Doo-Doo Process: John Durham Claims to Know Better than Anthony Trenga and Two Juries

There’s something grotesque and unethical about John Durham’s conduct that has gotten little attention.

After getting his ass handed to him by two juries and one judge, in his report, Durham nevertheless repeated the allegations against Michael Sussmann and Igor Danchenko on which they have been acquitted. While in one discussion of his prosecutorial decisions, Durham described these as “allegations,” in his executive summary and elsewhere, he stated, as fact, that both men had made false or fabricated statements. Worse still, in his efforts to sustain his false statements allegations, Durham himself makes claims that were rebutted or undermined by the trial records.

John Durham lies about press contacts to cover up his failure to investigate exculpatory information

As a reminder, the researchers who found the Alfa Bank anomaly found it organically, and out of a suspicion — later validated by at least three Mueller prosecutions (Paul Manafort, Michael Cohen, and Alex Van der Zwaan) — that Trump and his associates were lying about their ties to Russia, Rodney Joffe shared the Alfa Bank anomaly with Michael Sussmann.

Sussmann definitely packaged up the allegations and asked Fusion GPS what they knew about Alfa Bank. He definitely billed that packaging-up process to Hillary. The campaign definitely approved sharing that information with the NYT.

But then, without the consent of the campaign, Sussmann blew their big story, by sharing the allegations with the FBI.

Sussmann claimed that he did so because, as a former cybersecurity prosecutor, he knew that if DOJ were going to have a chance to investigate these allegations, they would need to do so, covertly, before the allegations went public. He claimed to have done so because he had been in the position where a big allegation broke before law enforcement had an opportunity to investigate. As proof to support this claim, Sussmann noted — and over the course of months, forced Durham to collect the heretofore ignored evidence proving — that he helped the FBI kill the NYT story the campaign had approved, in the process making it clear that he had to ask someone (Joffe’s) consent to do so.

Because the FBI used overt means to investigate these allegations — a violation of DOJ pre-election guidelines that Durham doesn’t mention in his screed about the FBI — a seeming response to NYT’s efforts which was actually a response to the FBI bigfooting helped to fuel the story. The record shows, and Durham’s most aggressive prosecutor conceded at closing arguments, that the FBI fucked up this investigation in other ways, yet more FBI shortcomings that Durham doesn’t mention in his screed.

After the election, at a time when Sussmann no longer worked for Hillary, Joffe asked him to try to get the CIA to look at these anomalies. Before that meeting, Sussmann told one of his CIA interlocutors that he did have a client (something Sussmann also told to Congress), but described that his client wanted anonymity because of concerns about Russian retaliation. In the meeting where he passed off his thumb drives, he said he was not representing a client.

Those are the competing signals on which Durham obtained a criminal indictment and did so before having consulted significant swaths of directly relevant evidence: a question about how Sussmann intended those words, “represent” and “on behalf of,” a problem with the indictment that Sussmann identified immediately.

Here’s how Durham presented the Sussmann charges in the Executive Summary (all bold in this post my own).

The Office also investigated the actions of Perkins Coie attorney Michael Sussmann and others in connection with Sussmann’s provision of data and “white papers” to FBI General Counsel James Baker purporting to show that there existed a covert communications channel between the Trump Organization and a Russia-based bank called Alfa Bank. As set forth in Section IV.E.1.c.iii, in doing so he represented to Baker by text message and in person that he was acting on his own and was not representing any client or company in providing the information to the FBI. Our investigation showed that, in point of fact, these representations to Baker were false in that Sussmann was representing the Clinton campaign (as evidenced by, among other things, his law firm’s billing records and internal communications). 42 In addition, Sussmann was representing a second client, a technology executive named Rodney Joffe (as evidenced by various written communications, Sussmann’s subsequent congressional testimony, and other records).

Cyber experts from the FBI examined the materials given to Baker and concluded that they did not establish what Sussmann claimed they showed. At a later time, Sussmann made a separate presentation regarding the Alfa Bank allegations to another U.S. government agency and it too concluded that the materials did not show what Sussmann claimed. In connection with that second presentation, Sussmann made a similar false statement to that agency, claiming that he was not providing the information on behalf of any client.

[snip]

As explained in Section IV.E. l .c.i, the evidence collected by the Office also demonstrated that, prior to providing the unfounded Alfa bank claims to the FBI, Sussmann and Fusion GPS (the Clinton campaign’s opposition research firm) had provided the same information to various news organizations and were pressing reporters to write articles about the alleged secret communications channel. Moreover, during his September 2016 meeting at the FBI, Sussmann told Baker that an unnamed news outlet was in possession of the information and would soon publish a story about it. The disclosure of the media’s involvement caused the FBI to contact the news outlet whose name was eventually provided by Sussmann in the hope of delaying any public reporting on the subject. In doing so it confirmed for the New York Times that the FBI was looking into the matter. On October 31, 2016, less than two weeks before the election, the New York Times and others published articles on the Alfa Bank matter and the Clinton campaign issued tweets and public statements on the allegations of a secret channel of communications being used by the Trump Organization and a Russian bank – allegations that had been provided to the media and the FBI by Fusion GPS and Sussmann, both of whom were working for the Clinton campaign. [my emphasis; link]

And here’s how Durham presented his prosecutorial decision.

Accordingly, Sussmann’s conduct supports the inference that his representations to both the FBI and the CIA that he was not there on behalf of a client reflect attempts to conceal the role of certain clients, namely the Clinton campaign and Joffe, in Sussmann’s work. Such evidence also further supports the inference that Sussmann’s false statements to two different agencies were not a mistake or misunderstanding but, rather, a deliberate effort to conceal the involvement of specific clients in his delivery of data and documents to the FBI and CIA. [link]

[snip]

First, and as noted above, we identified certain statements that Sussmann made to the FBI and the CIA that the investigation revealed were false. Given the seriousness of the false statement and its effect on the FBI’s investigation, a federal Grand Jury found probable cause to believe that Sussmann had lied to the FBI and charged him with making a false statement to the Bureau, in violation of 18 U.S.C. § 1001. 1675 Ultimately, after a two-week trial, a jury acquitted Sussmann of the false statement charge.

We also considered whether any criminal actions were taken by other persons or entities in furtherance of Sussmann’s false statement to the FBI. The evidence gathered in the investigation did not establish that any such actions were taken. [link]

As noted above, just in these two passages Durham repeats, five times, that Sussmann made false statements, even though he never charged Sussmann with making false statements to the CIA and even though a jury found Sussmann not guilty of making false statements to the FBI (Durham also misrepresents that the billing evidence presented at trial, which didn’t show Sussmann billing Hillary for the meeting with Baker). This is a gross assault on due process, to accuse a man anew of the charges for which he has already been acquitted.

Durham claims, in explaining why he charged this flimsy case, that the [alleged] “false statement” was serious and had what he insinuates was a major effect on the FBI investigation. Remember: When Durham made this prosecutorial decision, he still had never bothered to check two Jim Baker phones in DOJ IG possession (one of which he had learned about years earlier), texts in Baker’s iCloud account that complicated his case, and documents in DOJ IG’s possession showing that the FBI understood — whether true or not — that the Alfa Bank allegation came from the DNC. Indeed, Durham obscures that while those Baker texts did show that Sussmann had conveyed such a claim by text, those belatedly discovered texts undermined Durham’s case at trial that Sussmann had repeated the claim in person (without providing any clarity about how Sussmann meant “on behalf of”). And one possible explanation for the acquittal is that the jury found that Sussmann didn’t repeat his claim that he was representing no client at the face-to-face meeting with Baker. Certainly, the record showed that whatever memory Baker had of that meeting had been selectively reconstructed with Durham’s help to match the story he needed to sustain a certain narrative, one that didn’t line up with the documentary evidence.

And evidence presented at trial completely undermined the claim that this was a material false claim, the reason Durham made the claim about seriousness in the first place. Sussmann’s attorneys showed that only the threat of prosecution altered FBI Agent Ryan Gaynor’s memory — backed by his contemporaneous notes — that, in fact, he always understood that the allegation came from a DNC attorney. Durham’s star FBI witness admitted on cross-examination that he developed his belief that a reference to the DNC in his colleague’s Lync texts was just a typo after prosecutor Andrew DeFilippis coached him on that point. There were other Lync texts recording a belief that the tip had come from the DNC. Several people at the FBI conducted this investigation as if they understood it to be an investigation of a DNC tip, which likely contributed to the errors the FBI made in their investigation. Durham claims the opposite.

