John Durham’s Top Prosecutor, Andrew DeFilippis, Allegedly Miffed that DARPA Investigated Guccifer 2.0

Vladimir Putin’s invasion of Ukraine and the sanctions imposed as a result has led lawyers in the US to drop the now-sanctioned Alfa Bank and its owners, leading to the dismissal of the John Doe, BuzzFeed, and Fusion GPS lawsuits filed by Alfa Bank or its owners. That has, for now, brought an end to a sustained Russian effort to use lawfare to discover “U.S. cybersecurity methods and means” (as some of Alfa’s targets described the effort).

But the dismissal of the Alfa Bank suits hasn’t halted the effort to expose US cybersecurity efforts in the guise of pursuing right wing conspiracy theories. Both Federalist Faceplant Margot Cleveland and “online sleuths” goaded, in part, by Sergei Millian have picked up where Alfa Bank left off. In recent days, for example, documents obtained via a Federalist FOIA to Georgia Tech exposed the members of a cybersecurity sharing group, including a bunch at Three-Letter Agencies, which has little news value but plenty of intelligence value to America’s adversaries (these names were released even while someone — either Georgia Tech or the Federalist — chose to redact the contact information for Durham’s investigators, some of which is otherwise public).

Even while doing her part to make America less safe (raising the perennial question of who funds the Federalist), Cleveland has continued to do astounding work misrepresenting Durham’s investigation. From the same FOIA release, she published a document in which research scientist Manos Antonakakis described that chief Durham AUSA Andrew DeFilippis insinuated to him that it was abusive for DARPA to try to discover the network behind the Guccifer 2.0 persona.

Finally, I will leave you with an anecdote and a thought. During one of my interviews with the Special Counsel prosecutor, I was asked point blank by Mr. DeFilippis, “Do you believe that DARPA should be instructing you to investigate the origins of a hacker (Guccifer_2.0) that hacked a political entity (DNC)?” Let that sync for a moment, folks. Someone hacked a political party (DNC, in this case), in the middle of an election year (2016), and the lead investigator of DoJ’s special council would question whether US researchers working for DARPA should conduct investigations in this matter is “acceptable”! While I was tempted to say back to him “What if this hacker hacked GOP? Would you want me to investigate him then?”, I kept my cool and I told him that this is a question for DARPA’s director, and not for me to answer.

Assuming this is an accurate description, this is a shocking anecdote, a betrayal of US national security.

It suggests that Durham’s lead prosecutor doesn’t believe the government should throw its most innovative research at a hostile nation-state attack while that nation-state is attempting to influence an election. Sadly, though, it’s not surprising.

It is consistent with things we’ve seen from Durham’s team throughout. It’s consistent with Durham’s treatment of a loose tie between an indirect and unwitting Steele dossier source and the Hillary campaign as a bigger threat than multiple ties to Russian intelligence (or Dmitry Peskov’s office, which knew that Michael Cohen and Donald Trump were lying about the former’s secret communications with Peskov’s office). It is consistent with Durham’s more recent suggestion that the victim of such a nation-state attack must wait until after an election to report a tip that might implicate her opponent.

I almost feel like DeFilippis will eventually say Hillary should have just laid back and enjoyed being hacked in 2016.

DeFilippis, and Durham generally, have consistently treated Hillary as a far graver threat than Russia, even now, even as Russia conducts a barbaric invasion of a peaceful democracy.

But Antonakakis’ anecdote is all the more troubling because it suggests that DeFilippis seems to misunderstand what happened with the DARPA contract in question in 2016. The Enhanced Attribution RFP’s description of the hacking campaigns it was targeting — “multiple concurrent independent malicious cyber campaigns, each involving several operators” — pretty obviously aims to tackle Advanced Persistent Threats, of which APT 28 and 29 (both of which targeted the DNC) were among the most pressing in 2016. DARPA presumably didn’t ask Antonakakis to focus on Guccifer 2.0 — a persona which didn’t exist when the contract was put up for bid in April 2016, much less in the months earlier when it was originally conceived. Rather, by description, they were asking bidders to look at APTs, and looking at APT 28 would have happened to include looking at Guccifer 2.0, the DNC hack, and a number of hacks elsewhere in the US and the world.  The reason DARPA would ask Georgia Tech to look at APT 28 is because APT 28 was hacking a lot of targets in the time period, all of which provided learning sets for a researcher like Antonakakis. DeFilippis, then, seems miffed that the APT that DARPA wanted to combat happened to be one of two that targeted Hillary.

That’s a choice Russia made, not DARPA.

While I think Cleveland did serious damage with some of her releases, I’m glad she released this document because it provides a way for Michael Sussmann to make DeFilippis’ troubling views on national security a central issue at trial, something that normally is difficult to do.

It also provided Cleveland another opportunity to faceplant in spectacular trademark Federalist fashion. Cleveland used this document to rile up the frothers by suggesting this is proof that Durham is investigating the DNC attribution.

Exclusive: Special Counsel’s Office Is Investigating The 2016 DNC Server Hack

The U.S. Department of Defense tasked the same Georgia Tech researcher embroiled in the Alfa Bank hoax with investigating the “origins” of the Democratic National Committee hacker, according to an email first obtained by The Federalist on Wednesday. That email also indicates the special counsel’s office is investigating the investigation into the DNC hack and that prosecutors harbor concerns about the DOD’s decision to involve the Georgia Tech researcher in its probe.

[snip]

The public storyline until now had been that CrowdStrike, the cybersecurity firm Sussmann hired in April 2016, had concluded Russians had hacked the DNC server, and that the FBI, which never examined the server, concurred in that conclusion. Intelligence agencies and former Special Counsel Robert Mueller likewise concluded that Russian agents were behind the DNC hack, but with little public details provided.

It now appears that DARPA had some role in that assessment, or rather Antonakakis did on behalf of DARPA, which leads to a whole host of other questions, including whether DARPA had access to the DNC server and data and, if so, from whom did the DOD’s research arm get that access? Was it Sussmann?

There’s no reason to believe this and every reason to believe that — as I said — DeFilippis is pissed that DARPA prioritized their research on a target that was badly affecting national security (and not just in US, but also in allied countries) in 2016, one that happened to attempt to help Trump get elected.

But look how many errors Faceplant’s Cleveland made in the process:

Cleveland repeats the Single Server Fallacy, imagining that the DNC, DCCC, and Hillary had just one server between them to be hacked and all the servers that got hacked were in the possession of one of those victims. That’s, of course, ridiculous. The server that GRU hacked to get John Podesta’s emails belonged to Google. The server that GRU hacked to get Hillary’s analytics belonged to AWS. There was a staging server in AZ; I have been told that the FBI seized at least one US-based server that did not belong to the DNC (that server is why the frothy right’s focus on what Shawn Henry testified to HPSCI is so painfully ignorant — because it ignores that the FBI had access to servers that Henry did not that did show exfiltration).

Cleveland apparently doesn’t know that FBI knew who was hacking the DNC when they warned them starting in September 2015 they were being hacked. The FBI’s awareness of that not only explains why APT 29 and 28 would have been included in DARPA’s targets for EA, but proves that the government was tracking these hacking groups above and beyond the attack on Hillary. This was never just a reaction to the election year hack.

Cleveland claims Mueller’s attribution of the DNC hack to the GRU provided “little public details,” when in fact the Mueller Report showed 29 sources other than CrowdStrike, including:

  • Gmail
  • Linked-In
  • Microsoft
  • Facebook
  • Twitter
  • WordPress
  • ActBlue
  • AWS
  • AOL
  • Smartech Corporation
  • URL shortening service
  • Bitcoin exchanges
  • VPN services

According to Mueller’s report, all these sources also corroborated the GRU attribution. And Mueller’s list doesn’t include a number of other known entities that corroborated the attribution, including NSA and Dutch intelligence, which couldn’t be named in a public DOJ document. Mueller’s list doesn’t include Georgia Tech either, but it wouldn’t need to, because there was so much other evidence.

The Mueller Report described obtaining almost 500 warrants, but the released list — from which FBI’s Cyber Division successfully withheld those pertaining to the GRU investigation — only includes around 370-400 warrants (based on an 156 pages of warrants with roughly three per page), suggesting there may be 100 warrants tied to the GRU attribution alone.

By the time Antonakakis started looking at the DNC hack as part of EA, multiple entities, including several Infosec contractors, non-US intelligence services, and non-governmental entities like tech giants (including at least three of the ones on Mueller’s list), had plenty of evidence that the Guccifer 2.0 campaign was run by the APT 28. Including Guccifer 2.0 as part of the research set would simply be part of the existing targeting of a dangerous APT.

But apparently neither DeFilippis nor Cleveland understand that 2016 was part of an ongoing identified threat to US national security.

One thing Putin did in 2016 was to use disinformation to train the frothy right to favor Russia more than fellow Americans from the opposing party. Even as Russia attacks Ukraine, that still seems to be true.

Five Years after WikiLeaks Exposed CIA Identities in Vault 7, UK Moves Closer to Assange Extradition

Last November, in response to an order from Judge Jesse Furman, DOJ said that they were fine with accused Vault 7 leaker Joshua Schulte’s request for a delay before his retrial. In fact, they didn’t think a Schulte retrial could start before March 21.

