just say this is a serious story. It calls on the FBI to investigate.

That is incredibly prejudicial because it suggests that Mr. Sussmann was going to the campaign on their behalf, and there was literally zero evidence that the campaign knew Mr. Sussmann was going, including in Mr. Mook’s testimony today.

And second, that’s weeks after Mr. Sussmann went to the FBI. And the statement itself doesn’t say, “We’re so glad the FBI’s already investigating.” They’re steering far clear of any knowledge they could have even conceivably had about the investigation.

So we think Your Honor’s prior ruling stands.

THE COURT: All right. I want to review the statement again for the information that you say is extraneous.

Generally, as I indicated, I think, earlier this week, this does complete the story, and a lot of this is subject to cross. I think it can be explained that — just because it has Ms. Clinton’s name on it and is a statement of the campaign and it completes the narrative that the government has tried to advance, but I am concerned about any other extraneous information of the Tweet that may not be pertinent. So let me take a look at it. Can you complete your cross, or shall we just take a break?

MR. DeFILIPPIS: Maybe take a break, Your Honor. (This is the end of the bench conference)

THE COURT: All right. Ladies and gentlemen, we’re going to take about a five-minute break, so if you could just — to resolve an evidentiary issue. So if you could just retire to the deliberation room, we’ll call you when we’re ready. (Jury exits courtroom)

[snip]

THE WITNESS: Yes, Your Honor.

MR. BOSWORTH: Your Honor, do you want me to pass it up?

THE COURT: Yes, if you can pass it up. We have it back in chambers, but let me…

THE COURTROOM DEPUTY: Everyone can be seated.

THE COURT: Please be seated. And I’ll tell you what, just give me five minutes. (Recess taken)

THE COURT: All right. Mr. DeFilippis, if you can lay a foundation that he had knowledge that a story had come out and that the campaign decided to issue the release in response to the story, I’ll let you admit the Tweet. However, the last paragraph, I agree with the defense, is substantially more prejudicial than it is probative because he has testified that had neither — he nor anyone at the campaign knew that Mr. Sussmann went to the FBI, no one authorized him to go to the FBI, and there’s been no other evidence admitted in the case that would suggest that that took place. And so this last paragraph, I think, would unfairly suggest to the jury, without any evidentiary foundation, that that was the case. All right?

MR. DeFILIPPIS: Your Honor, just two brief questions on that.

THE COURT: Okay.

MR. DeFILIPPIS: Can we — so can we use — depending on what he says about whether he was aware of the Tweet or the public statement, may we use it to refresh him?

THE COURT: Sure. Sure.

MR. DeFILIPPIS: Okay. And then, as to the last paragraph, could it be used for impeachment or refreshing purposes as well in terms of any dealings with the FBI?

THE COURT: You can use anything to refresh.

MR. DeFILIPPIS: Okay.

THE COURT: But we’re not going to publish it to the jury. We’re not going to read from it. And let’s see what he says.

DeFilippis wasn’t even supposed to read it!! But he ignored Cooper’s orders, issued minutes earlier, and predictably set off a firestorm.

After Mook left the stand, Judge Cooper acknowledged that the FBI paragraph shouldn’t have come in. He acknowledged that DeFilippis had used it as hearsay to admit it for the truth. Sussmann’s lawyer Michael Bosworth graciously pretended DeFilippis’ actions were not intentional.

THE COURT: All right. Please be seated. Just for the record, in addition to the 403 grounds for the last paragraph of the press statement, it’s also hearsay from Mr. Sullivan for the truth — or whether it’s being offered for the truth, certainly it’s likely to be received for the truth that the campaign wished the FBI to investigate or had some hand in the FBI investigation. So that section of the Tweet, consistent with the Court’s prior ruling, is inadmissible as hearsay as well.

MR. BERKOWITZ: Thank you, Your Honor. Just briefly?

THE COURT: Yes.

MR. BERKOWITZ: Mr. DeFilippis, I’m sure, didn’t intend it, but he gave him the unredacted Tweet to perhaps refresh his recollection. He read probably two sentences, and we would ask that you strike from the record his reading of that. I know that —

THE COURT: The Court will strike those two sentences, and we’ll specify it for the court reporter. And obviously let’s make sure that the redacted copy is included in the exhibits that go to the jury.

MR. DeFILIPPIS: Yes, we will, Your Honor.

But DeFilippis did more than “accidentally” give Mook the unredacted tweet! He also had him read it, which he had just been told not to do.

Worse still, the record shows that neither Mook nor Hillary would have known about this tweet. It surely had high level press involvement, but this was presented as the words of Hillary when it was explicitly anything but.

And this is precisely what Sussmann’s team warned would happen when, in a pretrial hearing, Cooper floated reversing his past decision to exclude the tweet.

So the more I sort of dug into each side’s sort of theories of relevance over the weekend as we finalized the last motions in limine ruling, which you obviously got, I thought I might revisit one issue. And that is the Clinton campaign press release from October, late October, I guess.

I provisionally ruled that that would not be admissible based on the submissions that you all made. And I ruled from the bench without really getting any argument on that issue. And my previous understanding was that it was being offered to show a direct attorney-client relationship between Mr. Sussmann and the campaign as well as potentially the effect on the listener under a hearsay exception.

But I guess my question, as I have thought more about this, given the sort of two competing theories of the case and two narratives laid out in the Court’s ruling on the motion in limine, is whether it is relevant not for the truth, but to show the campaign’s connection to the alleged public relations effort to play stories regarding the Alfa-Bank data with the press and that therefore it of context for the Government’s motive theory, that Mr. Sussmann sought to conceal that effort, as well campaign’s general connection to that effort.

So, Mr. Berkowitz, please address that if want.

MR. BERKOWITZ: Yes, your Honor. Thank you for raising the issue.

THE COURT: Yes. And I will also say that I’ve never introduced a tweet at a trial. And there are certain evidentiary issues with what a tweet is and who it is sent by. I would like to avoid those issues. But there is a separate press release, which I’m not quite sure I appreciated when I ruled from the bench a week and a half ago.

MR. BERKOWITZ: So let me try and address the contextualized issue, your Honor.

With respect to the campaign’s involvement or PR connection to the Alfa-Bank story, we expect there will be testimony or other evidence that ties that together. And I know that in your motion in limine ruling, you assumed without saying we conceded it that we were taking the position that Mr. Sussmann was not acting on behalf of Hillary for America.

We’re not going to be taking the position that he was not counsel for Hillary for America in connection with various efforts and communications; and we will obviously address that at trial. But I don’t know that the connection between the campaign and PR efforts, opposition research to get the story of Alfa-Bank out there is going to be something that’s in dispute.

And I would ask that you, as you think about this issue, which is somewhat inflammatory because it gets the candidate — it’s a month after; it’s a different newspaper issue; and there’s no connection between Mr. Sussmann and that tweet to suggest that he was involved in that or was otherwise doing it.

And so as what else is coming is more prejudicial relates to a number it’s evaluated, I think contextualizing into evidence, I think that that tweet than it would be probative. It also of other issues that you note from an evidentiary standpoint.

So we don’t think that the tweet itself for all the reasons in our motion, but also because it’s not — it would be cumulative, I think, of the other evidence related to whether there was a connection at the time about that. Without getting into too much work product or issues, there were updates to the campaign related to, for example, the possibility of a New York Times story coming out. And I think that that will be what’s relevant as opposed to the larger issue of, you know, whether they continue to try and press that after the meeting.

THE COURT: I appreciate that. But there were a couple double negatives in there.

MR. BERKOWITZ: Please correct me or ask me to refocus it.

THE COURT: Did I understand you to say that the defense will not be contesting that he was representing the campaign in connection with some of the media outreach that was going on?

MR. BERKOWITZ: Correct.

THE COURT: Mr. DeFilippis?