Durham seems to hang his claim about seriousness on his own two inferences — one on top of another — that Sussmann had to have been deliberately hiding something, even though evidence presented at trial, most notably that Sussmann offered up information about having a client with both the FBI and CIA, undermined those inferences. As noted, Durham found April Lorenzen’s inferences as a private citizen to be potentially criminal, but he puts the weight of DOJ behind inferences that proved less robust than Lorenzen’s own.

Particularly given the fact that Durham only belatedly, months after indicting Sussmann, discovered evidence corroborating Sussmann’s explanation for reaching out to Baker — that he helped the FBI kill the NYT story the campaign very much wanted published — the Special Counsel’s misrepresentation of the timeline of press contacts is particularly dishonest. In response to an Eric Lichtblau email asking for more details about Russian hacking, Sussmann provided the tip. Durham’s claim that Sussmann “eventually provided” Lichtblau’s name falsely suggests it took more than a few days to make this happen. After that, Sussmann didn’t push the Alfa Bank story until it got published via other channels. For its part, Fusion was pushing this story weeks later, after April Lorenzen’s separately posted data had renewed questions about it. This muddled timeline repeats the outlandish claim Durham prosecutor Brittain Shaw made in opening arguments that an article most Democrats view as profoundly damaging was precisely the October Surprise Hillary wanted. But in this final report, it’s wildly dishonest spin to cover up the fact that Durham didn’t learn a key detail — that Sussmann helped kill the NYT story — until after charging him.

All the more so because telling the truth about Sussmann’s willingness to help the FBI kill the story suggests Sussmann’s version of the story is far more credible than Durham’s.

How Durham avoids admitting he charged a “literally true” statement as false

If you read nothing more than John Durham’s Executive Summary, you would never learn that John Durham falsely led the press to believe that Danchenko attributed the pee tape allegation to someone with distant ties to Hillary rather than the two Russians who admitted they went out drinking with Danchenko during the period in question. More importantly, you would never learn that Durham created that false pee tape panic out of what Judge Anthony Trenga ruled was a literally true statement.

This section of the Executive Summary, which doesn’t mention any prosecutorial decision regarding Dolan, is completely divorced from the prosecutorial decision it pertains to.

During the relevant time period, Danchenko maintained a relationship with Charles Dolan, a Virginia-based public relations professional who had previously held multiple positions and roles in the Democratic National Committee (“DNC”) and the Democratic Party. In his role as a public relations professional, Dolan focused much of his career interacting with Eurasian clients, with a particular focus on Russia. As described in Section IV.D. l.d.ii, Dolan previously conducted business with the Russian Federation and maintained relationships with several key Russian government officials, including Dimitry Peskov, the powerful Press Secretary of the Russian Presidential Administration. A number of these Russian government officials with whom Dolan maintained a relationship – and was in contact with at the time Danchenko was collecting information for Steele – would later appear in the Dossier.

In the summer and fall of 2016, at the time Danchenko was collecting information for Steele, Dolan traveled to Moscow, as did Danchenko, in connection with a business conference. As discussed in Section IV.D. l .d.iii, the business conference was held at the Ritz Carlton Moscow, which, according to the Steele Reports, was allegedly the site of salacious sexual conduct on the part of Trump. Danchenko would later inform the FBI that he learned of these allegations through Ritz Carlton staff members. Our investigation, however, revealed that it was Dolan, not Danchenko, who actually interacted with the hotel staff identified in the Steele Reports, so between the two, Dolan appears the more likely source of the allegations.

As discussed in Section IV.D. l .d.vi, our investigation also uncovered that Dolan was the definitive source for at least one allegation in the Steele Reports. This allegation, contained in Steele Report 2016/105, concerned the circumstances surrounding the resignation of Paul Manafort from the Trump campaign. When interviewed by the Office, Dolan admitted that he fabricated the allegation about Manafort that appeared in the Steele Report. Our investigation also revealed that, in some instances, Dolan independently received other information strikingly similar to allegations that would later appear in the Steele Reports. Nevertheless, when interviewed by the FBI, Danchenko denied that Dolan was a source for any information in the Steele Reports. [link]

When Durham gets around to describing his decision to charge Igor Danchenko in the Executive Summary, he makes no mention that one of those charges pertained to Dolan. Likewise, he makes no mention that Trenga threw out that charge before sending it to a jury.

Perhaps the most damning allegation in the Steele Dossier reports was Company Report 2016/95, which Steele attributed to “Source E,” one of Danchenko’s supposed sub-sources. This report, portions of which were included in each of the four Page FISA applications, contributed to the public narrative of Trump’s conspiring and colluding with Russian officials. As discussed in Section IV.D. l.f, Danchenko’s alleged source for the information (Source E) was an individual by the name of Sergei Millian who was the president of the Russian-American Chamber of Commerce in New York City and a public Trump supporter. The evidence uncovered by the Office showed that Danchenko never spoke with Sergei Millian and simply fabricated the allegations that he attributed to Millian.

When interviewed by Crossfire Hurricane investigators in late January 2017, Danchenko said that Source E in Report 2016/95 sounded as though it was Sergei Millian. As discussed in Section IV.D.1.f.i, Danchenko stated that he never actually met Millian. Instead, he said that in late-July 2016 he received an anonymous call from a person who did not identify himself, but who spoke with a Russian accent. Danchenko further explained that he thought it might have been Millian – someone Danchenko previously had emailed twice and received no response – after watching a YouTube video of Millian speaking. Thus, as detailed in Section IV.D. l .f.i, the total support for the Source E information contained in Steele Report 2016/95 is a purported anonymous call from someone Danchenko had never met or spoken to but who he believed might be Sergei Millian – a Trump supporter – based on his listening to a YouTube video of Millian. Unfortunately, the investigation revealed that, instead of taking even basic steps, such as securing telephone call records for either Danchenko or Millian to investigate Danchenko’ s hard-to-believe story about Millian, the Crossfire Hurricane investigators appear to have chosen to ignore this and other red flags concerning Danchenko’s credibility, as well as Steele’s.41

41 As noted in Section IV.D.2.f, a federal grand jury in the Eastern District of Virginia returned a five-count indictment against Danchenko charging him with making false statements. A trial jury, however, found that the evidence was not sufficient to prove his guilt beyond a reasonable doubt. See United States v. Igor Danchenko, 21-CR-245 (E.D. Va.). [link]

That’s what you’d learn from the Executive Summary.

It’s only in the body of his report where Durham reveals the Dolan-related charge and Judge Trenga’s finding that the statement he charged as a false statement was literally true. I’d like to congratulate Durham for here describing the false statements claims as “allegations” made by a grand jury, as distinct from the re-accusation of false statements made against Sussmann or his claim that Danchenko “fabricated the allegations” attributed to Millian. But even there he misrepresents the charges.

In November 2021, a grand jury sitting in the Eastern District of Virginia returned an indictment (“Indictment”) charging Igor Danchenko with five counts of making false statements to the FBI. The false statements, which were made during Danchenko’s time as an FBI CHS, related to his role as Steele’s primary sub-source for the Reports.

First, the Indictment alleged that Danchenko stated falsely that he had never communicated with Charles Dolan about any allegations contained in the Steele Reports. As discussed above, the documentary evidence clearly showed that Dolan was the source for at least one allegation in the Steele Reports. Specifically, that information concerned Manafort’s resignation as Trump’s campaign manager, an allegation Dolan told Danchenko that he sourced from a “GOP friend” but that he told our investigators was something he made up. 1384 The allegations regarding Dolan formed the basis of Count One of the Indictment.

Second, the Indictment alleged that Danchenko falsely stated that, in or about late July 2016, he received an anonymous phone call from an individual whom Danchenko believed to be Sergei Millian. Danchenko also falsely stated that, during this phone call, (i) the person he believed to be Millian informed him, in part, about information that the Steele Reports later described as demonstrating a well-developed “conspiracy of cooperation” between the Trump campaign and Russian officials, and (ii) Danchenko and Millian agreed to meet in New York. The available evidence was sufficient to prove beyond a reasonable doubt that Danchenko fabricated these facts regarding Millian. The allegations regarding Millian formed the bases for Counts Two through Five of the Indictment.

Following a one-week trial, and before the case went to the jury, the Court dismissed Count One of the Indictment pursuant to Federal Rule of Criminal Procedure 29. The Court held that Danchenko’s statement to the FBI regarding Dolan, i.e., that he [Danchenko] never “talked to [Dolan] about anything that showed up in the dossier” was “literally true” because, in fact, the information about Manafort was exchanged over email rather than in an actual verbal conversation. The Court denied Danchenko’s Rule 29 motion to dismiss related to the remaining counts of the Indictment. Following two days of deliberations, the jury concluded that the case had not been proven beyond a reasonable doubt.