Although the Government is available for trial at any time in the first or second quarters of 2022, the Government does not believe it would be practical to schedule the trial prior to March 2022. In particular, although the Government believes that the Court’s prior rulings pursuant to Section 6 of CIPA address the vast majority of questions concerning the use of classified information at trial in this matter, it appears likely that the defendant will seek to use additional classified information beyond that previously authorized by the Court. The process for pretrial consideration of that application pursuant to Section 6 is necessarily complex, entailing both briefing and hearings in a classified setting. To the extent the Court authorizes the defendant to use additional classified information, implementation of the Court’s rulings can also take time, such as through either declassification of information or supplemental briefing regarding the application of Section 8 of CIPA (authorizing the admission of classified evidence without change in classification status). The proposed trial date also takes into consideration matters discussed in the Government’s ex parte letter submitted on August 4, 2021. Accordingly, in order to afford sufficient time both for the likely upcoming CIPA litigation and for the parties to prepare for trial with the benefit of any supplemental CIPA rulings, the Government believes that the earliest practical trial date for this matter would be March 21, 2022.

Part of this delay was to revisit the Classified Information Procedures Act decisions from the first trial because, now that he’s defending himself, Schulte likely wanted to use more classified information than Sabrina Shroff had used in the first trial. It turns out March 21 was overly optimistic for CIPA to be done. Because of an extended debate over how to alter the protective order, the government will only file its CIPA motion tomorrow (it just asked to submit a much longer filing than originally permitted, and got permission to file a somewhat longer one).

It’s the other part of the government’s interest in delay — its references to “matters discussed” in a sealed letter from August 4 — that I’ve been tracking with interest, particularly as the Assange extradition proceeded. As I noted earlier, that August 4 letter would have been sent five years to the day after Schulte started searching on WikiLeaks, Edward Snowden, and Shadow Brokers (according to the government theory of the case, Schulte stole and leaked the CIA’s hacking tools earlier, in late April and early May 2016).

Since those mentions of a sealed letter last year, the government has asked for and gotten two meetings to discuss classified information with Judge Fruman under section 2 of CIPA, first for February 8 (after which a sealed document was lodged in Chambers), and the second one for March 9.

Section 2 provides that “[a]t any time after the filing of the indictment or information, any party may move for a pretrial conference to consider matters relating to classified information that may arise in connection with the prosecution.” Following such a motion, the district court “shall promptly hold a pretrial conference to establish the timing of requests for discovery, the provision of notice required by Section 5 of this Act, and the initiation of the procedure established by Section 6 (to determine the use, relevance, or admissibility of classified information) of this Act.”

That second CIPA Section 2 meeting, on March 9, would have taken place days after the five year anniversary for the first Vault 7 publication, and with it the publication of the names or pseudonyms and a picture of several colleagues Schulte had vendettas against.

Schulte acknowledged that publication in a recently-released self-justification he wrote to an associate after the Vault 7 release (it’s unclear when in 2017 or 2018 he wrote it), one he’s making a renewed attempt to suppress.

The names that were allegedly un-redacted were pseudonyms — fake names used internally in case a leak happened. Those of us who were overt never used last names anyway; This was an unwritten rule at the agency — NEVER use/write true last names for anyone. So I was convinced that there was little personal information revealed besides a picture of an old boss of mine that was mistakenly released with the memes.

Not long after he acknowledged the rule against using people’s names in that self-justification, Schulte used the names of the three colleagues he was most angry at: His boss Karen, his colleague “Jeremy Weber,” and another colleague, Amol, names that were also central to his efforts to leak from jail. If the FBI could ever develop evidence that Weber’s name was deliberately left in WikiLeaks’ Vault 7 publication, both Schulte and anyone else involved would be exposed to legal liability for violating the Intelligence Identities Protection Act, among other crimes.

On Monday, one week short of the day DOJ thought might be a realistic start day for the retrial, the British Supreme Court refused Assange’s bid to appeal a High Court decision accepting (flimsy) US assurances that Assange would not be held under Special Administrative Measures, finding that the appeal “does not raise an arguable point of law.”

Given the timing of the sealed filings in the Schulte case and the way the 2020 superseding indictment accuses Assange of “exhort[ing a Chaos Computer Club] audience to join the CIA in order to steal and provide information to WikiLeaks,” effectively teeing up Schulte’s alleged theft, I would be unsurprised if one of the things DOJ was delaying for weren’t this moment, some resolution to the Assange extradition.

To be sure: the Assange extradition is not over, not by a long shot. As a letter from his attorneys explains, this decision will go back to Vanessa Baraitser, who will then refer the extradition to Home Secretary Priti Patel. Assange will have four weeks to try to persuade Patel not to extradite him.

And, as the same letter notes in classically British use of the passive voice, Assange could still appeal Baraitser’s original ruling.

It will be recollected that Mr Assange succeeded in Westminster Magistrates’ Court on the issue subsequently appealed by the US to the High Court. No appeal to the High Court has yet been filed by him in respect of the other important issues he raised previously in Westminster Magistrates’ Court. That separate process of appeal has, of course, has yet to be initiated.

But an appeal on these issues would be decidedly more difficult now than they would have been two years ago.

That’s true, in part, because the Biden Administration’s continuation of Assange’s prosecution has debunked all the bullshit claims Assange made about being politically targeted by Donald Trump.

I also expect at least one of the purportedly exculpatory stories WikiLeaks has been spamming in recent months to be exposed as a complete set-up by WikiLeaks — basically an enormous hoax on WikiLeaks’ boosters and far too many journalist organizations. WikiLeaks has become little more than a propaganda shop, and I expect that to become clearer in the months ahead.

Finally, if the US supersedes[d] the existing indictment against Assange or obtains[ed] a second one in the last seven months, it will badly undermine any remaining claim Assange has to doing journalism. That’s true for a slew of reasons.

As I laid out here, the part of the Baraitser ruling that distinguished Assange’s actions from journalism based on his solicitation of hacks relied heavily on the language that directly teed up the hack-and-leak Schulte is accused of.

Mr. Assange, it is alleged, had been engaged in recruiting others to obtain information for him for some time. For example, in August 2009 he spoke to an audience of hackers at a “Hacking at Random” conference and told them that unless they were a serving member of the US military they would have no legal liability for stealing classified information and giving it to Wikileaks. At the same conference he told the audience that there was a small vulnerability within the US Congress document distribution system stating, “this is what any one of you would find if you were actually looking”. In October 2009 also to an audience of hackers at the “Hack in the Box Security Conference” he told the audience, “I was a famous teenage hacker in Australia, and I’ve been reading generals’ emails since I was 17” and referred to the Wikileaks list of “flags” that it wanted captured. After Ms. Manning made her disclosures to him he continued to encourage people to take information. For example, in December 2013 he attended a Chaos computer club conference and told the audience to join the CIA in order to steal information stating “I’m not saying don’t join the CIA; no, go and join the CIA. Go in there, go into the ballpark and get the ball and bring it out”. [emphasis Baraitser’s]

If the government proves what is publicly alleged, Schulte’s actions have nothing to do with whistleblowing and everything to do with vindictive hacking to damage the CIA, precisely what Assange was eliciting. Plus, even if such a hypothetical superseding indictment added just Vault 7/Vault 8 charges against Assange, it could put extortion and IIPA on the table (the latter of which would be a direct analogue to the UK’s Official Secrets Act), to say nothing of the still unexplained fate of the CIA source code which — as Schulte himself acknowledged — would have provided an unbelievable benefit had Russia had received it.

And that assumes that Vault 7/Vault 8 would be the only thing the US wanted to supersede with. When Jeremy Hammond asked prosecutors why they hadn’t charged Assange for helping Russia tamper in US elections, they appeared to respond by describing the long time it would take to extradite Assange, implying that they still had time to charge Assange. To be sure, Mueller concluded that he “did not have admissible evidence that was probably sufficient to obtain and sustain a Section 1030 conspiracy conviction of WikiLeaks [or] Assange.” But the implication was that Mueller had evidence, just not stuff that could be submitted at trial. The extradition of Vladislav Klyushin — whose lawyer believed the US was particularly interested in his knowledge of the 2016 operation — might change that. (Like Assange, Klyushin’s extradition was also pending when DOJ submitted that first sealed filing; Klyushin’s case has been continued to share more discovery.)

There are several other operations WikiLeaks was involved in in 2015 and afterwards that would undermine any claim of being a journalistic outlet — and would add to the evidence that Assange had, at least by those years, been working closely to advance the interests of the Russian government.

It would be very hard to argue that Assange was being prosecuted for doing journalism if the US unveiled more credible allegations about the multiple ways Assange did Russia’s bidding in 2016 and 2017, even in normal times. All the more so as Russia is continuing its attack on democracy with its invasion of Ukraine.

And that’s what Assange faces as he attempts to stay out of the US.

The Lesson Marina Ovsyannikova Offers to Chuck Todd and Lester Holt

Yesterday, an editor at Russia’s official Channel One news, Marina Ovsyannikova, came onto a live broadcast and held up a sign condemning Russia’s war on Ukraine.

Predictably, she was quickly detained; thus far, her attorneys have been unable to locate her (though one outlet has said she’ll be charged under Russia’s new crackdown law).

Shortly after her detention, a pre-recorded video was released, in which she explained her actions. She spoke of the shame she feels about her past involvement in Putin’s lies.

What is happening right now in Ukraine is a crime and Russia is the aggressor. And the responsibility for this aggression lies on the conscience of only one person. This man is Vladimir Putin. My father is Ukrainian. My mother is Russian. And they were never enemies. And this necklace on my neck is a symbol of the fact that Russia must immediately stop the fratricidal war and then our brotherly peoples will still be able to reconcile.

Unfortunately, in recent years I have been working on Channel One, working for Kremlin’s propaganda. And I am very ashamed of it. I am ashamed that I was letting them tell those lies from the screen. I’m ashamed that I allowed to “zombify” the Russian people.

