The Decline and Recent Fall of Manafort’s Hapsburg Empire

/10 Comments/in , /by

It turns out the government was telling the truth (not that I doubted it) when they told Judge Amy Berman Jackson they’ve only just put together the evidence that Paul Manafort violated bail by trying to suborn perjury from Alan Friedman and Eckart Sager, the two flacks who set up the Hapsburg Group for Manafort back in 2012. That’s made clear by comparing the materials submitted back on May 25 asking for leave to object to Manafort’s then just finalized bail proposal and the materials — particularly the declaration from FBI Agent Brock Domin — released in conjunction with Mueller’s motion to revoke or revise bail.

For example, whereas the later Domin declaration notes that Friedman and Sager (identified as Person D1 and D2) “provided the content of the text messages described below in May 2018,” Domin’s earlier declaration provides the specific dates.

Person D1 provided the text messages described below on May 12, 2018, and Person D2 provided the content of the text messages described below on May 21, 2018.

And while the earlier declaration relies on statements from Friedman,

Documents produced by Persons D1 and D2, statements made by Person D1 to the government, and documents recovered pursuant to a court-authorized search of Manafort’s iCloud account evidence that Manafort,

The later declaration refers to statements from Sager, too.

Documents produced by Persons D1 and D2, statements made by Persons D1 and D2 to the government, telephone records obtained by the government, and documents recovered pursuant to a court-authorized search of Manafort’s iCloud account evidence that Manafort,

So Sager must have been interviewed between May 25 and June 4.

A filing submitted last night, providing even more detail describing why Manafort should have his bail revoked includes this great quote from Sager, though it’s unclear when he gave it.

Manafort’s references to the Hapsburg member’s “role” and the “EP” refer to that Hapsburg member’s position as a representative of the European Parliament and the parallel actions of the European Parliament and the United States Senate regarding Tymoshenko’s imprisonment in 2012. That characterization is consistent with Person D2’s description, during a meeting with the government, of that Hapsburg member’s role as Manafort’s “spy and mouthpiece.”

And, as reflected both in the passage cited above and by comparing the two communication logs, the government did not reference toll records from Manafort in the May 25 filing but did in the June 4 one, suggesting that along with a Sager interview, they obtained the toll records after May 25.

Which raises two interesting questions for me: first, had the government interviewed Friedman and Sager before Manafort tried to suborn their perjury? If Mueller’s team hadn’t, it makes his effort all the more interesting, as if he somehow knew that. And also, did the government obtain proof of these communications (likely, via monitoring Manafort’s iCloud account) before reaching out to Friedman and Sager, whether anew or for the first time?

Interestingly, the earlier Domin declaration makes it clear Friedman took screen caps of the WhatsApp comms he had with Manafort contemporaneously, so even if he weren’t backing up his super secret obstruction of justice to Apple’s cloud, he’d have been fucked.

Person D1 has provided the government screen shots that Person D1 took contemporaneously of these messages.

That suggests it’s possible that Friedman contacted (possibly recontacted) the government to let them know this. But that doesn’t explain the two and a half month delay between the time Manafort tried to suborn perjury and the time the government actually chased this detail down.

Share this entry

Mueller to Yevgeniy Prigozhin: Sure You Can Have Discovery … If You Come to the United States to Get It

/25 Comments/in , , , /by

This Concord Management filing, from Mueller’s team, is attracting a lot of attention because Mueller predictably asked for a protective order and said Russians are still engaging in information operations (so are we!!). Since we covered the certainty that there’d be a protective order in this case over a month ago, I’m going to focus on some other interesting tidbits about this filing.

As a reminder, Concord Management is a company owned by close Putin ally Yevgeniy Prigozhin. Concord is accused in the Internet Research Agency indictment of funding the troll operation.

Defendants CONCORD MANAGEMENT AND CONSULTING LLC (Конкорд Менеджмент и Консалтинг) and CONCORD CATERING are related Russian entities with various Russian government contracts. CONCORD was the ORGANIZATION’s primary source of funding for its interference operations. CONCORD controlled funding, recommended personnel, and oversaw ORGANIZATION activities through reporting and interaction with ORGANIZATION management.

[snip]

To conceal its involvement, CONCORD labeled the monies paid to the ORGANIZATION for Project Lakhta as payments related to software support and development. To further conceal the source of funds, CONCORD distributed monies to the ORGANIZATION through approximately fourteen bank accounts held in the names of CONCORD affiliates, including Glavnaya Liniya LLC, Merkuriy LLC, Obshchepit LLC, Potentsial LLC, RSP LLC, ASP LLC, MTTs LLC, Kompleksservis LLC, SPb Kulinariya LLC, Almira LLC, Pishchevik LLC, Galant LLC, Rayteks LLC, and Standart LLC.

The indictment accuses Prigozhin of supervising the operation closely enough to have been saluted by troll operations in the US.

PRIGOZHIN approved and supported the ORGANIZATION’s operations, and Defendants and their co-conspirators were aware of PRIGOZHIN’s role.

For example, on or about May 29, 2016, Defendants and their co-conspirators, through an ORGANIZATION-controlled social media account, arranged for a real U.S. person to stand in front of the White House in the District of Columbia under false pretenses to hold a sign that read “Happy 55th Birthday Dear Boss.” Defendants and their co-conspirators informed the real U.S. person that the sign was for someone who “is a leader here and our boss . . . our funder.” PRIGOZHIN’s Russian passport identifies his date of birth as June 1, 1961.

When Concord moved to defend itself, it presented the possibility that it and Prigozhin would obtain discovery, and via Prigozhin, everyone else in Russia who was part of this operation, up to and including Putin. Indeed, the Mueller filing makes it quite clear that is the intent of the defense attorneys. They explicitly asked to share information with co-defendants that serve as officers of Concord, which can only mean they want to share information with Prigozhin.

In its initial proposed protective order, the government proposed a complete prohibition on sharing discovery with any co-defendant charged in this criminal case, whether individual or organizational. Defense counsel proposed that they be permitted to share discovery with a codefendant if that co-defendant is an officer or employee of Concord Management. To the government’s knowledge, the only charged defendant in this category is Yevgeniy Viktorovich Prigozhin, who was charged individually for conspiring to defraud the United States, in violation of 18 U.S.C. § 371.

So this dispute over the protective order is an effort to continue with the prosecution, while ensuring that Russia doesn’t obtain important information on the investigation into the operation by doing so.

Before I get into how Mueller’s team proposes to resolve the dispute, it’s worth reviewing the data in question, because that’s actually one of the most interesting parts of this filings. Apparently, the government used no classified information in the investigation of social media trolling (or parallel constructed whatever they did use).

As described further in the government’s ex parte affidavit, the discovery in this case contains unclassified but sensitive information that remains relevant to ongoing national security investigations and efforts to protect the integrity of future U.S. elections. [my emphasis]

Later, the filing makes it clear that much of the evidence in the case came from US providers — surely Facebook and Twitter and others.

The evidence includes data related to hundreds of social media accounts, as well as evidence obtained from email providers, internet service providers, financial institutions, and other sources. Additionally, the need to produce much of the data in its original format (formats that include, for example, Excel and HTML files) makes it infeasible to make certain redactions without compromising expeditious review of the data.

These two details confirm a point I made in March: this indictment really doesn’t rely on information as secret as many reporters claimed. It relies on stuff you get from social media providers.

And contrary to what NBC says about the heavy reliance, in the Internet Research Agency indictment, “on secret intelligence gathered by the CIA, the FBI, the National Security Agency (NSA) and the Department of Homeland Security (DHS),” it really wasn’t all that sophisticated from a cybersecurity standpoint. Especially not once you consider the interesting forensics on it (aside from IDing the IRA’s VPNs) would have come from Facebook and Twitter.

That detail — that much of this indictment comes from the social media providers that Russia exploited in 2016 — is important background to this passage (this is the one that has gotten all the press), which asserts that Russia continues to do what Prigozhin’s trolls did in 2016.