In determining whether to bring criminal charges against Danchenko, the Office expected to be able to introduce additional evidence against Danchenko that supported the charged crimes. Thus, prior to trial, the Office moved in limine to introduce certain evidence as direct evidence of the charged crimes. Alternatively, the Office moved to admit the evidence as “other act” evidence pursuant to Federal Rule of Evidence 404(b) to prove Danchenko’ s motive, intent, plan and absence of mistake or accident. In particular, the Office sought permission to introduce evidence of:

(1) Danchenko’ s uncharged false statements to the FBI regarding his purported receipt of information reflecting Trump’s alleged salacious sexual activity at the Ritz Carlton Hotel in Moscow. In particular, the Office planned to call as a witness the German-national general manager of the Ritz Carlton, identified in the Steele Report 2016/080 as “Source E.” The Office expected the general manager would testify that he (i) had no recollection of speaking with Danchenko in June 2016 or at any time, (ii) had no knowledge of the allegations set forth in the Steele Report before their appearance in the media, and (iii) never discussed such allegations with Danchenko or any staff member at the hotel;

(2) Danchenko’s uncharged false statements to the FBI reflecting the fact that he never informed friends, associates, and/or sources that he worked for Orbis or Steele and that “you [the FBI] are the first people he’s told.” In fact, the evidence revealed that Danchenko on multiple occasions communicated and emailed with, among others, Dolan regarding his work for Steele and Orbis, thus potentially opening the door to the receipt and dissemination of Russian disinformation; and

(3) Danchenko’s email to a former employer in which Danchenko advised the employer, when necessary, to fabricate sources of information. Specifically, on February 24, 2016, just months before Danchenko began collecting information for the Steele Reports, the employer asked Danchenko to review a report that the employer’s company had prepared. Danchenko emailed the employer with certain recommendations to improve the report. One of those recommendations was the following:

Emphasize sources. Make them bold of CAPITALISED [sic]. The more sources the better. If you lack them, use oneself as a source ([Location redacted]-Washington-based businessman” or whatever) to save the situation and make it look a bit better. 1385

Danchenko’s advice that he attach multiple sources to information and obscure one’s own role as a source for information was consistent with Danchenko’s alleged false statements in which he denied or fabricated the roles of sources in the Steele Reports.

The Court ruled, however, that the evidence described above was inadmissible at trial. The prosecution was forced to then proceed without the benefit of what it believed in good faith was powerful, admissible evidence under Rule 404(6) of the Federal Rules of Evidence.

In reality, the question Danchenko answered about Dolan was an attempt to learn whether Dolan could have been a direct source to Steele, not to Danchenko. And Danchenko didn’t entirely deny talking to Dolan about such issues. He said they talked about “related issues perhaps but no, no, no, nothing specific.” One of the FBI Agents who tried to open an investigation into Dolan relied on the statements Danchenko did make, so it’s not like anything Danchenko said impeded that investigation.

Meanwhile, Durham’s description of the acquitted false statements against Millian conflates, as he repeatedly did during the prosecution, what Danchenko told the FBI he told Christopher Steele, and what showed up in the dossier, which Danchenko had no hand in writing. Danchenko said that some of the allegations in the dossier didn’t come from him — including the claim of conspiracy (and lots of FBI Agents have been disciplined because they didn’t pass on this detail to the FISA Court). What Danchenko told the FBI was that the caller had said there was an exchange of information with the Kremlin (which, in fact, Mueller’s investigation proved, there already had been!), but that there was, “nothing bad about it,” all of which (as Danchenko’s team made clear at trial) is utterly consistent with other things Millian was saying at the time. The alleged lie Danchenko told is that he believed at the time (in July 2016) that the caller was Millian. Also, Durham claims that Danchenko said he made plans to meet in New York; he doesn’t note that Danchenko said those were tentative plans. In other words, Durham here misrepresents what Danchenko actually said! Durham is the fabricator here, not Danchenko.

Having grossly overstated what the charge against Danchenko was, Durham claims that, “The available evidence was sufficient to prove beyond a reasonable doubt that Danchenko fabricated these facts regarding Millian.”

That’s why we have juries, buddy! No, there was not. Nuh uh.

For some reason, Durham feels the need to explain why he got his ass handed to him even though, he’s sure, he had enough evidence in hand to charge Danchenko.  He blames Judge Trenga’s exclusion of three pieces of evidence about uncharged conduct (here’s my post on that ruling and here’s Trenga’s order). Among the three pieces of evidence he claims he relied on when making a prosecutorial decision in November 2021 is an interview with the former General Manager of the Ritz that only happened in August 2022 (the indictment relies on Dolan and one of Dolan’s colleagues for that claim, not the Manager himself). At least as described, Durham would have needed a time machine for the GM’s testimony to have factored in his prosecutorial decision.

Plus, the claim that those three pieces of evidence — none of which directly pertain to Millian! — were what Durham relied on to make a prosecutorial decision in November 2021 conflicts with what his team said in a filing last September. Back then, they said certain emails from Millian were the most probative proof against Danchenko.

The July 2020 emails between Millian and Zlodorev also bear circumstantial guarantees of trustworthiness. Again, in July 2020, Millian had no motive to lie to Zlodorev.

Third, whether the statements relate to a material fact. The Government submits that this factor is not in dispute.

Fourth, whether the statements are the most probative evidence on the point. Millian’s emails written contemporaneous to the events at issue are undoubtedly the most probative evidence to support the fact that Millian had never met or spoken with the defendant.

Trenga decided those emails were inadmissible hearsay.

Durham probably points to three other pieces of evidence — one obtained nine months after the indictment and all unrelated to Millian — because to admit that his case relied on inadmissible hearsay would require Durham to admit something still more embarrassing. Those hearsay emails from Millian were only the most probative evidence because Durham insanely charged Danchenko relying on what Millian had said on his Twitter account.

Only three months after indicting Danchenko on November 3, 2021 did Durham get around to interviewing Millian.

1085 OSC Report of Interview of Sergei Millian on Feb. 5, 2022 at 1.

His team did that interview remotely; Durham didn’t even have direct proof that Millian was in Dubai when he did that interview.

The Government has conducted a virtual interview of Millian. Based on representations from counsel, the Government believes that Millian was located in Dubai at the time of the interview.

[snip]

The Government has also been in contact with Millian’s counsel about the possibility of his testimony at trial. Nonetheless, despite its best efforts, the Government’s attempts to secure Millian’s voluntary testimony have been unsuccessful. Moreover, counsel for Millian would not accept service of a trial subpoena and advised that he does not know Millian’s address in order to effect service abroad.

[snip]

In the case of a U.S. national residing in a foreign country, 28 U.S.C. § 1783 allows for the service of a subpoena on a U.S. national residing abroad. Here, the Government has made substantial and repeated efforts to secure Millian’s voluntary testimony. When those efforts failed, the Government attempted to serve a subpoena on Millian’s counsel who advised that he was not authorized to accept service on behalf of Mr. Millian. The Government, not being aware of Millian’s exact location or address, asked counsel to provide Millian’s address so that service of a subpoena could be effectuated pursuant to 28 U.S.C. § 1783. Counsel stated that he does not know Millian’s address. In any event, even if the Government had been able to locate Millian, it appears unlikely that Millian would comply with the subpoena and travel to the United States to testify.

And a week after that interview, Durham accused Millian (though he didn’t name him) of “misrepresent[ing] facts” when he claimed “they” were spying on the White House on the very same Twitter account on which Durham relied to obtain the indictment.

One day later, Millian’s Twitter account revealed that Millian told the Trump White House who was “working against them” long before it was publicly known (Durham made no mention of these Tweets when he tried to claim that emails Millian sent in 2020 could be considered reliable).

In other words, abundant evidence suggests that Durham indicted Danchenko without doing the most basic step first, testing Millian’s reliability. By the time he got to trial, Millian — who like Danchenko, had been the subject of a counterintelligence investigation, and who unlike Danchenko had been frolicking in St. Petersburg during 2016 with Oleg Deripaska, someone who had a key role in Russia’s interference in 2016 — proved more than unreliable.

Durham makes no mention of that truly humiliating prosecutorial misstep, an embarrassment set in motion when he decided to indict a man based on claims made on Twitter, in his entire Report.

And yet not only does Durham refuse to state clearly, in his description of the prosecutorial decision, that Danchenko was acquitted of the charges against him, in his Executive Summary he falsely claims that he has proven Danchenko fabricated the claim. Worse still, Durham complains about investigative steps the Crossfire Hurricane investigators appear to have taken (which are different from the Mueller ones, who obtained abundant records about Millian’s communications), but he himself focused exclusively on disproving a telephony call between the two men, in spite of evidence (including of the contacts setting up a meeting between Millian and George Papadopoulos in precisely the same period) that any such call would have happened over the Internet.