We kept silent in 2014, when all this was just in the beginning. We didn’t go to rallies when the Kremlin poisoned Navalny. We just silently watched this inhumane regime.

And now the whole world has turned away from us, and even 10 generations of our descendants will not be enough to wash away the shame of this fratricidal war. We are Russian people — thoughtful and smart. It’s up to us to stop this madness. Come out to rallies. Don’t be afraid of anything. They can’t imprison all of us.

It was an incredibly brave — and because she planned her actions in advance — well-executed protest.

But make no mistake. Ovsyannikova is not, like another brave journalist who spoke up this week, Yevgenia Albats, someone who has criticized the regime in the past, someone whose witness now is a continuation of years of brave reporting.

Rather, Ovsyannikova is someone who, a profile describes, “was a cog in a big machine of Channel One’s news production.” She was part of the the production of official truth. And as she describes, hers is the lesson of regret for that complicity, someone who will forever own a part of Putin’s crimes because she took the comfortable route of contributing to and participating in Putin’s exercise of power. She will almost certainly pay a stiff price for her speech, but she is also someone who did nothing, up till now, as Putin kept raising the price of speaking freely.

While Ovsyannikova’s protest will likely resonate for some time, I would hope that complicit journalists in countries where it’s not too late to defend democracy reflect seriously on Ovsyannikova’s shame. Even as Russia rains bombs down on Ukraine, journalists like Chuck Todd and Lester Holt invited Bill Barr onto their TV to tell lies about Russia’s attack on democracy in the United States, to tell lies about Trump’s extortion of Ukraine, to tell lies about his role in an attack on democracy. Like Ovsyannikova, Todd and Holt sit, comfortable, polished, and complicit, as Barr told lies that were a direct attack on democracy and rule of law.

And like Ovsyannikova, they are doing nothing to rebut the lies of authoritarianism before it’s too late.

Update: Ovsyannikova has surfaced and is thus far facing only administrative crimes, so days, not years, in jail.

Update: Ovsyannikova was fined 30,000 rubles and released, but that apparently only covers the social media video, not the protest on TV.

“Problem:” SDNY Charges Elena Branson as Unregistered Agent of Russia

Back in 2013, the Senior Vice President of the Russian American Chamber of Commerce (Sergei Millian’s organization) sent Elena Branson language from FARA with the subject line, “Problem.”

a. On or about January 30, 2013, BRANSON received an email from an individual using an email address ending in “mail.ru.” Based on my review of publicly available information, I have learned that this individual was a Senior Vice President of the Russian American Chamber of Commerce in the USA. This email had the subject line “Problem.” and the text of the email included, among other things, a portion of the FARA Unit’s website with background on FARA. In response, BRANSON wrote, in part, “I am interested in the number of the law, its text in English[.]” The sender then responded with “Lena, read …” and copied into the email background on FARA and portions of the statute.

Branson, who the prior year had founded the Russian Center of New York and subsequently became the Chair of Russian Community Council of the USA (KSORS), apparently didn’t think it was an urgent problem. It wasn’t until 2019 that she appears to have considered — but then, after asking Russian Ambassador Anatoly Antonov for guidance, decided not to — register under FARA.

b. On or about December 10, 2019, BRANSON received an email indicating that BRANSON had requested a new FARA “eFile” account.21 That day, a member of the FARA Unit emailed the Branson RCNY Account with an eFile account number and temporary password to log in to the FARA eFile system. Later that day, a user logged in to the FARA eFile system using that account number and temporary password, and entered the registration name “Russian Center, Inc.” and the RCNY Office as the address. The user did not submit a FARA registration for the account. A user then accessed the account again on or about December 11, 2019, but, again, the individual did not submit a FARA registration. The internet protocol addresses connected to both log-ins of this account resolve to the same zip code as the RCNY Office.

c. On or about December 26, 2019, BRANSON emailed the Embassy Email Account. In the cover email, BRANSON wrote, in part, “[A] letter is in the attachment. Respectfully, Elena.” In the attached letter, BRANSON wrote, in part, that she had been asked questions from “compatriots” about “whether it is necessary to register their public organizations as a foreign agent.” BRANSON further wrote “[t]hese questions began to arise after the arrest of Maria Butina in Washington in July 2018 on charges of working as a foreign agent in the United States without registration.” BRANSON concluded the letter by asking the Embassy to advise such Russian compatriot groups, writing, “I am asking you to provide legal advice regarding registration as a foreign agent . . . for public organizations of Russian compatriots in the United States.” The letter was addressed to Ambassador-1.

Branson’s failure to register lies at the core of a 6-count complaint unveiled by SDNY yesterday, charging Branson in several conspiracies, under both FARA and 18 USC 951, as well as for visa fraud.

Branson won’t be arrested off this complaint. She’s long gone.

A month after the FBI interviewed her and searched her office in September 2020, she fled the country. Not long after Biden was inaugurated, Branson sold her NYC apartment.

During this investigation, the FBI has, among other things, executed judicially authorized search warrants for (i) approximately eight of BRANSON’s electronic accounts (the “Branson Accounts”3); (ii) the RCNY office (which was also BRANSON’s residence) in Manhattan, New York (the “RCNY Office”); and (iii) BRANSON’s person, for all electronics and other materials in her possession at the time of the search. From the RCNY Office and the search of BRANSON’s person, the FBI recovered a total of approximately 34 electronic devices (the “Branson Electronics”), including approximately 11 cellular phones. The FBI also conducted a voluntary interview of BRANSON on the same day as the search of the RCNY Office (the “Branson Interview”) and has interviewed other individuals living in the United States in connection with the investigation.

The searches of the RCNY Office (the “RCNY Search”) and BRANSON’s person, as well as the Branson Interview, took place on or about September 29, 2020. BRANSON flew to Moscow, Russia, on or about October 20, 2020, and BRANSON does not appear to have returned to the United States since that date. In or about March 2021, BRANSON sold the RCNY Office, which had been her residence in New York City. During in or about October and November 2020, BRANSON’s then boyfriend 9 (“Boyfriend-1”) wired approximately $197,000 to two of BRANSON’s bank accounts at Russian banks.4 On or about October 15, 2021, RT, formerly known as Russia Today, a Russian state-controlled television station, published an interview conducted by Maria Butina5 of BRANSON. During this interview, BRANSON told Butina, in substance and in part, that BRANSON left the United States for Moscow approximately one month after the Branson Interview because BRANSON was “scared” and thought the “probability was very high” that she would be arrested if she stayed in the United States.6

3 The Branson Accounts include four email accounts and four social media accounts, including BRANSON’s Facebook account (the “Branson Facebook Account”).

So Branson will only be arrested if she decides to flee Putin’s increasingly totalitarian regime.

Unlike the prosecution of Jack Hanick, then, whose indictment may have been timed to tolling statutes of limitation last November and in which the US is working on getting him extradited from the UK, this complaint seems to be more about messaging in the wake of the Russian invasion of Ukraine.

As a messaging vehicle, it shows how Russia has committed to the “consolidation” of Russian diaspora, cultivating a Russian identity that can be used to mobilize political pressure (and, in Ukraine and the Baltics, justifications for imperialism).

In or about November 2015, Lavrov published an article titled “Russian World: Steering Towards Consolidation.” In this article, Lavrov wrote, in part, “The provision of support to the Russian world is an unconditional foreign-policy priority for Russia, as formalized by Russia’s Foreign Policy Concept. . . . Over the years, we have managed to elevate our work in this area to an entirely new level and to create effective cooperation mechanisms in close contact with representatives of foreign communities.”

Some of Branson’s activities are mundane cultural exchanges paid for by Russian government entities. Some sprinkle the names of likely spies or handlers in the description.

Perhaps most interesting, the complaint provides an interesting addition to this passage from the Mueller Report.

Later [on November 9, 2016, the day after Trump’s victory, Kirill] Dmitriev flew to New York, where Peskov was separately traveling to attend the chess tournament. 1020 Dmitriev invited Nader to the opening of the tournament and noted that, if there was “a chance to see anyone key from Trump camp,” he “would love to start building for the future.” 1021 Dmitriev also asked Nader to invite Kushner to the event so that he (Dmitriev) could meet him. 1022 Nader did not pass along Dmitriev’s invitation to anyone connected with the incoming Administration. 1023 Although one World Chess Federation official recalled hearing from an attendee that President-Elect Trump had stopped by the tournament, the investigation did not establish that Trump or any Campaign or Transition Team official attended the event. 1024 And the President’s written answers denied that he had. 1025

The complaint describes how Branson had been instructed to arrange a meeting with Trump or Ivanka in March 2016, around the same time Russia was hacking John Podesta, though the complaint is remarkably coy about whether Branson ever sent her draft letter to Trump Organization (and if so, whether it was among the documents showing direct ties to Russia that Trump Organization withheld from Mueller’s inquiry and SSCI).

In or about March 2016, BRANSON exchanged a series of emails with Minister-2. During these messages, in part, Minister-2 asked BRANSON to organize a meeting with CC-2 and the now-former President of the United States, who was then a candidate for the Republican presidential nomination, or his daughter, in New York. On or about March 23, 2016, BRANSON received an email from Minister-2 with the subject line “additional meetings of [CC-2].” The email stated, in part, that the author was requesting BRANSON’s assistance in organizing meetings for CC-2 with “the management” of certain specified U.S. companies. On or about March 16, 2016, BRANSON sent an individual, who was then-chair of KSORS, a draft letter addressed to the now-former President, inviting him to the Russia Forum New York in April 2016 and suggesting that if his “busy schedule will not permit your attending our forum, perhaps you can suggest one of your children . . . who have followed in your footsteps.” The draft invitation included BRANSON’s name and contact information in the signature block. There is no indication that the now-former President or his children attended the referenced meeting.