Public or unauthorized disclosure of this case’s discovery would result in the release of information that would assist foreign intelligence services, particularly those of the Russian Federation, and other foreign actors in future operations against the United States. First, the substance of the government’s evidence identifies uncharged individuals and entities that the government believes are continuing to engage in interference operations like those charged in the present indictment. Second, information within this case’s discovery identifies sources, methods, and techniques used to identify the foreign actors behind these interference operations, and disclosure of such information will allow foreign actors to learn of these techniques and adjust their conduct, thus undermining ongoing and future national security investigations.

And that, in turn, explains much of the logic for the larger protective order request: the government is trying to prevent Prigozhin and through him Putin from learning what the US is doing to counter its information operations.

The government’s description of what it considers “sensitive” information that it wants to require a special review before sharing with foreign nationals reveals it is also trying to prevent Prigozhin and others from learning about the status of the investigation and its targets.

a. Witness statements provided pursuant to 18 U.S.C. § 3500;

b. Information that could lead to the identification of potential witnesses, including civilian, foreign and domestic law enforcement witnesses and cooperating witnesses;

c. Information related to ongoing investigations, including information that could identify the targets of such investigations; and

d. Information related to sensitive law enforcement or intelligence collection techniques.

Finally, the government is trying to hide what it knows about relationships between parties involved in this operation and “other uncharged foreign entities and governments.”

At a high level, the sensitive-but-unclassified discovery in this case includes information describing the government’s investigative steps taken to identify foreign parties responsible for interfering in U.S. elections; the techniques used by foreign parties to mask their true identities while conducting operations online; the relationships of charged and uncharged parties to other uncharged foreign entities and governments; the government’s evidence-collection capabilities related to online conduct; and the identities of cooperating individuals and, or companies. Discovery in this case contains sensitive information about investigative techniques and cooperating witnesses that goes well beyond the information that will be disclosed at trial. [my emphasis]

So one thing the government wants to protect is what it knows about the relationship between Prigozhin and Putin, and the Russian government’s involvement in this trolling operation more generally.

And to do that, the government is demanding the ability to prohibit Concord’s lawyers from sharing information with Prigozhin (or any other defendant) without prior court review.

Notwithstanding the previous categories of authorized persons, no co-defendant charged in this criminal case, whether individual or organizational, shall be deemed an authorized person for purposes of discovery until the co-defendant appears before this Court. Defense counsel shall not disclose or discuss the material or their contents to any co-defendant charged in this criminal case, whether individual or organizational, until the co-defendant appears before this Court unless otherwise directed by this Court. If defense counsel, after reviewing discovery in this matter, believes it necessary to seek to disclose or discuss any material with a co-defendant who has not appeared before this Court, counsel must first seek permission from this Court and a modification of this Order.

Perhaps more interesting, it is demanding that Concord’s lawyers keep anything deemed sensitive in the US, firewalled from the Internet.

Neither defense counsel nor any person authorized by this Court is permitted at any time to inspect or review Sensitive materials outside of the U.S. offices of Reed Smith LLP, without prior permission from of this Court. Defense counsel or a designated and identified employee of Reed Smith LLP must accompany any person at all times while he or she is reviewing Sensitive materials at U.S. offices of Reed Smith LLP, unless otherwise authorized by this Court.

[snip]

Sensitive materials shall not be viewed or stored on any device that is connected to or accessible from the Internet.

Sensitive materials may under no circumstances be transported or transmitted outside the United States.

The logic here is nifty: even if they lose on the ability to protect all materials from Prigozhin, they’ve already succeeded in requiring that he come to the US if he wants to read it. At which point, he’d be met by authorities at customs and promptly put in custody.

On one point I was mistaken. I thought there would be classified discovery of some sort, that would require the use of the Classified Intelligence Protection Act procedures. It will apparently never get to that. The government will either win on this protective order, which will largely moot much of the logic for Concord to contest the case, or it will lose, which will likely lead it to dismiss the indictment against Concord.

Update: Fixed protective for protection, h/t mw.

Share this entry

The Crimes with which NSD Envisions Charging Those Attacking Elections

/14 Comments/in , , /by

The Senate Judiciary Committee had a hearing on how to protect our elections today. Among others, Deputy Assistant Attorney General Adam Hickey from DOJ’s National Security Division testified. He gave a list of some of the crimes he thought might be used to charge people who tampered with elections.

Foreign influence operations, though not always illegal, can implicate several U.S. Federal criminal statutes, including (but not limited to) 18 U.S.C. § 371 (conspiracy to defraud the United States); 18 U.S.C. § 951 (acting in the United States as an agent of a foreign government without prior notification to the Attorney General); 18 U.S.C. § 1001 (false statements); 18 U.S.C. § 1028A (aggravated identity theft); 18 U.S.C. § 1030 (computer fraud and abuse); 18 U.S.C. §§ 1343, 1344 (wire fraud and bank fraud); 18 U.S.C. § 1519 (destruction of evidence); 18 U.S.C. § 1546 (visa fraud); 22 U.S.C. § 618 (Foreign Agents Registration Act); and 52 U.S.C. §§ 30109, 30121 (soliciting or making foreign contributions to influence Federal elections, or donations to influence State or local elections).

In their testimony, Ken Wainstein (someone with extensive experience of national security prosecutions, but less apparent focus on the available evidence in this investigation) and Ryan Goodman (who doesn’t have the prosecutorial experience of Wainstein, but who is familiar with the public facts about the investigation) also list what crimes they think will get charged.

I find a comparison of what each raised, along with what has already been charged, to be instructive. I believe that comparison looks like this:

I’m interested, in part, because Hickey, who likely has at least a sense of the Mueller investigation (if not personal involvement), sees the case somewhat differently than two differently expert lawyers. Two charges — agent of a foreign power (basically, being a foreign spy in the US not working under official cover) and CFAA (hacking) seem obvious to both National Security Division prosecutors, but have not yet been publicly charged. Illegal foreign contributions seems obvious to those paying close attention, but also has not been charged. We might expect to see all three charges before we’re done.

Neither Wainstein nor Goodman mentioned false statements, but of course that’s what we’ve seen charged most often so far.

Then there are the two crimes Hickey mentions that the others don’t, but that have not yet been charged (both have been alleged as overt acts in the Internet Research Agency indictment): Visa fraud (alleged against the trolls who came to the US to reconnoiter in 2014) and destruction of evidence (again, alleged against IRA employees destroying evidence after Facebook’s role was discovered). Mueller also described George Papadopoulos destroying evidencec when he deleted his Facebook account, but like the Russian trolls, he didn’t get charged for it. Visa fraud, in particular, is something that multiple figures might be accused of — Alexander Torshin and others reaching out via NRA, Natalia Veselnitskaya, and even Brits who worked illegally during the election for Cambridge Analytica.

I confess I’m most interested in Hickey’s mention of destruction of evidence, though. That’s true, in part, because SDNY seems to think Michael Cohen might destroy evidence.

Hope Hicks, too, reportedly thought about hiding evidence from authorities. Then there’s the report that Mueller is checking encrypted messaging apps as people turn in phones when they arrive for interviews.

Huckey seems to think some of the people being investigated — beyond Papadopoulos and IRA troll Viktorovna Kaverzina — may have been destroying evidence.

I wonder if he has reason to suspect that.

Share this entry

The New Cyber Sanctions

/27 Comments/in , , /by

Even as Trump was working hard to get Russia admitted back into the G-7, Treasury was preparing new cyber sanctions against a number of “Russian” entities. This appears to be an effort to apply sanctions for activities exploiting routers and other network infrastructure (activities that the US and its partners engage in too) that US-CERT released a warning about in April.

One of the designated entities in controlled by and has provided material and technological support to Russia’s Federal Security Service (FSB), while two others have provided the FSB with material and technological support.  OFAC is also designating several entities and individuals for being owned or controlled by, or acting for or on behalf of, the three entities that have enabled the FSB.