Durham does this while making it clear that one reason he charged the Millian counts is because the allegation attributed to Millian, “contributed to the public narrative of Trump’s conspiring and colluding with Russian officials.” That’s only a crime if someone lied to the FBI about it, and Durham didn’t prove his case that Danchenko did.

It should not be left to me, almost a week after this report got released, to point out something grotesque. Durham is still claiming that these men lied, even though two juries told him he didn’t have the evidence to prove that case. That’s not just a grave abuse of Michael Sussmann and Igor Dancheko’s due process, but it exhibits profound disrespect to the service of the jurors.

After both his acquittals, Durham issued a statement claiming, “we respect the jury’s decision and thank them for their service.” And then he wrote a 300-page report telling them he knew better.

Share this entry

John Durham Committed the “Crime” of “Inferring” of Which He Accused Rodney Joffe

I’d like to look at 13 instances in which the word, “inference” appears in the Durham Report.

Almost half come in Durham’s discussion of Rodney Joffe’s work on the Alfa Bank anomalies. Durham states as fact that Joffe “tasked” a number of people to “mine … data to establish ‘an inference’ … tying then-candidate Trump to Russia.”

With respect to the Alfa Bank materials, our investigation established that Joffe had tasked a number of computer technology researchers who worked for companies he was affiliated with, and who had access to certain internet records, to mine the internet data to establish “an inference” and “narrative” tying then-candidate Trump to Russia.

[snip]

In particular, in late July and early August, Joffe commenced a project in coordination with Sussmann and Perkins Coie to support an “inference” and “narrative” tying Trump to Russia. For example, records show that on three days in August 2016, Joffe had meetings or conference calls with Sussmann and Elias. 1401 At about the same time, Joffe began tasking his own employees and associates to mine and assemble internet data that would support such an inference or narrative. 1402

[snip]

Regarding this whole project, my opinion is that from DNS all we could gain even in the best case is an *inference*. I have not the slightest doubt that illegal money and relationships exist between pro-Russian and pro-Trump, meaning actual people very close to Trump if not himself, [meaning actual people very close to Trump if not himself. And by Putin’s traditional style, people Putin controls, but not himself. He controls the oligarchs and they control massive fortunes and cross nearly all major industries in a vast number of countries.]

But even if we found what Rodney asks us to find in DNS we don’t see the money flow, and we don’t see the content of some message saying “send me the money here” etc.

I could fill out a sales form on two websites, faking the other company’s email address in each form, and cause them to appear to communicate with each other in DNS (And other ways I can think of and I feel sure [University-1 Researcher-2] can think of[.])

IF Rodney can take the *inference* we gain through this team exercise … and cause someone to apply more use.fit! tools of more useful observation or study or questioning … then work to develop even an inference may be worthwhile.

That is how I understood the task. Because Rodney didn’t tell me more context or specific things. What [Cyber Researcher- 1] has been digging up is going to wind up being significant. It’s just not the case that you can rest assured that Hil[l]ary’s opposition research and whatever professional govts and investigative journalists are also digging … they just don’t all come up with the same things or interpret them the same way. But if you find any benefit in what [he] has done or is doing, you need to say so, to encourage [him]. Because we are both killing ourselves here, every day for weeks.

[I’m on the verge of something interesting with hosts that talk to the list of Trump dirty advisor domain resources, and hosts that talk to [Russian Bank1]-* domains. Take even my start on this and you have Tehran and a set of Russian banks they talk to. I absolutely do not assume that money is passing thru Tehran to Trump. It’s just one of many *inferences* I’m looking at.

SAME IRANIAN IP THAT TALKS TO SOME TRUMP ADVISORS, also talks to:

[list of domains redacted]

(Capitals don’t mean SUPER SIGNIFICANT it was just a heading.)

Many of the IPs we have to work with are quite MIXED in purpose, meaning that a lot of work is needed to WINNOW down and then you will still only be left in most cases with an *inference* not a certainty.]

Trump/ advisor domains I’ve been using. These include ALL from Rodney’s PDF [the Trump Associates List] plus more from [Cyber Researcher-1]‘s work[:

Trump/ advisor domains I’ve been using. These include ALL from [Tech Executive-1’s] PDF [the Trump Associate’s List] plus more from [name redacted, probably also Cyber Researcher-1]’s work: [list of domains redacted] [RUSSIAN BANK-1] DOMAINS [list of domains redacted] More needs to be added to both lists.]1438 

The word “inference” here comes not from Joffe, but from April Lorenzen, who wrote the large block quote here, to which I’ve added — in the italicized brackets — language from the Durham motion to get it admitted at trial. Even without the Lorenzen language Durham excludes, his deceit is clear, because someone that Durham has never included in his feverish conspiracy theories — Cyber Researcher-1 — is described as doing his or her own work. With Lorenzen’s language included, Durham’s deceit is still more obvious, given how Lorenzen talks about forming her own inference. Not to mention the fact that (as I noted here), many of Lorenzen’s inferences — starting with the fact that Trump’s campaign manager was laundering money from Russia through Cyprus and that he had a tie with Alfa Bank founder’s son-in-law or that Trump was hiding business ties with Russia — turned out to be 100% correct.

But Durham’s deceit goes even further, because the effort to review DNS data for signs of Russian hacking started, organically, in June, not in July in response to Joffe.

Durham’s misrepresentation of the relationship between the various researchers is particularly rich given that a technical review he had done months after indicting Sussmann revealed that the data Sussmann shared with the FBI was referred to as Lorenzen’s data, not Joffe’s.

The 851 records of resolutions on the USB drive were an exact match for a file of resolutions sent from University-1 Researcher-2 to University-I Researcher- 1 on July 29, 2016, which was referred to as “[first name of Tech Company-2 Executive-l]’s data.”

As it happens, three more of the appearances of the word “inference” in the Durham Report come from the technical review.

The FBI DNS experts with whom we worked also identified certain data and information that cast doubt upon several assertions, inferences, and allegations contained in (i) the above-quoted white papers about the Yotaphone allegations, and (ii) the presentation and Yotaphone-related materials that Sussmann provided to the CIA in 2017.

[snip]

Data files obtained from Tech Company-I, Tech Company-2, and University-I reflect that Yotaphone-related lookups involving IP addresses assigned to the EOP began long before November or December 2016 and therefore seriously undermine the inference set forth in the white paper that such lookups likely reflected the presence of a Trump transition-team member who was using a Yotaphone in the EOP.

[snip]

In sum, as a result of our investigation, the FBI experts advised us that actual data and information on YotaPhone resolution requests directly undermined or refuted several conclusions and inferences included in the Yotaphone white paper. 1674

But that technical review only treats claims made about Yotaphone, not the Alfa Bank allegations, as “inferences.”

I’ll return to the way that Durham presents this technical review at some later time. It doesn’t help Durham in the way he thinks it does.

The point being, though, is that Durham claimed that Joffe was directing people to make inferences about Alfa Bank. He investigated private citizens who made such inferences as a crime.

Which is why I find it telling that the remaining three uses of the word “inference” in the Durham report are his own.

For example, Durham infers, first, that Sussmann’s statements that he was not at the FBI or CIA on behalf of any client is proof he was hiding who his client(s) were, and from that inference, he in turn infers that Sussmann was deliberately trying to hide Clinton and Joffe.

Accordingly, Sussmann’s conduct supports the inference that his representations to both the FBI and the CIA that he was not there on behalf of a client reflect attempts to conceal the role of certain clients, namely the Clinton campaign and Joffe, in Sussmann’s work. Such evidence also further supports the inference that Sussmann’s false statements to two different agencies were not a mistake or misunderstanding but, rather, a deliberate effort to conceal the involvement of specific clients in his delivery of data and documents to the FBI and CIA.

Both these inferences are nonsense — not least because Clinton no longer was a client of Sussmann’s when he went to the CIA in 2017 and both in the process of setting up the CIA meeting and helping the FBI to kill the NYT Alfa Bank story, Sussmann revealed that he did have a client he was working with.

Durham simply refuses to consider the possibility that DNS experts can see anomalous traffic and view it with alarm. And he grossly misrepresents the evidence regarding whether Sussmann pushed the Alfa Bank story after helping the FBI to kill it, probably because that evidence strongly supports Sussmann’s claimed motive: to give the FBI a chance to investigate before the public story alerted those behind the anomaly.