Branson’s complaint describes what would be a second attempt to get Trump to attend the Chess Championship, in addition to Kirill’s attempt to extend an invite through George Nader. Branson sent her invite to an unnamed Trump Advisor.

BRANSON also attempted to arrange meetings for Russian officials at the 2016 World Chess Championship, which was held in Manhattan, New York:

1. On or about November 9, 2016, CC-6 emailed BRANSON with the subject line “Chess business.” CC-6 wrote to BRANSON, in part, “as discussed we will try to get Kirsan online after tomorrow’s official press-conference is over around noon at Fulton Street Market Building, South Street Seaport NY[.]”20 On or about that same day, BRANSON responded to CC-6 and wrote “[CC-6], good evening! I can bring the ipad for a Skype session. I will contact the media. Need them at noon?”

2. On or about November 10, 2016, BRANSON emailed an advisor to the now-former President of the United States (“Advisor-1”), expressing congratulations for their victory in the presidential election and attaching an invitation to the World Chess Championship addressed to the then-President- elect. The invitation was signed by “President of the International Chess Federation (FIDE-FIDE).” There is no indication that the now-former President attended the referenced event.

3. On or about November 11, 2016, BRANSON was photographed at the World Chess Championship with CC-6 and a second individual who I recognize, based on my review of publicly available photographs, to be the current Press Secretary for Russian President Vladimir Putin.

20 Based on my training and experience, including my review of publicly available material, I have learned that Kirsan Ilyumzhinov is the former President of the Republic of Kalmykia in the Russian Federation and the former president of FIDE, the International Chess Federation. I have further learned that, on or about November 25, 2015, the United States Department of the Treasury designated Ilyumzhinov as a Specially Designated National for his involvement with the Government of Syria and related entities.

Here, the complaint reiterates the Mueller conclusion: there’s no evidence Trump attended the event. But it does raise questions about the completeness of the response Trump offered to Mueller’s questions, pertaining to whether Trump was asked to attend.

Were you asked to attend the World Chess Championship gala on November 10, 2016? If yes, who asked you to attend, when were you asked, and what were you told about about [sic] why your presence was requested? 1. Did you attend any part of the event? If yes, describe any interactions you had with any Russians or representatives of the Russian government at the event.

Were you asked to attend the World Chess Championship gala on November 10, 2016? If yes, who asked you to attend, when were you asked, and what were you told about about [sic] why your presence was requested? 1. Did you attend any part of the event? If yes, describe any interactions you had with any Russians or representatives of the Russian government at the event.

Response to Question V, Part (a)

I do not remember having been asked to attend the World Chess Championship gala, and I did not attend the event. During the course of preparing to respond to these questions, I have become aware of documents indicating that in March of 2016, the president of the World Chess Federation invited the Trump Organization to host, at Trump Tower, the 2016 World Chess Championship Match to be held in New York in November 2016. I have also become aware that in November 2016, there were press inquiries to my staff regarding whether I had plans to attend the tournament, which was not being held at Trump Tower. I understand these documents have already been provided to you.

Trump describes a March 2016 discussion about hosting the event and November press inquiries about whether he would attend it. But there’s no mention of a November 2016 invitation asking him to attend.

Yet the Branson complaint suggests there would have been an invitation to Trump, signed by the sanctioned Kirsan Ilyumzhinov, sent through an unnamed advisor. His response reflects only earlier (in March) communications about the chess championship, not anything sent on November 10 bearing Ilyumzhinov’s signature.

This is a signaling complaint, one that likely won’t lead to anyone’s arrest. But it should raise more questions about Donald Trump’s candor with Mueller back in 2018.

And we should expect more of the same. On Twitter, Brandon Van Grack, who would have been involved in Branson’s investigation when he ran the National Security Division’s FARA office and likely knows what else might be in the pipeline, suggested there’s probably more of the same to come.

It Is Not News that Bill Barr Lied to Protect Kleptocracy

Let’s talk about what Bill Barr did in his second tenure as Attorney General.

Even before Jeff Sessions was fired, Barr decided — based on the false claims he saw on Fox News — that the allegations against Donald Trump were bullshit. He wrote up a memo suggesting that it was okay for the President to fire the FBI director to cover up his own crimes. And based on that audition, he was nominated and confirmed as Attorney General.

When the investigation into the aftermath of that firing shut down weeks after he was confirmed, Barr lied to downplay the degree to which the President had enthusiastically welcomed the help of a hostile country to get elected. Among the things his lies did was to hide that the investigation into whether Roger Stone conspired with Russia — with Trump’s full knowledge — remained ongoing, a detail that remains unreported everywhere but here. Barr also issued a prosecution declination for crimes still in progress, Trump’s ultimately successful effort to buy the silence of witnesses against him with pardons.

Barr poured whiskey to celebrate his old friend Robert Mueller’s frailty before Congress.

Then Barr turned to protecting Trump, Rudy Giuliani, and Sean Hannity when a whistleblower objected that Trump was extorting Volodymyr Zelenskyy for help on his reelection campaign. He did so in a number of ways, including interfering in legally mandated congressional and election oversight. He also stripped the whistleblower complaint to ensure that investigative steps put into place to protect national security in the wake of 9/11 wouldn’t tie Trump’s extortion attempt to an ongoing investigation into Ukrainian efforts to exploit Rudy Giuliani’s corruption to protect (Russian-backed) Ukrainian corruption. Barr’s efforts to hide the national security impact of Russian-backed Ukrainian efforts to corrupt American democracy gave Republicans cover — cover that every single Republican save Justin Amash and Mitt Romey availed themselves of — to leave Trump in place even after he put his own personal welfare above national security.

Then Barr turned to undoing the work of the Russian investigation. After Judge Emmet Sullivan ruled that the case against Mike Flynn was sound and Michael Horowitz concluded that the Russian investigation was not a partisan witch hunt, Barr assigned multiple investigators — John Durham and Jeffrey Jensen — to create a new set of facts claiming it was. He intervened to minimize the punishment against Stone, in the process claiming that threats against a witness and a judge — involving the same militias that would go on to lead an attack on the Capitol on January 6 — were mere technicalities. In his attempt to shield Stone from punishment, Barr ensured that the then-ongoing investigation into Stone’s suspected conspiracy with Russia would go nowhere. Barr’s efforts to attack Emmet Sullivan for refusing to rubber stamp Barr’s corruption resulted in a death threat against the judge. Barr’s effort to invent excuses to dismiss the prosecution against Flynn included altering documents and permitting an FBI agent who had sent pro-Trump texts on his FBI device to make claims in an interview that conflicted with the agent’s own past actions.

Barr used COVID as an excuse to let Paul Manafort serve his sentence in his Alexandria condo until such time as Trump pardoned his former campaign manager for lying about the help from Russia he used to get elected.

Barr took several measures to protect Rudy Giuliani from any consequences for his repeated efforts to get help for Donald Trump from Russian-backed Ukrainians, including outright Agents like Andrii Derkach. He ensured that the existing SDNY investigation into Rudy could not incorporate Rudy’s later efforts to solicit Russian-backed Ukrainian help. He attempted to fire Geoffrey Berman. He set up a parallel process so that DOJ could review the fruits of Rudy’s influence peddling for potential use against Trump’s campaign opponent.

This is just a partial list of the false claims that Bill Barr mobilized as Attorney General to ensure that the United States remained saddled with a President who repeatedly welcomed — at times extorted — Russian-backed help to remain as President.

It is not news that Bill Barr corrupted DOJ and lied to protect kleptocracy — in its American form of Donald Trump, but also, by association, in Putin’s efforts to exploit American venality to corrupt democracy.

Nevertheless, multiple outlets have decided that now — during Russia’s unprovoked attack on Ukraine — is a good time to invite Bill Barr onto TV or radio to tell further lies to spin his own role in protecting kleptocracy, Russian and American. They appear to think they’re clever enough to catch a shameless liar in a lie — or perhaps believe the news value of having Barr explain that he’d prefer a competent fascist to Trump but if Trump is all he gets, he prefers that to actual democracy.

You cannot win an interview with Bill Barr. Gaslighters like Barr are too skilled at exploiting our attention economy. The mere act of inviting him on accords a man who did grave damage to the Department of Justice and the Constitution in service of kleptocracy as a respectable member of society. Even assuming you’re prepared enough to challenge his lies (thus far none of the journalists who interviewed Barr has been), he’ll claim your truth, the truth, is just partisanship designed to smear those who believe kleptocracy is moral. More likely, you’ll end up like Savanah Guthrie did, letting Barr claim, unchallenged, that the allegation that Russia conducted a concerted effort to compromise Trump is a lie.

Before Russia invaded a peaceful country, it attempted to achieve the same ends by cultivating Trump, by trading him electoral advantage for Ukrainian sovereignty. Bill Barr was a central part in letting that effort continue unchecked until January 20, 2021.

If you invite him on to do anything other than apologize to Ukraine and the United States, you are part of the problem.

“The Whole Idea Was to Intimidate Congress:” Bill Barr Continues to Minimize Witness Tampering

In a supine interview to help Bill Barr rehabilitate his reputation, Lester Holt asked the former Attorney General about intervening to lessen Roger Stone’s sentence. According to the summary thus far posted, Barr claims it was made to look bad, but really he just thought it was right to halve the sentencing recommendation for the guy hiding the President’s knowledge of Russian interference during the 2016 election.

