“Yes and No:” John Durham Confuses Networking with Intelligence Collection

John Durham apparently believes li’l ol’ emptywheel is smarter than an entire team of seasoned FBI counterintelligence professionals. That’s the only conclusion I can draw from his effort to explain why a lie he accused — but did not charge — Igor Danchenko of telling was material to an ongoing investigation. Durham claims that in his first set of interviews, Danchenko was deliberately and knowingly hiding how indiscreet he had been about his intelligence work for Christopher Steele.

Such lies were material to the FBI’s ongoing investigation because, among other reasons, it was important for the FBI to understand how discreet or open DANCHENKO had been with his friends and associates about his status as an employee of U .K. Investigative Firm-1, since his practices in this regard could, in turn, affect the likelihood that other individuals — including hostile foreign intelligence services — would learn of and attempt to influence DANCHENKO’s reporting for U.K. Investigative Firm-1.

The alleged lie in question (which, as I’ll show, Durham misrepresents) is that Danchenko claimed to the FBI that he “never mentioned that he worked for [Christopher Steele or Orbis] to his friends or associates.”

In response, DANCHENKO falsely stated, in sum and substance, that while certain friends were aware that DANCHENKO worked generally in due diligence and business intelligence, DANCHENKO never mentioned that he worked for U.K. Person-I or U.K. Investigative Firm-1 to his friends or associates. DANCHENKO further stated, ”you [the FBI] are the first people” he had told. DANCHENKO added that the reason he never told associates about his relationship with U .K. Person-1 and U .K. Investigative Firm-1 was the existence of a non-disclosure agreement he signed with U.K. Person-1 and U .K. Investigative Firm-1.

As noted, Durham makes this claim based off Danchenko’s first series of FBI interviews in late January 2017.

It’s rather confusing that Durham claims Danchenko was hiding how indiscreet he was in those interviews, because after I read heavily redacted summaries of those very same interviews last year, I laid out a slew of ways that Danchenko and Steele were making themselves vulnerable to discovery:

PSS [Danchenko] described that his debriefings with Steele were always at the Orbis office, which meant if Steele himself were surveilled, PSS’ ties to Steele would become obvious.

[snip]

[H]is communications with Steele included many insecure methods. He first met Steele in a Starbucks. Early on, he communicated with him via email and Skype, and Steele would task him, at least in part, via email. He described discussing [Carter] Page’s trip to Russia with Source 3 on some kind of voice call, possibly a phone, while he was at a public swimming pool, though he also described talking in an opaque way about election interference. Likewise, the most problematic December 13 report was based on a conversation with the same source, which was also a phone call.

In short, while Steele and PSS and PSS’ sources made some efforts to protect their communications from the Russians that surely considered Steele a target, those efforts were inconsistent.

PSS described making three trips to Russia for his election year reporting. On the second trip, he got grilled suspiciously at the border. On his third, “nothing bad happened,” which made PSS suspicious about how perfectly everything had gone.

PSS repeatedly described being uncomfortable with the election year tasking, and he seems to have had suspicions in real time that Russia had taken note of it.

I also noted that two of Danchenko’s sources — to whom he admitted he worked in business intelligence — attempted to task him to collect information (indeed, Olga Galkina, described as S3 here, had done so just days before this interview, after the publication of the dossier by BuzzFeed, which she subsequently admitted to reading in detail when it came out). A third — someone Danchenko believed had close ties to an FSB officer — had gotten Danchenko to help him get a scholarship to study in the UK with help from Orbis.

And both Source 2 and Source 3 — the sources for some of the more problematic information in the Steele dossier — knew PSS brokered intelligence. Both also discussed brokering information in Russia.

[S3] is one of the individuals who knows that [PSS] works for due diligence and business intelligence. [As an aside at this point, [PSS] insisted that [S2] probably has a better idea about this than does [S3] because [S2] is always trying to monetize his relationship with [PSS]. [PSS] reiterated again to interviewers that [S2] will often pitch money-making ideas or projects — “Let’s work together. I [S2] can try and get [redacted] to answer a question, but I’ll need some money to do it.”] [S3] has an understanding that [PSS] is “connected.” In fact, either [redacted] morning or [redacted] morning, [S3] reached out to [PSS] and asked him for help in [redacted] on how [redacted] living in the United States are viewing the Trump administration. She is asking him [redacted] by the weekend, probably so she can sell it to a friend in Moscow.

And because PSS asked Orbis to help S1 — the guy with close ties to an FSB officer — get a scholarship for language study in the UK, S1 presumably knows what Orbis and who Steele is.

In other words, in the interview where (Durham claims) Danchenko lied to hide how indiscreet he was, he provided substantive reason to believe he hadn’t been at all discreet with three of his claimed dossier sources.

On top of that, the analyst who wrote up the report noted several times when Danchenko’s answers contradicted his early assertion that he himself had no known ties to Russian intelligence (there’s far more evidence that Danchenko knowingly lied about ties to Russian spooks than any of the charges laid out here, but that doesn’t serve Durham’s narrative and so instead he’s charging more random lies).

Thanks to Bruce Ohr’s help vetting Steele (for which he got fired), the FBI also learned that Steele was working for Oleg Deripaska, a central player in the election-year operation and one of the several obvious ways that Russia would have learned of this project.

If anyone at the FBI came away from these early interviews believing that Steele and Danchenko were exercising adequate operational security for this project (even ignoring Steele’s blabbing to the press), they had no business working in counterintelligence. Then again, Peter Strzok attempted to carry out an extramarital affair on an FBI device that (DOJ IG investigations would later disclose) happened to have a serious vulnerability built into it by a vendor. And in my own very limited experience, the FBI had uncomfortably shoddy operational security. So maybe there’s something to that.

Danchenko candidly told the FBI a number of things that should have given them ample reason to believe the project had been compromised. Importantly, that includes a warning that Galkina knew he was in business intelligence, the single most important detail as laid out in the Danchenko indictment. For Durham to suggest that Danchenko was withholding such details when, in that first interview, he carried out a debate with himself about which of two sources, including Galkina, knew more about his intelligence gathering is, frankly, batshit insane.

Worse still, Durham misrepresents what Danchenko was asked and how he answered.

As noted above (in bold) Durham claimed that Danchenko lied by saying that he, “never mentioned that he worked for Steele or Orbis to his friends or associates.” Durham, as is his sloppy habit, doesn’t quote either the question or Danchenko’s response. As a result, Durham hid the material fact that Danchenko was not asked whether he revealed that he worked for Orbis, but whether he told people he collected intelligence for them. And he didn’t answer, “no;” he answered, “yes and no.”

Here’s the question and the response that Durham didn’t bother to quote in the indictment.

[Danchenko] was asked how he “covers” his queries with his sources. He typically tells his sources that he is working on a research project or an analytical product. He was also asked if there were friends, associates, and/or sources who knew that he was collecting information for Orbis. He said, “yes and no,” and explained that some of his closer friends understand that he works in the area of due diligence and business intelligence. Many of the think that he is doing projects for entities like [redacted], the [redacted], or think tanks [redacted. They don’t know that he works for Orbis, as he signed a non-disclosure agreement and told not to talk about the company. He has never mentioned Chris Steele or Orbis to his friends and associates. He emphasized that “you [the FBI] are the first people he’s told.” [my emphasis]

Danchenko was not asked, generally, whether he talked about Orbis, which is what Durham claims he was asked. Danchenko was asked about how he covers his queries. He was specifically asked if his associates knew “that he was collecting information for Orbis.”

His answer was not “no,” but instead, “yes and no,” because people knew he was collecting intelligence. And (as noted above) he would refer back to the follow-on answer — that his friends understood that he works in business intelligence — by explaining that two of his claimed dossier sources, including Olga Galkina, not only knew that he collected intelligence, but had attempted to task him to collect it themselves. The context of whether he mentioned Steele or Orbis was explicitly a reference to him being paid (through a cut-out arrangement he had just described to the FBI) for intelligence collection by Orbis, not whether he ever networked using Steele’s name.

This is important because some of the “proof” that Durham provides that Danchenko was affirmatively lying that he had told people “he was collecting information for Orbis,” includes stuff that doesn’t mention intelligence collection. There’s nothing about two April 2016 communications with Charles Dolan, for example, that suggest Danchenko appeared to be more than an analyst, which is what he was on paper.

For example, on or about April 29, 2016, DANCHENKO sent an email to PR Executive-I indicating that DANCHENKO had passed a letter to U.K. Person-I on behalf of PR Executive-I. Specifically, the email stated that DANCHENKO had “forwarded your letter” to [U.K. Person-I] and his business partner. “I’ll make sure you gentlemen meet when they are in Washington or when you are in London.”

That same day, DANCHENKO sent an email to PR Executive-1 outlining certain work that DANCHENKO was conducting with U.K. Investigative Firm-1. The email attached a U.K Investigative Firm-1 report titled “Intelligence Briefing Note, ‘Kompromat’ and ‘Nadzor’ in the Russian Banking Sector.”

Indeed, a later reference to these exchanges describes it as “broker[ing] business,” not discussing collecting intelligence.

For example, and as alleged above, DANCHENKO attempted to broker business between PR Executive-1 and U .K. Person-1 as early as in or about April 2016. See Paragraphs 23-25, supra.

Nor does a later email Dolan sent definitively describe Danchenko as collecting intelligence.

Monday night I fly to Moscow and will meet with a Russian guy who is working with me on a couple of projects. He also works for a group of former [allied foreign intelligence service] guys in London who do intelligence for business …. [H]e owes me as his Visa is being held up and I am having a word with the Ambassador.

Durham makes much of the fact that, by the time the dossier was published, Dolan knew that Danchenko was behind it. But Durham provides no evidence about how Dolan learned that (even though Dolan was interviewed by the FBI somewhere along the way). It’s possible, for example, that Dolan put two and two together on his own and/or asked Galkina. And — as Danchenko freely offered up in his first interview! — Galkina knew he was in the intelligence business, so it’s likely she figured it out and told Dolan, not least because the two had shared business interests harmed by the dossier’s allegations, in the last report, about Webzilla.

To be clear, after having obtained warrants on (presumably) all three — Danchenko, Dolan, and Galkina — Durham did find one person with whom Danchenko was clearly discussing the topic he was asked about, collecting intelligence for Steele (as opposed to doing analysis, brokering business, or otherwise networking).

For example, on or about July 28, 2016, DANCHENKO sent a message to an acquaintance and stated “Thanks to my reporting in the past 36 hours, [U .K. Person-I] and [U.K. Investigative Firm-I Employee] are flying in tomorrow for a few days so I might be busy . . . . ” In addition, on or about September 18, 2016, DANCHENKO sent a message to the same acquaintance stating that DANCHENKO had “[w]ork to do for [U.K. Person-I] who’s probably coming to DC on Wednesday.” U.K. Person-I did, in fact, travel to Washington. D.C. on or about September 21, 2016.

That person is either not central to Durham’s narrative, or has reason to have known, because Durham doesn’t explain who it is. But if this person were not, for some reason, read into Danchenko’s cover story, or if the person is sufficiently memorable that Danchenko should have remembered these exchanges, then it does amount to proof that Danchenko answered incorrectly to that January 2017 question.

But all the things that Durham presents to suggest this answer was intentional — perhaps to insinuate that Danchenko didn’t hide the project because it made it more likely Galkina and Dolan would feed him bullshit — are, in fact, related to a different question, a question the FBI did not ask.

There’s one more thing that’s truly bizarre about Durham’s decision to include this allegation (again, it is not charged), particularly given that Danchenko freely offered up information making it clear Galkina knew a fair bit about Danchenko’s intelligence collection. According to the indictment, after that initial interview, the FBI interviewed Danchenko on — at a minimum — March 16, May 18, June 15, October 24, and November 16, 2017. Along the way, the FBI identified Galkina as a subject of particular interest and collected her communications under Section 702 which (among other things) identified precisely the relationships at the core of this indictment, presumably a response to the candid comments Danchenko made in that January 2017 (as well as the fact that she was his claimed source for the dodgiest claims).

But seemingly the FBI never revisited the question about how well Danchenko hid his intelligence collection and his relationship with Christopher Steele.

Perhaps that’s because Danchenko said enough in that first interview to make it clear that neither he nor Steele did adequately protect that relationship. The FBI didn’t return to that question — or the one Durham falsely claims he was asked — because he had already provided the answer with his other descriptions.

Danchenko posts

The Igor Danchenko Indictment: Structure

John Durham May Have Made Igor Danchenko “Aggrieved” Under FISA

“Yes and No:” John Durham Confuses Networking with Intelligence Collection

Daisy-Chain: The FBI Appears to Have Asked Danchenko Whether Dolan Was a Source for Steele, Not Danchenko

Source 6A: John Durham’s Twitter Charges

John Durham: Destroying the Purported Victims to Save Them

John Durham’s Cut-and-Paste Failures — and Other Indices of Unreliability

Aleksej Gubarev Drops Lawsuit after DOJ Confirms Steele Dossier Report Naming Gubarev’s Company Came from His Employee

In Story Purporting to “Reckon” with Steele’s Baseless Insinuations, CNN Spreads Durham’s Unsubstantiated Insinuations

On CIPA and Sequestration: Durham’s Discovery Deadends

The Disinformation that Got Told: Michael Cohen Was, in Fact, Hiding Secret Communications with the Kremlin

John Durham May Have Made Igor Danchenko “Aggrieved” Under FISA

Amidst a bunch of inaccurate quotations and insinuations, John Durham presented evidence in the Igor Danchenko indictment that Olga Galkina was (at least in part) seeking access when she claimed, in 2016, to be a fan of Hillary Clinton. And in the process, Durham may have created some significant discovery and FISA challenges for himself.

Olga Galkina, a friend of Igor Danchenko’s whom he said was the source for a key claim about Carter Page and all the discredited Michael Cohen claims, described herself this way in a declaration submitted in Alfa Bank’s lawsuit against Fusion GPS:

My name is Olga Aleksandrovna Galkina. I am a Russian citizen. I graduated with a law degree from Perm State University in 2002 and with a philology degree from Peoples’ Friendship University of Russia in 2004. In addition to Russian, I speak English and Bulgarian, and have basic knowledge of Georgian and Spanish.

My background is in journalism and public relations. I now work as a communications advisor. Previously, I held a number of positions in public relations and government, including head of the Governor’s Press Service in the Saratov Region (2005–2006); deputy head of the city administration in Saratov (2006–2007); and public relations advisor at Servers.com, a part of the XBT Holding group of companies that includes Webzilla (2015–2016).

[snip]

Igor Danchenko and I have been friends since our teen years in Perm, Russia. Through the years, Mr. Danchenko and I have communicated in person, over the phone, and through electronic messengers. I never gave my permission to Mr Danchenko to publish (or disclose to a third party) any part of our private discussions or private communications.

Mr. Danchenko and I met once in 2016. In connection with my job at Servers.com, I traveled to the United States in the spring of 2016 to participate in the Game Developers Conference event and investigate the prospects of running a public relations campaign for the company in the United States. I asked Mr. Danchenko to assist those efforts, and he introduced me to a third party, Charles Dolan, whom he thought could help. Mr. Danchenko and I did not discuss anything related to the Dossier or its contents during this meeting.

Note that this entire declaration is designed as a non-denial denial. The denial that she discussed the dossier in spring 2016, before the dossier project began, is in no way a denial that she discussed stuff — with Danchenko or Dolan — that ended up in the dossier, nor does she deny being the source of anything but the Alfa Bank allegations elsewhere in the declaration.

Durham describes Galkina this way.

At all times relevant to this Indictment, DANCHENKO maintained communications with a Russian national (“Russian Sub-Source-I”) based in a foreign country (“Country-1”) who, according to DANCHENKO, acted as one of DANCHENKO’s primary sources of information for allegations contained in the Company Reports. DANCHENKO and [Galkina] had initially met as children in Russia, and remained friends thereafter.

In or about early 2016, Russian Sub-Source-I began working at a business based in Country-1 (“Business-1”) that was owned by a Russian national and would later appear in the Company Reports. [Galkina] conducted public relations and communications work for Business-1

Business-1 would be XBT Holdings, which appeared in the last dossier report.

The Danchenko indictment barely mentions the long ties between him and Galkina, and doesn’t explain that she was the alleged source for the Cohen allegations (or even the claim that Danchenko named her as the source for a meeting Page had in Moscow, something utterly central to Durham’s project). Instead, it focuses on the fact that, after Danchenko himself met PR Executive Charles Dolan (through Fiona Hill) in February 2016, the next month, Danchenko introduced Dolan to Galkina for obvious business reasons, and then they all continued to communicate, both with Danchenko included and without him.

In or about March 2016, and prior to the June 2016 Planning Trip, DANCHENKO learned from Russian Sub-Source-I that Business-I was interested in retaining a U.S.-based public relations firm to assist with Business-1 ‘sentry into the U.S. market. DANCHENKO brokered a meeting between PR Executive-I and Russian Sub-Source-I to discuss a potential business relationship. Thereafter, PR Firm-I and Business-I entered a contractual relationship.

In or around the same time period, DANCHENKO, PR Executive-I, and Russian Sub-Source-I communicated about, among other things, the business relationship between Business-I and PR Firm-I. [my emphasis]

Thus far, this is garden variety networking, plopped into an indictment for reasons that do not directly relate to the crimes alleged.

The indictment then turns to laying out that, in conversations not including Danchenko, Dolan and Galkina spoke of their mutual enthusiasm for Hillary Clinton. Except the second paragraph Durham uses to substantiate “their [shared] support for Hillary Clinton” has nothing to do with Hillary Clinton, but in fact shows that Galkina was using Dolan’s ties to senior Russian officials for her own career advantage.