The final use of the word inference in the report is even more egregious.

As discussed above, Fusion GPS approached Steele in May 2016. Prior to his retention, Glenn Simpson met with Steele at Heathrow Airport in London and pitched Steele on the opposition research project. 1100 Approximately one week later, Danchenko contacted RIA Novosti journalists seeking Millian’s contact information. 1101 The timing of Danchenko’s request to RIA Novosti on the heels of Steele’s meeting with Simpson in London strongly supports the inference that Fusion GPS directed Steele to pursue Millian. 1102 Indeed, by the time of Steele’s meeting with Simpson, Nellie Ohr had already identified Millian’s alleged connections to Trump.

As with Carter Page (and Felix Sater, the focus on whom Durham continually downplayed over the course of this investigation), it didn’t take a research firm to identify Millian’s ties to Trump. Especially not with Millian bragging of those ties. Indeed, elsewhere Durham suggests Ohr learned of Millian from the RIA Novosti interviews he did in April. RIA Novosti was just as accessible to Danchenko as it was to Ohr.

But once you’ve traced the interest in Millian back to a Nellie Ohr report completed on April 22, 2016, then you’re tracking the research started no later than November 2015 under Paul Singer. You’re blaming Hillary for a project she took over from a right wing billionaire. You’re also tracking research that turned out to be reliable and accurate.

Again, these kinds of inferences are the stuff that Durham tried to criminalize when Lorenzen, a private citizen, made them.

But he nevertheless included them in a declination report provided to the Attorney General.

Share this entry

John Durham, High Priest of the Cult of the Coffee Boy

One of the most telling passages in the entire Durham Report is this one:

245 See supra§ IV.A.3.a (discussing the views of Papadopoulos held by the Australian diplomats and noting his strengths and weaknesses). Understandably, as noted below, when Crossfire Hurricane was opened, serious efforts were made to keep the investigation quiet so as not to interfere with the upcoming election. Ultimately, however, the Mueller investigation reported that:

When interviewed, Papadopoulos and the Campaign officials who interacted with him told the [Mueller] Office that they could not recall Papadopoulos’ sharing the information that Russia had obtained “dirt” on candidate Clinton in the form of emails or that Russia could assist the Campaign through the anonymous release of information about Clinton ….No documentary evidence, and nothing in the email accounts or other communications facilities reviewed by the [Mueller] Office, shows that Papadopoulos shared this information with the Campaign.

I Mueller Report at 93-94 [Ellipsis emphasis mine]

It appears in a section reviewing the Crossfire Hurricane investigation. There are no prosecutorial decisions tied to this section, meaning the section is — at least arguably — one of the 100 pages of extraneous material in this report outside the scope of “closing documentation” required by regulation.

In a section discussing whether the investigation should ever have been opened, preceding the discussion falsely claiming to have found a conflict between Alexander Downer’s version of George Papadopoulos’ statement about the Russian offer of help and Erika Thompson’s (which I laid out in this post), Durham footnotes a passage in which he discusses how little the FBI evaluated the Papadopoulos tip before opening an investigation by quoting what he claims is the Mueller Report conclusion on this matter.

Here’s what that passage from the Mueller Report actually looks like.

Durham omits with an ellipsis the part of the report that describes Papadopoulos, “wavered about whether he accurately remembered an incident in which Clovis had been upset after hearing Papadopoulos tell Clovis that Papadopoulos thought ‘they have her emails.'”

Durham purports to quote from the Mueller Report, but then leaves out language from it that utterly changes the entire meaning of the passage, showing that Papadopoulos did have some memory of telling Sam Clovis, “they have her emails,” rather than concluding definitively that he did not.

To sustain his narrative that the tip about Papadopoulos should not have been used to open an investigation, Durham distorts what the evidence about Papadopoulos actually shows.

This is not the only misrepresentation Durham makes with regards to the Papadopoulos investigation. Here’s how he describes Papadopoulos’ prosecution.

With regard to misleading and incomplete information being provided to the FBI, Papadopoulos was subsequently charged in a one-count Information with and convicted of making false statements in violation of 18 U.S.C. § 1001(a)(2). United States v. George Papadopoulos, Crim. No. 17-cr-182 (RMD) (D.D.C.), Document 8 (Information). Specifically, during his first interview with the Crossfire Hurricane Agents on January 27, 2017, Papadopoulos told the Agents about an individual associated with a London-based entity who had told him about the Russians having “dirt” on Clinton. Although Papadopoulos provided the FBI with the name of the individual and where he could be contacted, Papadopoulos lied to the Agents about when he had received the information (it was received after not before he was named as a foreign policy advisor to the Trump campaign) and he downplayed his understanding of the individual’s connections to Russian government officials. U.S. v. Papadopoulos Document 19 (Statement of the Offense) at 1-2. In addition, Papadopoulos misled the Agents about his attempts to use the individual and a female associated with that person to arrange a meeting between the Trump campaign and Russian government officials. Id. at 2-3. Ultimately, Papadopoulos pleaded guilty to making false statements. On multiple occasions he then met with, answered questions for, and provided information to the Government, id. at 13, and eventually was sentenced to 14 days incarceration. U.S. v. Papadopoulos Document 50.

He cites a few words in Papadopoulos’ Statement of Offense to suggest that Papadopoulos “provided information” to the government. He doesn’t quote the sentencing memo, which explains that Papadopoulos cooperated to the extent that DOJ had obtained a written record debunking the things he had earlier said to the FBI.

The defendant did not provide “substantial assistance,” and much of the information provided by the defendant came only after the government confronted him with his own emails, text messages, internet search history, and other information it had obtained via search warrants and subpoenas well after the defendant’s FBI interview as the government continued its investigation. The defendant also did not notify the government about a cellular phone he used in London during the course of the campaign – that had on it substantial communications between the defendant and the Professor – until his fourth and final proffer session.

And Durham definitely doesn’t cite the September 19 proffer in which Papadopoulos claimed to be unable to read his own notes, written around July 11, 2016 — so just weeks before the opening of Crossfire Hurricane — that appear to discuss plans for a September 2016 meeting with “Office of Putin” in London.

Just a few weeks before the FBI opened an investigation into Papadopoulos, he had discussed plans for a secret meeting with Putin’s office in London. Papadopoulos ultimately refused to explain that plan to the FBI.

And John Durham questions whether this investigation should ever have been opened.

This misrepresentation of the record on Papadopoulos is fairly significant. That’s because sixteen pages of Durham’s investigative review and two of his actual prosecutorial decisions pertain to whether the FBI committed a crime by having informants record conversations with Papadopoulos and Sam Clovis (again, remember that in his report Durham did not mention the informant, handled by pro-Trump agents, targeting the Clinton Foundation in the same period, a far clearer violation of what he complains about here), but not including everything that Durham believed helped Trump in Carter Page’s FISA application.

Durham goes to great lengths to conclude that there was not only exculpatory information in the recordings that didn’t make the Carter Page FISA applications (something about which DOJ IG agreed with him on), that Papadopoulos’ labeling of what Roger Stone ultimately did do — at Manafort’s request — to be treason as similarly exculpatory, but that Sam Clovis (who may have had advance notice about the emails) raising voter suppression in response to a question about Russia, or Papadopoulos, confessing he responded to Halper in the belief he might report back to the CIA were not inculpatory statements. These are all opinions. Significantly, some of the are opinions that Congress first floated in a hearing that served as the impetus for this very investigation, an investigation that concluded that investigations shouldn’t be driven by direction from Congress.

To prove the FBI wrong about this difference of opinion, though, Durham provides his own opinion about whether Papadopoulos had offered a scripted answer to the question that he later said he believed would be shared with the CIA. To attempt to criminalize the decision to leave out denials that the FBI believed to be scripted, Durham did his own review.

Things get weirder when Durham credits Papadopoulos’ statements — made to a friendly informant on March 31, 2017, after having already lied to the FBI and misrepresented to this particular informant his ties with Sergei Millian, though before FBI discovered the relationship with Ivan Timofeev that Papadopoulos had hidden in his initial interviews — that he had nothing to do with Russia.

14:03:45

CHS-2: Do you think the Russians would come and kill you if you said something? The Russian Mafia?

GP: I have nothing to do with the Russians.

14:14:30

CHS-2: If Russia [expletive] meddled in our elections, what else are they controlling about us? That just makes America look weak.

GP: I still don’t believe that [they did].

And we can be sure that Durham left out inculpatory statements.

For example, Durham makes no mention of the fact that Papadopoulos talked about monetizing his relationship with Trump specifically in context of a question about Russia, as described in the Horowitz Report.