As for his decision to soften a prison sentence for longtime Trump adviser Roger Stone that Trump had repeatedly blasted as unfair, Barr said: “I knew it would be made to look bad. At the end of the day, all you can do is what you think is right.”

Barr’s intervention was an ominous precursor to the January 6 riot. In slashing Stone’s sentencing recommendation, Barr affirmatively said that threats by Roger Stone and the Proud Boys on judge Amy Berman Jackson were just a technicality unworthy of a sentencing enhancement. He similarly suggested that the threat of militia violence against Randy Credico that, in summer 2018, was serious enough that the FBI gave him a warning, did not merit a full 8-point enhancement for threats of violence.

Less than a year before two Stone-connected militias led an attack on Congress, the Attorney General let it be known he didn’t find those threats to be all that serious.

That’s likely one factor that led the FBI to treat the Proud Boys as intelligence partners against Antifa rather than a dangerous gang to be infiltrated.

And Barr continues that approach to militia-assisted witness tampering. Holt asked Barr whether Trump was responsible for the mob led by Stone’s militia buddies at the Capitol. Barr responded by describing, effectively, witness tampering.

Do you think that President Trump was responsible for what happened here, ultimately?

I do think he was responsible in the broad sense of that word in that, it appears that part of the plan was to send this group up to the Hill. I think the whole idea was to intimidate Congress. And I think that that was wrong.

“Part of the plan,” the former top law enforcement officer in the US said, “was to send this group up to the Hill … to intimidate Congress.”

In describing January 6 that way, Barr better understands how the insurrection worked than so many TV lawyers. He described it as an attempt to corruptly convince Congress to do something illegal and, in asserting that sending the mob was part of the plan, describes it as pre-mediated obstruction. This is, by all appearances, the crime for which that DOJ is investigating the former President.

But then, having described the same crime, witness tampering and obstruction, achieved in partnership with the same militias, the Oath Keepers and Proud Boys, as Barr minimized with Stone, Barr then suggests Trump hasn’t committed the crime of incitement.

But, he added, he hasn’t seen evidence that Trump committed an actual crime. “I haven’t seen anything to say he was legally responsible for it in terms of incitement,” Barr said.

And Holt let him.

Barr is going to keep saying that mob violence by the Proud Boys is no big thing until someone like Lester Holt calls him out for coddling crime.

John Durham Says Election-Hack Victims Should Wait Until After the Election to Report Tips

Even as Russia assaults a peaceful democracy (which invasion, in a separate filing, Durham calls, “recent world events in Ukraine”), John Durham suggests that a political campaign victimized by Russia should expect to wait until after the election before the FBI opens an investigation into a cybersecurity anomaly potentially implicating her opponent.

Durham even asserts that such a cybersecurity anomaly is not a cybersecurity matter, but instead a political one.

Almost six years after Trump’s request, “Russia are you listening,” was met with a renewed Russian attack on Hillary Clinton, John Durham continues to treat Hillary’s attempts to run a campaign while being attacked as a greater threat than that nation-state attack by Russia.

Durham’s latest contortions come in a response to Micheal Sussmann’s motion to dismiss the indictment.

Sussmann argued that the alleged lie he told (motions to dismiss must accept the alleged facts as true), could not have affected the single decision facing the FBI when he shared information about a DNS anomaly: whether to open an investigation or not.

Following the Supreme Court’s clear instruction in Gaudin, in order to assess the materiality of the false statement that Mr. Sussmann is alleged to have made, this Court must ask what statement he is alleged to have made to the FBI; what decision the FBI was trying to make; and whether the false statement could have influenced that decision. Here, even accepting all the allegations in the Indictment as true—and the evidence would prove otherwise—the only decision the FBI was trying to make was the decision whether or not to commence an investigation into the allegations of suspicious internet data involving the Trump Organization and Russian Bank-1. Ample precedent—and the Special Counsel’s own allegations in this case—make clear that Mr. Sussmann’s purported false statement did not influence, and was not capable of influencing, that decision.

Predictably and reasonably, Durham’s response cited the precedent that leaves it up to juries to determine whether something is material or not.

In any event, the defendant’s arguments on the materiality of his statement are also premature. The Supreme Court in Gaudin held that materiality is an essential element of Section 1001 that must be resolved by a jury.

As I noted back in October, “Prosecutors will argue that materiality is a matter for the jury to decide.”

Prosecutors also noted what I did: a long list of precedents about materiality that Sussmann cited in his motion are all post-trial challenges to materiality, not pretrial motions to dismiss.

The defendant cites to multiple cases where the Supreme Court and Circuit Courts have held that the false statements and misrepresentations at issue were immaterial as a matter of law. See Def. Mot. at 7-10. But critically, all of those cases involved post-conviction appeals or motions to vacate the conviction after the Government presented its case at trial. Accordingly, none of these cases support the defendant’s requested relief here – that is, that the court dismiss the Indictment before trial because it fails to sufficiently allege that the defendant’s false statement is material. What the cases do show is that courts have routinely declined to usurp the jury’s role in making the determination on whether a false statement is material.

For those two reasons, Sussmann’s motion to dismiss is unlikely to succeed, and should instead be viewed as an opening bid to frame his defense and establish issues for appeal.

Those two arguments are all Durham really needed to respond to Sussmann’s motion to dismiss. Instead of leaving it with responsible lawyering, however, Durham instead launches into an illogical attempt to criminalize tip reporting.

Take his attempt to dismiss Rodney Joffe’s real cybersecurity expertise. In the three months since he charged Sussmann, Durham belatedly (at Sussmann’s request) discovered how closely Joffe had worked with the FBI on other investigations. As Sussmann scoffed in an earlier filing, “The notion that the FBI would have been more skeptical of the information had it known of Tech Executive-1’s involvement is, in a word, preposterous.” Now that Durham has discovered the close ties between Joffe and the FBI, he claimed that that history of reliability was itself something the FBI needed to know.

Namely, as the defendant’s motion reveals (Def. Mot. at 18-19, fn. 8), Tech Executive-1 had a history of providing assistance to the FBI on cyber security matters, but decided in this instance to provide politically-charged allegations anonymously through the defendant and a law firm that was then-counsel to the Clinton Campaign. Given Tech Executive-1’s history of assistance to law enforcement, it would be material for the FBI to learn of the defendant’s lawyer-client relationship with Tech Executive-1 so that they could evaluate Tech Executive-1’s motivations. As an initial step, the FBI might have sought to interview Tech Executive-1. And that, in turn, might have revealed further information about Tech Executive-1’s coordination with individuals tied to the Clinton Campaign, his access to vast amounts of sensitive and/or proprietary internet data, and his tasking of cyber researchers working on a pending federal cybersecurity contract.

Durham’s claim that “learning” how much data Joffe had access to (which is something the FBI undoubtedly knew — it is surely the reason why FBI partnered with him, because the volume of data Neustar had made their observations more useful) would make them more skeptical of the DNS tip is nonsensical. In fact, elsewhere (in tracking all the YotaPhone requests in the US over a three year period), Durham treated it as presumptively reliable.

Plus, Durham made no mention here of one of a number of the other things he belatedly learned: that the September 2016 tip Sussmann shared with FBI General Counsel James Baker was not the only one Joffe had shared via Sussmann anonymously. He shared a tip anonymously during this same time period with DOJ IG. Durham has no way of knowing, either, whether those two were the only ones, but his revised theory of materiality depends on an anonymous tip like this one being unique.

Similarly, Durham struggled to explain (including by citing an inapt precedent) why the FBI would need to be told that Sussmann represented Hillary when, in notes of Baker’s retelling of the meeting, Bill Priestap wrote that Sussmann represented the DNC and Clinton Foundation.

As he did with Joffe, Durham tried to flip Sussmann’s expertise, arguing that the former prosecutor’s recognized qualification as a cybersecurity expert, something that would help him assess whether DNS data were anomalous or not, is precisely why the Perkins Coie lawyer needed to disclose he was working for Hillary.

In an effort to downplay the materiality of this false statement, the defendant asserts that the FBI General Counsel was aware that the defendant represented the DNC. See Def. Mot at 18. But the Government expects that evidence at trial will establish that the FBI General Counsel was aware that the defendant represented the DNC on cybersecurity matters arising from the Russian government’s hack of its emails, not that he provided political advice or was participating in the Clinton Campaign’s opposition research efforts. Indeed, the defendant held himself out to the public as an experienced national security and cybersecurity lawyer, not an election lawyer or political consultant. Accordingly, when the defendant disclaimed any client relationships at his meeting with the FBI General Counsel, this served to lull the General Counsel into the mistaken, yet highly material belief that the defendant lacked political motivations for his work.

There are many crazy assumptions built into this statement: that, had Sussmann identified Hillary as his client, it would have required him to reveal her motives as political rather than security-related to the FBI, breaching privilege; that reporting an anomaly potentially involving Trump after Trump had begged Russia to further hack Hillary would not be a sound decision from a cybersecurity standpoint; that researching the context of an anomaly, such as Alfa Bank’s ties to Putin, is not part of cybersecurity. Effectively, Durham has unilaterally decided that pursuing this anomaly was a political act, with no basis in law or fact.

Which is how Durham espoused the claim that the FBI, facing an unprecedented attack by Russia on American elections in 2016, might have delayed investigation of a part of it that might have implicated one of the contestants.