41. During the same time period, [Galkina] and [Dolan] communicated regularly via social media, telephone, and other means. In these communications and others, [Galkina] and [Dolan] discussed their political views and their support for Hillary Clinton.

[snip]

b. Additionally, on or about July 13, 2016, [Galkina] sent a message to a Russia-based associate and stated that [Dolan] had written a letter to Russian Press Secretary-I in support of [Galkina]’s candidacy for a position in the Russian Presidential Administration.

This is important, presumably, because it shows Dolan had better access to some figures in the dossier than Galkina did, but it has nothing to do with Hillary Clinton. It does, however, show that Galkina used her relationship with Dolan for access, even in Russia. And Durham is likely to argue that she used that access to obtain information that she then shared with Danchenko, which ended up in the dossier.

But it’s also important because, in the later communications quoted, Durham shows that Galkina was leveraging her relationship with Dolan — and bragging about it to an associate — in hopes of access under a Hillary presidency.

d. In or about August 2016, [Galkina] sent a message to a Russia-based associate describing [Dolan] as an “advisor” to Hillary Clinton. [Galkina] further commented regarding what might happen if Clinton were to win the election, stating in Russian, “[W]hen [[Dolan] and others] take me off to the State Department [to handle] issues of the former USSR, then we’ll see who is looking good and who is not.”

e. In or about September 2016, [Galkina] made a similar comment in a message to the same associate, stating in Russian that [Dolan] would “take me to the State Department if Hillary wins.”

f. On or about November 7, 2016 (the day before the 2016 U.S. Presidential election), Russian Sub-Source-I emailed [Dolan] in English and stated, in part: [] I am preparing you some information on former USSR/UIC countries, Igor [DANCHENKO] possibly told you about that. …. Tomorrow your country is having a great day, so, as a big Hillary fan, I wish her and all her supporters to have a Victory day. Hope, that someday her book will have one more autograph on it) Thank you for your help and support, Best regards, [First Name of Russian Sub-Source-I] [my emphasis]

All this Hillary support — shared with Dolan, but not (at least in this indictment) with Danchenko — does matter to Durham’s project. The allegations Danchenko attributed to Galkina were the most damning in the dossier, including the post-election (purportedly free) report that Michael Cohen had actually paid for Russian hackers. If she genuinely supported Hillary, it’s possible she knowingly fed Danchenko bullshit in hopes of helping Hillary’s chances.

But those Cohen allegations were also the earliest claims debunked in the dossier. By January 12, 2017 (so, importantly, weeks before Danchenko’s first FBI interview and before Galkina tasked Danchenko with a collection request in the wake of the dossier’s release), the FBI had obtained information marking the Cohen allegations as likely disinformation.

A January 12, 2017, report relayed information from [redacted] outlining an inaccuracy in a limited subset of Steele’s reporting about the activities of Michael Cohen. The [redacted] stated that it did not have high confidence in this subset of Steele’s reporting and assessed that the referenced subset was part of a Russian disinformation campaign to denigrate U.S. foreign relations. A second report from the same [redacted] five days later stated that a person named in the limited subset of Steele’s reporting had denied representations in the reporting and the [redacted] assessed that the person’s denials were truthful.

This report should have led the FBI to treat any allegation sourced to Galkina, including the damning Carter Page one, with caution. All the more so after Danchenko told them (as he did in his January interviews) that Galkina recognized Cohen’s name almost immediately when he asked her for information about Trump’s associates.

[Danchenko] began his explanation of the Prague and Michael Cohen-related reports by stating that Christopher Steele had given him 4-5 names to research for the election-related tasking. He could only remember three of the names: Carter Page, Paul Manafort and Michael Cohen. When he talked to [Galkina] in the fall of 2016 — he believes it was a phone call — he rattled off these names and, out of them, he was surprised to hear that [she] immediately [later [Danchenko] softened this to “almost immediately”] recognized Cohen’s name.

But her emails boasting that Dolan would get her access to State in a Hillary Administration are naked influence-peddling, whether for banal careerist reasons or for more malign purposes of access. They are what you’d expect from anyone with growing ties to a well-connected person, regardless of political leanings.

And we already knew — and the FBI knew — that Galkina had sent communications indicating strong support for Hillary (whether good faith or feigned for access purposes). That was revealed in a footnote to the DOJ IG Report declassified in response to Chuck Grassley and Ron Johnson demands in April 2020. That footnote strongly suggests that FBI learned it from obtaining Galkina’s communications under FISA Section 702 (the footnote only makes sense if they had 702 collection on Galkina and only Galkina), and they learned it by “early June 2017.”

FBI documents reflect that another of Steele’s sub-sources who reviewed the election reporting told the FBI in August 2017 that whatever information in the Steele reports that was attributable to him/her had been “exaggerated” and that he/she did not recognize anything as originating specifically from him/her. 347

347 The FBI [received information in early June 2017 which revealed that, among other things, there were [redacted]] personal and business ties between the sub-source and Steele’s Primary Sub-source; contacts between the sub-source and an individual in the Russian Presidential Administration in June/July 2016; [redacted] and the sub‐source voicing strong support for candidate Clinton in the 2016 U.S. elections. The Supervisory Intel Analyst told us that the FBI did not have Section 702 coverage on any other Steele sub‐source. [my emphasis]

Galkina is the one Danchenko sub-source that the FBI interviewed directly. The business ties between her and Danchenko reflect loans back and forth. The contacts reflected here with someone in the Presidential Administration in June/July may reflect Dolan’s recommendation of Galkina for a job. The second redaction here may even include a reference to Dolan.

There are a whole slew of implications from this detail, if it indeed reflects that FBI obtained Galkina’s communications using Section 702, which by description included the communications with Dolan about Hillary and would have included any US-cloud based communications she had Danchenko as well.

The first implication is that, in relying on communications involving Danchenko, Galkina, and Dolan (bold and underlined above), Durham may have made Danchenko an “aggrieved person” under FISA.

The term “aggrieved” under FISA is a technical legal one, and one that the US government makes great efforts to obscure. But anyone whose communications “were subject to electronic surveillance,” is aggrieved.

“Aggrieved person” means a person who is the target of an electronic surveillance or any other person whose communications or activities were subject to electronic surveillance.

And FISA mandates that the government provide FISA notice to someone if they intend to use evidence obtained or derived from electronic surveillance “in any trial, hearing, or other proceeding in or before any court.”

Whenever the Government intends to enter into evidence or otherwise use or disclose in any trial, hearing, or other proceeding in or before any court, department, officer, agency, regulatory body, or other authority of the United States, against an aggrieved person, any information obtained or derived from an electronic surveillance of that aggrieved person pursuant to the authority of this subchapter, the Government shall, prior to the trial, hearing, or other proceeding or at a reasonable time prior to an effort to so disclose or so use that information or submit it in evidence, notify the aggrieved person and the court or other authority in which the information is to be disclosed or used that the Government intends to so disclose or so use such information.

While the government treats information obtained from the cloud as a physical search, after the Snowden releases, DOJ started notifying some defendants of 702 surveillance and in 2018 (before Durham was appointed), Congress mandated that information obtained under FISA 702 be treated as electronic surveillance for FISA’s notice provision.

Information acquired from an acquisition conducted under section 1881b of this title shall be deemed to be information acquired from an electronic surveillance pursuant to subchapter I for purposes of section 1806 of this title.

In 2018, Congress has also imposed restrictions on the searches of 702 data for criminal prosecution, restrictions that the FBI famously blew off under Bill Barr.

Also in 2018, Congress demanded that the government keep better records of how US person names get unmasked in FISA surveillance.

To be very clear: this doesn’t help Danchenko all that much. The government’s precedents seem to say that notice provisions only trigger in an actual trial, so including reference to communications that would have first been obtained under 702 in an indictment probably wouldn’t normally trigger the notice requirement. If Durham restricted himself to using only those communications involving Galkina and Dolan but not Danchenko at trial, it would not render Danchenko “aggrieved,” because a person is only aggrieved if his own communications are used, not if communications of two associates he introduced are used to prosecute him.

Moreover, as anyone not named Carter Page would discover, FISA’s due process protections are basically useless. If DOJ determined that Danchenko was, indeed, aggrieved, he’d get notice and a judge would review how Galkina got targeted and almost immediately determine that Galkina was lawfully targeted under 702 (she was) and FBI was not primarily trying to get Danchenko’s communications with her (they weren’t), and that would be that.

Plus, DOJ has developed a number of ways to launder 702 information, such as getting the same information first obtained with a 702 directive with a warrant, and then claiming, implausibly, that the criminal process was not “derived from” the FISA process. Durham might even try to claim he didn’t discover this information via FISA, he obtained it via completely independent parallel means. In any case, DOJ has well-developed ways of parallel constructing information collected via sensitive means to hide its sourcing.

Still, Danchenko might have cause to question whether Durham complied with search requirements and whether the FBI properly documented any searches of Galkina’s communications used in a non-national security investigation, but even there, the original investigation implicating Galkina was undeniably a national security one, investigating whether Carter Page was a foreign agent, and so that original search would not require documentation (and preceded the rigorous application of that requirement in any case).

The point of all this is not that this helps Danchenko, at all, from a due process standpoint. But in the same way that Carter Page used his status as the first person to learn he was targeted under FISA without being prosecuted to cause a great deal of trouble, Danchenko might be able to use his status as someone whose prosecution appears to tie directly to 702 searches years ago to cause a great deal of trouble. Because DOJ has already declassified material that ties these communications to 702 collection, Danchenko may be able to demand transparency about FISA procedures that no one before him has ever been able to, and that may complicate prosecution of him.

And, at the very least, Danchenko will be able to demand discovery on the circumstances of this collection when otherwise, DOJ would be able to hide it under FISA disclosure protections. Normally, if DOJ did not rely on these communications, they would not have to inform Danchenko about them at all. But given that DOJ has already acknowledged them and seemingly identified them as Section 702 collection, DOJ will be forced to acknowledge that by early June 2017, they had these communications.

The fact that DOJ obtained information showing the ties between Dolan and Galkina in “early June” may go a long way (along with demonstrating Durham’s inaccurate citation) to disproving the alleged lie charged in Count One of this indictment. It certainly undermines Durham’s claims that the lie was material. It further will make it easy to suggest that this prosecution arises out of political animus (though that is always of limited use at trial).

In substantiating the case that Carter Page was wrongly aggrieved under FISA thanks to rumors passed along by Igor Danchenko, Durham appears to have similarly made Danchenko aggrieved himself. And that may help him defend himself in ways that would not otherwise be available.

Related documents

Danchenko posts

The Igor Danchenko Indictment: Structure

John Durham May Have Made Igor Danchenko “Aggrieved” Under FISA

“Yes and No:” John Durham Confuses Networking with Intelligence Collection

Daisy-Chain: The FBI Appears to Have Asked Danchenko Whether Dolan Was a Source for Steele, Not Danchenko

Source 6A: John Durham’s Twitter Charges

John Durham: Destroying the Purported Victims to Save Them

John Durham’s Cut-and-Paste Failures — and Other Indices of Unreliability

Aleksej Gubarev Drops Lawsuit after DOJ Confirms Steele Dossier Report Naming Gubarev’s Company Came from His Employee

In Story Purporting to “Reckon” with Steele’s Baseless Insinuations, CNN Spreads Durham’s Unsubstantiated Insinuations

On CIPA and Sequestration: Durham’s Discovery Deadends

The Disinformation that Got Told: Michael Cohen Was, in Fact, Hiding Secret Communications with the Kremlin

The Igor Danchenko Indictment: Structure

I’m going to do a series of posts on John Durham’s indictment of Igor Danchenko. Because the indictment is an organizational shit-show and because the order Durham adopts obscures real problems with the indictment, I’m going to do the posts out of order. But I want to start by laying out the organization he uses, which will serve as a means to link the series I will do and explain the import. (I’ll do running updates on this post.)

Here’s the organization; I’ve bolded the parts of the indictment that pertain to actually charged crimes, I’ve italicized those that don’t relate to the charges, and underlined one that includes other dodgy claims:

I. Introduction and Overview

A. Igor Danchenko

B. Orbis and Its Role in the 2016 Presidential Election Campaign

C. Charles Dolan

D. Danchenko’s Relationship with Dolan

E. Olga Galkina

F. Danchenko Introduces Galkina to Dolan

G. Sergei Millian

H. Danchenko’s US Election Reporting

II. Danchenko’s False Statements Involving Dolan

A. Dolan Provides Information Regarding Paul Manafort

B. Danchenko’s Statements to the FBI Regarding Dolan

III. The Materiality of Danchenko’s [Alleged] Lies Regarding Dolan

A. Danchenko’s Allegations Regarding Salacious Sexual Activity

    1. Dolan and Organizer-1 Receive a Tour of the Ritz Presidential Suite
    2. Danchenko’s Statements to the FBI Regarding the Ritz

B. Danchenko’s Allegations Regarding Russian Diplomat-1

    1. Danchenko’s Statements to the FBI Regarding Russian Diplomat-1

C. Danchenko’s Allegation Regarding Russian Chief of Staff-1

    1. Danchenko’s Statements to the FBI Regarding Chief of Staff-1

IV. Danchenko’s False Statement Regarding Disclosure of His Relationship with Steele and Orbis

V. Danchenko’s False Statements Regarding Allegations Sourced to Sergei Millian

A. Danchenko’s Alleged Phone Call with Millian

B. Danchenko’s False Statement Regarding His Alleged Phone Call with Millian

VI. The Materiality of Danchenko’s [Alleged] Lies Regarding Millian

Charges

  • On or about June 15, 2017, Danchenko denied to agents of the FBI that he had spoken with Dolan about any material contained in the Company Reports, when in truth and in fact, Dolan was the source for an allegation contained in a Company Report dated August 22, 2016 and was otherwise involved in the events and information described in the reports. [my emphasis]
  • On or about March 16, 2017, Danchenko stated to agents of the FBI that he received a late July 2016 telephone call from an individual who DANCHENKO believed was “probably” Chamber President-1, when in truth and in fact, and as the defendant well knew. Chamber President-1 never called DANCHENKO.
  • On or about May 18, 2017, Danchenko stated to agents of the FBI that he “was under the impression” that a late July 2016 telephone call that he received was from Chamber President-1, when in truth and in fact, and as the defendant well knew. Chamber President-1 never called DANCHENKO.
  • On or about October 24, 2017, Danchenko stated to agents of the FBI that he believed that he spoke to Chamber President-1 on the telephone on more than one occasion, when in truth and in fact, and as the defendant well knew, DANCHENKO never spoke to Chamber President-1.
  • On or about November 16, 2017, Danchenko stated to agents of the FBI that he believed that he had spoken to Chamber President-1 on the telephone, when in truth and in fact, DANCHENKO never spoke to Chamber President-I.

The reason I’m starting by laying out this structure is to show that two entire sections of this indictment (both italicized), Section III (Materiality of Danchenko’s alleged lies regarding Dolan) and Section IV (Danchenko’s False Statement regarding disclosure of his relationship with Steele and Orbis), are not charged at all. When Durham did something analogous in the Michael Sussmann indictment, Sussmann accused him of improperly including 404b information in the indictment.

In this case, however, it’s even worse. Section III insinuates that Dolan is the source for dossier allegations that Durham doesn’t even try to prove. He introduces them by making a provably bullshit materiality claim. Worse still, the evidence Durham presents totally undermines those allegations. Nevertheless, having included those insinuations, propagandists like Kim Strassel and purportedly serious reporters like Jonathan Swan have treated those allegations as if they’ve actually been charged. So this section was a very successful way that Durham used credulous hacks to repeat claims he’s not even trying to prove are true.

Section IV, as I will argue, is an outright misrepresentation, a claim that Danchenko lied about a topic when in fact Durham misrepresented the public record (which may be why it’s not charged). On paper, this section mostly attempts to corroborate Charge 1, that Danchenko lied about what Dolan said. But it’s more cynical both for the materiality claim Durham invents (that FBI couldn’t have known that Russia was feeding disinformation to Danchenko and Steele) and because Durham treats Hillary Clinton, not Russia, as the hostile adversary to the US.

Finally, in the underlined section on Olga Galkina, Durham attempts to insinuate that Galkina and Dolan had some conspiracy going. This section is another uncharged allegation. It’s made all the worse because all the available evidence (including that Galkina is credibly alleged to be the source for the most discredited claims in the dossier, that Michael Cohen was in Prague) suggests something more nefarious was going on. In this section, then, Durham runs interference for Russian intelligence.

The point of this structure is that Durham has used both the two italicized sections and the underlined one to make wild (and in some cases, provably false) insinuations without even intending to prove them.