[snip]

Examples of Russia’s malign and destabilizing cyber activities include the destructive NotPetya cyber-attack; cyber intrusions against the U.S. energy grid to potentially enable future offensive operations; and global compromises of network infrastructure devices, including routers and switches, also to potentially enable disruptive cyber-attacks.  Today’s action also targets the Russian government’s underwater capabilities.  Russia has been active in tracking undersea communication cables, which carry the bulk of the world’s telecommunications data.

I’ve included the entire list of sanction targets below.

On paper, at least, it looks like Treasury is sanctioning:

  • An entity, Divetechnoservices, that helps Russia tap into submarine cables along with three of its employees (another thing our spooks do, but one the US and especially UK have been increasingly worried about from Russia); the Treasury release notes that Divetechnoservices got the contract for a FSB submersible craft way back in 2011
  • An entity, Kvant Scientific Research Institute, that has been a research institute for FSB since August 2015 and, since April 2017, the prime contractor on an FSB project
  • An entity, Digital Security, that as of 2015 worked on a project that would expand Russia’s offensive cyber capabilities; the sanctions also include two companies the release claims are Digital Security subsidiaries, both which have US and Israeli locations

All of these were sanctioned under E.O. 13694, which, as amended, included attacks on election processes; given the dates, they might be implicated in the election year hacks, or might just be deemed a threat to national security. Just Kvant was also sanctioned under CAATSA, which is the more general sanctions program forced onto Trump by Congress. I’ve also put the language for the two of those below.

And, as Lorenzo F-B notes, the heads of two of the sanctioned alleged subsidiaries of Digital Security, ERPScan and Embedi, say they have nothing to do with the company.

But one of the security companies named in the new sanctions, ERPScan, denied having anything to do with the Russian government in an email to Motherboard.

“The only issue is that I and some of my peers were born in Russia, oh, cmon, I’m sorry but I can’t change it,” ERPScan’s founder Alexander Polyakov told me. “We don’t have any ties to Russian government.”

ERPScan is mostly known for its product that hunts for vulnerabilities in companies’ systems provided by SAP, a popular German enterprise software maker. Cyber Defense Magazine gave ERPScan an award this year for “best product” in its artificial intelligence and machine learning category.

[snip]

Polyakov, however, claimed that as of 2014, ERPScan is a “private company registered in the Netherlands” and that it has no connections “with other companies listed in this document.”

[snip]

“The news came to us as an unpleasant surprize. We never worked for Russian government, but indeed we have some former Russian researchers in our Research Team (some of them are former employees of Digital Security),” Alex Kruglov, Embedi’s head of marketing, told Motherboard in an email. “It is the only reason we can figure out to be added to a sanctions list.”

And they’re both legit cybersecurity companies, which at the very least raises questions (as the Kaspersky targeting did) about whether this is just infosec protectionism. If these protestations are correct, however, it renews real questions about the accuracy of sanction claims made under Treasury Secretary Steve Mnuchin.

The first indication that Mnuchin’s Treasury Department was offering bullshit to fulfill Congress’ demand for sanctions came when Treasury released a list of Russian oligarchs in January that was basically just the Forbes list of richest Russians, including a number that oppose Putin.

President Trump’s Treasury Department releaseda list of prominent Russian political figures and business leaders who have prospered while Vladimir Putin has led Russia.

The list features 210 people, including politicians such as Prime Minister Medvedev and Minister of Defense Sergey Shoygu. Also on the list are 96 “oligarchs.” Within hours of the list’s posting , media organizations began pointing out the similarity between the 96 billionaires listed and the Russians that appear on Forbes’ 2017 list of the World’s Billionaires.

Forbes went through the lists and confirmed that indeed the Treasury Department’s list is an exact replica of the Russians on the 2017 billionaires list.

For a bit, I thought the list released in March, which added a few new GRU officers, might have reflected new knowledge about GRU officers involved in the targeting of the DNC. Except it turned out those officers were just people readily identifiable off public GRU records. Treasury basically could have gotten them from a spook phone book.

Treasury did better with non-cyber Ukraine-related sanctions in April. It actually named several figures — most obviously Oleg Deripaska and Alexander Torshin — suspected of having played key roles in the election interference. Since then, Deripaska and his aluminum company Rusal have pursued financial games to shield Rusal from sanctions. He’s doing this with the help of Mercury Public Affairs — the Vin Weber lobbying group that shows up in a lot of Manafort’s indictments — and former Trump aide Brian Lanza, who now works there. So it’s not clear whether Deripaska will be significantly impacted.

With that history in mind, it’s worth asking whether Treasury simply can’t do cyber sanctions well, both because it’s hard to distinguish infosec from hacking (it would be equally difficult to do so for any of a number of contractors with close ties to FBI, the analogue of the companies that got sanctioned yesterday), and perhaps because Treasury doesn’t have good intelligence on who is hacking for Russia. Or perhaps Mnuchin is just obstinate.

But thus far, the history of Treasury’s selections on Russian related cyber sanctions leaves quite a bit to be desired.

Today’s action includes the designation of five Russian entities and three Russian individuals pursuant to E.O. 13694, as amended, as well as a concurrent designation pursuant to Section 224 of CAATSA.

Digital Security was designated pursuant to E.O. 13694, as amended, for providing material and technological support to the FSB.  As of 2015, Digital Security worked on a project that would increase Russia’s offensive cyber capabilities for the Russian Intelligence Services, to include the FSB.

ERPScan was designated pursuant to E.O. 13694, as amended, for being owned or controlled by Digital Security.  As of August 2016, ERPScan was a subsidiary of Digital Security.

Embedi was designated pursuant to E.O. 13694, as amended.  As of May 2017, Embedi was owned or controlled by Digital Security.

Kvant Scientific Research Institute (Kvant) was designated pursuant to E.O. 13694, as amended, and Section 224 of CAATSA for being owned or controlled by the FSB.  In August 2010, the Russian government issued a decree that identified Kvant as a federal state unitary enterprise that would be supervised by the FSB.

Kvant was also designated pursuant to E.O. 13694, as amended, for providing material and technological support to the FSB.  As of August 2015, Kvant was a research institute with extensive ties to the FSB.  Furthermore, as of April 2017, Kvant was the prime contractor on a project for which the FSB was the end user.

Divetechnoservices was designated pursuant to E.O. 13694, as amended, for providing material and technological support to the FSB.  Since 2007, Divetechnoservices has procured a variety of underwater equipment and diving systems for Russian government agencies, to include the FSB.  Further, in 2011, Divetechnoservices was awarded a contract to procure a submersible craft valued at $1.5 million for the FSB.

Aleksandr Lvovich Tribun (Tribun) was designated pursuant to E.O. 13694, as amended, for acting for or on behalf of Divetechnoservices.  As of December 2017, Tribun was Divetechnoservices’ General Director.

Oleg Sergeyevich Chirikov (Chirikov) was designated pursuant to E.O. 13694, as amended, for acting for or on behalf of Divetechnoservices.  As of March 2018, Chirikov was Divetechnoservices’ Program Manager.

Vladimir Yakovlevich Kaganskiy (Kaganskiy) was designated pursuant to E.O. 13694, as amended, for acting for or on behalf of Divetechnoservices.  As of December 2017, Kaganskiy was Divetechnoservices’ owner.  Previously, Kaganskiy also served as Divetechnoservices’ General Director.

EO 13694 as amended

E.O. 13694 authorized the imposition of sanctions on individuals and entities determined to be responsible for or complicit in malicious cyber-enabled activities that result in enumerated harms that are reasonably likely to result in, or have materially contributed to, a significant threat to the national security, foreign policy, or economic health or financial stability of the United States.  The authority has been amended to also allow for the imposition of sanctions on individuals and entities determined to be responsible for tampering, altering, or causing the misappropriation of information with the purpose or effect of interfering with or undermining election processes or institutions.