The defendant’s false statement to the FBI General Counsel was plainly material because it misled the General Counsel about, among other things, the critical fact that the defendant was disseminating highly explosive allegations about a then-Presidential candidate on behalf of two specific clients, one of which was the opposing Presidential campaign. The defendant’s efforts to mislead the FBI in this manner during the height of a Presidential election season plainly could have influenced the FBI’s decision-making in any number of ways. The defendant’s core argument to the contrary rests on the flawed premise that the FBI’s only relevant decision was binary in nature, i.e., whether or not to initiate an investigation. But defendant’s assertion in this regard conveniently ignores the factual and practical realities of how the FBI initiates and conducts investigations. For example, the Government expects that evidence at trial will prove that the FBI could have taken any number of steps prior to opening what it terms a “full investigation,” including, but not limited to, conducting an “assessment,” opening a “preliminary investigation,” delaying a decision until after the election, or declining to investigate the matter altogether.

[snip]

Moreover, the Department of Justice and the FBI maintain stringent guidelines on dealing with matters that bear on U.S. elections. Given the temporal proximity to the 2016 U.S. presidential election, the FBI also might have taken any number of different steps in initiating, delaying, or declining the initiation of this matter had it known at the time that the defendant was providing information on behalf of the Clinton Campaign and a technology executive at a private company.

[snip]

And the evidence will show that it would have been all the more material here because the defendant was providing this information on behalf of the Clinton Campaign less than two months prior to a hotly contested U.S. presidential election. [my emphasis]

The first paragraph here is really telling, given Durham’s public complaint that the Crossfire Hurricane team should have opened the investigation as a preliminary investigation, not a full investigation (the investigation into Mike Flynn, specifically, wasn’t opened as a full investigation, but none of the techniques used would have otherwise been unavailable, not least because there was already a full investigation opened on Carter Page). This is an argument Durham may reprise in his report: That it was unreasonable for Hillary Clinton to ask the FBI to inquire into Trump’s campaign after he publicly asked a foreign country for help (even ignoring the tip from Australia).

Durham seems to think Hillary should have had no assistance from law enforcement when her opponent publicly asked Russia to hack her some more if people close to her found more reason to be concerned. He even mocked Sussmann as too powerful to choose to use anonymity.

[W]hile the defendant’s motion seeks to equate the defendant with a “jilted ex-wife [who] would think twice about reporting her ex-husband’s extensive gun-smuggling operation,” this comparison is absurd. Def. Mot. at 24

Far from finding himself in the vulnerable position of an ordinary person whose speech is likely to be chilled, the defendant – a sophisticated and well-connected lawyer – chose to bring politically-charged allegations to the FBI’s chief legal officer at the height of an election season.”

This also betrays pure insanity. The anomaly involving Trump could always have reflected disloyal insiders compromising the candidate, as could the YotaPhones potentially in use in Trump headquarters. In fact, Page did compromise Trump when he went to Russia in December 2016 and tell Russians there that he was representing Trump on matters pertaining to Ukraine, just as Mike Flynn did by selling his access to Trump to Turkey, just as Tom Barrack is accused of doing with the Emirates. The reason why Sussmann was providing this information less than two months before an election is because cybersecurity researchers had gone looking because there was an ongoing multi-faceted cybersecurity attack, one that continued right through the election, one that could have victimized Trump as well as Hillary.

Which brings me to the one point Sussmann made that Durham completely ignored. In his response, Durham’s response uses the word “purported” to describe the DNS allegations from Sussmann five times:

  1. The defendant provided the FBI General Counsel with purported data and “white papers” that allegedly demonstrated a covert communications channel between the Trump Organization and a Russia-based bank
  2. the purported data and white papers
  3. the purported DNS traffic that Tech Executive-1 and others had assembled
  4. the defendant provided data which he claimed reflected purportedly suspicious DNS lookups by these entities of internet protocol (“IP”) addresses affiliated with a Russian mobile phone provider (“Russian Phone Provider-1”)
  5. examine the origins of the purported data

What Durham did not do is ever address this point from Sussmann:

Indeed, the defense is aware of no case in which an individual has provided a tip to the government and has been charged with making any false statement other than providing a false tip. But that is exactly what has happened here.

In the fall of 2016, Michael Sussmann, a prominent national security lawyer, voluntarily met with the Federal Bureau of Investigation (“FBI”) to pass along information that raised national security concerns. He met with the FBI, in other words, to provide a tip. There is no allegation in the Indictment that the tip he provided was false. And there is no allegation that he believed that the tip he provided was false. Rather, Mr. Sussmann has been charged with making a false statement about an entirely ancillary matter—about who his client may have been when he met with the FBI—which is a fact that even the Special Counsel’s own Indictment fails to allege had any effect on the FBI’s decision to open an investigation.

[snip]

Again, nowhere in the Indictment is there an allegation that the information Mr. Sussmann provided was false. Nowhere is there an allegation that Mr. Sussmann knew—or should have known—that the information was false. And nowhere is there an allegation that the FBI would not have opened an investigation absent Mr. Sussmann’s purported false statement.

I could fund an entire Special Counsel investigation if I had $5 for every time in this prosecution Durham has used the word “purported.” For almost six months, his entire prosecution has been premised on this anomaly not being “real,” meaning unexplained traffic that might represent something serious.

And yet he has not charged that (though he seems to have bullied April Lorenzen, perhaps because he needs her to be something other than she was). Instead, he just keeps doing the work for which actual evidence is normally required by repeating the word “purported” over and over.

This motion to dismiss will likely fail, because juries get to decide what is material. But contrary to Durham’s claims, unless and until he can prove that Sussmann, Jofffe, and Lorenzen didn’t believe this was a real anomaly worth investigating given all the other attacks that, Sussmann especially, knew were ongoing, then he really will be prosecuting someone for reporting a valid national security concern.

John Durham Drops Claim that Rodney Joffe “Mined” EOP Data for Derogatory Information on Trump from Boilerplate

On Friday, John Durham’s team did two things. Publicly, they responded to Michael Sussmann’s motion to dismiss his indictment. I’ll deal with both those later, but the short summary is that Sussmann argued his alleged lie could not have been material, whereas Durham (predictably) cited precedent saying that’s a matter for the jury to decide.

Under seal, Durham’s team responded on Friday to a sealed motion to intervene in the Sussmann case and expunge references filed by Rodney Joffe’s attorneys.

Presumably, Joffe objected to the unsubstantiated and uncharged claims that Durham had made in a conflicts motion that led the former President to suggest Sussmann and Joffe should be put to death.

We may not find out about the substance of this dispute for some time. But it may already be reflected in Durham’s filings.

In his response to Sussmann, Durham obstinately repeated most of the inflammatory claims first floated in the conflicts memo that elicited the calls for death and other lies from Durham’s sources and witnesses. But there are two passages that Durham took out.

Durham removed the two passages italicized below.

The Government’s evidence at trial will also establish that among the Internet data Tech Executive-1 and his associates exploited was domain name system (“DNS”) Internet traffic pertaining to (i) a particular healthcare provider, (ii) Trump Tower, (iii) Donald Trump’s Central Park West apartment building, and (iv) the Executive Office of the President of the United States (“EOP”). (Tech Executive-1’s employer, Internet Company-1, had come to access and maintain dedicated servers for the EOP as part of a sensitive arrangement whereby it provided DNS resolution services to the EOP. Tech Executive-1 and his associates exploited this arrangement by mining the EOP’s DNS traffic and other data for the purpose of gathering derogatory information about Donald Trump.)

The Indictment further details that on February 9, 2017, the defendant provided an updated set of allegations – including the Russian Bank-1 data and additional allegations relating to Trump – to a second agency of the U.S. government (“Agency-2”). The Government’s evidence at trial will establish that these additional allegations relied, in part, on the purported DNS traffic that Tech Executive-1 and others had assembled pertaining to Trump Tower, Donald Trump’s New York City apartment building, the EOP, and the aforementioned healthcare provider. In his meeting with Agency-2, the defendant provided data which he claimed reflected purportedly suspicious DNS lookups by these entities of internet protocol (“IP”) addresses affiliated with a Russian mobile phone provider (“Russian Phone Provider-1”). The defendant further claimed that these lookups demonstrated that Trump and/or his associates were using supposedly rare, Russian-made wireless phones in the vicinity of the White House and other locations. The Special Counsel’s Office has identified no support for these allegations. Indeed, more complete DNS data that the Special Counsel’s Office obtained from a company that assisted Tech Executive-1 in assembling these allegations reflects that such DNS lookups were far from rare in the United States. For example, the more complete data that Tech Executive-1 and his associates gathered – but did not provide to Agency-2 – reflected that between approximately 2014 and 2017, there were a total of more than 3 million lookups of Russian Phone-Provider-1 IP addresses that originated with U.S.-based IP addresses. Fewer than 1,000 of these lookups originated with IP addresses affiliated with Trump Tower. In addition, the more complete data assembled by Tech Executive-1 and his associates reflected that DNS lookups involving the EOP and Russian Phone Provider-1 began at least as early 2014 (i.e., during the Obama administration and years before Trump took office) – another fact which the allegations omitted. 

The second of these passages was an innumerate claim that falsely suggested Russian YotaPhones were common in the United States because between 2014 and 2017, there had been three million such look-ups. As William Ockham explained, these three million look-ups aren’t much more than his own family’s DNS requests during the same four (or even three) year period.

Contra Durham, 3 million DNS requests for a related IP addresses over a four-year period means these requests are very rare.