Danchenko posts

The Igor Danchenko Indictment: Structure

John Durham May Have Made Igor Danchenko “Aggrieved” Under FISA

“Yes and No:” John Durham Confuses Networking with Intelligence Collection

Daisy-Chain: The FBI Appears to Have Asked Danchenko Whether Dolan Was a Source for Steele, Not Danchenko

Source 6A: John Durham’s Twitter Charges

John Durham: Destroying the Purported Victims to Save Them

John Durham’s Cut-and-Paste Failures — and Other Indices of Unreliability

Aleksej Gubarev Drops Lawsuit after DOJ Confirms Steele Dossier Report Naming Gubarev’s Company Came from His Employee

In Story Purporting to “Reckon” with Steele’s Baseless Insinuations, CNN Spreads Durham’s Unsubstantiated Insinuations

On CIPA and Sequestration: Durham’s Discovery Deadends

The Disinformation that Got Told: Michael Cohen Was, in Fact, Hiding Secret Communications with the Kremlin

John Durham Admits He Overstated Evidence in His Michael Sussmann Materiality Statement

In my post laying out Michael Sussmann’s motion for a Bill of Particulars, I expressed the following:

  • His claim that he needed the exact quote of the lie he purported told Jim Baker was well-founded
  • Durham would respond to Sussmann’s demand for more specificity about materiality by saying that was up to the jury
  • Sussmann surely knew the names of the other people at a CIA meeting where, Durham alleges, just two people present now claim that Sussmann lied about having a client
  • Sussmann surely knew there were no people on the Clinton Campaign with whom he had — as Durham had insinuated in a materiality statement — [personally] coordinated; he knew any such communications happened through Marc Elias

As I tweeted out here, Durham’s response to Sussmann affirms all of those predictions.

  • Durham responded to the request for the exact quote of the lie Sussmann purportedly told by block-quoting the indictment (which doesn’t quote his lie), but not providing the actual lie he told or the context in which he allegedly told it; in the process, Durham seemed to commit that he was not charging Sussmann with a lie of omission but only alleging Sussmann omitted material information with an alleged affirmative lie
  • Durham quoted the traditional definition of materiality (not the one DOJ espoused with Mike Flynn), and said it was up to the jury to decide
  • Durham admitted that he introduced the CIA lie as 404b information, not an actual charge (and seemed to concede he has no proof that Sussmann told exactly the same lie to the CIA as he allegedly did to the FBI)

But it’s Durham’s response to the request for the names of the Clinton Campaign people with whom Sussmann allegedly coordinated that I find most telling. Sussmann had asked for the identity of the Clinton Campaign people that Durham mentioned in a passage (bolded below) from paragraph 6 of the indictment that Durham used as one of three prongs in his materiality statement.

Finally, Mr. Sussmann seeks the identities of certain representatives and agents of the Clinton Campaign mentioned in the Indictment that the Special Counsel has refused to provide to date.7 The Indictment alleges that Mr. Sussmann, Tech Executive-1, and Law Firm-1 “coordinated, and were continuing to coordinate, with representatives and agents of the Clinton Campaign with regard to the data and written materials that Sussmann gave to the FBI and the media.” Indictment ¶ 6. The Indictment does not identify by name the alleged “representatives and agents of the Clinton Campaign.” Id.

The animating theory of the Special Counsel’s Indictment is that Mr. Sussmann was secretly working on behalf of the Clinton Campaign, and he intentionally and falsely stated that he was not acting on behalf of any client in order to conceal his ties to the campaign. The Special Counsel should not be permitted, on the one hand, to allege that Mr. Sussmann was working on behalf of the Clinton Campaign, but on the other hand, decline to identify the specific individuals with whom he was purportedly working. Among other things, Mr. Sussmann may wish to call such individuals as witnesses in his defense at trial, but, unless he knows of their identities, he will have no ability to do so. At base, an indictment must provide a defendant with the “essential facts constituting the offense charged.” Fed R. Crim. P. 7(c)(1). And no facts could be more essential than the names of the witnesses involved.

Having made these allegations, the Special Counsel must illuminate them—by identifying the relevant individuals referenced—to allow Mr. Sussmann to decide how to respond appropriately. See Butler, 822 F.2d at 1193 (the indictment must enable the defendant to understand the charges against him and prepare a defense); cf. Hubbard, 474 F. Supp. at 80 (ordering bill of particulars to define “unnecessarily vague” phrases used in the indictment). Therefore, Mr. Sussmann respectfully asks this Court to order the Special Counsel to provide a bill of particulars identifying, by name, the “representatives and agents of the Clinton Campaign” with respect to Paragraph 6.

7 The Special Counsel has identified virtually all of the other anonymous individuals and entities referred to in the Indictment (except, as noted above, the Agency-2 employees).

In my post, I suggested that Sussmann isn’t so much trying to get these names, but because he knows this claim is false, he’s trying to get Durham to admit that there are no names — because (Sussmann knows) he didn’t coordinate directly with the Clinton Campaign.

Sussmann likely doesn’t really need these names because he likely knows that Durham has nothing to substantiate this claim. If he did, Durham would have described such evidence in his speaking indictment.

And Durham’s response cedes the point: In response to a question about the “agents and representatives of the Clinton Campaign” with whom Sussmann directly coordinated referenced in paragraph 6, Durham explains that that reference is just a “summary” of “facts” later alleged in paragraphs 25(e), 20(d), and 20(g).

Paragraph 6 is a portion of the “Introduction and Overview” section of the Indictment that summarizes facts later alleged with specificity. And the later parts of the Indictment provide details underlying the more generalized allegation in Paragraph 6. For example, Paragraph 25(e) of the Indictment states that [Elias] had exchanged emails about the [Alfa Bank] allegations with the Clinton Campaign’s campaign manager, communications director, and foreign policy advisor which the defendant had provided to a newspaper. Ind. ¶ 25(e). Indeed, the government also provided the true identities of each of those referenced individuals to defense counsel in a discovery letter dated October 20, 2021. Likewise, Paragraphs 20(d) and 20(g) allege that the defendant, one of his law partners, and [Rodney Joffe] each communicated via email with an investigative firm that was at the time acting as an agent of the Clinton Campaign. The government similarly has provided the identity of that investigative firm to the defense in its October 20 discovery letter, even though counsel was undoubtedly already aware of that firm’s identity. Moreover, it was a production of information by the defendant’s counsel (i.e., a privilege log) that first alerted the government to these cited emails. Accordingly, the defendant is neither entitled to, nor needs any greater detail, regarding the identities of the individuals identified in Paragraph 25(e) at this stage, and any further information in that regard will be disclosed in due course in discovery prior to trial. At bottom, the defendant’s demand here is not an appropriate use of a motion for a bill of particulars and should be denied.

In response to the request for the identities of the Clinton Campaign people he was coordinating with, Durham pointed to the following allegations:

d. In or around the same time period [mid-August 2016], SUSSMANN, [Marc Elias], and personnel from [Fusion GPS] began exchanging emails with the subject line, “Connecting you all by email.”

[snip]

g. Later in or about August 2016, [Rodney Joffe] exchanged emails with personnel from [Fusion GPS].

[snip]

e. On or about September 15, 2016, [Elias] exchanged emails with the Clinton Campaign’s campaign manager, communications director, and foreign policy advisor concerning the [Alfa Bank] allegations that SUSSMANN had recently shared with [Franklin Foer]. [Elias] billed his time for this correspondence to the Clinton Campaign with the billing entry, “email correspondence with [Jake Sullivan], [name of campaign manager], [name of communications director] re: [Alfa Bank] Article.” [emphasis added by Durham]

That is, in response to a question, tell me what agents of the Clinton Campaign Sussmann and Joffe and Perkins Coie coordinated with, which is something (Durham claims) Sussmann lied to hide, Durham responded by pointing to 1) an email where Elias connected Fusion GPS and Sussmann via email (well after the identification of the Alfa Bank anomaly), 2) emails that Joffe exchanged with Fusion GPS, and 3) an email that Elias sent Jake Sullivan and others about the Franklin Foer article.

Effectively, Durham’s response admits that he has presented no evidence either Sussmann or Joffe ever spoke directly to members of the Clinton Campaign about the Alfa Bank allegations. He sustains the claim only by raising Elias, whom he doesn’t mention in that materiality statement.

He also admits that he is treating Fusion GPS as an agent of the Clinton Campaign, which it arguably is, but only through Perkins Coie. The indictment presents no evidence that the Campaign was directly managing Fusion, or even aware of it. There’s no place in this indictment where the Clinton Campaign provided directions into this effort that would amount to an instruction to feed information to the FBI, something that goes to the heart of whether or not Sussmann was representing Hillary at the meeting with Baker. (Right wing conspiracists have, in recent days, pointed back to Sussmann’s June 2016 efforts to get the FBI to attribute the DNC hack to Russia, conflating an interest in attribution to Russia and a later effort to investigate Trump’s ties to Russia.)

Durham might not even have the content of his emails with Fusion GPS or Elias’ emails with Sullivan and others. He only knows of these communications, Durham explains, because Sussmann invoked privilege over them in a privilege log shared with Durham.

In the indictment, Durham makes much of something April Lorenzen (the security expert who used the name Tea Leaves during this project but whom Durham has needlessly referred to as Originator-1) said on August 20, 2016 that reflects an obvious technical point: “even if we found what [Joffe] asks us to find in DNS, we don’t see the money flow, and we don’t see the content of some message saying, ‘send money here’.” That is, the DNS traffic they were following was proof of some kind of messaging. But it was not proof of what was being said. Durham may have the same problem: he may not have proof regarding what direction these communications flowed and what was really said.

I would not be remotely surprised if Durham used the fact that he obtained a false statements indictment as a basis to obtain a probable cause warrant to obtain these communications via other means (perhaps via whatever company hosts Perkins Coie’s email) such that an FBI filter team could do their own privilege determination of them. Durham is working on a theory that this is all two parallel conspiracies to defraud the government, and would need to use a crime-fraud exception to get to content that, he believes as a matter of faith, would prove the case. A big part of this investigation is an exercise in exposing Hillary to the same invasive investigative scrutiny as Trump (as if the Clinton email and Clinton Foundation investigations didn’t already do that), and Trump’s attorneys keep having their communications seized. So I’m sure Durham would relish seizing the communications of Elias and Sussmann.

That said, for the existing indictment charging only Sussmann with a single false statement, Durham claims that Sussmann lied to James Baker by disclaiming that both his work to chase down this Alfa Bank anomaly and his scheduling of a meeting at which he gave Baker a heads up that a media outlet was going to publish the story in order to hide that he was “coordinating” with the Clinton Campaign. But Durham presents no evidence Sussmann ever spoke to anyone at the Clinton Campaign on this topic … and the only evidence he presents that anyone spoke to Hillary’s people comes well after the white papers provided to the FBI were substantially complete.

This doesn’t really fly in an indictment charging just Sussmann. It effectively treats this as a conspiracy, without (yet) charging a conspiracy. With his response to Sussmann’s motion for a Bill of Particulars, Durham has effectively accused and treated all the named people of engaging in a conspiracy without showing any evidence that they were doing anything other than trying to understand an anomaly involving Trump’s company and a Russian bank.

Andrew McCabe Got His Pension and His Cufflinks — But Is that Adequate Recourse for the Country?

As part of a settlement DOJ entered into yesterday to avoid giving Andrew McCabe discovery on the full extent of the politicized campaign against him, DOJ agreed to give him his retirement — and the cufflinks he would normally have gotten upon retiring from Senior Executive Service.

The more substantive parts of the agreement reflect a total capitulation by DOJ: restoration of McCabe’s pension backdated to the time he was fired and partial award of his legal fees for representation from Arnold & Porter.

Defendants will complete all actions necessary to ensure that Plaintiff will be recorded as having entered the federal retirement system effective March 19, 2018, with an annuity commencement date of April 1, 2018, see 5 U.S.C. § 8464(a)(1)(A), 5 C.F.R. § 842.208(b), and will receive:

a. a payment of a lump sum representing all retirement annuity payments, including annuity supplement payments, that he would otherwise have received from the April 1, 2018 annuity commencement date until the day before he is paid his first regular monthly payment, which will be computed in accordance with all relevant statutory and regulatory provisions, and which will not deduct or withhold any amounts for benefits not received or for taxes not owed during the time period specified above, unless such deductions and/or withholdings are required by relevant statutory or regulatory provisions;

b. prospectively from the date of his first regular monthly payment, through the federal retirement system, all periodic annuity payments, including annuity supplement payments, consistent with his March 19, 2018 retirement date;

[snip]

Defendants agree to pay $539,348.15 to Plaintiff, pursuant to the Equal Access to Justice Act, and in full settlement and satisfaction of all attorney’s fees, costs, and expenses. Payment shall be made to Plaintiff via electronic funds transfer to Arnold & Porter Kaye Scholer LLP, as promptly as practicable, consistent with the normal processing procedures followed by the Department of Justice and the Department of the Treasury, following the dismissal of the above-captioned civil action. This provision does not constitute an admission that Defendants’ position was not substantially justified under 28 U.S.C. § 2412(d)(1)(A).

McCabe will get also an admission that “Executive Branch officials outside the Department” — otherwise known as The President —  “should not comment publicly on ongoing career civil service employee disciplinary matters.” [my emphasis]

WHEREAS, the Parties agree that Executive Branch officials outside the Department of Justice and its components should not comment publicly on ongoing career civil service employee disciplinary matters, except as provided by statute or regulation, so as not to create any appearance of improper political influence;

But McCabe won’t get a concession that numerous people within the chain of command at DOJ and FBI, including prosecutors who pursued a false statements charge against McCabe, bowed to that improper political influence. Nor, as noted, will McCabe get discovery to learn what documents — besides proof that Bill Barr’s DOJ altered McCabe’s notes in an effort to undermine the Mike Flynn prosecution —  DOJ was so determined to avoid disclosing that they settled this case.

All this is being accomplished, legally, by a kind of reset. McCabe’s personnel records will be altered such that there’s no record of his firing.

1. Within 30 days of the execution of this Settlement Agreement, Defendants will rescind their removal of Plaintiff from the FBI and the civil service, and will rescind and vacate former Attorney General Jefferson B. Sessions’s March 16, 2018 removal decision (“DOJ Removal Decision”), and the March 16, 2018 removal recommendation that was submitted to Attorney General Sessions (“DOJ Removal Recommendation”).

2. The Parties agree that Plaintiff’s electronic Official Personnel Folder will reflect that he was employed continuously by the FBI from July 1996 until his retirement on March 19, 2018, as the FBI Deputy Director and a member of the Senior Executive Service (“SES”), after becoming 50 years of age and completing over 20 years of service.

3. Within 30 days of the execution of this Settlement Agreement, the government will remove from Plaintiff’s electronic Official Personnel Folder all documents that reflect or reference his removal, and replace them with documents reflecting that Plaintiff was continuously employed by the FBI until his retirement on March 19, 2018. Defendants will then provide to Plaintiff a copy of his revised electronic Official Personnel Folder.

4. Plaintiff will be deemed to have retired from the FBI on March 19, 2018.

5. Plaintiff will be deemed to have separated from the FBI in good standing for the purposes of 18 U.S.C. § 926C(c)(1).

By my reading, this doesn’t force DOJ Inspector General to revise its report on McCabe to incorporate Michael Kortan’s testimony, one of the problems in the report identified in McCabe’s suit. It doesn’t negate the conflicting Office of Professional Responsibility review results. But it does legally remove the final effect of over a year of retaliation and public badgering by the President, eliminating all trace of Sessions’ last minute firing of McCabe.

I have no doubt this settlement makes a lot of sense for McCabe. He gets the money he earned over two decades of chasing terrorists, spies, and organized crime and the ability to be treated with the respect a former Deputy Director is normally accorded.

But this country is still fighting the aftereffects of a coup attempt that almost succeeded, in part, because the FBI backed off investigating those close to the President, including Proud Boys who played a key leadership role in the attack. We never got fully visibility into the President’s relationship with Russia because Trump throttled that investigation with firings and pardons. And an unrelenting flood of disinformation masks both of these facts.

We know, from the fact that DOJ entered into this settlement (among other things), that Trump badly politicized DOJ. But this settlement allows DOJ to avoid coming clean about all that happened.

Michael Sussmann Attempts to Bill [of Particulars] Durham for His Sloppy Indictment Language

“Without prejudice to any other pretrial motions”

Michael Sussmann’s lawyers reserve their right to challenge the Durham indictment of Sussmann via other pretrial motions in their motion for a Bill of Particulars six different times. The motion does so three different times when noting that Durham used squishy language to paraphrase Sussmann’s alleged lie and couldn’t seem to decide whether he affirmatively lied or lied by omission.

Mr. Sussmann is entitled to understand which particular crime he must defend himself against. Without prejudice to any other pretrial motions Mr. Sussmann may bring on the matter, Mr. Sussmann is also entitled to additional particulars regarding the alleged omissions in the Indictment, including regarding the legal duty, if any, that required him to disclose the allegedly omitted information the Indictment suggests he should have disclosed.

[snip]

The Special Counsel should be required to clarify which crime he believes Mr. Sussmann committed and, to the extent the Special Counsel is proceeding on an omissions theory, he should be required to provide additional particulars (without prejudice to any motions Mr. Sussmann may make later).

[snip]

To the extent that the Special Counsel believes the Indictment is alleging a material omission under Section 1001(a)(1), and without prejudicing any other motions Mr. Sussmann may make on this issue, the Special Counsel should be required to clarify: (1) what specific information Mr. Sussmann failed to disclose; (2) to whom he failed to disclose it; (3) what legal duty required Mr. Sussmann to make the required disclosure; and (4) why the omission was material. See United States v. Safavian, 528 F.3d 957, 964 (D.C. Cir. 2008). [my emphasis]

It does so twice when asking that Durham address problems with his claims that Sussmann’s alleged lie was material.

The Indictment does make several allegations regarding materiality, and yet these allegations are vague, imprecise, and inconsistent. Suggesting the FBI might have asked more questions, taken other steps, or allocated resources differently, without specifying how or why it would have done so, leaves Mr. Sussmann having to guess about the meaning of the allegations that the Special Counsel has leveled against him. Accordingly, without prejudice to any pretrial motions Mr. Sussmann may make regarding materiality, Mr. Sussmann requests that the Court order the Special Counsel to provide more detail about why the purported false statement was material.