MR. DeFILIPPIS: Yes, your Honor. Let me just briefly say that I think it’s plain from the contents of the tweet and the press statements themselves that the Government is not offering those for their truth. So I think your Honor, it seems, agrees that they’re not hearsay. It’s more of a relevance/probity thing.

And while I don’t have it in front of me, your Honor, when you read the contents both of the press statement and the tweet, the thrust of them is the very culmination of Mr. Sussmann’s work and strategy, which was twofold: First, the strategy, as the Government will argue at trial, was to create news stories about this issue, about the Alfa-Bank issue; and second, it was to get law enforcement to investigate it; and perhaps third, your Honor, to get the press to report on the fact that law enforcement was investigating it.

And we see all three things there reflected in the tweet and in the press statement. It says something to the effect of, Donald Trump has a secret channel with Russia and the FBI should look into this or we trust that the FBI is looking into this.

That is highly probative, your Honor, because it is, as I said, the culmination of everything the Defendant was trying to do as he billed work to the campaign.

And we expect to call at least currently, your Honor, the campaign manager of the Hillary Clinton campaign, who will say this was a conscious decision. After being briefed specifically on Mr. Sussmann’s efforts, the campaign made a conscious decision, authorized at the very highest levels of the campaign, to share the Alfa-Bank allegations with the media.

THE COURT: Well, if that’s going to be the case, and he’s not contesting that he was representing the campaign in connection with that effort, isn’t the tweet cumulative? It’s icing on the cake. Right?

MR. DeFILIPPIS: I don’t think so, your Honor, only because we will not have, your Honor — we will not call reporters to the stand who will in fact confirm that the campaign spoke to the media. We will not — we will have essentially the testimony of a campaign official.
And then the only way to show, your Honor, how the campaign actually capitalized on what it was that Mr. Sussmann did in the media is to — and it’s a very limited — as your Honor knows, it’s not long. It’s not particularly or really at all prejudicial, your Honor, because the contents of it are essentially just the candidate and one of her advisors adopting the allegation that Mr. Sussmann has been working on.

So, your Honor, it’s really just context and the pure result of everything that Mr. Sussmann and the campaign were working on in this regard. And it’s not inflammatory. It simply states the allegation and it states that the campaign hopes the FBI’s looking into it.
We —

THE COURT: I’ll reserve on it. Let’s see how the evidence comes in. And just don’t open on it.

MR. DeFILIPPIS: Okay. Thank you, your Honor.

MR. BERKOWITZ: Your Honor, I was also asking permission to approach, but I guess I don’t need to here.

Mr. DeFilippis in describing the relevance focused on the portion of the tweet that was different than you or I were talking about, that calling on the FBI to investigate. That in and of itself in our — from our perspective suggests that they are offering the tweet for the truth of the matter, that that’s what the campaign desired and wanted and that it was a accumulation of the efforts.

Number one, it’s not the truth; and in fact, it’s the opposite of the truth. We expect there to be testimony from the campaign that, while they were interested in an article on this coming out, going to the FBI is something that was inconsistent with what they would have wanted before there was any press. And in fact, going to the FBI killed the press story, which was inconsistent with what the campaign would have wanted.

And so we think that a tweet in October after there’s an article about it is being offered to prove something inconsistent with what actually happened.

This jury is not sequestered. It would take a great deal of diligence to avoid the shit storm this set off.

There is no way to undo the damage that this will do to the trial. And it happened because DeFilippis ignored not one but two parts of Cooper’s order — first, that the reference to the FBI be redacted, and second, that it not be read.

And it’s clear from the record that this has been the plan all along, just like using a self-described non-expert at DNS to offer an opinion about DNS. The truth is it’s Durham’s team, not Hillary, that had the plan to set off an October Surprise by manipulating the press all along.

Worse still, while there are legal measures to take, even then that would not undo the damage. Anything Cooper does to correct his own poor decision and DeFilippis’ worse flouting of Cooper’s orders would be blamed on him being an Obama appointment, not the law, and only further fuel the firestorm.

Even as the record sits right now, I believe there’s a great deal from which the jury would find reasonable doubt to convict. Given where I think Sussmann’s team is going to go from here, I think chances are good they get an acquittal.

But the Durham team just succeeded in a desperate bid to win this case using hearsay. Because hearsay is all they’ve got.


Jim Baker’s Tweet and the Recidivist Foreign Influence Cheater

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

In my post on what prosecutors need to prove to win their case against Michael Sussmann, I noted they had to prove that:

  • Sussmann said the lie that they claim he did: that he affirmatively said he was not sharing the Alfa Bank allegations on behalf of a client
  • He said it on September 19, and not just on September 18
  • It was an intentional lie
  • It was material, meaning the alleged lie mattered to the operation of the FBI

I think the government has, in some ways, done best presenting their materiality arguments (but then, that’s the lowest bar). But even there, exhibits submitted at trial show that at least two of the key decision-makers on investigative issues had received a text referencing that this was a DNC report; Andrew DeFilippis speculated with one of the witnesses who received the text that it was a typo for DNS. And it appears, in multiple situations, people just assumed that Sussmann was at the FBI on behalf of the Hillary campaign, and took it into account. That said, Berkowitz got Baker — who was a key player in the Stellar Wind story that Eric Lichtblau held through an election in 2004 — to explain how important, from a national security perspective, it can be to hold certain stories.

And as I’ll show, Sussmann’s team may have something very special in store to make their materiality argument.

Regarding whether his statement that he was not there “on behalf of any client,” I think Sussmann has made a very good case that he meant his comment to Jim Baker on September 18 that he wanted to help the FBI. Both Marc Elias and Robbie Mook testified that sharing advance warning of a story they wanted to come out was the last they would have wanted or approved, because Jim Comey had done so much to damage the campaign. Particularly if Eric Lichtblau testifies, Sussmann will have a powerful story about all the damage that going to the FBI did to the campaign.

As to the other questions, they all go to Baker’s credibility on the stand.

I can’t say how the jury reacted, but I think prosecutors really didn’t do what they needed to do to prove that Sussmann repeated his comment about not meeting with Baker on behalf of any client and, then, hiding it when he helped the FBI kill the story later in the week. And Berkowitz did even more to show the changing nature of Baker’s statements about the meeting over time.

I did two long twitter threads on Sean Berkowitz’ cross-examination of Baker (Thursday night, Friday morning). I think Berkowitz achieved the following:

  • Used Baker to define “lie” as having an intention to deceive.
  • Made it clear that Baker reconstructed his understanding of his face-to-face meeting with Sussmann with the help of a chain of custody log that an FBI agent referring to the process called “doctored.” That’s going to provide Sussmann’s team a great metaphor to explain what Baker’s memory consists of.
  • Got Baker to suggest his memory of what happened on September 19 amounted to “words to that effect” of what has been charged.
  • Got Baker to agree that there’s at least a 25% chance Sussmann told him he had a client on September 21, which would be proof he wasn’t hiding a client.
  • Foregrounded the possibility that Baker could be prosecuted for his many inconsistent statements, including some that were made in 2018 and some that were made months ago. The statute of limitations on Baker’s inconsistent statements won’t expire until 2027.
  • Showed that Baker’s testimony on the stand was inconsistent with things he told Durham even in recent months; and Baker continues to not remember key details both of what happened on September 19 but also much more recently.
  • Showed that Baker’s reconstructed memory shifts at times from “that matter” (collecting the data) to the meeting itself; this is a reconstructed memory that can only come from prosecutors.
  • Demonstrated that Durham withheld at least three documents that could have “refreshed” Baker’s memory to believing Sussmann had told him he had a client.
  • Placed Durham in the room for some of the key sessions — including in Summer 2020, when Barr and Trump were pressuring Durham to show some results in time for the election — when Baker’s memory was “refreshed.”