CAATSA Section 224

IN GENERAL.—On and after the date that is 60 days after the date of the enactment of this Act, the President shall— (1) impose the sanctions described in subsection (b) with respect to any person that the President determines— (A) knowingly engages in significant activities undermining cybersecurity against any person, including a democratic institution, or government on behalf of the Government of the Russian Federation; or (B) is owned or controlled by, or acts or purports to act for or on behalf of, directly or indirectly, a person described in subparagraph (A);

[snip]

SIGNIFICANT ACTIVITIES UNDERMINING CYBERSECURITY DEFINED.—In this section, the term ‘‘significant activities undermining cybersecurity’’ includes— (1) significant efforts— (A) to deny access to or degrade, disrupt, or destroy an information and communications technology system or network; or (B) to exfiltrate, degrade, corrupt, destroy, or release information from such a system or network without authorization for purposes of— (i) conducting influence operations; or (ii) causing a significant misappropriation of funds, economic resources, trade secrets, personal identifications, or financial information for commercial or competitive advantage or private financial gain; (2) significant destructive malware attacks; and (3) significant denial of service activities.

Share this entry

Revisiting Trump’s Joint Defense Agreement

/17 Comments/in , /by

Betsy Woodruff has a story reminding us that Trump has a joint defense agreement with some of the other people caught up in Mueller’s probe.

The president’s personal lawyers have teamed up with attorneys for other individuals embroiled in special counsel Bob Mueller’s probe, multiple sources tell The Daily Beast. For a while, the president’s lawyers even had regular conference calls with other attorneys to discuss the Mueller investigation, according to one source familiar with the calls.

The arrangement is known as a joint defense agreement, and it allows the lawyers to share information—without violating attorney-client privilege. It’s a common strategy when multiple defendants are dealing with the same prosecutor on the same matter.

I say “reminding us,” because this is not news. When Mike Flynn flipped, the first notice came when he alerted this very same joint defense agreement he could no longer share information (as the story itself notes).

The story doesn’t even describe, generally, who is included in it, which might help observers understand the dynamics we’re watching. The closest hint of that is the observation that Paul Manafort might be going to jail on Friday.

This week is poised to be less-than-harmonious for at least one person in Mueller’s sights: Paul Manafort, who will appear in court on Friday for a hearing where a judge will decide whether or not to revoke his bail.

The article doesn’t even confirm that Manafort is part of the defense agreement. But Trump was bragging, back in January, that he had “decided that a key witness in the Russia probe, Paul Manafort, isn’t going to ‘flip’ and sell him out, friends and aides say.” That’s the kind of thing Trump might have assurance about if Manafort were part of a joint defense agreement, particularly if — as has subsequently been reported — John Dowd offered Manafort a pardon (through one of his lawyers, in the kind of discussion lawyers might assume were shielded by a joint defense agreement) last year.

The pardon discussion with Mr. Manafort’s attorney, Reginald J. Brown, came before his client was indicted in October on charges of money laundering and other financial crimes. Mr. Manafort, the former chairman of Mr. Trump’s presidential campaign, has pleaded not guilty and has told others he is not interested in a pardon because he believes he has done nothing wrong and the government overstepped its authority. Mr. Brown is no longer his lawyer.

Mind you, now we know that Mueller knows about such offers (because it’s one of the questions they posed to Trump in March). That makes Trump’s legal impunity for offering such pardons at least slightly more sketchy, particularly if he’s pardoning someone so obviously corrupt as Paul Manafort. Add in the fact that Jared Kushner sold out Flynn last fall (which is reportedly what led him to flip), and Manafort may be less certain about Trump’s reliability, even in spite of Trump’s Tweets suggesting FBI should have prevented him from hiring someone they were investigating back in 2016, posted — with remarkable prescience! — on the eve of the latest setback in Manafort’s case.

Still, the reminder that Trump and a number of subjects of this investigation have been comparing notes explains a lot we’ve seen since. It explains, for example, why Manafort has made such a diligent effort to get the court to disclose information to him– such as the substance of warrant affidavits to seize up to four other people’s AT&T phone information, or the other bullet points in Rod Rosenstein’s August 2, 2017 memo laying out the scope (at that point) of the investigation — that affects others likely covered by the defense agreement. It explains one advantage to Manafort of insisting on being charged in two jurisdictions: because it gives him two bites at an attempt to challenge Mueller’s jurisdiction.

The joint defense agreement also explains several other things we’ve seen, such as the coordinated messaging — particularly the planted narrative about Spygate — best explained by the coordination of Victoria Toensing armed with information only legally available to Trump.

Finally, it explains the delay in any charges related to the conspiracy between Trump and the Russians: once Mueller charges those issues, he will have to provide discovery about what he knows, which will then get shared back with others involved in the conspiracy. It appears he’s primarily sharing that information (aside from in the form of questions to witnesses who appear before the grand jury) with those who’ve flipped. Even the questions he has posed to Trump are probably sharply limited to hide the main thrust of the conspiracy investigation.

That’s why the stakes for Friday are so high (and the timing of this reminder that there’s a joint defense agreement). Mueller still won’t need to provide Manafort the evidence he has about his role in the conspiracy, though the indictment of Kilimnik gets far closer to that. But it raises the cost on Manafort for sustaining a joint defense, minimizes his value to the others, all while the crimes charged could still be refiled in a VA state court.

Share this entry

“I Mean His Trump Organization Employees”

/29 Comments/in , /by

I’m still plodding through the June 9 meeting materials, working on what they show about the story about the June 9 meeting that got crafted after the fact.

There’s one detail that I want to post separately. On July 13, 2017, Ike Kaveladze (who was really in charge of the meeting for his boss, Aras Agalarov) and Roman Beniaminov (Emin Agalrov’s assistant, who heard ahead of time the meeting was about dealing dirt on Hillary to the Trumps) had the following exchange by text (PDF 34).

[Kaveladze sends link]

Beniaminov: But I don’t recall taking any video. And I can’t understand why it looks so similar.

Kaveladze: I mean his trump organization employees.

By July 13, the Agalarovs and Trumps were increasingly at odds on how to respond to the story, not least after the Trumps leaked Rod Goldstone’s name to the press after saying they wouldn’t. After that, there seemed to be increasing amounts of dirt being leaked, perhaps by both sides.

It appears that Kaveladze may have phoned Beniaminov right before this to raise this CNN story, which had just been posted. Beniaminov seemed to think Kaveladze had suggested that he, Beniaminov, had taken the video, even while he seems to have been present at the Las Vegas event back in 2013.

Scott Balber, the Agalarov’s ever-present lawyer (who had actually represented Trump on a Miss Universe related issue in 2013), was quoted in the piece.

“It’s simply fiction that this was some effort to create a conduit for information from the Russian federal prosecutors to the Trump campaign,” Balber said on CNN’s “New Day.” “It’s just fantasy world because the reality is if there was something important that Mr. Agalarov wanted to communicate to the Trump campaign, I suspect he could have called Mr. Trump directly as opposed to having his son’s pop music publicist be the intermediary.”

I don’t rule out Balber having taken and leaked the video.

Or maybe not: What Kaveladze is interested in highlighting to Beniaminov is the presence of two other Trump employees in the video: Keith Schiller and Michael Cohen, shown above.

I don’t know what to make of the reference — though it’s equally possible they were involved in the 2017 response, or were viewed for some other reason as an additional concern regarding the June 9 meeting. Both, of course, have gotten some scrutiny for the liaison role they have served between Trump and other Russians.

Share this entry

On the Tactics of the Latest Manafort Indictment

/55 Comments/in , , /by

When I went out to run errands yesterday, Paul Manafort was likely facing having his bail revoked next Friday and going to jail, from where he would fight charges that could put him in prison for the rest of his life. When I returned after an hour and a half, Paul Manafort — faced with a new superseding indictment — was probably facing having his bail revoked next Friday and going to jail, from where he will fight charges that could put him in prison for the rest of his life. That is, nothing much has changed, especially if you’ve been following along closely enough to know that Konstantin Kilimnik, who finally got added to Manafort’s indictments, has always been a key part of the election year conspiracy and the damage control since.

The key development, in my mind, is tactical. As Popehat explained in one of two great lawsplainers yesterday, the standard on revoking bail in any case is just probable cause that you’ve committed new crimes while being out on bail. By getting the grand jury to indict the underlying behavior behind the witness tampering claim, you’ve established probable cause.