[snip]

Accordingly, without prejudice to any pretrial motions Mr. Sussmann may make regarding materiality, Mr. Sussmann requests that the Special Counsel be ordered to provide more detail about why the purported false statement was material. See Fed. R. Crim. P. 7(c)(1). [my emphasis]

And the motion does so again when pointing out that Durham hasn’t included specifics about another alleged lie, to just two of an unidentified number of people who attended a meeting at CIA, which Sussmann elsewhere describes as improper inclusion of 404(b) material in an indictment.

Without prejudicing any other motions Mr. Sussmann may make on this issue, the Special Counsel should first be required to clarify the false statement alleged to have been made to the two anonymous Agency-2 employees, and any other individuals present at the meeting, in February 2017. [my emphasis]

A list of things John Durham didn’t provide in his Michael Sussmann indictment

It’s only after making it clear that this is just his opening move before filing a motion to dismiss and other legal challenges to the indictment…

The Indictment is seriously vulnerable to challenge as a matter of law, and Mr. Sussmann will make relevant pretrial motions at the appropriate time. For now, Mr. Sussmann moves for a bill of particulars.

…that Sussmann lays out a list of things he claims he can’t figure out from Durham’s sloppy indictment:

For the foregoing reasons, this Motion for a Bill of Particulars should be granted, and the Court should order the Special Counsel to promptly:

A. Provide particulars regarding the specific false statement the Special Counsel alleges Mr. Sussmann made to Mr. Baker, namely:

1. The exact words of Mr. Sussmann’s alleged false statement;

2. The specific context in which the statement was made so that the meaning of the words is clear;

3. What part of the statement is allegedly false, i.e., whether the statement was false because Mr. Sussmann allegedly stated he was not “acting on behalf of any client in conveying particular allegations concerning a Presidential Candidate” as alleged in Paragraph 46, or if he falsely stated that he was not doing any “work” on behalf of a client more generally, as alleged in Paragraphs 4, 27(a), 28;

4. What is meant by “his work,” as referenced in Paragraph 4;

5. What is meant by “acting [or acted] on behalf of any client” as alleged in Paragraphs 27(a) and 30; and

6. What “this” refers to in the Assistant Director’s notes referenced in Paragraph 28.

B. Provide particulars regarding the statutory violation charged and, if applicable any alleged omissions, namely:

1. Which crime the Special Counsel believes Mr. Sussmann has committed; and

2. To the extent the Special Counsel alleges that Mr. Sussmann made a material omission in violation of 18 U.S.C. § 1001(a)(1), as suggested by Paragraph 30 of the Indictment –

a. the specific information Mr. Sussmann allegedly failed to disclose;

b. to whom he allegedly failed to make that disclosure;

c. what legal duty required Mr. Sussmann to disclose such information; and

d. why the allegedly omitted information was material.

C. Provide particulars regarding how the alleged false statement to Mr. Baker was material, specifically:

1. The “other reasons” Mr. Sussmann’s false statement was material, as alleged in Paragraphs 5 and 32;

2. What “his work” refers to as referenced in Paragraph 5, what about such work was unknown to the FBI, and how the “political nature of his work” was material to the FBI’s investigation;

3. How Mr. Sussmann’s alleged false statement was material to the FBI’s ability to “assess and uncover the origins of the relevant data and technical analysis,” as alleged in Paragraph 5, when Mr. Sussmann disclosed the origins of the data and technical analysis;

4. How Mr. Sussmann’s role as a paid advocate was materially “relevant” to the FBI’s investigation, as alleged in Paragraph 32, given that the information itself raised serious national security concerns and the FBI otherwise enables civilians to provide anonymous tips; and

5. What potential questions, additional steps, resource allocations, or more complete information the FBI would have gathered absent Mr. Sussmann’s false statement, as alleged in Paragraph 32.

D. Provide particulars regarding the alleged false statement Mr. Sussmann made to all Agency-2 employees and representatives, as alleged in Paragraphs 39 and 42, namely:

1. The exact words of Mr. Sussmann’s alleged false statement;

2. The specific context in which the statement was made so that the meaning of the words is clear;

3. What portion of the statement is allegedly false;

4. The identities of all individuals to whom the statement was made, including:

a. both Employee-1 and Employee-2 as referenced in Paragraph 42; and

b. anyone else present who also heard the false statement.

E. Provide particulars regarding the identities of the “representatives and agents of the Clinton Campaign” referenced in Paragraph 6.

Motions for a Bill of Particular rarely work

Make no mistake, most demands for a Bill of Particulars like this fail. The prosecution will argue that everything Sussmann needs is in the indictment and, if Judge Christopher Cooper agrees, Sussmann will just submit his motion to dismiss and other challenges like he’s clearly planning to do anyway.

That’s almost certainly what will happen for several of these requests, such as the names of Clinton Campaign personnel Durham accuses Sussmann of coordinating with on the Alfa Bank materials. But Sussmann likely doesn’t really need these names because he likely knows that Durham has nothing to substantiate this claim. If he did, Durham would have described such evidence in his speaking indictment. Sussmann may well know there are no names — of campaign personnel with whom he personally coordinated in advance of the James Baker meeting, at least — to give, because he didn’t coordinate with anyone from the campaign (Durham probably wants to substantiate this claim by charging Marc Elias in a conspiracy with Sussmann, but that all depends on being able to prove that anyone was lying about all this).

Similarly, Sussmann seems to know — and Durham may not — that there were more than just two people at a February 9, 2017 meeting at which Sussmann tried to bring new concerns to the attention of the government. This request seems to suggest there was at least one and possibly other witnesses who were at this meeting that Durham should know of who didn’t corroborate a claim that Sussmann lied, witnesses Durham didn’t mention in his indictment.

Likewise, Sussmann is unlikely to get very far asking for more details about Durham’s materiality claim, in particular, Durham’s repeated allegation that what he presented were just some, “among other reasons,” why Sussmann’s alleged lie was material. Prosecutors will argue that materiality is a matter for the jury to decide. But if Sussmann can force Durham to admit he has a theory of prosecution he hasn’t included in his indictment — that Durham believes that, rather than raising a real anomaly to the FBI’s attention because it was a real anomaly, lawyers who were paid by Hillary were trying to start a witch hunt against Donald Trump (never mind that the actual investigation that would prove at least three Trump officials, and probably Trump himself, got advance warning of a Russian attack on Hillary started three weeks before the meeting at which Sussmann is alleged to have lied) — then it will make it far easier for Sussmann to attack the indictment down the road.

What a false statement charge is supposed to look like

But Sussmann may succeed on his key complaint, that Durham has built a 27-page indictment around a false claim allegation without any means to clearly lay out what was the specific lie Sussmann told.

To understand what Sussmann means when he says,

It is simply not enough for the Indictment to make allegations generally about the substance of the purported false statement. Rather, the law requires that the Special Counsel identify the specific false statement made, i.e., the precise words that were allegedly used.

We can look at the false statements that Trump’s associates made to cover up the Trump campaign’s ties to Russia. For example, for each of six charged lies in the Roger Stone indictment, Mueller’s prosecutors quoted the precise questions he was asked as well as his response, then laid out specific evidence that each lie was a lie.

22. During his HPSCI testimony, STONE was asked, “So you have no emails to anyone concerning the allegations of hacked documents . . . or any discussions you have had with third parties about [the head of Organization 1]? You have no emails, no texts, no documents whatsoever, any kind of that nature?” STONE falsely and misleadingly answered, “That is correct. Not to my knowledge.”

23. In truth and in fact, STONE had sent and received numerous emails and text messages during the 2016 campaign in which he discussed Organization 1, its head, and its possession of hacked emails. At the time of his false testimony, STONE was still in possession of many of these emails and text messages, including:

a. The email from STONE to Person 1 on or about July 25, 2016 that read in part, “Get to [the head of Organization 1] [a]t Ecuadorian Embassy in London and get the pending [Organization 1] emails . . . they deal with Foundation, allegedly.”;

b. The email from STONE to Person 1 on or about July 31, 2016 that said an associate of Person 1 “should see [the head of Organization 1].”;

c. The email from Person 1 to STONE on or about August 2, 2016 that stated in part, “Word is friend in embassy plans 2 more dumps. One shortly after I’m back. 2nd in Oct. Impact planned to be very damaging.”;

d. Dozens of text messages and emails, beginning on or about August 19, 2016 and continuing through the election, between STONE and Person 2 in which they discussed Organization 1 and the head of Organization 1;

e. The email from STONE on or about October 3, 2016 to the supporter involved with the Trump Campaign, which read in part, “Spoke to my friend in London last night. The payload is still coming.”; and

f. The emails on or about October 4, 2016 between STONE and the high-ranking member of the Trump Campaign, including STONE’s statement that Organization 1 would release “a load every week going forward.”

For some of Stone’s charged lies, prosecutors even had communications with Jerome Corsi or Randy Credico or one of his lawyers showing Stone planned in advance to lie.

In George Papadopoulos’ statement of offense, for each of several lies outlined, prosecutors laid out specifically what he told the FBI and then laid out how Papadopoulos’ own communications records and his later testimony proved those statements to be false.

c. Defendant PAPADOPOULOS claimed he met a certain female Russian national before he joined the Campaign and that their communications consisted of emails such as, ‘”Hi , how are you?”‘ In truth and in fact, however, defendant PAPADOPOULOS met the female Russian national on or about March 24, 2016, after he had become an adviser to the Campaign; he believed that she had connections to Russian government officials; and he sought to use her Russian connections over a period of months in an effort to arrange a meeting between the Campaign and Russian government officials.

The most recent Mueller backup liberated by Jason Leopold reveals that, in addition to Papaodpoulos’ communications and later testimony that prove this particular claim to be an intentional lie, Papadopoulos also emailed the FBI on January 27 after consulting his records, laying out his claim that he met Olga before he joined the Trump campaign and never met her after that.

As promised, wanted to send you the name of the individual that Joseph Mifsud introduced me to over lunch in February or early March (while I was working with the London Center of International Law Practice and did not even know at that time whether or not I would even have moved back to the U.S. or especially worked on another presidential campaign).

He introduced her as his student, but was looking to impress her by meeting with me fresh off my Ben Carson gig. That is all I know. Never met her again.

I could go on for each of the false statements charged against Trump’s flunkies (and also show how, when Andrew Weissmann fell short of this kind of evidence, Amy Berman Jackson ruled against prosecutors on two of five claimed lies alleged in Paul Manafort’s plea breach determination).

Even Mike Flynn’s statement of offense, substantiating a charge that Trump loyalists have spent years wailing about, laid out clearly the two charged lies.

During the interview, FLYNN falsely stated that he did not ask Russia’s Ambassador to the United States (“Russian Ambassador”) to refrain from escalating the situation in response to sanctions that the United States had imposed against Russia. FLYNN also falsely stated that he did not remember a follow-up conversation in which the Russian Ambassador stated that Russia had chosen to moderate its response to those sanctions as a result of FL YNN’s request.

[snip]

During the January 24 voluntary interview, FLYNN made additional false statements about calls he made to Russia and several other countries regarding a resolution submitted by Egypt to the United Nations Security Council on December 21, 2016. Specifically FLYNN falsely stated that he only asked the countries’ positions on the vote, and that he did not request that any of the countries take any particular action on the resolution. FLYNN also falsely stated that the Russian Ambassador never described to him Russia’s response to FL YNN’s request regarding the resolution.

Not only did prosecutors describe what a transcript of these calls said, but they also had testimony from both Flynn himself and KT McFarland substantiating that these were lies. They even had a text that Flynn sent McFarland, before any of these intercepts had leaked, that Flynn later admitted he had deliberately written to cover up the content of his calls with Sergey Kislyak.

Then, after Sidney Powell spent six months trying to claim that one of Flynn’s lies wasn’t clearly laid out in his original 302, Judge Emmet Sullivan meticulously pointed out that the notes of both FBI interviewers matched every iteration of Flynn’s 302.

Having carefully reviewed the interviewing FBI agents’ notes, the draft interview reports, the final version of the FD302, and the statements contained therein, the Court agrees with the government that those documents are “consistent and clear that [Mr. Flynn] made multiple false statements to the [FBI] agents about his communications with the Russian Ambassador on January 24, 2017.” Gov’t’s Surreply, ECF No. 132 at 4-5. The Court rejects Mr. Flynn’s request for additional information regarding the drafting process for the FD-302s and a search for the “original 302,” see Def.’s Sur-Surreply, ECF No. 135 at 8- 10, because the interviewing FBI agents’ notes, the draft interview reports, the final version of the FD-302, and Mr. Flynn’s own admissions of his false statements make clear that Mr. Flynn made those false statements.

These are what false statements charges are supposed to look like. They’re backed by contemporaneous admissible evidence and laid out in specific detail in charging documents.

Trump and his supporters have wailed for years about these charges. Except prosecutors had evidence to substantiate them, the kind of evidence Durham makes no claim to have.

What few witnesses Durham has may not all agree on Sussmann’s alleged lies

Sussmann is more likely to succeed with his request to have his alleged false statement laid out in quote form and in context — and even if he doesn’t, he may back Durham into a corner he doesn’t want to be in — because Sussmann has presented several central questions about what the allegation really is. Is it that Sussmann didn’t offer up that he was working with (Sussmann claims) Rodney Joffe or  (Durham also alleges) Hillary on the Alfa Bank issues? Is it that Sussmann falsely claimed not to be billing the meeting with James Baker (evidence of which Durham has not presented)? Or does Durham have any shred of evidence that Baker affirmatively asked Sussmann, “are you sharing this on behalf of a client,” or even less supported in the indictment, “are you sharing this on behalf of Trump’s opponent, Hillary Clinton”? Similarly, Durham doesn’t explain whether when he claims that Sussmann lied about “this,” or “his work,” he means about the meetings that were actually billed to Hillary’s campaign internally at Perkins Coie (even if Hillary paid no money specifically tied to those meetings), or that the meeting with Baker was billed to one or another client (no evidence of which Durham presents). Those details will all be necessary for Durham to prove his case and for Sussmann to rebut it. And Sussmann needs to know whether he should focus his time on the absence of billing records substantiating that he met with Baker and then billed it to Hillary (something implicated by the meaning of “this” and “his work”), or whether he needs to focus on showing whether Priestap distinguished these allegations from the other claims about a Russian information operation undeniably targeting Hillary (something implicating whether this is supposed to be a crime of commission or omission).

It’s quite possible that Durham has presented these allegations using such squishy language because what little evidence he has doesn’t actually agree on the claimed lies. That is, it may be that Baker believes Sussmann simply didn’t bother explaining which client he was working for, but Bill Priestap, the next in line in a game of telephone, differently understood from Baker’s report that Sussmann affirmatively failed to provide Baker information that (Priestap’s own notes prove) the FBI already had anyway, that he was working with Hillary Clinton.

If, having had these weaknesses laid out by Sussmann’s attorneys, Durham can show that all his evidence actually substantiates the same false claim, he could get a superseding indictment making that clear. But once he does that, it may tie his hands at trial.

But it’s distinctly possible that Durham can’t prove that what little evidence he has backs the same interpretation of Sussmann’s alleged lie. That is, there may be a reason — on top of the fact that he has no contemporaneous transcript from a witness — that he avoided being more specific in his indictment, and that’s because it was the only way he could cobble together enough evidence to get a grand jury to indict.

So while much of the rest of this motion of a Bill of Particulars may serve only to call attention to gaping holes in the rest of the indictment, the request for specifics about what, specifically, Sussmann is alleged to have said when he lied may succeed. And even if it doesn’t, it may force Durham to commit to an interpretation that not all of his thin evidence would ultimately support.

In Indictment Accusing Michael Sussmann of Hiding Details about Researchers, John Durham Hid Details about Researchers

In my initial John Durham Is the Jim Jordan of Ken Starrs post pointing to all the problems with John Durham’s attempt to criminalize victims reporting on information operations, I described Durham’s description of why Michael Sussmann’s alleged lie was material.

SUSSMANN’s lie was material because, among other reasons, SUSSMANN’s false statement misled the FBI General Counsel and other FBI personnel concerning the political nature of his work and deprived the FBI of information that might have permitted it more fully to assess and uncover the origins of the relevant data and technical analysis, including the identities and motivations of SUSSMANN’s clients.

Had the FBI uncovered the origins of the relevant data and analysis and as alleged below, it might have learned, among other things that (i) in compiling and analyzing the Russian Bank-1 allegations, Tech Executive-1 had exploited his access to non-public data at multiple Internet companies to conduct opposition research concerning Trump; (ii) in furtherance of these efforts, Tech Executive-1 had enlisted, and was continuing to enlist, the assistance of researchers at a U.S.-based university who were receiving and analyzing Internet data in connection with a pending federal government cybersecurity research contract; and (iii) SUSSMAN, Tech Executive-1, and Law Firm-1 had coordinated, and were continuing to coordinate, with representatives and agents of the Clinton Campaign with regard to the data and written materials that Sussmann gave to the FBI and the media. [my emphasis]

John Durham says it is a crime to hide details about the researchers who first identified the Alfa Bank anomaly.

Yet, even based on the indictment, I identified a number of holes in Durham’s description of what the researchers had done. Yesterday, NYT and CNN both published stories identifying the four researchers — Rodney Joffe (Tech Executive-1), April Lorenzen (Tea Leaves, whom Durham needlessly renamed Originator-1), Manos Antonakakis (Researcher-1), and David Dagon (Researcher-2) — showing that the holes I identified in the indictment indeed left out information that totally undermined Durham’s insinuations.