When Source 3 asked Papadopoulos if he had ever met Putin, Papadopoulos said that he was invited “to go and thank God I didn’t go though.” Papadopoulos said that it was a “weird story” from when he “was working at … this law firm in London” that involved a guy who was “well connected to the Russian government.” Papadopoulos also said that he was introduced to “Putin’s niece” and the Russian Ambassador in London. 472 Papadopoulos did not elaborate on the story, but he added that he needed to figure out

how I’m going monetize it, but I have to be an idiot not to monetize it, get it? Even if [Trump] loses. If anything, I feel like if he loses probably could be better for my personal business because if he wins I’m going to be in some bureaucracy I can’t do jack … , you know?

This expressed enthusiasm to monetize his access to Trump and his relationship with “Putin’s niece” is a clear counterintelligence concern. Durham doesn’t mention it.

All this provides likely explanation for why Durham misrepresented the results of the investigation against Papadopoulos.

Immediately before the section, quoted above, where Durham describes Papadopoulos’ guilty plea and exaggerates his cooperation, Durham complains that a footnote in the Carter Page FISA applications referring to lies Papadopoulos later pled guilty to telling in interviews with FBI Agents “contained qualifying language regarding the denials.” Here’s the footnote from the last two Page FISA applications:

As of March 2017, the FBI has conducted several interviews with Papadopoulos. During these interviews, Papadopoulos confirmed that he met with officials form the above-referenced friendly foreign government, but he denied that he discussed anything related to the Russian Government during these meetings. Based on the FBI’s investigative efforts and some of the comments made by Papadopoulos, the FBI believes that Papadopoulos provided misleading or incomplete information to the FBI during the interviews.

Durham’s own interviews with Downer and Thompson confirm Papadopoulos’ statements about the Australians were incorrect. And yet Durham complains that the FBI correctly observed that Papadopoulos was misleading the FBI about statements that he himself proved to be inaccurate.

As noted above, certain denials made by Papadopoulos in FBI interviews were mentioned in a footnote, but the Crossfire Hurricane team reported that it believed Papadopoulos was misleading in those interviews. This denial from Papadopoulos in this conversation with CHS-2, which occurred prior to those two renewal applications being submitted to the FISC, was also omitted from any discussion in that referenced footnote.

I would write this all off as just Durham’s effort to parrot what people like Mark Meadows and Jim Jordan urged him to investigate, or desperation, or maybe just an old man seeing clouds in old informant recordings, except for a few more details about Durhams’ treatment of Papadopoulos.

First, as I noted here, as of June 2022, Durham had never interviewed Papadopoulos himself. In fact, if you can believe Papadopoulos, rather than interviewing him, Durham relied on Papadopoulos’ congressional testimony conducted without any of the underlying documents in question, in which Papadopoulos repeatedly laundered conspiracy theories told in right wing rags into the Congressional record. If you can believe Papadopoulos, Durham took those conspiracy theories, and ran off to Europe to chase them down.

Papadopoulos: So, that’s a good question. In 2018, I was one of five witnesses who was invited by–under oath, behind closed doors–in front of the House Oversight Committee. And the other four witnesses, besides myself, were Rod Rosenstein, Sally Yates, uh, Jim Comey, and Loretta Lynch. Now, back in 2018, and there’s a Washington Post article, I think it’s called “Papadopoulos and Rosenstein about to testify behind closed doors,” back in 2018, people were scratching their heads, why on earth is George Papadopoulos one of four, one of five witnesses who is going to testify to both John Ratcliffe and Mark Meadows. Back then, obviously, before Mark Meadows was Chief of Staff at the White House and Ratcliffe was the head of DNI, they were Congressmen. They were in charge of the House Oversight Committee. During that testimony back then, both of those individuals who later served in senior White House, uh, Administrative capacities were asking me questions about wiretaps. They were asking me if I was being monitored while I was in Europe. They were asking me whether my lawyers were ever given so-called exculpatory information about any of, about Joseph Mifsud, any of these other type of operatives, both domestic and foreign. And I basically let them know, under oath, that I’m telling you. How I met him, what my background was, why I believe there was this target on my back, why I think it followed me all the way from the beginning, all the way until the summer of 2017, where they were, the FBI was trying to set me up while I was in Israel with this other bizarre exchange that I had, that I talk about in my book. So that testimony, I believe, was used with the Durham team, to help get this entire thing started, that’s how Durham and Barr flew to both to Rome, to talk to Italian intelligence services — not the FBI — to learn about Mifsud, and I believe — that’s why NBC has also been quoted as saying that Western intelligence officials have gone on the record and stated that it’s Papadopoulos’ breadcrumbs, if you want to call it that, that have led to Durham’s real conspiracy case that he’s trying to uh–

Stone: So, but to go to my direct question, have you had any direct contact with Durham or his office, or your attorneys?

Papadopoulos: No, I haven’t. No no no, no I haven’t. But my understanding is that that testimony, 2018, was used by the Durham, that’s my understanding.

Rather than corroborating Papadopoulos’ conspiracy theories, Durham instead learned of evidence implicating Trump in a crime, an investigation that has disappeared. Durham makes no mention of these junkets in his final report — he makes no mention that Papadopoulos, whose criminal investigation he misrepresents, sent him and the Attorney General on wild goose chases to Europe.

That’s one reason it matters that Durham made no mention of these junkets in his final report, because doing so would discredit the testimony Papadopoulos made to Congress, and in the process make it even more clear that the FBI was right to open an investigation into the Coffee Boy.

But there’s an even bigger reason that Durham’s failure to interview Papadopoulos matters: because he was the one person known to have undeniably relevant testimony about Sergei Millian’s communication practices during July 2016, someone who could provide direct insight onto whether it was possible that Igor Danchenko and Millian communicated in those very same weeks.

Durham’s failure to interview Papadopoulos on that topic is all the more telling given that in the 11-page section of the report in which Durham discusses the basis for four charges against Igor Danchenko that a jury acquitted on, he makes just three references to actual interviews his own team did:

1085 OSC Report of Interview of Sergei Millian on Feb. 5, 2022 at 1.

[snip]

1136 OSC Report of Interview of Brian Auten on July 26, 2021 at 21; OSC Report of Interview of Kevin Helson on July 27, 2021 at 3-4.

The Millian interview was conducted remotely; Millian refused to make the same comments under oath, in a venue in which he could be held accountable for lies.

The interviews with Auten and Helson were significantly debunked on the stand at Danchenko’s trial.

Under cross-examination by Danchenko attorney Stuart Sears, for example, Helson testified he never walked away from his meetings with Danchenko believing he had lied.

Q. Agent Helson, it was no — it was no secret, during the course of your relationship with Mr. Danchenko, that there was a discrepancy between how Mr. Steele described how Mr. Danchenko represented his interactions with Mr. Millian and how Mr. Danchenko told you he actually explained his interactions?

A. Yes.

Q. Okay. It was no — it was no secret. Everyone knew all along that there was a disconnect there?

A. Correct.

Q. And at no point during your entire time of meeting with Mr. Danchenko over those three years, did you ever walk away thinking that he was lying to you about anything; is that fair?

A. That’s fair.

Q. In fact, for years after your conversations with Mr. Danchenko about his anonymous phone call with the person he believed to be Mr. Millian, you would submit reports indicating that he was a reliable source?

A. Correct.

Q. And some of those reports would even mention the Millian discrepancy and you would write that you believed that Mr. Danchenko had accurately reported the information as best you could recall?

A. Yes.

Helson is likely the person whom Durham referred for further investigation for his handling of Danchenko. The report doesn’t provide the date of the referral, suggesting he may have retaliated against Helson for this testimony given under oath.

In cross-examination, Danchenko attorney Danny Onorato first got Auten to acknowledge that Danchenko himself had said the communication he had with someone he believed was Millian was “strange,” and Auten never followed to up clarify if they meant the same thing by “strange.”

Q. All right. So, first of all, I think your testimony yesterday was that you thought that the interaction was strange between Millian, the person he believed to be Millian, and Mr. Danchenko.

A. I thought that that interaction, as described, was peculiar and strange, yes.

Q. Right. And before you thought they were peculiar, Mr. Danchenko told you, on the 24th, is that he thought what happened was strange, right?

A. I do recall that, yes.

Q. Right. Because when you write a 302 or your memo, you write what the witness tells you, right?

A. Correct.

Q. Okay. And you would agree that his characterization was, “Guys, this is strange,” and that’s what you wrote in that report?

A. I believe that’s how I characterized it.

Q. Okay. So you agree with him when he said, “This was strange.” You said, “You know what, he’s right. This seems strange,” right?