Those threads were hard to write and I’m sure even more painful for people who are friends of one or both men to read. The story Berkowitz told was how, through the relentless grind of Republican blowhards and the Trump DOJ’s politicized investigations, Baker came to “remember” testimony that could put his friend, Sussmann, someone who had tried to get him a job when he was at a really bad point in his life, in prison.

There was no way out for Sussmann except to destroy his friend. And Berkowitz at least made it seem that Baker had believed there was no way out for him except to “refresh” his memory to match what Durham wanted.

I suspect it likely that Sussmann’s team will point out that Durham is choosing to prosecute just the people whose story doesn’t match the one that Durham wants to tell. It’s not just Baker whose testimony to Durham is inconsistent with provable facts, but Durham is not prosecuting any of the witnesses who are saying what he wants them to.

With all that as background I want to point to something subtle that I suspect will become part of that theme. Ostensibly to address materiality — Baker’s belief, one he shared with Congress in 2018 but contradicted under coaching by Durham on the stand — that if you have a national security tip you need to feel free to come to the FBI. Baker tweeted it out on June 13, 2019.

This would have been posted weeks after Durham was appointed, which — Baker testified — led Baker to expect he’d be under criminal investigation again.

Q. And you, sir, were aware that Mr. Baker was — I mean, Mr. Durham was reappointed as special counsel, correct, in or around 2019?

A. For this matter?

Q. yes.

A. yes.

Q. And when that happened, you were concerned, were you not?

A. Concerned about what?

Q. That Mr. Durham might come and investigate you more?

A. I wasn’t concerned about it. I expected it.

Q. All right. You expected to be investigated further by Mr. Durham. Correct?

A. Correct.

After having laid out how Baker had been investigated by Durham as part of a leak investigation for years, Berkowitz even introduced a text that Baker sent Ben Wittes the day after Durham was appointed saying, “now I get to be investigated for another year or two by John Durham. Lovely.”

But the tweet about going to the FBI wasn’t about Durham and it wasn’t random.

Rather, it was a response to something Trump said in an interview with George Stephanopoulos, between the time Mueller wrapped up his investigation, in part, of Trump’s request, “Russia, are you listening,” in 2016 and the time Trump asked Volodymyr Zelensky, “but first, I would like you to do us a favor.” On the same day Baker encouraged people to go to the FBI if they had evidence, ABC posted an interview in which Trump said,

“It’s not an interference, they have information — I think I’d take it,” Trump said. “If I thought there was something wrong, I’d go maybe to the FBI — if I thought there was something wrong. But when somebody comes up with oppo research, right, they come up with oppo research, ‘oh let’s call the FBI.’ The FBI doesn’t have enough agents to take care of it. When you go and talk, honestly, to congressman, they all do it, they always have, and that’s the way it is. It’s called oppo research.”

I’m not precisely sure how Sussmann’s team is going to use this tweet, beyond the materiality question, materiality about precisely this situation, whether someone should share information with the FBI after their opponent solicited help from a hostile foreign government.

But it sure seems to be evidence of more than just materiality.


The Methodology of Andrew DeFilippis’ Elaborate Plot to Break Judge Cooper’s Rules

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

When Michael Sussmann attorney Sean Berkowitz was walking FBI Agent Scott Hellman through the six meetings he had with Durham’s team on Tuesday — meetings he first had as a witness about the investigation into the Alfa Bank allegations and later in preparation for his trial testimony — Berkowitz asked Hellman about how, sometime earlier this year, Andrew DeFilippis and Jonathan Algor asked him whether he could serve as their DNS expert for the trial.

Q And then, more recently, you met with Mr. DeFilippis and I think Johnny Algor, who is also at the table here, who’s an Assistant U.S. Attorney. Correct?

A. Yes.

Q. They wanted to talk to you about whether you might be able to act as an expert in this case about DNS data?

A. Correct.

To Hellman’s credit, he told Durham’s prosecutors — who have been investigating matters pertaining to DNS data for two years — that he only had superficial knowledge of DNS and so wasn’t qualified to be their expert.

Q. You said, while you had some superficial knowledge, you didn’t necessarily feel qualified to be an expert in this case, correct, on DNS data?

A. On DNS data, that’s correct.

It wasn’t until the third day of trial before Durham’s team presented any evidence about the alleged crime. Instead, Durham’s first two witnesses were their nominal expert, David Martin, and Hellman, who told Durham he wasn’t an expert but who offered opinions he neither had the expertise to offer nor had done the work to substantiate.

That’s important, because DeFilippis used him to provide an opinion only an expert should give. And virtually everything about his testimony — his claim to have relied on the data in the materials without looking at the thumb drives, an apparently made up claim about the timing of the analysis, and behaviors that the FBI normally finds suspicious — suggest he’s not only not a DNS expert qualified to assess this report, but his assessment of the white paper Sussmann shared also suffers from serious credibility issues.

The battle over an expert

The testimony of the nominal expert, David Martin, was remarkably nondescript, particularly given the fight that led up to his testimony. Durham’s team sprung even having an expert on Sussmann at a really late date: on March 30, after months of blowing off Sussmann’s inquiries if they would. Not only did they want Martin to explain to the jury what DNS and Tor are, Durham’s team explained, but they also wanted him to weigh in on the validity of conclusions drawn by researchers who had found the anomaly.

  • the authenticity vel non of the purported data supporting the allegations provided to the FBI and Agency-2;
  • the possibility that such purported data was fabricated, altered, manipulated, spoofed, or intentionally generated for the purpose of creating the false appearance of communications;
  • whether the DNS data that the defendant provided to the FBI and Agency-2 supports the conclusion that a secret communications channel existed between and/or among the Trump Organization, Alfa Bank, and/or Spectrum Health;

[snip]

  • the validity and plausibility of the other assertions and conclusions set forth in the various white papers that the defendant provided to the FBI and Agency-2;

As Sussmann noted in his motion to limit Martin’s testimony, he didn’t mind the testimony about DNS and Tor. He just didn’t want this trial to be about the accuracy of the data, especially without the lead time to prepare his own expert.

As the Government has already disclosed to the defense, should the defense attempt to elicit testimony surrounding the accuracy and/or reliability of the data that the defendant provided to the FBI and Agency-2, Special Agent Martin would explain the following:

  • That while he cannot determine with certainty whether the data at issue was cherry-picked, manipulated, spoofed or authentic, the data was necessarily incomplete because it was a subset of all global DNS data;
  • That the purported data provided by the defendant nevertheless did not support the conclusions set forth in the primary white paper which the defendant provided to the FBI;
  • That numerous statements in the white paper were inaccurate and/or overstated; and
  • That individuals familiar with these relevant subject areas, such as DNS data and TOR, would know that such statements lacked support and were inaccurate and/or overstated.

Based off repeated assurances from Durham that they weren’t going to make accuracy an issue in their case in chief, Judge Cooper ruled that the government could only get into accuracy questions if Sussmann tried to raise the accuracy of the data himself. But if he said he relied on the assurances of Rodney Joffe, it wouldn’t come in.

The government suggests that Special Agent Martin’s testimony may go further, depending on what theories Sussmann pursues in cross-examination or his defense case. Consistent with its findings above, the Court will allow the government’s expert to testify about the accuracy (or lack thereof) of the specific data provided to the FBI here only in certain limited circumstances. In particular, if Sussmann seeks to establish at trial that the data were accurate, and that there was in fact a communications channel between Alfa Bank and the Trump Campaign, expert testimony explaining why this could not be the case will become relevant. But, as the Court noted above, additional testimony about the accuracy of the data—expert or otherwise—will not be admissible just because Mr. Sussmann presents evidence that he “relied on Tech Executive-1’s conclusions” about the data, or “lacked a motive to conceal information about his clients.” Gov’s Expert Opp’n at 11. As the Court has already explained, complex, technical explanations about the data are only marginally probative of those defense theories. The Court will not risk confusing the jury and wasting time on a largely irrelevant or tangential issue. See United States v. Libby, 467 F. Supp. 2d 1, 15 (D.D.C. 2006) (excluding evidence under Rule 403 where “any possible minimal probative value that would be derived . . . is far outweighed by the waste of time and diversion of the jury’s attention away from the actual issues”).