For example, I noted that the date when what NYT identifies as DARPA shared information with the researchers is important to identify whether they obtained the data in order to research Trump.

At some point [Durham doesn’t provide even a month, but by context it was at least as early as July 2016 and could have been far, far earlier], TE-1’s company provided a university with data for a government contract ultimately not contracted until November 2016, including the DNS data from an Executive Branch office of the US government that Tech Exec-1’s company had gotten as a sub-contractor to the US government. [This date of this is critical because it would be the trigger for a Conspiracy to Defraud charge, if Durham goes there.]

NYT describes that DARPA first approached potential partners in the spring, long before Sussman or Joffe got involved.

The involvement of the researchers traces back to the spring of 2016. DARPA, the Pentagon’s research funding agency, wanted to commission data scientists to develop the use of so-called DNS logs, records of when servers have prepared to communicate with other servers over the internet, as a tool for hacking investigations.

DARPA identified Georgia Tech as a potential recipient of funding and encouraged researchers there to develop examples. Mr. Antonakakis and Mr. Dagon reached out to Mr. Joffe to gain access to Neustar’s repository of DNS logs, people familiar with the matter said, and began sifting them.

I noted that Durham didn’t give the date when Lorenzen first started looking at the the DNS data. That date is another read of whether she had done so out of malice targeting Trump.

By some time in late July 2016 [the exact date Durham doesn’t provide], a guy who always operated under the pseudonym Tea Leaves but whom Durham heavy-handedly calls “Originator-1” instead had assembled “purported DNS data” reflecting apparent DNS lookups between Alfa Bank and “mail1.trump-email.com” that spanned from May 4 through July 29.

NYT reveals that Lorenzen and Dagon first started talking about using the DNS data to check other election-related hacking at a conference that went from June 13 to June 16 (meaning, the DNC hack would have been revealed during the conference).

Separately, when the news broke in June 2016 that Russia had hacked the Democratic National Committee’s servers, Mr. Dagon and Ms. Lorenzen began talking at a conference about whether such data might uncover other election-related hacking.

Ms. Lorenzen eventually noticed an odd pattern: a server called mail1.trump-email.com appeared to be communicating almost exclusively with servers at Alfa Bank and Spectrum Health. She shared her findings with Mr. Dagon, the people said, and they both discussed it with Mr. Joffe.

I noted that Durham had left out all mention of the WikiLeaks release and Trump’s invitation to Russia to keep hacking his opponent.

It appears (though Durham obscures this point) that all the actions laid out in this indictment post-date the press conference. Virtually everyone in the US committed to ensuring America’s national security was alarmed by Trump’s comments in this press conference. Yet Durham doesn’t acknowledge that all these actions took place in the wake of public comments that made it reasonable for those committed to cybersecurity to treat Donald Trump as a national security threat, irrespective of partisan affiliation.

Durham will work hard to exclude detail of Trump’s press conference from trial. But I assume that if any of the named subjects of this investigation were to take the stand at trial, they would point out that it was objectively reasonable after July 27 to have national security concerns based on Trump’s encouragement of Russia’s attack on Hillary Clinton and his defensive denials of any business ties. Any of the named subjects of the indictment would be able to make a strong case that there was reason to want to, as a matter of national security, test Trump’s claim to have no financial ties to Russia. Indeed, the bipartisan SSCI Report concluded that Trump posed multiple counterintelligence concerns, and therefore has concluded that Durham’s portrayal of politics as the only potential motive here to be false.

Central to Durham’s theory of prosecution is that there was no sound national security basis to respond to anomalous forensic data suggesting a possible financial tie between Trump and Russia. Except that, after that July 27 speech — and all of these events appear to post-date it — that theory is unsustainable.

NYT reveals that when Dagon shared the data with Joffe on July 29, he did so in the context of those two events.

“Half the time I stop myself and wonder: am I really seeing evidence of espionage on behalf of a presidential candidate?” Mr. Dagon wrote in an email to Mr. Joffe on July 29, after WikiLeaks made public stolen Democratic emails timed to disrupt the party’s convention and Mr. Trump urged Russia to hack Mrs. Clinton.

I noted that Durham was probably wrong to believe that an August discussion about whether the data could have been spoofed was inculpatory.

Still others (such as the recognition that this could be spoofed data) will almost certainly end up being presented as exculpatory if this ever goes to trial, but Durham seems to think is inculpatory.

NYT describes that a later discussion doubted that the data could have been spoofed.

The indictment quotes August emails from Ms. Lorenzen and Mr. Antonakakis worrying that they might not know if someone had faked the DNS data. But people familiar with the matter said the indictment omitted later discussion of reasons to doubt any attempt to spoof the overall pattern could go undetected.

I noted that Durham attributed the view that the DNS traffic was a “red herring” to everyone involved, including Sussmann, even though Sussmann appears not to have been on the email.

In one place, Durham describes “aforementioned views,” plural, that the Alfa Bank data was a “red herring,” something only attributed to TE-1 in the indictment, seemingly presenting TE-1’s stated view on August 21 to everyone involved, including Sussmann, who does not appear to have been on that email chain.

NYT describes that after that, Joffe came to discount the marketing server explanation.

Mr. Tyrrell, his lawyer, said that research in the weeks that followed, omitted by the indictment, had yielded evidence that the specific subsidiary server in apparent contact with Alfa Bank had not been used to send bulk marketing emails. That further discussion, he said, changed his client’s mind about whether it was a red herring.

“The quotation of the ‘red herring’ email is deeply misleading,” he said, adding: “The research process is iterative and this is exactly how it should work. Their efforts culminated in the well-supported conclusions that were ultimately delivered to the F.B.I.”

It also explains that in context, Joffe referenced a June article describing Trump’s interest in a Trump Tower Moscow.

The indictment says Mr. Joffe sent an email on Aug. 21 urging more research about Mr. Trump, which he stated could “give the base of a very useful narrative,” while also expressing a belief that the Trump server at issue was “a red herring” and they should ignore it because it had been used by the mass-marketing company.

The full email provides context: Mr. Trump had claimed he had no dealings in Russia and yet many links appeared to exist, Mr. Joffe noted, citing an article that discussed aspirations to build a Trump Tower in Moscow. Despite the “red herring” line, the same email also showed that Mr. Joffe nevertheless remained suspicious about Alfa Bank, proposing a deeper hunt in the data “for the anomalies that we believe exist.”

He wrote: “If we can show possible email communication between” any Trump server and an Alfa Bank server “that has occurred in the last few weeks, we have the beginning of a narrative,” adding that such communications with any “Russian or Ukrainian financial institutions would give the base of a very useful narrative.”

In my post, I noted that Durham neglected to describe that the researchers turned out to correctly suspect Trump was hiding efforts to broker a Trump Tower deal.

According to Michael Cohen, when Trump walked off the stage from that July 27 press conference, Cohen asked Trump why he had claimed that he had zero business ties with Russia when he had in fact been pursuing an impossibly lucrative deal to brand a Trump Tower in Moscow. And we now know that within hours of Trump’s request, GRU hackers made a renewed assault on Hillary’s own servers. By the time security researchers pursued anomalous data suggesting covert communications with a Russian bank, Cohen had already participated in discussions about working with two sanctioned Russian banks to fund the Trump Tower deal, had agreed to work with a former GRU officer to broker it, had spoken to an aide of Dmitry Peskov, and had been told that Putin was personally involved in making the deal happen. Just on the Trump Tower basis alone, Trump had publicly lied in such a way that posed a counterintelligence risk to America.

In my post, I noted that Durham downplayed that, when Joffe asked the researchers if the paper Sussmann wrote was plausible, they said it was.

On September 14, TE-1 [not Sussmann] sent the white paper he had drafted to Researcher 1, Researcher 2, and Tea Leaves to ask them if a review of less than an hour would show this to be plausible. Though some of them noted how limited the standard of “plausibility” was, they agreed it was plausible, and Researcher 2 said [Durham does not quote the specific language here] “the paper should be shared with government officials.”

NYT describes that Durham misrepresented the enthusiasm with which Lorenzen “wholeheartedly” expressed her belief the explanation was plausible.

The indictment also quoted from emails in mid-September, when the researchers were discussing a paper on their suspicions that Mr. Sussmann would soon take to the F.B.I. It says Mr. Joffe asked if the paper’s hypothesis would strike security experts as a “plausible explanation.”

The paper’s conclusion was somewhat qualified, an email shows, saying “there were other possible explanations,” but the only “plausible” one was that Alfa Bank and the Trump Organization had taken steps “to obfuscate their communications.”

The indictment suggested Ms. Lorenzen’s reaction to the paper was guarded, describing an email from her as “stating, in part, that it was ‘plausible’ in the ‘narrow scope’ defined by” Mr. Joffe. But the text of her email displays enthusiasm.

“In the narrow scope of what you have defined above, I agree wholeheartedly that it is plausible,” she wrote, adding: “If the white paper intends to say that there are communications between at least Alfa and Trump, which are being intentionally hidden by Alfa and Trump I absolutely believe that is the case,” her email said.

NYT shows several more ways that Durham utterly misrepresented how seriously the researchers took this thesis.

The indictment cited emails by Mr. Antonakakis in August in which he flagged holes and noted they disliked Mr. Trump, and in September in which he approvingly noted that the paper did not get into a technical issue that specialists would raise.

Mr. Antonakakis’ lawyer, Mark E. Schamel, said his client had provided “feedback on an early draft of data that was cause for additional investigation.” And, he said, their hypothesis “to this day, remains a plausible working theory.”

The indictment also suggests Mr. Dagon’s support for the paper’s hypothesis was qualified, describing his email response as “acknowledging that questions remained, but stating, in substance and in part, that the paper should be shared with government officials.”

The text of that email shows Mr. Dagon was forcefully supportive. He proposed editing the paper to declare as “fact” that it was clear “that there are hidden communications between Trump and Alfa Bank,” and said he believed the findings met the probable cause standard to open a criminal investigation.

“Hopefully the intended audience are officials with subpoena powers, who can investigate the purpose” of the apparent Alfa Bank connection, Mr. Dagon wrote.

One of the first things Michael Sussmann is going to do after this story is request information on what the grand jury was told, including whether any of this was affirmatively misrepresented to the grand jury.

The sheer amount of communications that, in days, these researchers have been able to prove were misrepresented, too, suggests DOJ has cause to review whether Durham misrepresented the substance of this indictment to those who approved it, up to and including Merrick Garland.

John Durham says it is a crime to lie about these researchers in an effort to launch an investigation. And yet, the available evidence suggests he did just that.

Update: To be clear, he can’t be prosecuted for any of this. Prosecutors have expansive immunity for such things.

John Durham Is the Jim Jordan of Ken Starrs

Last Thursday, John Durham indicted Michael Sussmann, the Perkins Coie lawyer who advised the DNC, DCCC, and Clinton Campaign about cybersecurity in 2016 as they struggled to deal with a hostile nation-state attack aiming — in part — to help elect their opponent. The indictment accuses Sussmann of lying to FBI General Counsel James Baker at a September 19, 2016 meeting at which Sussmann shared information about the curious DNS traffic between a server used by a Trump marketing contractor and Alfa Bank.

emptywheel’s long history of debunking the Alfa Bank story

Before I unpack the indictment, let me remind readers that when this story first publicly broke, I explained why the Spectrum Health (aka my boob hospital at the time) aspect of the allegations made no sense, criticized Hillary’s team (including Jake Sullivan) for jumping on the story, and echoed Rob Graham’s criticism of the researchers who accessed DNS data to conduct this research.

In addition to his technical debunking, Robert Graham made an equally important point: researchers shouldn’t be accessing this data for ad-lib investigations into presidential candidates, and it’s not even clear who would have access to it all except the NSA.

The big story isn’t the conspiracy theory about Trump, but that these malware researchers exploited their privileged access for some purpose other than malware research.

[snip]

In short, of all the sources of “DNS malware information” I’ve heard about, none of it would deliver the information these researchers claim to have (well, except the NSA with their transatlantic undersea taps, of course).

[snip]

[B]efore Tea Leaves started pushing this story to the press, the FBI had been investigating it for two months.

Which, to my mind, raises even more questions about the anonymous researchers’ identities, because (small world and all) the FBI likely knows them, in which case they may have known that the FBI wasn’t jumping on the story by the time they started pitching it.

Or the FBI doesn’t know them, which raises still more questions about the provenance of these files.

Ah well, if President Hillary starts a war with Russia based off Iraq-War style dodgy documents, at least I’ll have the satisfaction of knowing my boob clinic is right there on the front lines.

In March 2017, I observed that the weird Alfa Bank entry in the Steele dossier suggested a feedback loop between the Alfa Bank server story and the dossier project. Then days after that, I noted all the ways that the packaging of this story made it more suspect.

In 2018, I complained about the way Dexter Filkins had strained to sustain the story, while noting that people ought to look more closely at why Alfa Bank might be the focus here; the Mueller Report since confirmed that within weeks after the story broke publicly, Vladimir Putin pushed Oligarchs from Alfa Bank to fight harder against western sanctions, something that the alleged source for the Alfa Bank entry in the dossier seemed to parrot.

In short, I not only have consistently criticized this story, but done so in ways that anticipate the most justifiable parts of the indictment. It’s only the last bit — how the Alfa narrative echoes Putin’s interests — that this indictment doesn’t incorporate.

I guess with five more years Durham might get there…

So in unpacking this indictment, I’m in no way defending the Alfa Bank – Trump Tower story. It was a sketchy allegation, the packaging of it was suspect, and those who conducted the research arguably violated ethical guidelines.

I got to where Durham got in this indictment years and years ago. But that doesn’t make it a crime.

John Durham’s “narrative”

Moreover, that doesn’t mean Durham should tell as strained a “narrative” as those who packaged up this story. Central to Durham’s indictment is an assumption that if a victim of a crime who believed at the time that the crime had a — since confirmed — political goal reports suspicious, potentially related details, the victim must be motivated exclusively out of self-interest, not good citizenship or a concern about national security. That is, this entire indictment assumes that when Russia attacks a Presidential candidate, that is not itself a national security concern, but instead nothing more than a political dispute.

Effectively, John Durham has made it a crime for someone victimized by a Russian influence operation to try to chase down Russian influence operations.

Tech Executive-1 and Clinton both had retained Perkins Coie long before this, with Sussmann getting involved specifically for cybersecurity help in the wake of the Russian hack

The indictment, perhaps deliberately, obscures the timeline and facts leading up to the charged lie. But here’s the story it tells. First, all of Durham’s subjects established contracts with each other, even though all of those contracts (including Fusion GPS’) had scopes far larger than oppo research on Trump’s relationship with Russia.

  • In February 2015, Tech Executive-1 (whom I’ll call TE-1 for brevity) retained Sussmann to deal with a US government agency [Durham does not say whether this matter was resolved or continued in this period in 2016, which is central to the question of what kind of client of Sussmann’s TE-1 was].
  • In April 2015, the Clinton Campaign retained Perkins Coie and made Marc Elias the Campaign’s General Counsel.
  • In April 2016, the victim of a Russian government election-related attack, the DNC, retained Sussmann to help it deal with aftermath, which included meeting with the FBI. As the indictment describes this was not just legal support but cybersecurity.
  • [After a Republican retained them first and on a date that Durham doesn’t reveal,] Perkins Coie retained Fusion GPS to conduct oppo research on Trump pertaining to Russia [and other topics, though Durham doesn’t mention those other topics].

Durham only mentions in passing, later, that the researchers involved here similarly knew each other through relationships that focused on cybersecurity and predated these events.

Via means and on specific dates that Durham doesn’t always provide, Tea Leaves, TE-1, Sussmann, and two Researchers got the DNS data showing an anomaly

There are two sets of research here: that done in a university setting and that done at companies associated with TE-1, though TE-1 is the pivot to both. As depicted, Durham suggests the former are more legally exposed than the latter.

  • By some time in late July 2016 [the exact date Durham doesn’t provide], a guy who always operated under the pseudonym Tea Leaves but whom Durham heavy-handedly calls “Originator-1” instead had assembled “purported DNS data” reflecting apparent DNS lookups between Alfa Bank and “mail1.trump-email.com” that spanned from May 4 through July 29.
  • Tea Leaves was a business associate of TE-1 and via means Durham doesn’t describe, the data Tea Leaves gathered was shared with TE-1.
  • “In or about July 2016” [at a time that, because of the laws of physics, must post-date the late July date when Tea Leaves collected this data and the date when he shared them with TE-1], TE-1 alerted Sussmann to the data.
  • On July 31, Sussmann billed the Clinton Campaign for 24 minutes with the billing description, “communications with Marc Elias regarding server issue.”
  • At some point [Durham doesn’t provide even a month, but by context it was at least as early as July 2016 and could have been far, far earlier], TE-1’s company provided a university with data for a government contract ultimately not contracted until November 2016, including the DNS data from an Executive Branch office of the US government that Tech Exec-1’s company had gotten as a sub-contractor to the US government. [This date of this is critical because it would be the trigger for a Conspiracy to Defraud charge, if Durham goes there.]
  • In or about August 2016 [Durham doesn’t provide a date], a federal government was finalizing but had not yet signed a cybersecurity research contract with [presumably] that same university to receive and analyze large quantities of public and non-public data “to identify the perpetrators of malicious cyber-attacks and protect U.S. national security.” Tea Leaves was the founder of a company that the university was considering [Durham doesn’t provide the date of consideration, but generally these things precede finalization] for a subcontract with the government contract.