A. He characterized it as strange. I think my characterization of strange might not be the same characterization of strange.

Q. Okay. But you used the same word?

A. Used the same word, yes.

Q. So you can use the same word, and sometimes people can interpret the word differently is what you’re telling me.

A. Yes.

Q. Okay. And the only way for you to know that is to ask a follow-up question and say, “Hey, when you say ‘strange,’ this is what I think and this is what you think,” right?

A. Right.

Q. But you never did that?

A. I don’t recall asking him to define what he meant by strange in that.

Q. Very well. But he told you that he got information from a person who did not identify himself, correct?

A. Correct.

Q. Okay. And, again, I’m not giving you a hard time because you didn’t ask a lot of probing questions on that day because you were just trying to break the ice with him to see if you can get him to work with you. Somma said you’d have more time to work with him, right?

A. Correct.

Then, Onorato demonstrated that Durham had gotten Auten to lie unwittingly on the stand by withholding the part of the Danchenko transcript where, in his first interviews with the FBI, he said the call he had with the person he believed was Millian could have been via app.

Q. Okay. But I do want to try to correct something about what you testified about this morning. Okay?

A. Okay.

Q. And you prepared to testify with Mr. Durham and his team, right?

A. Yes.

Q. Okay. And I think he asked you to look at Government Exhibit 100.

A. Yes.

Q. Okay. And when he asked you to look at Government one- — Exhibit 100, I think you may have answered that he did not mention a call app on Page 20, right, in response to his questions?

A. Yes.

Q. Okay. Well, do me a favor. Look at Page 20 and then 21, And see if that refreshes your memory the first day about what Mr. Danchenko told you.

A. I apologize. Yes, it basically says — would you like me to read it?

Q. Yeah.

A. Okay. I’ll start at the middle of — middle of the last paragraph of Page 20. [As read:] “The two of them talked for a bit and the two of them tentatively agreed to meet in person in New York City at the end of July. At the end of July, Danchenko traveled with his daughter to New York but the meeting never took place and no one ever called Danchenko back. Altogether, he had only a single phone call with an individual he thought to be Millian. The call was either a cellular call or it was a communication through a phone app.”

Q. I’m sorry, what did you just say?

A. “Or it was a communication through a phone app.”

Q. Okay. So remember when Mr. Durham asked you questions this morning, right?

A. Yes.

Q. Did he omit — ask you to look at page 21 to see what Mr. Danchenko told you that day?

A. I don’t think he was omitting. I think I —

Q. Okay. And did you intentionally omit, intentionally tell the jury something wrong, right?

A. No.

Q. But the import of the testimony was that, no, he never mentioned in that first meeting it could have been a phone app, right?

A. Correct.

Q. And now we all know that that’s false, right?

A. Correct.

Q. So he did mention a mobile app?

A. That is correct.

Onorato then got Auten to testify to how Durham had withheld the Amtrak records that corroborated Danchenko’s version of what happened.

What happened next was more dramatic. Durham attempted to exclude just the metadata of communications between Papadopoulos and Millian in these very same weeks of July 2016 because — he said in a bench conference — the content of the communications “sound[ed] creepy.”

The defendant has provided what he has premarked as Defendant’s Exhibit 480, 4-8-0, which is an email, a LinkedIn message from Millian to George Papadopoulos. Unless the defendant is going to somehow explain to the jury what Millian and Papadopoulos were communicating about at this period of time, then the Court should not permit it. Papadopoulos and Millian, as I think the defense knows from the discovery in this case, were exchanging any number of emails or Facebook exchanges or LinkedIn all about real estate, potential real estate transactions.

And so what the defense would be asking the jury to do is to draw some adverse inference that there was something going on between Millian and Papadopoulos that they really don’t know about, but it certainly sounds creepy. Well, in fact, if you look at what the communications were, as I say, between Papadopoulos and Millian, they are all about real estate, potential real estate investments.

[snip]

MR. DURHAM: 486 is from Millian to Papadopoulos. Again, you know, its irrelevant to these proceedings, but for the same reason, in the government’s view, it would be inadmissible unless we want to get into evidence relating to what Papadopoulos and Millian were doing at or about the time these email exchanges were occurring. [my emphasis]

Then, when Durham made another attempt to prevent just this metadata from coming into evidence, he spent five minutes trying unsuccessfully to get Auten to rule out that these communications could be proof of Russian “collusion.”

Q. And do you remember what Papadopoulos and Millian were involved in that generated these numbers?

A. I don’t recall exactly what they were involved in, but it was —

Q. But was it pretty much they were involved in real estate or investment discussions over a long period of time?

A. That, I don’t recall exactly.

Q. Well, how about generally? Do you generally refer — recall that Papadopoulos and Millian were involved in discussions about real estate projects and the like?

A. In January of…

Q. Well, this whole period that’s reflected in Defendant’s Exhibit 403.

A. Yeah, again, I don’t know if I — I don’t know if I can speak to that at this point.

Q. Well, you — you were the analyst — that supervisory analyst, correct?

A. Yes.

Q. Did you recall, sir, what it was that Mr. Millian was involved in, the kind of investments?

A. Yes, he was involved in investments and the like.

Q. Right.

A. But I don’t know if I can speak to, at this point, these phone records being tied to any real estate deals or anything of that sort.

Q. Right. So all of these records have shown there was contact between the two of them, correct?

A. Correct.

Q. And did you know that Millian was involved in the energy sector as well?

A. Yes, correct.

Q. And did you know that Papadopoulos was talking about getting involved in the energy sector in the Middle East?

A. Yes, I did know that.

Q. Does that refresh any recollection as to whether or not the contact between Millian and Papadopoulos had to do with energy and other investments?

A. Again, I am familiar with both of those things. I don’t know if that is what this document was actually written for.

Q. Okay. And there’s nothing in this document that tells you what it is about, correct?

A. No. Gmail talks about — there are a couple of references on — it’s not — it’s Bates Number — last Bates number is 105262.

Q. Uh-huh.

A. And there are two paragraphs that talk about another individual involved with energy.

Q. Right. This is all about business, correct?

A. Again, I don’t know if all of this is about business. I know that there are paragraphs in here involving energy.

Q. Okay. So one can tell from this is that they were involved in exchanges of emails or the like, correct?

A. Correct.

Q. And it appears it has to do with energy, correct?

A. It might , yes. Again, there are a lot of — there are a lot of communications on here.

Q. Yes.

A. So I would not be able to state with any substance that these are all involving energy issues.

Q. You can’t say that because the document doesn’t tell the jury what it’s about, other than that it, at least it has partially to do with energy?

A. Correct.

Q. Between Millian and Papadopoulos, correct?

A. That’s what it appears, correct.

Q. So it would be unreasonable to conclude anything or draw any conclusions from this other than Papadopoulos and Millian were involved in investments in the energy sector, right?

A. I don’t know if I can say that it follows necessarily from this, that all of these things deal with that.

Q. That wasn’t my question, though.

A. Okay.

Q. My question was: It would be unreasonable to conclude from this document anything other than they were at least involved in talking about — the energy sector, correct?

A. I would say that from this document there may —

Q. Uh-huh.

A. — there are likely communications within this list of communications dealing with energy, though I cannot say, analytically speaking, that all of these deal with energy

Q. Fair enough. You know that Millian was involved in the energy sector and real estate?

A. I do recall that.

Q. And Papadopoulos is involved in the energy sector and real estate?

A. I recall that.

Q. And so this document doesn’t have anything to do, from looking at it on its particulars, anything to do with Russia and Russia collusion and the like, correct?

A. So the only thing that this has is — it has a list of — most of it is a list of communications between the two parties, dates, times.

Q. Okay. [my emphasis]

Durham, in open court, tried to prevent any mention of the relationship between Papadopoulos and his sole affirmative witness against Danchenko, Sergei Millian, because, in his own words, the communications between Millian and Papadopoulos “certainly sound[] creepy.”

And he made no mention of any of this in his report. He sure as hell made no mention of getting a prosecution witness to make a false claim on the stand by withholding information.

This is the witness, Papadopoulos, he never interviewed to learn about the nature of Millian’s communications at the time.

This is the witness he spent pages and pages of his report misrepresenting.

This is the witness, George Papadopoulos, whose Congressional testimony launched him onto multiple international junkets with the Attorney General, in search of conspiracy theories that yielded only some useless Blackberries and evidence of financial crimes involving Trump.

In his report to Merrick Garland, John Durham maintains that the FBI was overly hasty to open an investigation into Papadopoulos, the guy who weeks before the investigation was opened was planning a secret meeting with Putin.