Then, days before the trial, the issue came up again. Durham sent a letter on May 6 (ten days before jury selection), raising a bunch of new issues they wanted Martin to raise. Sussmann argued that Durham was trying to expand the scope of what his expert could present. Among his complaints, Sussmann argued that Durham was trying to make a materiality argument via his expert witness.

Third, the Special Counsel apparently intends to offer expert testimony about the materiality of the false statement alleged in this case. Indeed, the Special Counsel’s supplemental topic 9 regarding the importance of considering the collection source of DNS data is plainly being offered to prove materiality. But the Special Counsel did not disclose this topic in either his initial expert disclosure or Opposition, and the Court’s ruling did not permit such testimony. The Special Counsel should not now be allowed to offer an entirely new expert opinion under the guise of eliciting testimony regarding the types of conclusions that can be drawn from a review of DNS data.

Judge Cooper considered the issue Tuesday morning, before opening arguments. When asking why Martin had to present the concept of visibility, DeFilippis explained that Hellman–the Agent who’s not an expert on DNS but whom DeFilippis nevertheless had asked to serve as an expert on DNS–would talk about the import of knowing visibility to assess data.

THE COURT: Well, but isn’t the question here whether a case agent — is your case agent later going to testify that that was something that the FBI looked at or wanted to look at in this case and was unable to do so, and that that negatively affected the FBI’s investigation in some way? MR.

DeFILIPPIS: Yes, and I expect Special Agent Hellman, who will testify likely today, Your Honor, I expect that that is a concept that he will say was relevant to the determination that — determinations he was making as he drafted analysis of the data that came in. And, again, I don’t think we — for example, another way in which this comes up is that the FBI routinely receives DNS data from various private companies who collect that data, and it is always relevant sort of the breadth of visibility that those companies have. So it’s relevant generally, but also in this particular case the fact that the FBI did not have insight into the visibility or lack of visibility of that data certainly affected steps that the FBI took.

THE COURT: Okay. But Mr. Sussman has not been accused of misrepresenting who the source is. He’s simply — but rather who the client is. So how do you link that to the materiality of the alleged false statement?

MR. DeFILIPPIS: Because, Your Honor, I think we view them as intertwined. It was because — it was in part because Mr. Sussman said he didn’t have a client that made it more difficult for the FBI to get to the bottom of the source of this data or made it less likely they would, and so — and, again, I don’t think we expect to dwell for a long time on this, but I think the agents and the technical folks will say that that is part of why the origins of the data are extremely relevant when they took investigative steps here.

When Cooper noted Sussmann’s objection to Martin discussing possible spoofing of data, DeFilippis again answered not about what Martin would testify, but what Hellman would.

As DeFilippis explained, he claimed to believe that under Cooper’s ruling, the government could put in any little thing they wanted that they claimed had been part of the investigation.

And Special Agent Hellman, when he testifies today — now, Your Honor’s ruling we understand to permit us to put into evidence anything about what the FBI analyzed and concluded as its investigation unfolded because that goes to the materiality of the defendant’s statement. So Special Agent Hellman — through Agent Hellman we will offer into evidence a paper he prepared when the data first came in, and among its conclusions is that the data might — he doesn’t use the word “spoof” — but might have been intentionally generated and might have been fabricated. That was the FBI’s initial conclusion in what it wrote up.

So in order for the jury to understand the course of the FBI’s investigation and the conclusions that it drew at each stage, those concepts are at the center of it.

[snip]

MR. DeFILIPPIS: Okay. Your Honor, I’m sorry. We understood your ruling to be that the FBI’s conclusions as it went along were okay as long as we weren’t asserting the conclusion that it was, in fact, fabricated. You know, I mean, it’s difficult to chart the course of the FBI’s investigation unless we can elicit at each stage what it is that the FBI concluded.

Judge Cooper ordered that references to spoofing be removed — leading to a last minute redaction of an exhibit — but permitted a discussion of visibility to come in.

After all that fight, Martin’s testimony was not only bland, but it was recycled powerpoint. He not only admitted lifting the EFF description of Tor for his PowerPoint, but he included their logo.

Hellman delivers the non-expert expert opinion Durham was prohibited from giving

As I said, Martin was witness number one, Hellmann — the self-described non-expert in DNS — was witness number two.

Even though Hellman admitted, again, that he’s not a DNS expert, DeFilippis still had him go over what DNS is.

Q. How familiar or unfamiliar are you with what is known as DNS or Domain Name System data?

A. I know the basics about DNS.

Q. And in your understanding, on a very basic level, what is DNS?

A. DNS is basically how one computer would try and communicate with another computer.

After getting Hellman to explain how he purportedly got chain of custody signatures on September 20, 2016 for the materials Michael Sussmann dropped off with James Baker on September 19, DeFilippis walked Hellman through how, he claimed, he had concluded that the allegations Sussmann dropped off were unsupported. Hellman reviewed the data accompanying the white paper, Durham’s star cybersecurity witness claimed on the stand, and after reviewing that data, determined there was no allegation of a hack in the materials and therefore nothing for the Cyber Division to look at. And, as a report he wrote “within a day” summarized, he concluded the methodology was horrible.

As you read the following exchange, know that (as I understand it) some, if not most, of what Hellman describes as the methodology is wrong. Obviously, if Hellman’s understanding of the methodology is wrong, then the opinion that DeFilippis elicits from a guy who admitted he was not an expert on DNS but whom DeFilippis nevertheless asked to serve as his expert witness on DNS before inviting David Martin in to present slides lifted from the Electronic Frontier Foundation instead [Takes a breath] … If Hellman’s understanding of the methodology and the data he’s looking at is wrong, then his opinion about the methodology is going to be of little merit.

With that understanding, note the objection of Sean Berkowitz, who fought DeFilippis’ late hour addition of an expert that DeFilippis wanted to use to opine on the validity of the research, bolded below.

So we looked at the top part, which set out your top-line conclusion. You then have a portion of the paper that says, “The investigators who conducted the research appear to have done the following.” Now, Special Agent Hellman, it appears to be a pretty technical discussion, but can you just tell us, in that first part of the paper, what did you set out and what did you conclude?

A. It looks to be that they were looking for domains associated with Trump, and the way that they did that was they looked at a list of sort of all domains and looked for domains that had the word “Trump” in them as a way to narrow down the number of domains they were looking at.

And then they wanted to find, well, which of that initial set of Trump domains, which of them are email servers associated with those domains. And the way they did that was to search for terms associated with email, like “mail” or other email-related terms to then narrow down their list of domains even further to be Trump-associated domains that were email servers.

Q. And did you opine on the soundness of that methodology? In other words, did you express a view as to whether this was a good way to go about this project?

A. We did not — I did not feel that that was the most expeditious way to go about identifying email servers associated with the domain.

Q. And why was that?

A. You can name an email server anything you want. It doesn’t have to have the words “mail” or “SMTP” in it. And so by — if you’re just searching for those terms, I would wager to guess you would miss an actual email server because there are other — there are other more technical ways that you can use — basically look-up tools, Internet look-up tools where you can say, for any domain, tell me the associated email server. That’s essentially like a registered email server. But the way that they were doing it was they were just looking for key terms, and I think that it just didn’t make sense to me why they would go about identifying email servers that way as opposed to just being able to look them up.

Q. Was there anything else about the methodology used here by the writer or writers of this paper that you found questionable or that you didn’t agree with?

A. I think just the overall assumptions that were being made about that the server itself was actually communicating at all. That was probably one of the biggest ones.

Q. And what, if anything, did you conclude about whether you believed the authors of the paper or author of the paper was fairly and neutrally conducting an analysis? Did you have an opinion either way?