And by the way, those accusations that Manafort committed a crime on bail? Mueller got a grand jury indictment, establishing probable cause. That may be all the judge requires. Manafort’s in trouble. I mean, even in the context of someone facing multiple indictments trouble.

This makes easier for Amy Berman Jackson to send Manafort to jail next Friday, effectively outsourcing the decision to a bunch of anonymous grand jurors. That is, it takes a likely action and makes it even more likely.

I’m interested in what it does to preserve evidence, though.

Manafort submitted his opposition to having his bail revoked last night, effectively claiming that Mueller has shown almost no evidence of witness tampering.

The Special Counsel creates an argument based on the thinnest of evidence; to wit, Mr. Manafort violated the Release Order’s standard admonition that a defendant not commit an offense while on release by allegedly attempting to tamper with trial witnesses. However, the scant proof of this claim is an 84-second telephone call and a few text messages between Mr. Manafort (or an associate referred to as “Person A”) and two former business associates(Doc. 315-2, Ex. N). These brief text messages followed the filing of the Superseding Indictment on February 23, which was the first time the Special Counsel raised any allegations about the mission and work of the Hapsburg Group. (Doc. 202, ¶¶30, 31.) Closer scrutiny of this “evidence” reveals that the Special Counsel’s allegations are without merit because Mr. Manafort’s limited communications cannot be fairly read, either factually or legally, to reflect an intent to corruptly influence a trial witness.

The merits aside (remember, Jeffrey Sterling spent years in prison based in significant part on metadata showing 4:11 in phone calls, without content, between him and James Risen), I find this footnote most interesting.

2 This is no small matter. It is clear from the Special Agent’s declaration that the agent spoke with the person on the other end of the call (i.e., D1). (See Doc. 315-2, ¶¶ 19, 20). Instead of identifying what was said exactly for purposes of this motion, however, the Special Counsel instead states what D1 “understood” from Mr. Manafort’s brief text messages—not the telephone call that occurred. Id. at ¶19. The Special Agent also states what D1 opines, i.e., what D1 believes Mr. Manafort knew. Id. Person D2, with whom Mr. Manafort had no telephone conversations or text messages, states that D1 told him (D2) that he “abruptly ended the call.” Id. at ¶ 20.

Manafort is complaining that Mueller didn’t reveal precisely what FBC Group’s Alan Friedman (see this post to explain who he is) told the government about the call. Had Mueller not indicted, then he would have had a real incentive to call Friedman as a witness next week to explain precisely why Manafort’s comments reeked of obstruction. Mueller has likely presented the substance of the call to the grand jury, however, and may now have less need to put Friedman on the stand next week.

But there is probably far more interesting evidence that Mueller presented to the grand jury to substantiate these two charges:

Obstruction of Justice

From in or about and between February 23, 2018, and April 2018, both dates being approximate and inclusive, within the District of Columbia and elsewhere, the defendants PAUL J. MANAFORT, JR., and KONSTANTIN KILIMNIK knowingly and intentionally attempted to corruptly persuade another person, to wit: Persons D1 and D2, with intent to influence, delay, and prevent the testimony of any person in an official proceeding

Conspiracy to Obstruct Justice

From in or about and between February 23, 2018, and April 2018, both dates being approximate and inclusive, within the District of Columbia and elsewhere, the defendants PAUL J. MANAFORT, JR., and KONSTANTIN KILIMNIK knowingly and intentionally conspired to corruptly persuade another person, to wit: Persons D1 and D2, with intent to influence, delay, and prevent the testimony of any person in an official proceeding, in violation of 18 U.S.C. § 1512(b)(1).

Charging both the obstruction charge and the conspiracy charge is, in some ways, insurance. It implicates Manafort in what are mostly Kilimnik’s efforts to get Friedman on the phone to coordinate stories.

But to charge conspiracy to obstruct, as opposed to just obstruction, Mueller also needs to show an agreement between Manafort and Kilimnik. Such an agreement would likely get to the core of Manafort’s intent more quickly than the calls as received by D1. That is, such an agreement would be the evidence that Manafort claims is lacking.

Which brings me to this exhibit, submitted Monday as part of the government’s motion to revoke bail, which is an XLS spreadsheet bearing the title “Open Source Timeline – March 2016 to March 2017 – Edited_lm.xlsx” uploaded to the docket.

It tracks the phone, WhatsApp, and Telegram communications between Manafort and Person D1 and D2, and the WhatsApp and Telegram chats between Kilimnik and D1 and D2 (Manafort uses WhatsApp once to place a phone call, but otherwise the WhatsApp and Telegram communications are all chats). It shows that the government has third-party sources for all of this — either D1 and D2 turning things over on their own, Manafort’s phone company (he was using AT&T quite recently) turning over his toll records, or Apple turning over the contents of Manafort’s iCloud account.

The table also shows time tracked in two scales: All of Manafort’s communications and the single chat between Kilimnik and D1 are in Coordinated Universal Time, while all of Kilimnik’s chats with D2 are in Central European Summer Time. You might get the latter via screen shots from a phone taken while in Central Europe.

Note, even though Kilimnik tells D2 that he had tried D1 “on all numbers,” the log doesn’t show any calls between Kilimnik and D1, it shows only the one WhatsApp chat between Kilimnik and D1. So the log doesn’t even show all the communications to D1 that exist. Just those that the government can provide a source that it’s willing to share publicly. I assure you, however, that the government knows when those calls were placed.

The log, as presented, also doesn’t show any communications between Manafort and Kilimnik.

Now go back to the fact that, yesterday, the government showed the grand jury not just evidence that Manafort and Kilimnik individually tried to suborn perjury from D1 and D2, but that they agreed to do so. At the very least, that would involve communications between the two of them. They’re only going to have the substance of that communication in one of two ways, though: if they did this via WhatsApp chats, those chats would be available on Manafort’s iCloud account, because he’s got really bad OpSec.

But if those communications were via a phone or WhatsApp call, then the government would have gotten that communication via some other means, means it hasn’t shown in that contact log. Keep in mind: as a foreigner with key connections, Kilimnik is a legitimate spying target under any definition of the term, even aside from the allegation he’s got active ties to Russian intelligence. And since January 2017, the NSA has been able to share raw EO 12333 intelligence with intelligence agencies, including the FBI. If that sharing works the same way Section 702 sharing works (and Kilimnik’s WhatsApp activity may or may not be collectable under 702, even before you get to EO 12333 collection), then so long as the FBI has a full investigation, it can obtain raw feeds of the targets covered by that full investigation.

No FISA notice has been filed in this case; it’s not clear whether the government would give notice of EO 12333 data (they should but they likely don’t). In either case they’d only have to if they intended to use that information in trial. The rest, they’d parallel construct by obtaining from the other parties to a communication or Manafort’s iCloud account.

Now, I suspect Mueller did not intend to file a document indicating that this communication log was originally started with a March 2016 to March 2017 scope, making it clear they’ve got a collection of parallel constructed sources for Kilimnik and Manafort communications that go back that far, right back to when Manafort joined the Trump campaign (which is slightly different than saying they got all of Manafort’s communications during the campaign).

That they’re still using the log to track the duo’s really idiotic ongoing communications is testament to the fact that since Manafort was indicted in October, the government has just been sitting back, watching everything Manafort and Kilimnik do and say to each other while getting Rick Gates to flip, collecting more information, and forcing Manafort to pledge all remaining liquidity to get bail. They’ve been watching Manafort and Kilimnik continue their efforts to try to get out of the deep shit Manafort is in, biding their time.

At the very least, revealing the communication log on Monday would have led Manafort to finally change the privacy settings on his phone, though it may well have led to a noticeable security change from Kilimnik as well, perhaps even a new phone without an FBI or NSA sensor collecting everything.