For comparison purposes, my best estimate is that my family (7 users, 14 devices) generated roughly 2.9 million DNS requests just from checking our email during the same time frame. That’s not even counting DNS requests for normal web browsing.

This seeming concession that Durham was wrong makes the other removal especially interesting, particularly given Joffe’s motion to intervene.

Durham also removed a passage claiming that Joffe “exploited” his access to data from the White House “for the purpose of gathering derogatory information about Donald Trump.”

Remember, the data in question all preceded January 20, 2017. Even assuming “exploit” and “mine” are the appropriate verbs here, to suggest accessing data from before Trump became President was an effort to obtain derogatory information on him makes no sense. And the inclusion of Spectrum Health in all of this — for which people made baseless claims about the DeVoses — is further proof that Joffe wasn’t looking for derogatory information. He was looking for anomalies, and those anomalies ended up implicating Trump-related servers. Plus, even if Joffe were accessing just Trump-related data, finding some unexplained Russian traffic would normally be seen as a risk to Trump, not a political attack on him.

Durham claims he didn’t say anything in the conflicts memo that needed to be struck. That issue (and the claimed conflict) will be reviewed at a hearing on Monday. But in the meantime, Durham already dropped two claims.

John Durham and Newly-Sanctioned Alfa Bank’s Filings: “Almost like they were written by the same people”

In a DC hearing on February 9 regarding Alfa Bank’s attempt to obtain documents from Michael Sussmann before his trial, DC Superior Judge Shana Frost Matini observed that the Alfa Bank allegations and the John Durham indictment seemed like they could be written by the same people.

[R]ight now, given the — if the closeness of Alpha’s allegations, I mean, quite frankly, it’s — reading Alpha’s submissions and what the — and that compared to the indictment, there’s — it’s almost like they were written by the same people in some way. [Alpha misspelling original]

Judge Matini, a Trump appointee, scolded Alfa — which over this past weekend was included in sanctions against Russian banks in retaliation for the invasion — for claiming that their lawsuit and Durham’s indictment of Sussmann were not closely related after having raised the indictment in the first place.

As to the claims that the criminal and civil proceedings are not closely related, this is a surprising representation for Alpha to make, given that Alpha was the one to bring the criminal charges to the Court’s attention by filing what was styled as a notice of supplemental authority in support of its Motion to Compel.

Of course, there is no Supplemental Authority here. A criminal indictment is not an opinion of the Court. It’s just a charge that the prosecuting authority is bringing against an individual with facts that are alleged to support the charge.

In dual lawsuits in FL and PA, Alfa Bank purports to be trying to figure out who allegedly faked DNS records to make it look like Alfa was in contact with Trump back in 2016 so it can sue those people. Rather than finding anyone to sue, however, it has instead spent its time subpoenaing experts to learn as much as it can about how the US tracks DNS records to prevent cyberattacks by — among other hostile countries — Russia.

Matini ruled that Alfa’s effort to get more information from Sussmann will have to wait until June, after his trial. (It’s unclear whether the sanctioned bank will still have legal means to pay Skadden lawyers to pursue this lawsuit at that point.)

But since then, the timelines of the Alfa Bank and Durham investigations have closely paralleled.

Of particular interest, on the morning of February 11, Rodney Joffe — referred to as Tech Executive-1 in the Durham filings — sat for an almost 5-hour deposition with Alfa Bank’s lawyers. He revealed that Durham had first approached him for an interview at least a year earlier. He revealed he had been asked to testify before the grand jury, but he “declined to interview,” presumably meaning he told Durham he’d invoke the Fifth (just as Don Jr and probably his daddy are understood to have done with Mueller).

Joffe’s refusal to voluntarily feed this witch hunt continued in his Alfa deposition. Citing the ongoing Durham investigation, he invoked the Fifth Amendment a slew of times (though not as many times as your average Trump man in a financial fraud deposition or even Alex Jones in an interview about an insurrection). Those questions to which he invoked his Fifth Amendment rights and those he answered mapped out an interesting territory, marking who he does know and those Alfa thought he did but that he does not.

For example, he said he had never heard of Alfa Bank before investigating the anomaly related to it. He said he had never met Jean Camp or several of the other researchers that frothers are certain he conspired with. Joffe twice said he had never met Christopher Steele and also said he “had no idea” that Sussmann met with Steele about the server allegations. He denied knowing what the contract between Georgia Tech and DARPA looked like.

Alfa made a number of mistakes — confusing a domain name with a business. Claiming he authored a paper that David Dagon had. Asking him about several emails he hadn’t been sent.

There were several claims Alfa made that Joffe’s lawyer, Steven Tyrrell, established a record were unproven assumptions on Alfa’s part, such as that Joffe got one of the white papers described in the indictment. Importantly, that includes a question about the EOP server.

Q: I was just going to ask Mr. Joffe whether or not he knows who the executive branch office of the U.S. government is?

A: I have to invoke my Fifth Amendment rights.

Mr. Tyrrell: And Margaret, if I may, just — I apologize. Just for the record, I want to be clear that — that in invoking his rights and my allowing my client to invoke his rights, that should not be interpreted as an admission that the — I mean, you’ll argue whatever it is, if you do, that the allegations, which are just allegations in the indictment, are accurate.

In addition to those curious objections, there were several things alleged in the indictment that Joffe outright denied. In several questions, Joffe challenged the meaning of an email Durham has used to suggest he anticipated, and wanted, a top cybersecurity job within a hypothetical Hillary Administration. After objecting to the form of the way the Alfa Bank’s Skadden lawyer tried to corner Joffe into answering the question, Tyrrell answered,

You know, again, our position on this is Mr. Joffe is happy to answer the question that was posed about whether he was ever offered the top cybersecurity job by the Democrats when it looked like they’d win. I think he’s answered that question.

He’s not going to answer questions about communications that he may or may not have had with other people about the topic. And as to those, he would invoke his rights under the Fifth Amendment.

Joffe answered no to three questions about whether the Clinton campaign paid him for his work on the server allegations, a false claim that Kash Patel spread.  Joffe also distinguished his concern about Donald Trump from a political desire to see him lose.

I’ve never been interested in politics. I’ve never been involved in politics. I haven’t voted for many, many years. I haven’t donated to any parties or any — or given any kind of benefit to any parties, but I certainly over the last few years have had an interest in the politics of the country that I live in.

That explanation premised two invocations of his Fifth Amendment in response to questions about Trump specifically.

In other words, Joffe’s Alfa Bank deposition on February 11 undermined several of the premises of the Durham investigation, while it identified several areas where his lawyer suggested Alfa’s assumptions were wrong (in the hearing on Laura Seago’s deposition, there was a central Alfa Bank assumption I know to be badly wrong).

Joffe’s deposition ended at 2:07PM ET on February 11.

Nine hours later, at 11:32PM, Durham submitted the belated conflicts motion — which would have been filed in September if Durham really had concerns about any conflict — and floated a number of claims about Joffe, claims that went beyond those in the indictment. Joffe is mentioned twenty times, including the following:

The defendant’s billing records reflect that the defendant repeatedly billed the Clinton Campaign for his work on the Russian Bank-1 allegations. In compiling and disseminating these allegations, the defendant and Tech Executive-1 also had met and communicated with another law partner at Law Firm-1 who was then serving as General Counsel to the Clinton Campaign (“Campaign Lawyer-1”).

The Indictment also alleges that, beginning in approximately July 2016, Tech Executive-1 had worked with the defendant, a U.S. investigative firm retained by Law Firm-1 on behalf of the Clinton Campaign, numerous cyber researchers, and employees at multiple Internet companies to assemble the purported data and white papers. In connection with these efforts, Tech Executive-1 exploited his access to non-public and/or proprietary Internet data. Tech Executive-1 also enlisted the assistance of researchers at a U.S.-based university who were receiving and analyzing large amounts of Internet data in connection with a pending federal government cybersecurity research contract. Tech Executive-1 tasked these researchers to mine Internet data to establish “an inference” and “narrative” tying then-candidate Trump to Russia. In doing so, Tech Executive-1 indicated that he was seeking to please certain “VIPs,” referring to individuals at Law Firm-1 and the Clinton Campaign.

The Government’s evidence at trial will also establish that among the Internet data Tech Executive-1 and his associates exploited was domain name system (“DNS”) Internet traffic pertaining to (i) a particular healthcare provider, (ii) Trump Tower, (iii) Donald Trump’s Central Park West apartment building, and (iv) the Executive Office of the President of the United States (“EOP”). (Tech Executive-1’s employer, Internet Company-1, had come to access and maintain dedicated servers for the EOP as part of a sensitive arrangement whereby it provided DNS resolution services to the EOP. Tech Executive-1 and his associates exploited this arrangement by mining the EOP’s DNS traffic and other data for the purpose of gathering derogatory information about Donald Trump.)