MR. BERKOWITZ: Objection, Your Honor.

THE COURT: Basis?

MR. BERKOWITZ: Objection on foundation. He asked him his opinion. He’s not qualified as an expert for that.

THE COURT: I’ll overrule it.

A. Sorry, can you please repeat the question?

Q. Sure. Did you draw a conclusion one way or the other as to whether the authors of this paper seemed to be applying a sound methodology or whether, to the contrary, they were trying to reach a particular result? Did you —

A. Based upon the conclusions they drew and the assumptions that they made, I did not feel like they were objective in the conclusions that they came to.

Q. And any particular reasons or support for that?

A. Just the assumption you would have to make was so far reaching, it didn’t — it just didn’t make any sense.

That’s how, as his second witness, Andrew DeFilippis introduced the opinion of a guy who admitted he wasn’t an expert on DNS that DeFilippis had asked to serve as an expert even though DeFilippis should have known that he didn’t have the expertise to offer expert opinions like this.

If Sussmann is found guilty, I would bet a great deal of money this stunt will be one part of a several pronged appeal, because Judge Cooper permitted DeFilippis to do precisely what Cooper had prohibited him from doing before trial, and he let him do it with a guy who by his own admission is not a DNS expert.

Cyber Division reaches a conclusion without looking at the thumb drives

Now let’s look at what Hellman describes his own methodology to be.

First, it was quick. DeFilippis seems to think that serves his narrative, as if this stuff was so crappy that it took a mere glimpse to discredit it.

Q. Special Agent Hellman, how long would you say it took you and Special Agent Batty to write this up?

A. Inside of a day.

Q. Inside of a day, you said?

Berkowitz walked Hellman through the timeline of it, and boy was it quick. There’s some uncertainty about this timeline, because John Durham’s office doesn’t feel the need to make clear whether exhibits they’re turning over in discovery reflect UTC or ET. But I think I’ve laid it out below (Berkowitz got it wrong in cross-examination, which DeFilippis used to attack his analysis).

As you can see, not only were FBI’s crack cybersecurity agents making a final conclusion about the data within a day but — by all appearances — they did so before they had ever looked at the thumb drives included with the white papers. From the record, it’s actually not clear when — if!!! — they looked at the thumb drives. But it’s certain they had their analysis finalized no more than one working day after they admitted they hadn’t looked at the thumb drive, which was itself after they had already decided the white paper was shit.

Timeline

September 20, 10:20AM: Nate Batty tells Jordan Kelly they’ll come from Chantilly to DC get the thumb drives

September 20, 10:31AM: Jordan Kelly tells Batty the chain of custody is “Sussman to Strzock to Sporre”

September 20, 12:29PM: Hellman and Nate Batty accept custody of the thumb drives

September 20, 1:30PM: Hour drive back to Chantilly, VA

September 20, 4:44PM: Hellman appears to explain the process of picking up the thumb drives to jrsmith, claiming to have spoken to Baker on the phone. jrsmith jokes about “doctor[ing] a chain of evidence form.”

September 20, 4:58: Hellman says the more he reads the report “it feels a little 5150ish,” suggesting (as he explained to Berkowitz on cross) the authors suffered from a mental disability, and Hellman complains that “it contains an absurd quantity of data” to which Batty responded, the data seemed “inserted to overwhelm and confuse the reader.”

September 21, 8:47AM: Batty tells Hellman their supervisor wants them to “write a brief summary of what we think about the DNC report.” Batty continues by suggesting that “we should at least plug the thumb drives into Frank’s computer and look at the files…”

9/22, 9:44AM: Curtis Heide, in Chicago, asks Batty to send the contents of the thumb drive so counterintelligence agents can begin to look at the evidence. The boys in Cyber struggle to do so for a bit.

9/22, 2:49PM: Batty asks Hellman what he did with the blue thumb drive.

9/22, 4:46PM: Batty sends “analysis of Trump white paper” to others.

In other words, the cyber division spent less than 28 hours doing this analysis.

Yes. The analysis was quick.

Hellman says his analysis is valid because he looked at the data

The hastiness of the analysis and the fact that Hellman didn’t look at the thumb drive before making initial conclusions about the research is fairly problematic, because when he discussed his own methodology, he described the data driving everything.

Q. Now, what principally, from the materials, did you rely on to do your analysis?

A. So it was really two things. It was looking at the data, the technical data itself. There was a summary that it came with. And then also we were comparing what we saw in the data, sort of the story that the data told us, and then looking at the narrative that it came with and comparing our assessment of the data to the narrative.

[snip]

Q. And in connection with that analysis, did you also take a look at the data itself that was underlying this paper?

A. Yes

[snip]

Q. And if we look at that first page there, Agent Hellman, what kind of data is this?

A. It appears to be — as far as I can tell, it looks to be — it’s log data. So it’s a log that shows a date and a time, a domain, and an IP address. And, I mean, that’s — just looking at this log, there’s not too much more from that.

Q. And do you understand this to be at least a part of the DNS data that was contained on the thumb drives that I think you testified about earlier?

A. Yes.

[snip]

A. It would have mattered — well, I think on one hand it would not have mattered from the technical standpoint. If I’m looking at technical data, the data’s going to tell me whatever story the data’s going to tell me independent of where it comes from. So I still would have done the same technical analysis.

But knowing where the data comes from helps to tell me — it gives me context regarding how much I believe in the data, how authentic it is, do I believe it’s real, and do I trust it. [my emphasis]

He repeated this claim on cross with Berkowitz.

I just disagreed with the conclusions they came to and the analysis that they did based upon the data that came along with the white paper.

When Berkowitz asked him why counterintelligence opened an investigation when Cyber didn’t, Hellman suggested that the people in CD wouldn’t understand how to read the technical logs.

A. Um, I think they’d probably be looking at it from the same vantage point, but if you’re not — you don’t have experience looking at technical logs, you may not have the capability of doing a review of those logs. You might rely on somebody else to do it. And perhaps counterintelligence agents are going to be thinking about other investigative questions. So I guess it would probably be a combination of both.

“If I’m looking at technical data,” DeFilippis’ star cybersecurity agent explained, “the data’s going to tell me whatever story the data’s going to tell me.”

Except he didn’t look at the technical data, at least not the data on the thumb drives, before he reached his initial conclusion.

Hellman makes a claim unsupported by the data in his own analysis

I’ll leave it to people more expert than me to rip apart Hellman’s own analysis of the white paper Sussmann shared with the FBI. In early consultations, I’ve been told he misunderstood the methodology, misunderstood how researchers used Trump’s other domains to prove that just one had this anomaly (that is, as a way to test their hypothesis), and misstated the necessity of some long-term feedback loop for this anomaly to be sustained. Again, the experts will eventually explain the problems.

One part of his report that I know damns his methodology, however, is where he says the researchers,

Searched “…global nonpublic DNS activity…” (unclear how this was done) and discovered there are (4) primary IP addresses that have resolved to the name “mail1.trump-email.com”. Two of these belong to DNS servers at Russian Alfa Bank. [my emphasis]

This is the point where every single person I know who assessed these allegations who is at least marginally expert on DNS issues stopped and said, “global nonpublic DNS activity? There are only a handful of people that could be!” See, for example, this Robert Graham post written in response to the original Slate story, perhaps the most influential critique of the allegations, probably even on Durham. Every marginally expert person I know has, upon reading something like that, tried to figure out who would have that kind of visibility on the data, because that kind of visibility, by itself, would speak to their expertise. Those marginally expert people did not have the means to identify the possible sources of the data. But a lot of them — including the NYTimes!! — were able to find people who had that kind of visibility to better understand the anomaly. When Hellman read that, he simply said, “unclear how this was done” and moved on.