In the interim, too, other corners of the government revealed, in fairly spectacular fashion, that they can and will obtain the Signal and WhatsApp chats involving journalists of even congressional staffers like James Wolfe, meaning not just that they would do the same for alleged criminals out on bail and their co-conspirators, but that the means to do so has become readily available to the FBI for national security investigations. In short, this week the government tipped their hand about a whole slew of communications involving Manafort and Kilimnik that haven’t been disclosed in discovery yet as well as a capability that even lots of national security journalists (present company excepted) didn’t know they had.

Thus the grand jury and the new charges. It strikes me that, after disclosing the additional collection the FBI has on these two (though both have been fairly stupid in response to such disclosures in the past), the government has less incentive to let Manafort remain out on bail, because it will have a diminishing yield of information about the conspiracy. But the government also has a need to move things along without presenting everything they’ve got (including what they’ve asked Friedman about the developments post April 2 that led Kilimnik to try reaching out a second time). The new indictment provides a way to get to probable case without showing everything they’ve got, which in turns makes the chances that Manafort will finally be going to jail that much higher.

Update: On June 12, the government elaborated on the evidence showing that Manafort intended to suborn perjury, noting that the indictment should be enough by itself to revoke bail.

On June 8, 2018, a grand jury sitting in the District of Columbia returned a Superseding Indictment charging Manafort and his longtime associate, Konstantin Kilimnik, with attempted witness tampering and conspiracy to commit witness tampering, in violation of 18 U.S.C. §§ 1512(b)(1) and (k). See Doc. 318 ¶¶ 48-51. Counts Six and Seven of that Superseding Indictment “‘conclusively determine[] the existence of probable cause’ to believe the defendant” committed a federal crime while on pretrial release. Kaley v. United States, 134 S. Ct. 1090, 1097 (2014) (quoting Gerstein v. Pugh, 420 U.S. 103, 117 n.19 (1975)); see also United States v. Smith, 79 F.3d 1208, 1210 (D.C. Cir. 1996) (“[T]he indictment alone would have been enough to raise the rebuttable presumption that no condition would reasonably assure the safety of the community.”). Probable cause to believe that Manafort committed a crime, in turn, triggers a rebuttable presumption “that no condition or combination of conditions will assure that [Manafort] will not pose a danger to the safety of any other person or the community.” 18 U.S.C. § 3148(b). Manafort’s challenge to the strength of the government’s evidence of witness tampering is thus both misplaced and unavailing. See Kaley, 134 S. Ct. at 1098 & n.6 (explaining that “[t]he grand jury gets to say—without any review, oversight, or second-guessing—whether probable cause exists to think that a person committed a crime,” and recognizing that this “unreviewed finding . . . may play a significant role in determining a defendant’s eligibility for release before trial under the Bail Reform Act”). 1

The go on to suggest that given the indictment, they don’t even need to bring the FBI agent to testify, but will.

Although the government submits that the grand jury’s probable-cause determination obviates the need for testimony by the agent who signed the declaration in support of the government’s motion to revoke or revise, the agent will be available to testify if needed per the Court’s Order. The government submits, however, that any remaining factual matters can be addressed by proffer, as is common practice at bail hearings. See Smith, 79 F.3d at 1210; see also United States v. LaFontaine, 210 F.3d 125, 131 (2d Cir. 2000) (calling it “well established . . . that proffers are permissible both in the bail determination and bail revocation contexts”).

Again, all this seems designed to make it easy for Amy Berman Jackson to revoke his bail.

Share this entry

Some Possibilities on the Emails Hope Hicks Wanted to Withhold

/20 Comments/in , , /by

Remember this story about how Hope Hicks told Mark Corallo in a conference call on July 9, 2017 that they didn’t have to be fully forthcoming about the purpose of the meeting because the emails would never come out?

In Mr. Corallo’s account — which he provided contemporaneously to three colleagues who later gave it to The Times — he told both Mr. Trump and Ms. Hicks that the statement drafted aboard Air Force One would backfire because documents would eventually surface showing that the meeting had been set up for the Trump campaign to get political dirt about Mrs. Clinton from the Russians.

According to his account, Ms. Hicks responded that the emails “will never get out” because only a few people had access to them. Mr. Corallo, who worked as a Justice Department spokesman during the George W. Bush administration, told colleagues he was alarmed not only by what Ms. Hicks had said — either she was being naïve or was suggesting that the emails could be withheld from investigators — but also that she had said it in front of the president without a lawyer on the phone and that the conversation could not be protected by attorney-client privilege.

At the time, I suggested something didn’t make sense about the story, given the facts we knew at the time, because the NYT already had (what we assume to be) the set of emails that got released.

[T]he NYT admits that even as (or shortly after) that meeting transpired it already had the emails Don Jr released that day and was going to publish them itself.

I suggested at the time that there might be other emails — perhaps between Don Jr and Rob Goldstone, perhaps between other players — that provided more damning information.

But there’s another possibility: that more emails exist, between Don Jr and Rob Goldstone (indeed, we know Goldstone sent follow-up emails involving Vkontakte). Or that there are communications between other players. In which case the release of the current emails might serve to distract from a fuller set that Hicks did succeed in burying.

Given the materials released to SJC — and when they were released — we can be sure there were other emails, and at least some of them have come out.

A return email to Paul Manafort

I’ve already noted one example, or at least part of one example. The Don Jr production turned over by the Trump Organization withheld the version of the original invite letter that includes a response from Paul Manafort.

Of particular interest, however, is a detail revealed about the email that Don Jr released last summer. Effectively, the email thread setting up the meeting appears in two places in the exhibits introduced with Don Jr’s testimony. The thread appearing at PDF 26 to 29 is for all intents and purposes the set he released over two tweets last July 11. That bears Bates stamp DJTJR 485 to 487, which designates that it was the version that Don Jr himself turned over. There’s another version of that thread, though, bearing Bates stamp DJTFP 11895 to 11897, which appears at PDF 1 to 3 in Don Jr’s exhibits (and is used for all the other witnesses). The Bates stamp abbreviation DJTFP, Donald J Trump for President, indicates that that’s the version turned over by the campaign. The exhibit shows the same thread, only with this addition.

That is, after Don Jr informed Jared and Paul Manafort that the meeting would be at 4 instead of 3, Manafort responded, “See you then.”

That — and the fact that Don Jr chose to suppress it when publicly releasing his email — is not by itself damning.

Jared wasn’t copied on the Manafort response, so he couldn’t have turned over the Manafort response (and it wouldn’t have been in the copy leaked to the NYT, if he did the leaking, as suggested by Michael Wolff’s book). Nevertheless by the time Don Jr testified on September 7, SJC had both copies.

Manafort’s awareness of the meeting might be damning by itself, because he spoke with Don Jr and met with Trump on June 7, the day Trump announced the campaign would soon be making a “a major speech on probably Monday of next week, and we’re going to be discussing all of the things that have taken place with the Clintons.”

But it’s possible Manafort’s response wasn’t the last in the thread. Perhaps Don Jr wrote back and said something like, “with the dirt Emin promised we’ll really take out this bitch” or something similarly dignified.

The emails showing Agalarov involvement

As I mentioned in this thread, Goldstone did not fully cooperate with SJC. In the first round he left out a lot of stuff that was responsive to SJC’s request and he never provided phone records; in his later production, two voice mails from Emin appear to be truncated. But in February of 2018 (probably after at least one interview with Mueller’s team), his lawyer provided more documents not produced in the first go-around. Among other things, those materials included more details on Emin’s involvement in crafting a statement, and Kaveladze’s role running everything. Of particular interest, many of these materials would show direct communications between the Agalarov camp and Trump Organization lawyers as they crafted their statement.

The draft statement from July 6

Finally, when considering the possibility that parties withheld damning records, consider this email between Goldstone and Don Jr’s lawyer.

It shows that by the time Goldstone (and Emin and Kaveladze) had some phone calls with Alan Garten and Alan Futerfas at the end of June, the Trump folks already had a statement. When Goldstone gets off his cruise in Greece on July 6, he immediately contacts the Trump camp and asks if that statement has been released.

There’s no record of a response to Goldstone from the Trump camp for several days (though they were on the phone with Kaveladze), until when, on July 9, someone (Goldstone believes it’s the Trump camp) leaked his name. That’s when communications resumed, starting with a Trump request that Goldstone attest that the misleading Don Jr statement they subsequently released is 100% true.