TE-1 directs employees of companies under his control to research this issue

Though Durham’s indictment is somewhat vague, at least one piece of research from companies associated with TE-1 was shared with the FBI; it appears that other threads of research were not shared.

  • In or about early August 2016 [the dates of which Durham doesn’t provide], TE-1 directed personnel at two companies in which he had an ownership interest to search for what the indictment calls, “any Internet data reflecting potential connections or communications between Trump or his associates and Russia,” which Durham describes to be “derogatory information on Trump.” In connection with this tasking, TE-1 later stated [on a date Durham doesn’t describe] he was working with someone who had close ties to the Democratic Party.
  • At some point, an individual tasked with this work described being “uncomfortable regarding this tasking,” [Durham doesn’t describe when he learned this or whether there is any contemporaneous proof].
  • At some point [Durham doesn’t describe the date], TE-1 provided one of his companies with personal (but publicly available) data from six Trump associates and one purported US-based lobbyist for Alfa Bank and directed these individuals should be the focus of that company’s data queries and analysis [Durham doesn’t say whether these six associates overlapped with the people Fusion had been tasked to research, nor does he allege they got included in the eventual reports to the FBI; both details are needed to assess his case].
  • On August 12, 2016, Sussmann, Elias, and TE-1 met in Elias’ office; Sussmann billed his time to the Clinton Campaign describing, “confidential meetings with Elias, others.”
  • On August 15, employees at one of the companies queried their holdings against a set of addresses that referred to Trump and/or Alfa Bank.
  • During the same time period [Durham doesn’t specify when], employees at Internet Company-3 drafted a written paper that included technical observations that Sussmann would later convey to the FBI.

Around the time this started, Sussmann met Fusion and a bunch of meetings happened that were billed to Hillary

  • On July 29, Sussmann and Marc Elias met with Fusion GPS [Durham doesn’t affirmatively claim this data pertained to the server issue], and Sussmann billed his time to the Hillary Campaign under “General Political Advice,” a different description than all the other Fusion meetings that Durham more credibly claims relate to the Alfa Bank allegation.
  • Around “the same [August] time period” [Durham doesn’t provide the date], Sussmann, Elias, and Fusion personnel began exchanging emails with the subject line, “Connecting you all by email;” [Durham doesn’t say who initiated the email, but it suggests that before this period, Sussmann and Fusion did not have direct contact].
  • On August 17, 2016, Sussmann, Elias, and TE-1 conducted an additional conference call, for which Sussmann billed his time to the Clinton campaign, noting “telephone conference with” TE-1 and Elias.
  • On August 19, 2016, Sussman and Elias had another in-person meeting that Sussmann described as a meeting with TE-1, which was billed as a “confidential meeting with Elias, others.”

Researchers 1 and 2 and Tea Leaves worked with TE-1 on a “storyline” and “narrative” with varying degrees of skepticism expressed

This is the stuff Durham–with some justification–will and has used to taint all this as a political project.

  • On July 29, Researcher-2 emailed Researcher-1 the data compiled by Tea Leaves [Durham provides no evidence that TE-1 was involved in this exchange].
  • On August 19, Researcher-1 queried Internet data maintained by TE-1’s company [it is not clear but this suggests it was not the data turned over to the University] for the aforementioned mail1.trump-email.com domain. Researcher-1 then emailed TE-1 with the list of domains that had communicated with it, saying the list, “does not make much sense with the storyline you have.”
  • On August 20, Tea Leaves emailed Tech Exec-1, Researcher-1, and Researcher 2, stating that, “even if we found what [TE-1] asks us to find in DNS, we don’t see the money flow, and we don’t see the content of some message saying, ‘send money here’.” Tea Leaves then explained that one could fill out sales forms and cause them, “to appear to communicate with each other in DNS.” Tea Leaves then noted that “it’s just not the case that you can rest assured that Hillary’s opposition research and whatever professional gov and investigative journalists are also digging come up with the same things.”
  • On August 20, TE-1 clarified that the task was “indeed broad,” and that,
    • Being able to provide evidence of *anything* that shows an attempt to behave badly in relation to this [Durham doesn’t describe what the antecedent of “this” is], the VIPs would be happy. They’re looking for a true story that could be used as the basis for closer examination.
  • Still on August 20, seemingly distinguishing between that task and the Alfa Bank allegations, TE-1 said, “the prior hypothesis was all that they needed: mailserver dedicated or related to trump … and with traffic almost exclusively with Alfa was sufficient to do the job. … Trump has claimed he and his company have had NO dealings with .ru other than the failed Casino, and the Miss universe pageant. He claims absolutely NO interaction with any financial institutions. So any potential like that would be jackpot.” [Ellipses original]
  • On August 21, TE-1 emailed the recipients [but not, apparently, Sussmann], urging them to do further research on Trump which would “given the base of a very useful narrative.” He added that he didn’t believe the trump-email.com domain was a secret communications channel but a “red herring,” because the host was “a legitimate valid company,” stating they could “ignore it, together with others that seem to be part of the marketing world.”
  • On August 22, Researcher-1 raised doubts about whether, using only the tools they were currently using, they could prove their hypothesis. Among the concerns raised is that they couldn’t prove that “this is not spoofed [] traffic.” [brackets original; bolded in the original]
  • Later in or about August 2016 [on dates Durham doesn’t provide], TE-1 exchanged emails with personnel from Fusion.

Sussmann drafts a white paper and (via unstated means) TE-1 gets Researchers 1 and 2 and Tea Leaves to review it

  • Between September 5 and September 14, Sussmann drafted a white paper, generally billing his time to the Clinton Campaign, but on September 14, billing time to both Clinton and TE-1.
  • On September 14, TE-1 [not Sussmann] sent the white paper he had drafted to Researcher 1, Researcher 2, and Tea Leaves to ask them if a review of less than an hour would show this to be plausible. Though some of them noted how limited the standard of “plausibility” was, they agreed it was plausible, and Researcher 2 said [Durham does not quote the specific language here] “the paper should be shared with government officials.”

Sussmann shares this and other information with James Baker and–Durham claims–affirmatively lies about whether he is representing someone

  • Both before the September 19 meeting and after it (notably in a September 12 meeting involving the NYTimes, in which Marc Elias also participated), Sussmann spoke to the press about what Durham credibly suggests was the Alfa Bank white paper. Sussmann billed this to Clinton.
  • On September 19, Sussmann met with Baker and provided him with three white papers and a thumb drive with data. Durham doesn’t actually make clear where all three of these came from.
  • On September 19, Sussmann met with James Baker. Durham claims that “he stated falsely that he was not acting on behalf of any client” [which Durham cannot quote because there’s no contemporaneous record], that he had been approached by multiple cyber experts [Durham doesn’t say whether the three he named were Researcher 1, Researcher 2, and Tea Leaves or other people, as seems to be the case], three white papers [which I may return to because this is another problematic spot in his story], and some of the data, which Durham calls “purported.”
  • Immediately after the September 19 meeting, Baker met with Bill Priestap whose notes read:
    • Michael Sussman[n] — Atty: Perkins Coie — said not doing this for any client
      • Represents DNC, Clinton Foundation, etc. []
      • Been approached by Prominent Cyber People (Academic or Corp. POCs), People like: [three names redacted]
  • Durham substantiates a claim that Sussmann billed the meeting itself to Hillary to a description, “work and communications regarding confidential project,” that does not, at least as he quotes it, mention a meeting with the FBI General Counsel at all.

Some of this — the reference to crafting a narrative and a storyline — is damning and validates my discomfort with the political nature of this project five years ago. Other parts of this emphasize the researchers’ insistence on truth from at least parts of this effort. Still others (such as the recognition that this could be spoofed data) will almost certainly end up being presented as exculpatory if this ever goes to trial, but Durham seems to think is inculpatory.

In one place, Durham describes “aforementioned views,” plural, that the Alfa Bank data was a “red herring,” something only attributed to TE-1 in the indictment, seemingly presenting TE-1’s stated view on August 21 to everyone involved, including Sussmann, who does not appear to have been on that email chain. He claims Sussmann, Researcher 1 and 2, TE-1, and Tea Leaves drafted the white paper(s) shared with the FBI, but all he substantiates is a less than one hour review by everyone but Sussmann. He leaves out a great deal of detail about what Jean Camp and someone using the moniker Tea Leaves did and said, publicly, after the FBI meeting, which may totally undercut Durham’s “narrative.”

But other parts, even of the story that Durham tells, are problematic for his narrative. First, there is not (yet) the least hint that Tea Leaves — whom he calls “The Originator” — fabricated this data (or even packaged it up misleadingly, though I think there is evidence he did). Nor is there the least hint that TE-1 asked Tea Leaves to come up with the data. That part of the story is fundamentally important and Durham simply ignores it with that legally unnecessary — particularly given that Durham clearly labels this person as Tea Leaves — moniker “Originator,” giving the anomalous forensic data a kind of virgin birth. And while two of the four tech experts described herein (there appear to be at least three others not described) expressed some doubt about the meaning of it, none of them seems to have doubted that there was an anomaly in the Trump marketing server and Alfa Bank.

Based on this story, though, Durham insinuates Sussmann fed information that he, Sussmann, knew to be bullshit to the FBI on behalf of both Hillary and TE-1, and in so doing affirmatively hid that the bullshit “storyline” was designed to help Hillary which (he claims) would have led the FBI to treat it differently.

In spite of a lot of thus far extraneous details, that’s the only crime he has alleged.

The existing case is remarkably weak

As a number of people have noted, as charged this is a remarkably weak case. Ben Wittes dedicates a section of his post on this indictment to those weaknesses. They are, succinctly:

  • The evidence regarding the core allegation in the indictment pits Sussmann’s word against James Baker’s; there are no other witnesses.
  • After the meeting with Baker, Sussmann repeatedly admitted under oath he was representing a client, a detail which could be exculpatory or inculpatory.
  • Baker testified to Congress he did believe Sussmann was representing a client (meaning Baker will be used to discredit Baker, the one witness to Sussmann’s alleged lie).
  • Even in Bill Priestap’s nearly-contemporaneous notes which are the only documentation of Sussmann’s comments, he describes Sussmann as Hillary’s lawyer (including for the Clinton Foundation, which may be incorrect), so FBI knew full well that Sussmann represented Hillary.
  • Priestap’s notes may be inadmissible hearsay at trial.

The NYT article predicting these charges also claim Durham is conflating Sussmann’s tracking of his hourly work with the actual money charged to the Hillary campaign.

Moreover, internal billing records Mr. Durham is said to have obtained from Perkins Coie are said to show that when Mr. Sussmann logged certain hours as working on the Alfa Bank matter — though not the meeting with Mr. Baker — he billed the time to Mrs. Clinton’s 2016 campaign.

[snip]

They are also said to have argued that the billing records are misleading because Mr. Sussmann was not charging his client for work on the Alfa Bank matter, but needed to show internally that he was working on something. He was discussing the matter with Mr. Elias and the campaign paid a flat monthly retainer to the firm, so Mr. Sussmann’s hours did not result in any additional charges, they said.

There are a number of other ways that Sussmann’s presumably well-funded defense will combat these charges. But as to the allegation buried amid all these details, Durham’s evidence is weak.

Durham’s materiality broadcasts his bid for a ConFraudUS conspiracy

But that’s not what this is about.

Durham is not just alleging that Sussmann was hiding that he was working for Hillary. He is also claiming that Sussmann was at the same time representing TE-1 at that meeting. In the indictment, I think that’s based on a single data point — that Sussmann billed TE-1’s company for “communications regarding confidential project” on September 14. I’m not sure whether that makes the false statements case still weaker or stronger.

But it’s a key part of where Durham obviously wants to go.

Not only are many of the details Durham included in the indictment irrelevant to the false statements charge, but if they were crimes by themselves, they would have been tolled under any five year statute of limitations already. There are only two conceivable purposes for including them in this indictment. First, to give the Alfa Bank Oligarchs more cause to sue more people, effectively a US prosecutor assisting Russians in cynical lawfare. Durham’s investigation incorporates stuff the Oligarchs have already liberated, so is itself derivative of Russian lawfare. Effectively, that means that a prosecutor working for Bill Barr’s DOJ pursued a prosecution that was complementary to an intelligence-related effort by foreigners who pay Kirkland & Ellis a lot of money. Sussmann will have real cause to question whether Brian Benczkowski (who recused from matters involving this aspect of Alfa Bank) or any other Kirkland & Ellis lawyer had a role in this strand of the investigation.

Then there’s the most obvious way to extend the statute of limitations on the events that happened in July and August 2016: to include them in a conspiracy that continued after those dates (and indeed, Durham refers to Elias, Researcher 1 and 2, and Tea Leaves in the way DOJ often uses to refer to charged or uncharged co-conspirators).

Given the extended statement Durham includes to explain why Sussmann’s alleged lie is material under the charged statute, that’s undoubtedly where Durham wants to head with his investigation.

SUSSMANN’s lie was material because, among other reasons, SUSSMANN’s false statement misled the FBI General Counsel and other FBI personnel concerning the political nature of his work and deprived the FBI of information that might have permitted it more fully to assess and uncover the origins of the relevant data and technical analysis, including the identities and motivations of SUSSMANN’s clients.

Had the FBI uncovered the origins of the relevant data and analysis and as alleged below, it might have learned, among other things that (i) in compiling and analyzing the Russian Bank-1 allegations, Tech Executive-1 had exploited his access to non-public data at multiple Internet companies to conduct opposition research concerning Trump; (ii) in furtherance of these efforts, Tech Executive-1 had enlisted, and was continuing to enlist, the assistance of researchers at a U.S.-based university who were receiving and analyzing Internet data in connection with a pending federal government cybersecurity research contract; and (iii) SUSSMAN, Tech Executive-1, and Law Firm-1 had coordinated, and were continuing to coordinate, with representatives and agents of the Clinton Campaign with regard to the data and written materials that Sussmann gave to the FBI and the media.

Don’t get me wrong. This will clearly pass the incredibly low standard for materiality under existing precedent. Though Sussmann will surely make much of citing the invented standard Billy Barr used to try to dismiss the Mike Flynn prosecution, which first requires the investigation in question to be legitimate.

The Government is not persuaded that the January 24, 2017 interview was conducted with a legitimate investigative basis and therefore does not believe Mr. Flynn’s statements were material even if untrue. Moreover, we not believe that the Government can prove either the relevant false statements or their materiality beyond a reasonable doubt.

[snip]

In any event, there was no question at the FBI as to the content of the calls; the FBI had in its possession word-for-word transcripts of the actual communications between Mr. Flynn and Mr. Kislyak. See Ex. 5 at 3; Ex. 13. at 3. With no dispute as to what was in fact said, there was no factual basis for the predication of a new counterintelligence investigation. Nor was there a justification or need to interview Mr. Flynn as to his own personal recollections of what had been said. Whatever gaps in his memory Mr. Flynn might or might not reveal upon an interview regurgitating the content of those calls would not have implicated legitimate counterintelligence interests or somehow exposed Mr. Flynn as beholden to Russia.

If DOJ had no interest in figuring out whether Trump was undermining sanctions to pay off a quid pro quo, they sure as hell have no interest in launching a 3-year investigation to figure out the tie between these allegations and Hillary that was obvious to Priestap in real time, particularly given how quickly the FBI dismissed the allegations in 2017 and given that the allegations are not publicly known to have had a tie to their larger Russian investigation.

Still, while Durham will have no trouble proving Sussmann’s claimed lie meets the standards of materiality, Durham’s claims for it are ridiculous.

It’s a load of horseshit that FBI would have treated this tip any differently — which amounted to investigating it, alerting the press there was nothing to it, then dismissing it pretty quickly, as far as is public — if they knew that Sussmann was formally being paid at that meeting by Hillary, if he in fact was. Priestap knew Sussmann was representing Hillary and said as much in the best evidence Durham has! In fact, FBI’s warning to the NYT about this story in October could be presented as evidence that FBI already incorporated an assumption this came from Hillary.

Likewise, it’s a load of horseshit that FBI couldn’t know that the Bureau needed to ID the researchers behind the project. If I was able to figure that was important out before the 2016 election, and I did, then the experts at the FBI surely figured that out.

But what Durham’s materiality statement emphasizes — what Durham claims Sussmann intended to hide with his claimed lie — is that, “researchers at a U.S.-based university … were receiving and analyzing Internet data in connection with a pending federal government cybersecurity research contract.” That’s the significance of ¶¶23a through e of the indictment, which describe how TE-1 provided data that included some from an Executive Branch office of the U.S. government, which his company had obtained “as a sub-contractor in a sensitive relationship between the U.S. government and another company,” to the university at which Researcher 1 and 2 were working, and both with his university researcher allies and employees of his own company, he tasked people to research Donald Trump. Durham is suggesting that subset of data taints the whole pool that TE-1 shared, making it a Federal interest.

It’s not just that Durham is working on a theory that Sussmann deliberately dealt garbage to the FBI (which GOP sources also did on the Clinton Foundation) while trying to hide that fact. It’s that data originally sourced from the government was used in doing that research.

It’s actually the kind of argument that DOJ prosecutors typically succeed with. Except it’s all premised on proving that Sussman was trying to hide all this in his meeting with Baker. Even if the evidence surrounding the meeting weren’t so flimsy, this is another degree of motive that Durham is straining mightily to make.