The Indictment further details that on February 9, 2017, the defendant provided an updated set of allegations – including the Russian Bank-1 data and additional allegations relating to Trump – to a second agency of the U.S. government (“Agency-2”). The Government’s evidence at trial will establish that these additional allegations relied, in part, on the purported DNS traffic that Tech Executive-1 and others had assembled pertaining to Trump Tower, Donald Trump’s New York City apartment building, the EOP, and the aforementioned healthcare provider. In his meeting with Agency-2, the defendant provided data which he claimed reflected purportedly suspicious DNS lookups by these entities of internet protocol (“IP”) addresses affiliated with a Russian mobile phone provider (“Russian Phone Provider-1”). The defendant further claimed that these lookups demonstrated that Trump and/or his associates were using supposedly rare, Russian-made wireless phones in the vicinity of the White House and other locations. The Special Counsel’s Office has identified no support for these allegations. Indeed, more complete DNS data that the Special Counsel’s Office obtained from a company that assisted Tech Executive-1 in assembling these allegations reflects that such DNS lookups were far from rare in the United States. For example, the more complete data that Tech Executive-1 and his associates gathered – but did not provide to Agency-2 – reflected that between approximately 2014 and 2017, there were a total of more than 3 million lookups of Russian Phone-Provider-1 IP addresses that originated with U.S.-based IP addresses. Fewer than 1,000 of these lookups originated with IP addresses affiliated with Trump Tower. In addition, the more complete data assembled by Tech Executive-1 and his associates reflected that DNS lookups involving the EOP and Russian Phone Provider-1 began at least as early 2014 (i.e., during the Obama administration and years before Trump took office) – another fact which the allegations omitted.

As I noted, less than a day after Durham filed that motion, the former President suggested that Joffe had been spying and should be killed. In response to the furor, Joffe’s spox later issued a statement clarifying what went on — precisely the information he had tried to plead the Fifth over.

In a statement, a spokesperson for Mr. Joffe said that “contrary to the allegations in this recent filing,” he was apolitical, did not work for any political party, and had lawful access under a contract to work with others to analyze DNS data — including from the White House — for the purpose of hunting for security breaches or threats.

After Russians hacked networks for the White House and Democrats in 2015 and 2016, it went on, the cybersecurity researchers were “deeply concerned” to find data suggesting Russian-made YotaPhones were in proximity to the Trump campaign and the White House, so “prepared a report of their findings, which was subsequently shared with the C.I.A.”

And some of the other researchers had to provide more details to push back on the frenzy (including that the data from EOP preceded Trump’s inauguration). Few outlets, though, have presented the basic innumeracy in Durham’s filing about the rarity of YotaPhones as anything but a contested issue.

And after Durham incited claims that Joffe should be killed, one week later Alfa Bank then affirmed the tie between Joffe and Tech Executive 1 by posting his deposition in their motion to get another four months to conduct their fishing expedition. That has had the effect of further inflaming the frothy right, and providing Durham sworn testimony from Joffe that he was otherwise not entitled to (including several warnings about how his case against Sussmann may be vulnerable).

In the wake of the release of the Florida filing, Joffe’s lawyers intervened in the Sussmann case and then filed a separate sealed motion to strike the (misleading) references to Joffe in the filing.

A Trump appointed judge in DC believes these efforts look like they’re being written by the same people. Whether Durham’s sources and a sanctioned Russian Bank’s sources are “colluding,” these parallel developments had the effect of depriving Joffe of his ability to fully invoke the Fifth Amendment. And with the help of a sanctioned Russian bank, it gave Durham a substantial benefit in a criminal investigation.

Timeline

January 25: Durham asks to extend discovery deadline

January 28: Durham admits that Durham was informed about the James Baker phone he claimed to forget knowing about

February 9: Michael Sussmann succeeds in staying Alfa Bank’s effort to get documents from him

February 10: Fusion GPS’ Laura Seago attempts to quash a subpoena

February 11, 9:30AM: Rodney Joffe deposition

February 11, 11:32PM: Durham files a motion purporting to be a conflicts motion that misrepresents the evidence

February 14: Sussmann asks to strike unsupported allegations in conflicts motion

February 14: Peter Fritsch deposition

February 17: Sussmann moves to dismiss the case, arguing his alleged lie would not be material

February 17: Durham claims that the close associates of the investigation that lied about what the conflicts motion said have nothing to do with the Durham team

February 18: Alfa Bank requests another extension to keep looking for John Does in FL

February 24: Rodney Joffe’s lawyers file notices of appearance in the Sussmann docket

February 25: Judge Christopher Cooper schedules a hearing on the conflicts motion for March 7

February 28: Joffe files a sealed motion to expunge the references to Tech Executive-1

March 1: Judge Cooper sets a Friday deadline for the government to respond to Joffe’s motion

March 7: Hearing scheduled to address conflicts memo

EDNY Notes that Tom Barrack Won’t Explain the Tactical Advantage of Waiting to Charge Him

I continue to follow Tom Barrack’s prosecution with interest, not least because it is the single example of a case that arose out of the Mueller investigation, was largely completed while Trump remained in office, yet was only charged after Merrick Garland took over.

As I noted last month, Barrack filed a motion to dismiss based, in significant part, on the two year delay between the time he interviewed with the FBI and when he was charged.

The government has submitted an omnibus response to Barrack’s filing as well as one from his alleged co-conspirator, Matthew Grimes (whose motion to dismiss focused more closely on the Foreign Agent statute under which they were charged).

The motion shoots down Barrack’s claims that the delays — and the treatment of his interview just like all other non-custodial FBI interviews — will make it harder for him to defend against the false statement charges, noting in part that he had a room full of lawyers with him making their own record of what he said.

Barrack claims that because of the purported delay, he is unable to obtain (1) “critical proof to establish what he was asked and how he answered” questions when he was interviewed in 2019; and (2) evidence of records from others of communications he may have had. Id. Neither has merit.

First, Barrack was represented by multiple attorneys who took notes during the 2019 interview, presumably with the intent of creating the “critical proof to establish what he was asked and how he answered” of which defendant claims he has been deprived. Barrack Mot. at 38. Barrack fails to articulate how these notes would have been more helpful to the defendant if the charges were brought earlier. And Barrack identifies no other proof that he could have gathered regarding his statements at his interview, had he been indicted earlier. As a result, Barrack not only fails to establish a substantial, actual, non-speculative prejudice, but fails to establish any prejudice at all. See Birney, 686 F.2d at 105-06.

More coyly, however, DOJ notes that Barrack has not tried to obtain any records from the Trump administration that might undermine the charges against him nor has he identified any witnesses who would have testified in his favor two years ago who cannot now.

Second, Barrack does not provide a single concrete example of attempts that he has made to obtain documents or offer examples about how these attempts have been thwarted by the passage of time. See Barrack Mot. at 38. He does not specify what documents he could have obtained, from whom he would have obtained them, or make any claims that this evidence would have been admissible. He merely speculates that the evidence could have helped his defense.

[snip]

Finally, Barrack makes a general claim about a loss of memories, without identifying a single witness who is now unavailable due to loss of memory. See Barrack Mot. at 39. “Faded memories or unavailable witnesses are inherent in any delay, even if justifiable.

[snip]

Even were Barrack to provide the names of witnesses with failing memories, this in and of itself would still be insufficient.

[snip]

He must also show that the witness would have testified, withstood cross-examination, and that the jury would have found the witness credible.” (citations omitted)); see also United States v. Valona, 834 F.2d 1334, 1339 (7th Cir. 1987) (noting that prejudice analysis must consider whether the missing witness “would have withstood cross-examination,” whether the jury would have found him a “credible witness,” and whether the testimony, when compared to other trial evidence “would affect the trial outcome” (internal quotation marks and citations omitted)).

Here, Barrack has not alleged that anyone would have been available to testify in the first instance, much less that he or she would have voluntarily agreed to testify at his trial in a way that would help, rather than hurt, Barrack.

There are, surely, witnesses who would have testified in favor of Barrack if they expected their own testimony would be immune from consequences or that they’d be receiving a pardon. Paul Manafort, for example, is a key witness to Barrack’s actions.

The government’s filing reveals more details about the circumstances of his interview in 2019 at which he allegedly lied. After he was alerted to the investigation, he asked for the interview and then — the government claims — he told a number of blatant lies about his own conduct.

After Barrack subsequently became aware that he was being investigated by the FBI for his actions at the behest of the UAE, Barrack, through counsel, contacted the government and affirmatively requested an interview. After the government consented to the request, the interview was scheduled for June 20, 2019, at the law firm offices of Barrack’s counsel in Washington, D.C. FBI special agents traveled from New York to Washington, D.C. to attend the interview. During the interview, Barrack was represented by multiple attorneys and was advised that the interview was entirely voluntary and that he was free to end the interview at any time. During the interview, an FBI special agent took detailed, contemporaneous notes, totaling more than 50 pages. Barrack’s counsel also took contemporaneous notes during the interview, but did not electronically record or transcribe the interview, nor did Barrack ever request that the interview be so recorded or transcribed, despite being the party that requested the interview and set its date, time, and location.

During the interview, Barrack repeatedly and materially lied about the events and activities that underlie Count One and Count Two of the Indictment, including, but not limited to, making misstatements about whether Al Malik proffered policies or requests to Barrack on behalf of the UAE, whether he was ever asked to download a messaging application or acquire a dedicated telephone to communicate with UAE officials, whether he facilitated communications between President-Elect Donald Trump and UAE officials after the 2016 Presidential Election, and whether he provided any guidance or input in arranging a former U.S. official’s meeting with a senior UAE official. Indictment ¶¶ 91-92, 98-107.

As I described, these alleged lies will make the core 18 USC 951 charges far more durable. Indeed, the government makes precisely that point: if Barrack was not intentionally hiding his ties to the Emirates, then why would he tell blatant lies about it?

Although not dispositive to Barrack’s vagueness challenge, if Barrack actually believed that he had done nothing wrong, it is unclear why he allegedly lied to FBI special agents during his voluntary June 20, 2019 interview as set forth in Counts Three through Seven of the Indictment.

But the circumstances of his charges raise questions about how he learned he was under investigation and whether he had any belief that if he lied to protect himself (and Trump) — as so many other Trump associates were prosecuted for doing — he could expect impunity.

image_print