Still, the communication on July 6 is damning enough, because it makes it clear that before Trump is known to have been involved, before Trump spoke to Putin, the Trump camp had what it presented as a finalized statement.

Now imagine if either Goldstone or someone else has a hard copy of that statement and it qualitatively deviates from the existing story?

One notable detail. As noted, Goldstone provided these materials after the NYT story at question here, and after Mark Corallo said he’d testify about Hope Hicks’ obstruction; it possibly took place after the Corallo testimony itself. Goldstone testified to SJC a second time on March 29, not long after Mueller subpoenaed the Trump organization — a subpoena that almost certainly would obtain new copies of the documents at least pointed to if not turned over by others.

All of which is to say that there are numerous emails that have been identified since Don Jr testified that appear not to have been turned over in his production, not to mention any Manafort communications he suppressed.

As I’m still working on showing, there was a tremendous degree of coordination going on in that period. And yet, perhaps in spite of that, some of the key documents didn’t get turned over.

Update: Here’s a version of the document requests to the Trump’s. Any of the emails between the Trump lawyers and Kaveladze or Goldstone would have been responsive. Here is what Jared got (remember, the committee complained that he hadn’t provided everything). And here is what Kaveladze and what Goldstone got. I can see Goldstone arguing the follow-up — and the discussions about earlier Agalarov/Trump meetings — didn’t fit the criteria laid out.

Share this entry

On the James Wolfe Indictment: Don’t Forget Carter Page

/48 Comments/in , , /by

Last night, DOJ unsealed the indictment of James Wolfe, the former Director of Security for the Senate Intelligence Committee. He is accused of one count of false statements to the FBI. The indictment alleges that he lied about his conversation with four journalists, Ali Watkins and three others.

The NYT has revealed that Watkins, who had a three-plus year relationship with Wolfe, had years of her communications subpoenaed. They obtained years of her subscriber information, and a more narrow period of additional information from her phone. As a reminder, the subscriber information that can be obtained with a d-order is tremendously invasive — in addition to name and financial and other contact information, the government obtains IP and device addresses that allow them to map out all the communications a person uses. This post lays out what the government demands from tech companies. Obtaining it will burn all but the most disciplined operational security and with it, a journalists’ sources.

The indictment also reveals the government obtained Signal and WhatsApp call records and content; it seems to have been Wolfe’s preferred means to communicate “securely.” I suspect they obtained the communications after June 2017, by targeting Wolfe’s phone. It’s possible he voluntarily provided his phone after confronted with his lies, but I suspect they obtained the Signal content via other means, basically compromising his device as an end point. I’ll return to this, but it appears DOJ has made a decision in recent days to expose the ease with which they can obtain Signal and other secure chat apps, at least in national security investigations, perhaps to make people less comfortable using it.

What I’d like to focus on, however, is the role of Carter Page in the indictment.

The government lays out clear proof Wolfe lied about conversations with three reporters. With Watkins and another, they point to stories about Carter Page to do so. The Watkins story is this one, confirming he is the person identified in the Evgeny Buryakov indictment. Another must be one of two stories revealing Page was subpoenaed for testimony by the Senate Intelligence Committee — either this one or this one.

I’m most interested, however, in this reference to a story the FBI raised with Wolfe in its interview, a story for which (unlike the others) the indictment never confirms whether Wolfe is the source.

During the interview, FBI agents showed WOLFE a copy of a news article authored by three reporters, including REPORTER #1, about an individual (referred to herein as “MALE-l), that contained classified information that had been provided to the SSCI by the Executive Branch for official purposes

The story suggests they don’t have content for the communications between Wolfe and Reporter #1, and the call records they’re interested in ended last June (meaning the story must precede it).

For example, between in or around December 2015 and in or around June 2017, WOLFE and REPORTER #1 communicated at least five times using his SSCI email account.

For that reason, I suspect this is the story they asked about — whether Wolfe is a source for the original credible story on Carter Page’s FISA order. The focus on Page generally in the indictment suggests this investigation started as an investigation into who leaked the fact that Page had been targeted under FISA, and continued to look at the stories that revealed classified details about the investigative focus on him (stories which he rightly complained to SSCI about).

I know the focus will be on the impact on Watkins and any other journalists DOJ has subpoenaed, if they have with the others; that impact is very real and we’ll hear more about how DOJ has shifted its treatment of journalists in upcoming days.

But I’d like to consider what it means that this investigation largely stems from leaks about the investigation into Page.

Page is not at all a sympathetic person. He’s nuts, and may well be or have been a willing recruit of Russia. But there are two reasons why the leaks into the investigation into him should be of concern, along with the concern about journalism.

First, whatever the truth about Page, one reason the government treats counterintelligence wiretaps differently than criminal ones is because there are times they need to obtain content from people they don’t have probable cause are criminals. Legitimately obtained wiretaps should never be revealed except in legal proceedings anyway, but that’s all the more true where the government may be using the wiretap to learn whether someone has been recruited. Unlike Paul Manafort, Mike Flynn, and George Papadopoulos, Carter Page has not been charged, yet the leaks about the investigation into him (including of the damned Steele dossier) have branded him as a Russian spy. I’ve reported on too many cases where FISA orders were used against people who weren’t spies (particularly Chinese Americans), and it needs to be said that investigative targets are kept secret, in part, because they’ve not been charged yet.

Then there’s the flip side to the issue. All the leaks about Carter Page may well have poisoned the investigation into him in several ways. Certainly, Page and the Russians were alerted to the scrutiny he was under. If he is or was a Russian spy, the government may never make its case because the stories on Page made it a lot easier for the targets of the investigation to counter it (I actually think several of the less credible leaks about this investigation were designed to do just that).

Indeed, all the leaked stories about him may have made it politically impossible for FBI to continue the investigation. We know the FISA orders against him ceased after all the leaks about his targeting, for example. So if Page is a spy, all the publicity about this may help him get away with it.

The government has wrapped up a tidy indictment where, while they know Wolfe is a source for at least some of the suspect stories about Page, any trial would instead focus on the clear evidence Wolfe lied about things like a multi-year relationship with someone working SSCI and not classified information. Probably, the hope is he’ll plea and identify all the stories for which he has been a source. To get there, the government has used awesome powers against at least one journalist (and in Watkins’ case, it’s not at all clear they needed to do that).

That said, while I don’t defend Page as a person at all, the giddy leaks about him do come with a cost in both due process and investigative terms and it’s worth remembering that as we talk about this case.

Share this entry

The Smoking Craters Where Trump Deal Brokers Used to Be

/73 Comments/in , /by

Amid the news that DOJ is giving the Gang of Eight another chance to look at sensitive case files on the Russia investigation (some of which they failed to look at in the last briefing), two scoops yesterday should provide far more damning proof of where the “SpyGate” is.

One-time Trump broker Sergei Millian offered Papadopoulos $30,000 a month to partner while working for Trump

First, in a piece that finally recognizes the existence of Ivan Timofeev (yet still hides how George Papadopoulos successfully hid his communications with him through two FBI interviews), Chuck Ross confirms what I had guessed: that Sergei Millian is the contact described in the FBI affidvit about whom Papadopoulos asks for feedback from Timofeev.

Mangiante, an Italian national, confirmed to TheDCNF that Millian is the individual Papadopoulos described in a July 22, 2016 Facebook message that is cited in documents the special counsel’s office released in October.

“On or about July 22, 2016, PAPADOPOULOS messages Foreign Contact 2 on Facebook to ask whether Foreign Contact 2 knew a particular individual with extensive ties to Russian-based businesses and persons,” reads an affidavit released along with Papadopoulos’ guilty plea. “PAPADOPOULOS asked Foreign Contact 2 ‘[i]f you know any background of him that is noteworthy before I see him, kindly send my way.’”

Papadopoulos and Millian met days after the July 22, 2016 Facebook message, said Mangiante, who has recently denied that Papadopoulos was engaged in collusion with Russians.