Durham needs Sussmann to have lied, because a deliberate attempt to obscure the rest is necessary for his “storyline.” His evidence that Sussmann lied — much less, deliberately — is shoddy. But if he can’t get that, then his hopes for a larger “narrative” collapse.

The parts of the story Durham doesn’t tell

That becomes more clear when you consider some details that Durham doesn’t include in his indictment.

Two details that were public to everyone involved make it clear why Durham’s silence about the exact dates in July when this operation started is so corrupt.

On July 22, WikiLeaks published emails that were at the time believed and since have been confirmed by the FBI to have been hacked by Russia. Durham hides the dates in July when many of these events transpired, but everything he includes suggests this activity post-dated the time when WikiLeaks published stolen emails and the entire security community in the US, surely including every researcher mentioned in this story, coalesced on the belief that Russia was the culprit. Durham refers to Russia’s attack on Hillary (and therefore on the US) inaccurately as, “the hacking of its email servers by the Russian government” and “a hack” (the hack went well beyond just email and continued through the period of Sussmann’s meeting with Baker). But, amazingly, Durham’s “narrative” doesn’t account for the fact that Hillary was targeted not just with an attack but with an information operation. And the timeline he presents here affirmatively hides that these events took place after the entire security community understood that there was an information operation aspect to the attack.

Then, on July 27, Trump gave a press conference in Florida where he said numerous things that make all the actions of Sussmann and others justifiable on national security grounds. First, Trump raised doubts about the Russian attribution of the DNC hack that, by that point in July, was the consensus among national security experts, undoubtedly including every tech expert mentioned in this indictment.

I watched this guy Mook and he talked about we think it was Russia that hacked. Now, first of all was what was said on those that’s so bad but he said I watched it. I think he was live. But he said we think it was Russia that hacked.

And then he said — and this is in person sitting and watching television as I’ve been doing — and then he said could be Trump, yeah, yeah. Trump, Trump, oh yeah, Trump. He reminded me of John Lovitz for “Saturday Night Live” in the liar (ph) where he’d go yes, yes, I went to Harvard, Harvard, yes, yes. This is the guy, you have to see it. Yes, it could be Trump, yes, yes. So it is so farfetched. It’s so ridiculous. Honestly I wish I had that power. I’d love to have that power but Russia has no respect for our country.

And that’s why — if it is Russia, nobody even knows this, it’s probably China, or it could be somebody sitting in his bed. But it shows how weak we are, it shows how disrespected we are. Total — assuming it’s Russia or China or one of the major countries and competitors, it’s a total sign of disrespect for our country. Putin and the leaders throughout the world have no respect for our country anymore and they certainly have no respect for our leader. So I know nothing about it.

Trump then offered his bullshit explanation for why he wouldn’t release his tax returns, framing it in terms of whether he had business ties to Russia.

TRUMP: Because it’s under order. And I’ll release them when the audits completed. Nobody would release when it’s under — I’ve had audits for 15 or 16 years. Every year I have a routine audit. I’m under audit, when the audits complete I’ll release them. But zero, I mean I will tell you right now, zero, I have nothing to do with Russia, yes?

Trump then said the nation-state hack of his opponent wasn’t the important thing, the content of the emails that were released was, thereby encouraging the press to participate in the information operation aspect of this attack.

He already did something today where he said don’t blame them, essentially, for your incompetence. Let me tell you, it’s not even about Russia or China or whoever it is that’s doing the hacking. It was about the things that were said in those e-mails. They were terrible things, talking about Jewish, talking about race, talking about atheist, trying to pin labels on people — what was said was a disgrace, and it was Debbie Wasserman Schultz, and believe me, as sure as you’re sitting there, Hillary Clinton knew about it. She knew everything.

Trump then asked Russia to further hack his opponent.

Russia, if you’re listening, I hope you’re able to find the 30,000 e-mails that are missing.

Trump then doubled down on the comment he made about his taxes, assuring the press that he had “zero” business ties with Russia.

TRUMP: No, I have nothing to do with Russia, John (ph). How many times do I have say that? Are you a smart man? I have nothing to with Russia, I have nothing to do with Russia.

And even — for anything. What do I have to do with Russia? You know the closest I came to Russia, I bought a house a number of years ago in Palm Beach, Florida.

Palm Beach is a very expensive place. There was a man who went bankrupt and I bought the house for $40 million and I sold it to a Russian for $100 million including brokerage commissions. So I sold it. So I bought it for 40, I told it for 100 to a Russian. That was a number of years ago. I guess probably I sell condos to Russians, OK?

QUESTION: (OFF-MIKE)

TRUMP: Of course I can. I told you, other than normal stuff — I buy a house if I sold it to a Russian. I have nothing to do with Russia. I said that Putin has much better leadership qualities than Obama, but who doesn’t know that?

QUESTION: (OFF-MIKE)

TRUMP: Of course not. I own the Trump organization. Zero, zero. Go ahead.

Trump then reiterated his claim that no one could attribute the DNC hack to Russia.

TRUMP: No, but they seem to be, if it’s Russians. I have no idea. It’s probably not Russia. Nobody knows if it’s Russia. You know the sad thing is? That with the technology and the genius we have in this country, not in government unfortunately, but with the genius we have in government, we don’t even know who took the Democratic National Committee e-mails. We don’t even know who it is.

I heard this morning, one report said they don’t think it’s Russia, they think it might be China. Another report said it might be just a hacker, some guy with a 200 I.Q. that can’t get up in the morning, OK? Nobody knows. Honestly they have no idea if it’s Russia. Might be Russia. But if it’s any foreign country, it shows how little respect they have for the United States. Yes, ma’am.

Finally, Trump also stated that he would consider lifting sanctions on Russia.

QUESTION: I would like to know if you became president, would you recognize (inaudible) Crimea as Russian territory? And also if the U.S. would lift sanctions that are (inaudible)?

TRUMP: We’ll be looking at that. Yeah, we’ll be looking.

Each of these comments, individually, would have raised eyebrows. The same comments, made by an American citizen, would equally have raised alarms among those committed to cybersecurity.

But for a presidential candidate to encourage the hostile nation-state information operation targeting his opponent, then ask the hostile nation-state to further target her, in conjunction with the repeated denials of any business ties to Russia raised real, legitimate questions about whether Trump was putting his own interests above the national security of the country.

You might excuse Durham for excluding this from his indictment because after all he was busy indicting a ham sandwich based on hearsay evidence he might be able to exclude these facts at trial. Except that an August 20 comment from TE-1 that Durham quotes in his indictment may be a direct reference to (and at the least incorporates knowledge of) this press conference.

Trump has claimed he and his company have had NO dealings with .ru other than the failed Casino, and the Miss universe pageant. He claims absolutely NO interaction with any financial institutions. So any potential like that would be jackpot.

That is, Durham included what appears to be a reference to the July 27 press conference. It appears (though Durham obscures this point) that all the actions laid out in this indictment post-date the press conference. Virtually everyone in the US committed to ensuring America’s national security was alarmed by Trump’s comments in this press conference. Yet Durham doesn’t acknowledge that all these actions took place in the wake of public comments that made it reasonable for those committed to cybersecurity to treat Donald Trump as a national security threat, irrespective of partisan affiliation.

Durham will work hard to exclude detail of Trump’s press conference from trial. But I assume that if any of the named subjects of this investigation were to take the stand at trial, they would point out that it was objectively reasonable after July 27 to have national security concerns based on Trump’s encouragement of Russia’s attack on Hillary Clinton and his defensive denials of any business ties. Any of the named subjects of the indictment would be able to make a strong case that there was reason to want to, as a matter of national security, test Trump’s claim to have no financial ties to Russia. Indeed, the bipartisan SSCI Report concluded that Trump posed multiple counterintelligence concerns, and therefore has concluded that Durham’s portrayal of politics as the only potential motive here to be false.

Central to Durham’s theory of prosecution is that there was no sound national security basis to respond to anomalous forensic data suggesting a possible financial tie between Trump and Russia. Except that, after that July 27 speech — and all of these events appear to post-date it — that theory is unsustainable.

The parts of the story Durham doesn’t tell

And not only was it objectively reasonable to test whether Trump’s claims to have “zero” business ties to Russia were false, but those suspecting that Trump was hiding such ties were, in fact, correct.

According to Michael Cohen, when Trump walked off the stage from that July 27 press conference, Cohen asked Trump why he had claimed that he had zero business ties with Russia when he had in fact been pursuing an impossibly lucrative deal to brand a Trump Tower in Moscow. And we now know that within hours of Trump’s request, GRU hackers made a renewed assault on Hillary’s own servers. By the time security researchers pursued anomalous data suggesting covert communications with a Russian bank, Cohen had already participated in discussions about working with two sanctioned Russian banks to fund the Trump Tower deal, had agreed to work with a former GRU officer to broker it, had spoken to an aide of Dmitry Peskov, and had been told that Putin was personally involved in making the deal happen. Just on the Trump Tower basis alone, Trump had publicly lied in such a way that posed a counterintelligence risk to America.

But that was not the only thing that Trump had done by the date when a bunch of security researchers responded to anomalous forensic data to test whether Trump was hiding further ties to Russia’s attack on Hillary Clinton.

In March, Trump hired Paul Manafort, a financially desperate political operative with close ties to a Russian intelligence officer, Konstantin Kilimnik, who (SSCI provided three redacted examples of) may have been involved in the hack-and-leak operation. In April, Manafort started leveraging his relationship with Trump to try to make money. In May, Manafort started regularly sending Kilimnik the campaign’s internal polling data. All that happened before researchers started testing Trump’s claims to have had no tie to Russia. On July 28, Kilimnik emailed Manafort to set up a meeting to talk about the future of Ukraine. Just days after the researchers started the inquiry, on August 2, Manafort met with Kilimnik to discuss carving up Ukraine in the same meeting where he described his strategy to win the election.

In April, an academic with close ties to Russia, Joseph Mifsud, told an unqualified braggart whom Trump had added to his team to pretend he had a foreign policy plan, George Papadopoulos, that Russia had thousands of Hillary’s emails that they intended to release to help Trump.

In May, according to Rick Gates’ testimony, Roger Stone started claiming he had advance knowledge of what would become the WikiLeaks releases. On or about June 15, per Gates, Stone told him that “he had contact with Guccifer 2.” According to a warrant affidavit targeting Stone, he searched Google on “Guccifer” before the Guccifer website went up that day. On June 23, Manafort called Stone and then the two old friends met for 30 minutes in the Trump cafeteria. On June 30, Stone spoke to Trump. According to multiple sources (including Michael Cohen), Stone knew of the DNC drop before it happened.

In June, Don Jr accepted a meeting with Natalia Veselnitskaya at which he believed he would get dirt on Hillary Clinton. At the meeting, Veselnitskaya asked Don Jr to end sanctions on Russia, and the candidate’s son said his dad would reconsider it if he won.

In short, the researchers who, in the wake of Trump’s damning comments, were testing whether Trump had lied about having ties to Russia, not only had objectively reasonable reasons to do that research. But their suspicions were proven correct, over and over again.

Durham describes the outcome of the FBI investigation into the allegations this way:

The FBI’s investigation of these allegations nevertheless concluded that there was insufficient evidence to support the allegations of a secret communications channel with Russian Bank-1. In particular, and among other things, the FBI’s investigation revealed that the email server at issue was not owned or operated by the Trump Organization but, rather, had been administered by a mass marketing email company that sent advertisements for Trump hotels and hundreds of other clients.

Nothing here suggests the FBI disproved that this was an anomaly.

And there’s one more detail that Durham didn’t include in the Sussmann indictment: on July 26, Australia first shared their report about what George Papadopoulos told Alexander Downer in May. The next day, July 27, the FBI Legat in the UK got the tip. On July 31 — before the substantive research into the Alfa Bank allegation began — the FBI opened an UNSUB investigation into who got advance warning about the Russian operation and shared it with George Papadopoulos. In other words, by hiding the dates when Tea Leaves first discovered the anomalous data, Durham is hiding not just the damning things that publicly happened before the Alfa Bank operation got started, but probably details about the tip that turned into the Crossfire Hurricane investigation.

In the wake of the Sussmann indictment, the usual Russian denialists have claimed that this proves that what they call “Russiagate” was all a fraud.

Such claims defy the rules of physics, suggesting that events that happened after the FBI opened an investigation to learn how and why the Trump campaign (via three channels, as it turns out) learned of the Russian attack in advance were in fact the cause of it.

It is likely that Durham will be able to exclude all these details from a Michael Sussmann trial, at least if it remains just a false statements case. He will be able to convince Judge Christopher Cooper, who is presiding over the case, that this information — that the researchers not only had reason to believe Trump presented a cybersecurity risk to the country, but that the researchers turned out to be right, and that FBI had itself determined there was reason to carry out the same kinds of investigations that the researchers did, possibly before any one of them took a single step — is irrelevant to the case against Sussmann. But if Durham charges ConFraudUS based on a claim that it was illegitimate to look into why Donald Trump was inviting Russia to hack his opponent, it will become centrally important that, before these researchers started conducting their investigation, the FBI had likewise decided such an investigation had merit.

The Alfa Bank story was sleazy and unethical. But it was still, nevertheless, an instance where someone representing the victim of a nation-state attack attempted to chase down information that may have pertained to that nation-state attack.

John Durham will go down in history as the guy who decided that torturing detainees, even in excess of legal guidance, was not a crime, but a victim sharing concerns about nation-state hacking is.

Update: It’s likely that Richard Burt was one of the people investigated as part of this effort. Per the Mueller Report, he was the person Petr Aven asked to establish a tie with Trump’s transition in 2016.

After the December 2016 all-hands meeting, A ven tried to establish a connection to the Trump team. A ven instructed Richard Burt to make contact with the incoming Trump Administration. Burt was on the board of directors for LetterOne (L 1 ), another company headed by Aven, and had done work for Alfa-Bank. 1169 Burt had previously served as U.S. ambassador to Germany and Assistant Secretary of State for European and Canadian Affairs, and one of his primary roles with Alfa-Bank and Ll was to facilitate introductions to business contacts in the United States and other Western countries. 1170

While at a L1 board meeting held in Luxembourg in late December 2016, Aven pulled Burt aside and told him that he had spoken to someone high in the Russian government who expressed interest in establishing a communications channel between the Kremlin and the Trump Transition Team. 1171 Aven asked for Burt’s help in contacting members of the Transition Team. 1172 Although Burt had been responsible for helping Aven build connections in the past, Burt viewed Aven’s request as unusual and outside the normal realm of his dealings with Aven. 1173

Burt, who is a member of the board of CNI (discussed at Volume I, Section IV.A.4, supra), 1174 decided to approach CNI president Dimitri Simes for help facilitating A ven’ s request, recalling that Simes had some relationship with Kushner. 1175 At the time, Simes was lobbying the Trump Transition Team, on Burt’s behalf, to appoint Burt U.S. ambassador to Russia.1176

Burt contacted Simes by telephone and asked if he could arrange a meeting with Kushner to discuss setting up a high-level communications channel between Putin and the incoming Administration. 1177 Simes told the Office that he declined and stated to Burt that setting up such a channel was not a good idea in light of the media attention surrounding Russian influence in the U.S. presidential election. 1178 According to Simes, he understood that Burt was seeking a secret channel, and Simes did not want CNI to be seen as an intermediary between the Russian government and the incoming Administration. 1179 Based on what Simes had read in the media, he stated that he already had concerns that Trump’s business connections could be exploited by Russia, and Simes said that he did not want CNI to have any involvement or apparent involvement in facilitating any connection. 118

Update: Corrected scope of Benczkowski’s recusal. His should cover the server issue (and Alfa Bank issues for the first two years he was CRM).

Update: Brian Krebs wrote a post laying out all the people who still believe there’s something going on technically. I don’t think that’s inconsistent, at all, with this one. As noted, everyone who looked at this believes it’s an anomaly. What I keep pointing to is the aftermath of that anomaly got Alfa Bank to act in a certain way that is consistent with Putin’s interests. Krebs notes that it has also led to a lot of scrutiny of security researchers in the US, not unlike the way the aftermath of the Steele dossier discredited most top Russian experts in the US government.

Update: This transcript of Preet Bharara and Joyce Vance discussing the many weaknesses of the Durham indictment largely replicates what I’ve laid out here but is worth a review.

SDNY Showed Probable Cause Rudy Giuliani Was Criming While He Represented Trump in the Russian Investigation

In August, the Special Master reviewing Rudy Giuliani and Victoria Toensing’s seized phone contents for privilege determinations, Barbara Jones, publicly filed notice of a conflict between the Trumpsters and the government: how to apply the date range in the warrants.

There is a dispute between Mr. Giuliani and the Government over whether the Special Master’s review process should be limited to materials with electronic metadata within the date range set forth in the search warrants. Mr. Giuliani argues for such a date range limitation; the Government argues against it. I have informed the parties that the issue should be briefed to, and decided by, the Court, and that I would set a briefing schedule for Mr. Giuliani’s motion.

On Thursday, Judge Paul Oetken released his decision deciding the matter. Effectively, he adopted the government’s compromise that it exclude everything that pre-dates 2018.

On June 9, 2021, this Court appointed the Honorable Barbara S. Jones (Ret.) as Special Master to “render decisions regarding privilege issues relating to the materials seized in the execution of certain search warrants” that are the subject of this matter. (Dkt. No. 25.) Giuliani and Toensing ask the Court to restrict the Special Master’s review to the time periods set forth in the search warrants: August 1, 2018 to December 31, 2019 for Giuliani; and January 1, 2019 to December 31, 2019 for Toensing.