Still, Hellman did not contest (or possibly even test) the analysis that said there were really just four IP addresses conducting look-ups with the Trump marketing server. Dozens of people have continued to test that result in the years since, and while there have been adjustments to the general result, no one has disproven that the anomaly was strongest between Alfa Bank and Trump’s marketing domain.

Where Hellman’s insta-analysis really goes off the rails, however, is in his assertion that, “it appears that the presumed suspicious activity began approximately three weeks prior to the stated start date of the investigation conducted by the researcher.”

I’m not a DNS expert, but I’m pretty good at timelines, and by my read here are the key dates in the white paper.

May 4, 2016: Beginning date for look-up analysis

July 28, 2016: Lookup for hostnames yielding Trump

September 4, 2016: End date for look-up analysis

September 14, 2016: Updated search for look-ups covering June 17 through September 14

The start date reflected in this white paper is July 28, 2016. Three weeks before that would be July 7, 2016, a date that doesn’t appear in the white paper. The anomaly started 85 days before the start date reflected in this white paper (and the start date for the research began months earlier, but still over three weeks after the May 4 start date).

I don’t understand where he got that claim. But DeFilippis repeated it on the stand, as if it were reflected in the data, I guess believing it makes his star cybersecurity agent look good.

DeFilippis’ star cybersecurity agent has some credibility problems

There are a few more problems with the credibility of Hellman, DeFilippis’ star cybersecurity agent who is not a DNS expert. One of those is that he compared notes with his boss before first testifying.

Q: And you also spoke with Nate Batty around that time, Right?

A: Yes.

Q: Did you talk to him before the first interview to kind of get ready for it?

A: I think so, but I don’t remember.

Q: Is that something that you encourage witnesses to do, to talk to other witnesses to see if your recollections are consistent?

A: No.

In addition, notwithstanding that Batty was told that Sussmann was in the chain of control, Batty claimed to believe the source was “anonymous” and Hellmann claimed to believe it was sensitive–a human source. Even after comparing notes their stories didn’t match.

There are other problems with Hellman’s memory of the events, notably that in his first interview — the one he did shortly after comparing notes with Batty — he claimed that Baker had told him he was unable to identify the source of the data.

Q. And when you went to Mr. Baker’s office, do you remember what, if anything, was said during that discussion or during that interaction?

A. I remember being in the office, but I don’t distinctly recall what the conversation was. I do remember after the fact, though, that I was frustrated that I was not able to identify who had provided these thumb drives, this information to Mr. Baker. He was not willing to tell me.

At the very least, this presents a conflict with Baker’s testimony, but it’s also another testament to how variable memories can be four years, much less six years, after the fact.

Hellman also claimed, when asked on cross, that the first time he had ever seen the reference to a “DNC report” in September 21 Lync notes he received was two years ago, when he was first interviewed.

A: The first time I saw this was two years ago when I was being interviewed by Mr. DeFilippis, and I don’t recall ever seeing it. I never had any recollection of this information coming from DNC. I don’t remember DNC being a part of anything we read or discussed.

Q: Okay. When you say, the first time you saw it was two years ago when you met with Mr. DeFilippis, that’s not accurate. Right? You saw it on September 21st, 2016. Correct?

A: It’s in there. I don’t have any memory of seeing it.

And when Sean Berkowitz asked about Hellman the significance of seeing the reference to a “DNC report” first thing on September 21, he described that DeFilippis suggested to him that it was likely just a typo for DNS.

Q. What’s your explanation for it?

A. I have no recollection of seeing that link message. And there is — I have absolutely no belief that either me or Agent Batty knew where that data was coming from, let alone that it was coming from DNC. The only explanation that popped or was discussed was that it could have been a typo and somebody was trying to refer to DNS instead of DNC.

Q. So you think it was a typo?

A. I don’t know.

Q. When you said the only one suggesting it — isn’t it true that it was Mr. DeFilippis that suggested to you that it might have been a typo recently?

A. That’s correct.

When asked about a topic for which there was documentary evidence Hellman had seen in real time that he claimed not to remember, Andrew DeFilippis offered up an explanation that Hellman then offered on the stand.

On the stand, DeFilippis also tried to get Hellman to call a marketing server a spam server, though Hellman resisted.

Once you look closely, I don’t think Hellman’s testimony helps Durham all that much. What it proves, however, is that DeFilippis attempted to coach testimony.

One final thing. DeFilippis got his star cybersecurity agent to observe that the researchers didn’t include their name or other markers on their report, as if that’s a measure of unreliablity.

Q. Now, let me ask you, were you able to determine from any of these materials who had actually drafted the paper alleging the secret channel?

A. No.

Q. In other words, was it contained anywhere in the documents?

Here’s what Hellman’s own report looks like:

There’s a unit — ECOU1 — but the names of the individual agents appear nowhere in the report. The report is not dated. It does not specifically identify the white papers and thumb drives by control numbers, something key to evidentiary analysis.

It has none of the markers of regularity you’d expect from the FBI. Hellman’s own analysis doesn’t meet the standards that DeFilippis uses to measure reliability.

This long-time Grand Rapids resident is furious that Hellman judged there was no hack

Everything above I write as a journalist who has tried to understand this story for almost six years. Between that and 18 years of covering national security cases, I hope I now have sufficient familiarity with it to know there are real problems with Hellman’s analysis.

But let me speak as someone who lived in Grand Rapids for most of this period, and had friends who had to deal with the aftermath of Spectrum Health appearing at the center of a politically contentious story.

Hellman had, as he testified, two jobs. First, he was supposed to determine whether there were any cyber equities, then he was supposed to do some insta-analysis of the data without first looking at the thumb drives.

According to Hellman, there was no hack.

I was asked to perform two tasks in tandem with Special Agent Batty, and our tasks were, number one, to look at this data, look at the data and look at the narrative that it came with and identify were there any what’s known as cyber equities. And by that it was, was there any allegation of a hacking. That’s what cyber division does. We investigate hacking. So was there an allegation that somebody or some company or some computer had been hacked. That was first.

[snip]

As I mentioned, the first piece was we had to identify was there any real allegation of hacking; and there was not. That was our first task by our supervisor. There was not.

[snip]

The allegation was that someone purported to find a secret communication channel between the Trump organization and Russia. And so we identified first that, no, we didn’t think that there was any cyber equity, meaning that there was probably nothing more for cyber to investigate further, if there was no hacking crime.

Except here’s what the white paper says about Spectrum, that Grand Rapids business that was swept up in this story.

The Spectrum Health IP address is a TOR exit node used exclusively by Alfa Bank. ie.,  Alfa Bank communications enter a Tor node somewhere in the world and those communications exit, presumably untraceable, at Spectrum Health There is absolutely no reason why Spectrum would want a Tor exit node on its system. (Indeed, Spectrum Health would not want a TOR node on its system because, by its nature, you never know what will come out of a TOR node, including child pornography and other legal content.)

We discovered that Spectrum Health is the victim of a network intrusion. Therefore, Spectrum Health may not know it has a TOR exit node on its network. Alternatively, the DeVos family may have people at Spectrum who know there is a TOR node. i.e.,  could have been placed there with inside help.

When faced with some anomalous activity that seemed to tie into the weird DNS traffic, the experts suggested that maybe the Spectrum hack related to the DNS anomaly.

To be clear, this Tor allegation is the the weakest part of this white paper. You will hear about this to no end over the next week. It was technically wrong.

But the allegation in the white paper is that maybe a recent hack of Spectrum Health is why it had this anomalous traffic with Trump’s marketing server. There’s your hack!!

Had the people at FBI’s cybersecurity side actually treated this as a possible compromise, it might have addressed the part of this story that never made any sense. And we might not, now, six years later, be arguing about what might explain it.

Let me be clear: I do think the white paper overstated its conclusions. I don’t think secret communication is the most obvious explanation here.

But there are hacks and then there are hacks in the testimony of DeFilippis’ star cybersecurity agent.