Mangiante also said that Papadopoulos and Millian met multiple times in Chicago and New York City before the election. In one encounter in Chicago, Millian offered Papadopoulos a substantial sum of money as part of an energy-related business deal.

The catch was that Millian said Papadopoulos would have to remain in the Trump administration while carrying out the work.

The business offer has been previously reported by The New York Times and NBC News. However, Mangiante is providing new details, saying that Millian offered Papadopoulos “$30,000 a month to work as a consultant while with Trump.”

“He refused, of course,” Mangiante said of Papadopoulos.

Interjection: This confirmation should end all the speculation from people examining Mangiante’s apparent flip flop in her public statements about Papadopoulos and seeing a Slavic accent to her statements. Mangiante’s actions are best understood, I think, by understanding that she knows little about US law and how she might best help her spouse, which has led her to respond to the cues of a bunch of sleazy people who have used her unfamiliarity to feed their own narratives or help their own clients (I’m thinking specifically of Victoria Toensing’s client Sam Clovis). But if Mangiante were a Russian spy, there’d be little reason for her to provide evidence that Millian is a Russian operative who sought to handle Papadopoulos and through him Trump’s foreign policy.

That said, Mangiante’s claims about her spouse are unsurprisingly misleading. For example, she has Chuck Ross ignoring the most damning parts of Papadopoulos’ lies to the FBI, as well as his deletion of his Facebook account to hide (among other things) precisely the exchange where Papadopoulos asked Timofeev about Millian. Unsurprisingly, she doesn’t mention that Papadopoulos couldn’t take Millian up on his lucrative deal, because Mike Flynn didn’t last in the National Security Advisor job long enough for him to offer Papadopoulos the job that would have been the prerequisite to accept the offer.

Mr. Millian proposed that he and Mr. Papadopoulos form an energy-related business that would be financed by Russian billionaires “who are not under sanctions” and would “open all doors for us” at “any level all the way to the top.”

One billionaire, he said, wanted to explore the idea of opening a Trump-branded hotel in Moscow. “I know the president will distance himself from business, but his children might be interested,” he wrote.

Nothing came of his proposals, partly because Mr. Papadopoulos was hoping that Michael T. Flynn, then Mr. Trump’s pick to be national security adviser, might give him the energy portfolio at the National Security Council.

The pair exchanged New Year’s greetings in the final hours of 2016. “Happy New Year, sir,” Mr. Papadopoulos wrote.

“Thank you and same to you, George. Happy New Year!” Mr. Flynn responded, ahead of a year that seemed to hold great promise.

But 2017 did not unfold that way. Within months, Mr. Flynn was fired, and both men were charged with lying to the F.B.I. And both became important witnesses in the investigation Mr. Papadopoulos had played a critical role in starting.

This is all the more interesting because (as Glenn Simpson explained to Adam Schiff) Millian has served a function for Trump that — like this Trump Tower deal — provided Trump a way to get loans for his business projects, in this case for Project Hollywood.

MR. SCHIFF: And tell me about the Trump Hollywood project. That was an example of the latter or the former? Did they get the financing from what you could tell because they got a bunch of Russians to pre-sale, or did they go to a bank and say these are our investors, or how did they go about that?

MR. SIMPSON: Well, eventually, I mean, they lost the project. It went under. I, can’t – I’m not – I’m sure we did look at who the creditors were, who the lenders were. This is the project that Sergi Millian appears to have been involved in, and there’s a picture of Jorge Perez, Donald Trump, and Sergi Millian.

And he tells a story about meeting Donald Trump at the golf — at a racetrack, drinking a bottle of Crystal with him, seems — he gave him some Crystal. And that was in the early phases of the project. So it was clear that Donald Trump — so the equity partner was the related group. It was clear that this Russian had been brought into this with Trump, and what you can surmise from that is that he’s there to say there are buyers. We can bring you buyers for this property. And that’s what a developer needs to know is that he’s got buyer interest.

MR. SCHIFF: And how does it work? Let’s say Sergi Millian or someone else lines up the Russian buyers. The Russian buyers sign pre-sale agreements. Trump can then get financing for the res! of the project. Do the buyers go through and buy the properties, or is that no longer necessary, once you’ve obtained the bank financing you can actually sell them to real people?

An architecture firm disappears overnight upon learning Mueller is watching

Keep that model — doing the real estate things that help Trump get loans — in mind when you read this, which I genuinely find to be among the most amazing Russian related stories since the election. In April, acting on a tip, CNBC asked an architect who has worked with Trump on some Eurasian and two American projects, John Fotiadis, about that relationship. Within days, his firm folded.

Between 2007 and 2013, Fotiadis designed all or part of six Trump-branded developments: a Trump Tower in Kazakhstan; a Trump-branded seaside resort in the republic of Georgia; a 47-story Trump Tower in Tbilisi, Georgia; hotel rooms at the Trump Tower in Istanbul; a Trump movie studio complex in Florida; and major portions of the Trump Parc Stamford, a condominium tower in Connecticut.

[snip]

The McClatchy news service reported in April that Mueller’s probe was looking more closely at the people involved in Trump’s dealings in three countries, Georgia, Kazakhstan and Russia.

Around this time, CNBC received a tip that Fotiadis had worked on several Trump projects in Eurasia. Curious about his professional relationship with Trump, CNBC reached out to Fotiadis on April 11 for comment about this work.

Fotiadis did not respond to a call or an email. But eight hours later, he announced on Twitter that he was closing his firm, John Fotiadis Architect, or JFA, after 10 years in business. A few days later, Fotiadis closed the Twitter account he had used to announce he was closing down his firm.

By the end of the week, all the content from Fotiadis’ professional website, including his portfolio, had been removed, leaving only a notesaying he planned to join a New Jersey-based engineering company.

Gone was Fotiadis’ impressive portfolio of 30 projects (some of which are pictured below), including villas, schools and office buildings he has designed for clients around the world. Also gone was any reference to the two overseas branches of JFA that he had opened — in Tbilisi and Kiev, Ukraine.

Admittedly, there’s no evidence to explain what happened here. But it sure has the look of either an intelligence front folding, or someone trying to get out of some really uncomfortable relationships quickly (CNBC describes Fotiadis’ new job with a company that does “car dealerships, self-storage facilities and medical labs,” which would seem to support the latter conclusion).

That said, as CNBC notes, the complex projects of the sort that Trump often use the architect as one key ingredient to bring in big creditors.

“The architect is a key part of the Trump sales pitch when he goes into these countries, and he’s convincing the money guys to give him a branding and development deal,” said Jan deRoos, a Cornell University professor of real estate finance. “The architect is the one who translates the Trump brand into actual design and construction standards.”

Update, July 2020: Fotiadis contacted me to explain that he took down his firm’s site at the request of a new employer.

In June of 2018, she published two articles on me on CNBC’s website and tweeted away – touting her “scoop” for all the world to see and marvel at. You see, around the same time she had tried to contact me (in mid-April of 2018), I took down my Architecture firm’s (JFA’s) social media and website when I was asked to do so by my new employers, with whom I had just come to an agreement for employment. The timing of those two completely separate and unrelated events, may have been unfortunate, but far worse, was exploited by Wilkie in a rather pathetic attempt at self-aggrandizement, so as to create a news story where there was none.

In her tweets Wilkie claimed I “disappeared” and went “MIA” simply because I chose not to respond to her and took my company’s social media down around the same time. In other words Wilkie was trying to falsely claim that somehow her inquiry had forced me to “disappear” or at least “lower my profile”.

He also says he was never contacted by any investigators.

The Agalrov perennial Trump dangle

And these two stories come on top of the Agalarov’s perennial Trump dangle, including for a Trump Tower Moscow. I’m still working on the SJC released files (which are really damning), but the family complained that their years of cultivating Trump crumbled after the June 9 Magnitsky dangle was exposed.

These people — or the people who in turn managed them — exerted and probably still exert tremendous influence over Trump. They all seem to lay out a network of compromise far deeper than we imagined when this all started.

Share this entry