The Government has proposed a compromise that significantly limits the scope of the parties’ dispute: it consents to the Special Master’s excluding from her review any documents that clearly and entirely predate 2018. The Court approves this compromise and directs the Special Master to proceed accordingly.

But Oetken notes that the warrants permit the government to determine what materials are responsive to the warrant, meaning Jones should not determine anything further than what is privileged. And he laid out that the warrants permit the government to access materials that were deleted (or accessed, sent, or modified) between — for Rudy — August 1, 2018 and December 31, 2019.

Third, the warrants cover materials “sent, received, posted, created, or otherwise accessed, established, modified, or deleted during [the time range].” It is entirely possible that a document “dated” outside the time range may have been “accessed,” “sent,” “modified,” or “deleted” during the time range. Moreover, the warrants permit review of any of the seized material “if necessary to evaluate its contents and to locate all data responsive to the warrant.” See, e.g., United States v. Gatto, 313 F. Supp. 3d 551, 561 (S.D.N.Y. 2018).

The timeline here is consistent with what I intuited in this post — and, based on what Lev Parnas and others previously revealed, it clarifies the exact date range of the files obtained in November 2019. The Rudy range covers eight months of the period when he was representing Donald Trump in the Russian investigation, goes through the period when (Parnas has earlier alleged) people started deleting files during Trump’s first impeachment, and continues through the meeting Rudy had with Andrii Derkach in December 2019.

And unsurprisingly, the government obtained warrants covering the same period of the earlier search on the parties’ iCloud accounts by providing probable cause to show that they were deleting and modifying earlier files, even files from earlier in 2018, to include the period when both lawyers were pitching a means to represent Trump.

But it’s clear that Rudy and Toensing worry the government may find evidence of crimes that exceeds this timeline, which would give them the opportunity to obtain new warrants with a broader timeframe. That’s because they asked Oetken to force the government to delete everything else.

Finally, the Court denies Giuliani’s and Toensing’s request to order the Government to return or destroy any material at this time.

Oetken denied this request. This means materials that predate these warrants, but also materials from more recently, when Rudy was laundering Russian disinformation and making wildly false claims about the election results, would remain available for further search, if the government can or has demonstrated probable cause.

We’ll learn more about this next week. Oetken also ruled that the letters disputing all this, including those from Dmitro Firtash, will be docketed after the parties fight over redactions.

DOJ Put Someone Who Enabled Sidney Powell’s Lies — Jocelyn Ballantine — in Charge of Prosecuting the Proud Boys

Because of Joe Biggs’ role at the nexus between the mob that attacked Congress and those that orchestrated the mob, his prosecution is the most important case in the entire January 6 investigation. If you prosecute him and his alleged co-conspirators successfully, you might also succeed in holding those who incited the attack on the Capitol accountable. If you botch the Biggs prosecution, then all the most important people will go free.

Which is why it is so unbelievable that DOJ put someone who enabled Sidney Powell’s election season lies about the Mike Flynn prosecution, Jocelyn Ballantine, on that prosecution team.

Yesterday, at the beginning of the Ethan Nordean and Joe Biggs hearing, prosecutor Jason McCullough told the court that in addition to him and Luke Jones, Ballantine was present at the hearing for the prosecution. He may have said that she was “overseeing” this prosecution. (I’ve got a request for clarification in with the US Attorney’s office.)

Ballantine has not filed a notice of appearance in the case (nor does she show on the minute notice for yesterday’s hearing). In the one other January 6 case where she has been noticeably involved — electronically signing the indictment for Nick Kennedy — she likewise has not filed a notice of appearance.

Less than a year ago when she assisted in DOJ’s attempts to overturn the Mike Flynn prosecution, Ballantine did three things that should disqualify her from any DOJ prosecution team, much less serving on the most important prosecution in the entire January 6 investigation:

  • On September 23, she provided three documents that were altered to Sidney Powell, one of which Trump used six days later in a packaged debate attack on Joe Biden
  • On September 24, she submitted an FBI interview report that redacted information — references to Brandon Van Grack — that was material to the proceedings before Judge Emmet Sullivan
  • On October 26, she claimed that lawyers for Peter Strzok and Andrew McCabe had checked their clients’ notes to confirm there were no other alterations to documents submitted to the docket; both lawyers refused to review the documents

After doing these things in support of Bill Barr’s effort to undermine the Flynn prosecution (and within days of the Flynn pardon), Ballantine was given a confidential temporary duty assignment (it may have been a CIA assignment). Apparently she’s back at DC USAO now.

Three documents got altered and another violated Strzok and Page’s privacy

As a reminder, after DOJ moved to hold Mike Flynn accountable for reneging on his plea agreement, Billy Barr put the St. Louis US Attorney, Jeffrey Jensen, in charge of a “review” of the case, which DOJ would later offer as its excuse for attempting to overturn the prosecution.

On September 23, Ballantine provided Powell with five documents, purportedly from Jensen’s investigation into the Flynn prosecution:

I outlined the added date on the first set of Strzok notes here:

There was never any question that the notes could have been taken no earlier than January 5, because they memorialized Jim Comey’s retelling of a meeting that other documentation, including documents submitted in the Flynn docket, shows took place on January 5. Even Chuck Grassley knows what date the meeting took place.

But DOJ, while using the notes as a central part of their excuse for trying to overturn the Flynn prosecution, nevertheless repeatedly suggested that there was uncertainty about the date of the notes, claiming they might have been taken days earlier. And then, relying on DOJ’s false representations about the date, Sidney Powell claimed they they showed that Joe Biden — and not, as documented in Mary McCord’s 302, Bob Litt — was the one who first raised the possibility that Flynn may have violated the Logan Act.

Strzok’s notes believed to be of January 4, 2017, reveal that former President Obama, James Comey, Sally Yates, Joe Biden, and apparently Susan Rice discussed the transcripts of Flynn’s calls and how to proceed against him. Mr. Obama himself directed that “the right people” investigate General Flynn. This caused former FBI Director Comey to acknowledge the obvious: General Flynn’s phone calls with Ambassador Kislyak “appear legit.” According to Strzok’s notes, it appears that Vice President Biden personally raised the idea of the Logan Act.

During the day on September 29, Powell disclosed to Judge Sullivan that she had spoken to Trump (as well as Jenna Ellis) about the case. Then, later that night, Trump delivered a prepared attack on Biden that replicated Powell’s false claim that Biden was behind the renewed investigation into Flynn.

President Donald J. Trump: (01:02:22)
We’ve caught them all. We’ve got it all on tape. We’ve caught them all. And by the way, you gave the idea for the Logan Act against General Flynn. You better take a look at that, because we caught you in a sense, and President Obama was sitting in the office.

In a matter of days, then, what DOJ would claim was an inadvertent error got turned into a campaign attack from the President.

When DOJ first confessed to altering these notes, they claimed all the changes were inadvertent.

In response to the Court and counsel’s questions, the government has learned that, during the review of the Strzok notes, FBI agents assigned to the EDMO review placed a single yellow sticky note on each page of the Strzok notes with estimated dates (the notes themselves are undated). Those two sticky notes were inadvertently not removed when the notes were scanned by FBI Headquarters, before they were forwarded to our office for production. The government has also confirmed with Mr. Goelman and can represent that the content of the notes was not otherwise altered.

Similarly, the government has learned that, at some point during the review of the McCabe notes, someone placed a blue “flag” with clear adhesive to the McCabe notes with an estimated date (the notes themselves are also undated). Again, the flag was inadvertently not removed when the notes were scanned by FBI Headquarters, before they were forwarded to our office for production. Again, the content of the notes was not otherwise altered.

There are multiple reasons to believe this is false. For example, when DOJ submitted notes that Jim Crowell took, they added a date in a redaction, something that could in no way be inadvertent. And as noted, the January 5 notes had already been submitted, without the date change (though then, too, DOJ claimed not to know the date of the document).

But the most important tell is that, when Ballantine sent Powell the three documents altered to add dates, the protective order footer on the documents had been removed in all three, in the case of McCabe’s notes, actually redacted. When she released the re-altered documents (someone digitally removed the date in the McCabe notes rather than providing a new scan), the footer had been added back in. This can easily be seen by comparing the altered documents with the re-altered documents.

The altered January 5, 2017 Strzok notes, without the footer:

The realtered January 5, 2017 Strzok notes, with the footer:

The second set of Strzok notes (originally altered to read March 28), without the footer:

The second set of Strzok notes, with the footer.

The altered McCabe noteswith the footer redacted out:

The realtered McCabe notes, with the footer unredacted:

This is something that had to have happened at DOJ (see William Ockham’s comments below and this post for proof in the metadata that these changes had to have been done by Ballantine). The redaction of the footers strongly suggests that they were provided to Powell with the intention of facilitating their further circulation (the other two documents she shared with Powell that day had no protective order footer). In addition, each of these documents should have a new Bates stamp.

DOJ redacted Brandon Van Grack’s non-misconduct

On September 24, DOJ submitted a report of an FBI interview Jeffrey Jensen’s team did with an Agent who sent pro-Trump texts on his FBI-issued phone, Bill Barnett. In the interview, Barnett made claims that conflicted with actions he had taken on the case. He claimed to be unaware of evidence central to the case against Flynn (for example, that Flynn told Sergey Kislyak that Trump knew of something said on one of their calls). He seemed unaware of the difference between a counterintelligence investigation and a criminal one. And he made claims about Mueller prosecutors — Jeannie Rhee and Andrew Weissmann — with whom he didn’t work directly. In short, the interview was obviously designed to tell a politically convenient story, not the truth.

Even worse than the politicized claims that Barnett made, the FBI or DOJ redacted the interview report such that all reference to Brandon Van Grack was redacted, substituting instead with the label, “SCO Atty 1.” (References to Jeannie Rhee, Andrew Weissmann, and Andrew Goldstein were not redacted; there are probable references to Adam Jed and Zainab Ahmad that are not labeled at all.)

The result of redacting Van Grack’s name is that it hid from Judge Sullivan many complimentary things that Barnett had to say about Van Grack:

Van Grack’s conduct was central to DOJ’s excuse for throwing out the Flynn prosecution. Powell repeatedly accused Van Grack, by name, of engaging in gross prosecutorial misconduct. Yet the report was submitted to Judge Sullivan in such a way as to hide that Barnett had no apparent complaints about Van Grack’s actions on the Flynn case.

I have no reason to believe that Ballantine made those redactions. But according to the discovery letter she sent to Powell, she sent an unredacted copy to Flynn’s team, while acknowledging that the one she was submitting to the docket was redacted. Thus, she had to have known she was hiding material information from the Court when she submitted the interview report.

Ballantine falsely claimed Strzok and McCabe validated their notes

After some of these alterations were made public, Judge Sullivan ordered DOJ to authenticate all the documents they had submitted as part of their effort to overturn the Flynn prosecution. The filing submitted in response was a masterpiece of obfuscation, with three different people making claims while dodging full authentication for some of the most problematic documents. In the filing that Ballantine submitted, she claimed that Michael Bromwich and Aitan Goelman, lawyers for McCabe and Strzok, “confirmed” that no content was altered in the notes.

The government acknowledges its obligation to produce true and accurate copies of documents. The government has fully admitted its administrative error with respect to the failure to remove three reviewer sticky notes containing estimated date notations affixed to three pages of undated notes (two belonging to former Deputy Assistant Director Peter Strzok, and one page belonging to former Deputy Director Andrew McCabe) prior to their disclosure. These dates were derived from surrounding pages’ dates in order to aid secondary reviewers. These three sticky notes were inadvertently not removed when the relevant documents were scanned by the FBI for production in discovery. See ECF 259. The government reiterates, however, that the content of those exhibits was not altered in any way, as confirmed by attorneys for both former FBI employees. [underline original]

According to an email Bromwich sent Ballantine, when Ballantine asked for help validating the transcripts DOJ did of McCabe’s notes, McCabe declined to do so.

I have spoken with Mr. McCabe and he declines to provide you with any information in response to your request.

He believes DOJ’s conduct in this case is a shocking betrayal of the traditions of the Department of the Justice and undermines the rule of law that he spent his career defending and upholding. If you share with the Court our decision not to provide you with assistance, we ask that you share the reason.

We would of course respond to any request that comes directly from the Court.

And according to an email Goelman sent to Ballantine, they said they could not check transcriptions without the original copies of documents.

Sorry not to get back to you until now.  We have looked at the attachments to the email you sent yesterday (Sunday) afternoon.  We are unable to certify the authenticity of all of the attachments or the accuracy of the transcriptions.  To do so, we would need both more time and access to the original notes, particularly given that U.S. Attorney Jensen’s team has already been caught altering Pete’s notes in two instances.  However, we do want to call your attention to the fact that Exhibit 198-11 is mislabeled, and that these notes are not the notes of Pete “and another agent” taken during the Flynn interview.

Additionally, we want to register our objection to AUSA Ken Kohl’s material misstatements to Judge Sullivan during the September 29, 2020, 2020, [sic] telephonic hearing, during which Mr. Kohl inaccurately represented that Pete viewed himself as an “insurance policy” against President Trump’s election.

I have no reason to believe the content was altered, though I suspect other things were done to McCabe’s notes to misrepresent the context of a reference in his notes to Flynn. But not only had McCabe and Strzok not validated their notes, but they had both pointedly refused to. Indeed, during this same time period, DOJ was refusing to let McCabe see his own notes to prepare for testimony before the Senate Judiciary Committee. Nevertheless, Ballantine represented to Judge Sullivan that they had.

It baffles me why DOJ would put Ballantine on the most important January 6 case. Among other things, the conduct I’ve laid out here will make it easy for the defendants to accuse DOJ of similar misconduct on the Proud Boys case — and doing just that happens to be Nordean’s primary defense strategy.

But I’m mindful that there are people in DC’s US Attorney’s Office (not Ballantine) who took actions in the past that may have made the January 6 attack more likely. In a sentencing memo done on Barr’s orders, prosecutors attempting to minimize the potential sentence against Roger Stone suggested that a threat four Proud Boys helped Roger Stone make against Amy Berman Jackson was no big deal, unworthy of a sentencing enhancement.

Second, the two-level enhancement for obstruction of justice (§ 3C1.1) overlaps to a degree with the offense conduct in this case. Moreover, it is unclear to what extent the defendant’s obstructive conduct actually prejudiced the government at trial.

Judge Jackson disagreed with this assessment. In applying the enhancement, she presciently described how dangerous Stone and the Proud Boys could be if they incited others.

Here, the defendant willfully engaged in behavior that a rational person would find to be inherently obstructive. It’s important to note that he didn’t just fire off a few intemperate emails. He used the tools of social media to achieve the broadest dissemination possible. It wasn’t accidental. He had a staff that helped him do it.

As the defendant emphasized in emails introduced into evidence in this case, using the new social media is his “sweet spot.” It’s his area of expertise. And even the letters submitted on his behalf by his friends emphasized that incendiary activity is precisely what he is specifically known for. He knew exactly what he was doing. And by choosing Instagram and Twitter as his platforms, he understood that he was multiplying the number of people who would hear his message.

By deliberately stoking public opinion against prosecution and the Court in this matter, he willfully increased the risk that someone else, with even poorer judgment than he has, would act on his behalf. This is intolerable to the administration of justice, and the Court cannot sit idly by, shrug its shoulder and say: Oh, that’s just Roger being Roger, or it wouldn’t have grounds to act the next time someone tries it.

The behavior was designed to disrupt and divert the proceedings, and the impact was compounded by the defendant’s disingenuousness.

The people at DOJ who claimed that this toxic team was not dangerous in the past may want to downplay the critical role that Stone and the Proud Boys played — using the same kind of incendiary behavior — in the January 6 assault.

Whatever the reason, though, it is inexcusable that DOJ would put someone like Ballantine on this case. Given Ballantine’s past actions, it risks sabotaging the entire January 6 investigation.

DOJ quite literally put someone who, less than a year ago, facilitated Sidney Powell’s lies onto a prosecution team investigating the aftermath of further Sidney Powell lies.

Update: DC USAO’s media person refused to clarify what Ballantine’s role is, even though it was publicly acknowledged in court.

We are not commenting on cases beyond what is stated or submitted to the Court. We have no comment in response to your question.

Update: Added links to William Ockham’s proof that Ballantine made the realteration of the McCabe notes.

Update: One more point on this. I am not claiming here that anyone at DOJ is deliberately trying to sabotage the January 6 investigation, just that putting someone who, less than a year ago, made multiple representations to a judge that could call into question her candor going forward could discredit the Proud Boys investigation. I think it possible that supervisors at DC USAO put her on the team because they urgently need resources and she was available (possibly newly so after the end of her TDY). I think it possible that supervisors at DC USAO who are also implicated in Barr’s politicization, perhaps more closely tied to the intervention in the Stone case, put her there with corrupt intent.

But it’s also important to understand that up until February 2020, she was viewed as a diligent, ruthless prosecutor. I presume she buckled under a great deal of pressure after that and found herself in a place where competing demands — her duty of candor to the Court and orders from superiors all the way up to the Attorney General — became increasingly impossible to square.

Importantly, Lisa Monaco’s chief deputy John Carlin, and probably Monaco herself, would know Ballantine from their past tenure in the National Security Division as that heretofore ruthless national security prosecutor. The only mainstream outlet that covered anything other than DOJ’s admission they had added post-its to the notes was Politico. And the instinct not to punish career employees like Ballantine would mean what she would have avoided any scrutiny with the transition. So her assignment to the case is not itself evidence of an attempt to sabotage the prosecution.

image_print