Update: Corrected an attribution to Batty instead of Hellman.

Update: Fixed my own timeline.

Update: Added link to Robert Graham’s analysis.

Update: This may be where Hellman gets his erroneous three week claim. There were two histograms included with the report. One, the close-up, does start around July 7.

But the broader scope shows look-ups earlier, very actively in June, but with a few stray ones in May.

The government didn’t include the pages and pages of logs that Batty complained about in this exhibit. Had they, it would be clear to jurors that this claim is false.

Update: Correction on two points. First, I think I’ve finally got the Lync exchange above correct between Batty and Hellman. As noted, Hellman complains that “it contains an absurd quantity of data” to which Batty responded, the data seemed “inserted to overwhelm and confuse the reader.”

Second, I was wading through exhibits this morning and found the exhibit of 19 pages of logs. Here’s just a subset of them, including logs that go back to May 2016. Hellman didn’t look even at the printed page of log files closely enough to realize his claim about three weeks was wrong. These data weren’t intended to overwhelm the reader. They were there to show how the anomaly accelerated during the election.


Brittain Shaw’s Privileged Attempt to Misrepresent Eric Lichtblau’s Privilege

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

In the first words of her opening argument in the Michael Sussmann case, Durham prosecutor Brittain Shaw argued that this case is all about Sussmann’s privilege, his purported ability to exploit high level ties at DOJ to seed what she claims would be a smear campaign against the guy who was, in fact, hiding secret communications with the Kremlin and soliciting hacks of his opponent.

The evidence will show that this is a case about privilege: the privilege of a well-connected D.C. lawyer with access to the highest levels of the FBI; the privilege of a lawyer who thought that he could lie to the FBI without consequences; the privilege of a lawyer who thought that for the powerful the normal rules didn’t apply, that he could use the FBI as a political tool.

The really painful irony of this case, though, is that Sussmann is being significantly hamstrung because of privilege, attorney-client privilege, because it is limiting his ability to present evidence about what really happened.

When Judge Christopher Cooper ruled that a subset of emails that had been protected under privilege were not, after all, he explained that, the documents, “do not strike the Court as being particularly revelatory.” Even so, Sussmann and Fusion can’t, ethically, simply offer up emails over which the Democrats are claiming privilege. There’s good reason to believe if they could, they could show that significant parts of Durham’s conspiracy theory have been based on imagining that Democrats were hiding the worst possible plotting behind privilege claims, when in fact the reality was much more mundane.

Take two exhibits from the trial as an example. Durham is making much of a September 15, 2016 email from Marc Elias to top people on the campaign. Its subject line was “Alfa article.” But it appears to be sharing an article about “testimony of an oil trader.” If Sussmann could share it, it might simply show that Elias had seen an article about corruption and seen some tie with the Alfa Bank allegations. He can’t, because Elias is the one who made that connection.

Meanwhile, two exhibits Sussmann introduced into evidence show Robby Mook — who is not a lawyer — sharing Sidney Blumenthal “intelligence” with him that the Trump campaign was freaking out because they had gotten advance word of a NYT article about Trump’s ties with Russia.

The Trump campaign is having “a major league freak-out,” according to a Republican source who has been reliable in the past. What is causing the Trump “freak-out” is anticipation of an investigative story to be published by the New York Times. The subject is described as “Russia” and “a disaster.” “That is completely the story of everything going on since Thursday,” insists the source. The Times story, says the source, accounts for Tramp’s extraordinarily defensive aggressive reactions–his declaration that he will sue the New York Times, his personal tweeting attack on Maureen Dowd as “wacky” and a neuSidney rotic dope,” (though the source says “that’s just him anyway”), his call for the assassination of HRC, and the campaign’s push to the media of the flat-out lie that I was behind birtherism in 2008. On Saturday night, Trump tweeted: “My lawyers want to sue the tailing @nytimes so badly for irresponsible intent. I said no (for now), but they are watching. Really disgusting.” Trump did not specify why the Times might be guilty of”irresponsible intent,” which in any case lacks any legal weight. Earlier on Saturday, he tweeted that the Times was “a laughingstock rag.” The atmosphere inside the campaign is described as chaotic, frenetic and “spontaneous.” Bannon and Bossie are said to be grasping at anything to throw back in order to distract from and fend off the coming story. Journalistic sources have independently said that reporters at the Times are working on a Tromp-Russia story.

It wouldn’t be a high profile political trial, I guess, if Sid Blumenthal didn’t make a showing. Note that Mike Flynn’s Mueller interviews show him responding to some Sid Blumenthal stuff in precisely this period, so it’t clear Sid was talking to Republicans.

Anyway, that part — Blumenthal sharing with Mook — was not privileged. And that part makes it clear that Elias was right to be concerned about Trump suing if the Hillary campaign made factual observations about his ties with Russia. It also may (though this is uncertain) back Sussmann’s understanding that Eric Lichtblau was close to publishing the Alfa story, so close that Trump’s moles at the NYT had alerted him to it. But whatever Mook said about it to Elias, the campaign’s lawyer guarding against lawsuits, is privileged, as whatever Elias said to Sussmann and the Fusion guys when he forwarded Mook’s comment would be.

Whatever was said may have influenced Sussmann’s decision to go to the FBI, though, as this was shortly before he texted Jim Baker and asked to meet.

In his testimony, Elias stated that he had not given Sussmann permission to go to the FBI with the Alfa Bank story. He doesn’t think he knew until shortly afterwards, though could have learned before (the Blumenthal story may serve to explain a call that Sussmann knows prosecutors plan to dramatically reveal).

You testified that you became aware that Mr. Sussmann went to the FBI. Correct?

A. Yes.

Q. And your testimony was that you think that you were told right after, although there’s a possibility it was right before?

A. Yes.

Q. Your best recollection is which of those?

A. Is after.

Q. Okay. Did you tell him to go to the FBI?

A. No.

Q. Did he seek your permission to go to the FBI?

A. No.

Q. Did you authorize him to go to the FBI?

A. No.

Q. Are you aware of anyone at the Clinton Campaign that authorized Mr. Sussmann to go to the FBI to share the possibility of The New York Times story?

A. Not that I’m aware of. No.

Q. Did you consent to his going to the FBI?

A. No, not that I remember. No.

Elias even explained what a colossally bad idea it would be for a candidate whose campaign had been badly damaged by Jim Comey to go to the FBI.

A. First of all, the FBI had in my view not been particularly helpful in investigating or doing anything to prevent the leaks of the emails. The exfiltration is one thing, you know, the stealing of the emails. But the publication of the emails, it was not just this one time. I mean, we were dealing with multiple publications of emails. And it was not just this one client.

And I think my sense was that the FBI was not for a variety of reasons going to do anything that was going to be — like stop bad things from happening, which would be one reason to go for the FBI.

The second, which is more unique to the Clinton Campaign, is that I think he was then the FBI director, but James Comey had taken public stances in around that time period that were in my view unfair and putting a thumb on the scale against Secretary Clinton.

So I’m not sure that I would have thought that the FBI was going to be — give a fair shake to anything that they viewed as anti-Trump or pro-Clinton.

And then the final thing is that if The New York Times was going to run this story, like that’s the goal. Right? The New York Times runs the story. If you get the FBI involved, any number of things could prevent that from happening. Right?

In the most extreme instance, the FBI can go to the publication and say: Please don’t. But the second is, the newspaper itself might then want to do further reporting on the FBI investigation and delay its story. Right?

So, like, even in a world in which, like, the FBI is being helpful — not being helpful; even in a world in which the FBI is doing stuff, the media may not run the story because they want to get the full picture because they view the FBI piece of it as an essential piece of the story.

It’s certainly possible that, given this advance warning of a Trump shit-storm, Sussmann decided it would be best to give FBI a head’s up. Sussmann, however, can’t ethically share the communications between Elias and him, even if it would help him. That’s how privilege works.

With that in mind, consider what Shaw said in Durham’s bid to keep Eric Lichtblau off the stand (this appears to have been filed two days after Judge Cooper ordered it, but one of the Durham lawyers has had a family emergency so they may have gotten an extension).

After explaining that prosecutors need to question Lichtblau about things the scope of which have been specifically excluded in the trial, a footnote claims that they won’t violate Judge Cooper’s rules about such things (they have, serially, during the trial).

The government should be permitted to cross-examine Lichtblau about any communications he had with other individuals, including, but not limited to, Fusion GPS personnel and computer researchers, regarding the alleged connections between the Trump Organization and Alfa bank. To the extent Sussmann, Fusion GPS, or others (including computer researchers) approached or communicated with Lichtblau concerning Alfa Bank or related matters, the government should be permitted to question Lichtblau about such exchanges, as they are relevant to the defendant’s communications with Lichtblau on these same issues and are probative of the defendant’s alleged actions on behalf of clients (Rodney Joffe and the Clinton Campaign). The government also intends to cross-examine Lichtblau on issues pertaining to the credibility and reliability of his testimony. 1

[snip]

If Fusion GPS (which was hired by the defendant’s firm on behalf of the Hillary for America Campaign) and other persons known to Joffe and/or Sussmann similarly supplied opposition research-type information to Lichtblau regarding the Trump Organization as a part of a coordinated effort, this would be relevant to demonstrate that Sussmann was not acting merely as a concerned citizen trying to help the FBI when he met with FBI General Counsel and that his contrary representations were false. Indeed, the Government is aware that Sussmann and Joffe did enlist and/or task one or more other computer researchers to communicate with the media (including Lichtblau) concerning these matters

1 The government will abide by the Court’s order of May 7, 2022 and, in accordance with that order, will not “put on extensive evidence” about the accuracy of the data provided by Sussmann or his clients to the FBI, Lichtblau, or others. See Op. & Order (“In Limine Order”) at 5, ECF No. 121. [my emphasis]

Here, Shaw states as fact that the computer research was opposition research. It was not.

I am 100% certain that if Lichtblau could testify about all the people he spoke with on this story, he could explain that many if not most of the people involved — as well as a bunch of other people, including at least one whom prosecutors have affirmatively claimed did not have a role in chasing down this anomaly — believed the anomaly was real and were motivated out of a genuine alarm about the Russian attack that year. Yes, the NYT found people who pushed back (more so after the FBI killed the story). But that’s what makes Lichtblau’s work reporting, not opposition research.

If Lichtblau is able to testify, he could also provide a key piece of important context to evidence the government has already presented. Yesterday, Jim Baker described how, starting on September 21, he reached out to Sussmann for the name of the reporter working on the story.

Baker provided Lichtblau’s name to Bill Priestap before noon on September 22. But Lichtblau didn’t meet with the FBI until Monday, September 26.

We know that in between, the FBI called Cendyn, leading them to alter their DNS address, and the NYT called a representative for Alfa Bank which later — NYT believed, at least — led Alfa to alter their DNS address. The NYT believed that there was a response from Alfa that indicated they were trying to hide this activity.

A key part of Durham’s claim is that NYT wasn’t close to publishing when Sussmann went to the FBI and that Sussmann was, instead, trying to provide urgency for the story. That doesn’t accord with my understanding and it doesn’t accord with what Dexter Filkins has written. Durham can keep telling it so long as Lichtblau doesn’t testify.

One thing that happened, though — in addition to initial contacts that would have alerted Lichtblau that the FBI didn’t want him to publish — was the response to those calls after Sussmann and Joffe decided to share Lichtblau’s name. There was new news that Lichtblau had to try to understand that created a new delay.

As with Sussmann, it would be nice for Lichtblau if he could describe all the efforts he made to verify the story. If he could, it would demonstrably undercut several of the claims Durham is making. He can’t, because he has separate confidentiality agreements with those other sources.

Shaw, who accuses Sussmann of being privileged, completely flips how privilege works on its head (including by mis-citing the David Tatel concurrence in the Judy Miller subpoena, which as I understand it would support Lichtblau making the call about the scope of his testimony). She ties it to a topic rather than a privileged relationship to accuse Lichtblau of trying to selectively pick which parts of the story he can tell.

The D.C. Circuit has “declined to adopt a selective waiver doctrine” in the context of attorney-client communications that “would allow a party voluntarily to produce documents covered by the attorney-client privilege to one party and yet assert the privilege as a bar to production to a different party.” United States v. Williams Companies, Inc., 562 F.3d 387, 394 (D.C. Cir. 2009). “The client cannot be permitted to pick and choose among his opponents, waiving the privilege for some and resurrecting the claim of confidentiality to obstruct others.” Permian Corp. v. United States, 665 F.2d 1214, 1221 (D.C. Cir. 1981). Privilege holders must instead “treat the confidentiality of attorney-client communications like jewels—if not crown jewels” because courts “will not distinguish between various degrees of ‘voluntariness’ in waivers of the attorney-client privilege.” In re Sealed Case, 877 F.2d 976, 980 (D.C. Cir. 1989).

This principle—which restricts a privilege of “ancient lineage and continuing importance,” In re Sealed Case, 877 F.2d at 980—necessarily governs the novel and qualified reporter’s privilege advanced in this case. Sussmann subpoenaed Lichtblau to appear as a witness and Lichtblau has not moved to quash. Lichtblau and defendant Sussmann cannot “tactical[ly] employ[]” the asserted privilege to pick and choose the topics that may be put to Lichtblau on the witness stand. Permian Corp., 665 F.2d at 1221. Privileges are not “tool[s] for selective disclosure.” Ibid

I get why someone in the grips of a fevered conspiracy theory would make this argument. Durham believes that everyone involved with the Alfa Bank story was part of the same malicious conspiracy targeting poor Donald Trump, even though DOJ has in its possession abundant proof that’s false. Yet even in this case, Cooper has distinguished between the privileged relationships that Joffe has with what the Democrats have, and he has also pointed to affirmative evidence that this wasn’t one big conspiracy.

But Shaw would have you believe that Lichtblau’s privilege obligations are tied to a project, a story, and not a bunch of individuals, many of whom he had existing relationships with well before this story.

A lawyer not in the grip of a fevered conspiracy theory, however, would understand that that kind of privilege doesn’t make you special, it creates an obligation, even if the obligation prevents you from using your profession from helping yourself.


emptywheel’s Continuing Obsession with Sticky Notes, Michael Sussmann Trial Edition

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

Longtime readers of emptywheel are no doubt familiar with my obsession with the weird prevalence of sticky notes that appear on exhibits used by prosecutors Bill Barr appointed to launch politicized witch hunts. These posts provide a background, but the tl;dr is that I caught the Jeffrey Jensen crew adding dates on sticky notes, some inaccurate, to FBI notes as part of the effort to kill the Mike Flynn prosecution.

The Jeffrey Jensen “Investigation:” Post-It Notes and Other Irregularities (September 26, 2020)

Shorter DOJ: We Made Shit Up … Please Free Mike Flynn (October 27, 2020)

John Durham Has Unaltered Copies of the Documents that Got Altered in the Flynn Docket (December 3, 2020)

John Durham Is Hiding Evidence of Altered Notes (April 5, 2022)

As I noted here, there some reason to believe Durham’s evidence comes from the same collection of documents as Jeffrey Jensen’s.

Durham released the trial versions of Bill Priestap and Trisha Anderson’s notes yesterday. So without further commentary (for now), I’d like to post how these notes appeared in the filing he used to get the notes admitted in the first place with what the jury will see.

Priestap notes motion version

Priestap notes trial exhibit version

Anderson notes motion version

Anderson notes trial exhibit version

Copyright © 2022 emptywheel. All rights reserved.
Originally Posted @ https://www.emptywheel.net/mueller-probe/