But in open court, Durham admitted that in very weeks the FBI opened the investigation, the Coffee Boy was involved in “creepy” communications with Sergei Millian.

And he doesn’t mention those creepy communications in his report.

Share this entry

“Ridiculous:” Durham’s Failed Clinton Conspiracy Theory

I put together a very rough list of the interviews that John Durham included in his Report and a table showing the organization of his report.

I’d like to describe what appears to have happened with the investigation. Remember a few things about this list: It won’t include everything. Even just among witnesses who testified at trial, Durham was known to have done initial interviews, then threatened them with prosecution, in an often successful attempt to shade their testimony (see this post for an example). With others, Durham is being affirmatively misleading by stating that people who did appear before the grand jury were unwilling to be interviewed.

This list is just a list of interviews that actually support his narrative.

2019: Manufacturing a new origin story

As noted, most of the junkets that Durham and Barr did in the first year of the investigation don’t appear. The only overseas investigative steps noted in 2019 include the Legal Attaché personnel in London and the two Australian sources, Alexander Downer and Erika Thompson (described as Australian Diplomat-1), behind the original tip on George Papadopoulos. Durham did two separate interviews with the Australians, done on the same day, months before the DOJ IG Report determined the investigation was properly predicated.

Durham relies heavily on Downer, instead of Thompson, and claims to have discovered a conflict in their two accounts.

The Australian account reflects that two meetings of a casual nature took place with Papadopoulos. 215 These meetings were documented by Downer on May 11, 2016 and by Australian Diplomat-I later in the month. 216 Both diplomats advised that prior to the Spring of 2016, Papadopoulos was unknown to them. 217 Notably, the information in Paragraph Five does not include any mention of the hacking ofthe DNC, the Russians being in possession of emails, or the public release of any emails. In addition, when interviewed by the Office, Downer stated that he would have characterized the statements made by Papadopoulos differently than Australian Diplomat-1 did in Paragraph 5. According to Downer, Papadopoulos made no mention of Clinton emails, dirt or any specific approach by the Russian government to the Trump campaign team with an offer or suggestion of providing assistance. Rather, Downer’s recollection was that Papadopoulos simply stated “the Russians have information” and that was all. 218

As recounted to the FBI on August 2, 2016, by Australian Diplomat-1, the substance of Paragraph Five was written in a “purposely vague” way. 219 This was done because Papadopoulos left a number of things unexplained and “did not say he had direct contact with the Russians.” 220 The impression Papadopoulos made on the Australian diplomats was wide ranging. On the one hand, he “had an inflated sense of self,” was “insecure,” and was “trying to impress.” 221 On the other hand, he was “a nice guy,” was “not negative,” and “did not name drop.” 222

Downer noted that he

was impressed Papadopoulos acknowledged his lack of expertise and felt the response was uncommon for someone of Papadopoulos’ age, political experience and for someone thrust into the spotlight overnight. Many people in a similar position would represent themselves differently and [Downer] would have sniffed them out. If [Downer] believed Papadopoulos was a fraud [he] would not have recorded and reported on the meeting [he] had with Papadopoulos. 223

Downer also said that he “did not get the sense Papadopoulos was the middle-man to coordinate with the Russians.” 224 The Australian diplomats would later inform the FBI, and subsequently the Office, that the impetus for passing the Paragraph Five information in late-July was the public release by WikiLeaks ( on July 22, 2016) of email communications that had been hacked from the DNC servers. 225

215 We note there is an inconsistency in the statements given by Australian Diplomat-1 and former-High Commissioner Downer to the Crossfire Hurricane interviewers in August 2016 and what they told the Office when interviewed in October 2019. Australian Diplomat-1 and Downer were interviewed together in August 2016, and, according to the FD-302 prepared afterward by Supervisory Special Agent- 1, Papadopoulos made the statements about the Russians during the May 6, 2016 introductory meeting when he met only with Australian Diplomat-1. When the two diplomats were interviewed separately by the Office in October 2019, investigators were advised that Papadopoulos made the statements in front of both Australian Diplomat-1 and Downer during the second meeting on May 10, 2016.

216 The meetings with Papadopoulos took place on May 6 and 10, 2016. Australia 302 at 1- 2. The Australian diplomats documented the meetings in two cables dated May 11 and May 16, 2016; OSC Report of Interview ofAlexander Downer on Oct. 9, 2019 at 2; OSC Report of Interview ofAustralian Diplomat-1 on Oct. 9, 2019 at 3.

217 OSC Report of Interview of Alexander Downer on Oct. 09, 2019 at 1; OSC Report of Interview of Australian Diplomat-I on Oct. 09, 2019 at 1-2.

218 OSC Report of Interview of Alexander Downer on Oct. 09, 2019 at 2 (and related field notes); Downer also is reported to have stated in an interview that in talking with Papadopoulos there was “no suggestion that there was collusion between Donald Trump or Donald Trump’s campaign and the Russians.” Brooke Singman, Diplomat Who Helped Launch Russia Probe Speaks Out, Defends Role, Fox News (May 10, 2019), https://www.foxnews.com/politics/forrner-ausralian-diplomat-alexander-downer-defendswork-pushes-back-on-claim-he-tried-to-trap-papadopoulos. 219 Australia 302 at 2.

There’s no conflict.

Papadopoulos appears to have told the story about advance notice of Russia’s help to Thompson twice, once on May 6 and again, with Downer present, on May 10. She explains that not everything Papadopoulos said made it into her report. It’s likely Papadopoulos said more at the first meeting (I believe the record reflects that he drank more at the first meeting).

But by relying on Downer instead of Thompson, Durham claims that there was less to the tip than Thompson appears to have taken from it.

Having manufactured an alternate story about the initial predication, it’s no wonder Durham pushed Michael Horowitz not to say the investigation was fully predicated.

Durham also appears to have investigated why it took so long for the Steele reports to make their way from New York to DC. This is a fairly remarkable and sustained part of his report, because Durham is basically complaining that the pee tape report wasn’t immediately taken seriously.

Finally, from the very first year, Durham started doing investigations into the treatment of the Clinton Foundation investigation. As I have noted, his report leaves out really important details of that investigation: that agents who exhibited every bit as much bias as Durham finds in Peter Strzok, Lisa Page, or Kevin Clinesmith were running a key informant on the investigation, something no one has alleged happened with investigations into Trump’s associates.

That silence is all the more important given how Durham compares the predication of the Crossfire Hurricane investigation with that of Clinton Foundation, which relied in significant part on the Steve Bannon-linked Clinton Cash book which was every bit as shoddy as the Christopher Steele dossier, with a much more aggressive bias.

Once again, the investigative actions taken by FBI Headquarters in the Foundation matters contrast with those taken in Crossfire Hurricane. As an initial matter, the NYFO and WFO investigations appear to have been opened as preliminary investigations due to the political sensitivity and their reliance on unvetted hearsay information (the Clinton Cash book) and CHS reporting. 388 By contrast, the Crossfire Hurricane investigation was immediately opened as a full investigation despite the fact that it was similarly predicated on unvetted hearsay information. Furthermore, while the Department appears to have had legitimate concerns about the Foundation investigation occurring so close to a presidential election, it does not appear that similar concerns were expressed by the Department or FBI regarding the Crossfire Hurricane investigation. Indeed, in short order after opening the Crossfire Hurricane file and its four subfiles, the FBI was having one of its long-time CHSs meet not with just one Trump campaign associate, but meet and record conversations with three such insiders. And a little more than a month after opening the Crossfire Hurricane file on Page, a “senior U.S. law enforcement official” was publicly reported as confirming for Michael Isikoff and Yahoo! News that the FBI had Page on its radar screen. 389

Durham says two Australians who had no stake in the election (and who likely didn’t want to create a row with a major political candidate) have the same credibility as a long term political hoaxster paid by Trump’s ultimate campaign manager.

And in making this comparison, Durham doesn’t consider the urgency of the ongoing Russian attack on democracy (something that he generally ignores throughout the report). The underlying crime behind the Papadopoulos tip was potential (and real, in the case of both Paul Manafort and Roger Stone) ongoing involvement in Russia’s efforts to interfere in the election.

2020: Laying the ground work for the Clinton conspiracy

Early in 2020, Barr made Durham a Special Counsel, giving him authority to use a grand jury.

The very next day, he met with Jim Baker.

In cross-examination at the Sussmann trial, Baker lawyer Sean Berkowitz situated this meeting and another, in June 2020, when Baker’s story about the Sussmann meeting was still radically different than the one he told at trial, in terms of a leak investigation into Baker that had just closed. Baker had recently been criminally investigated by Durham, he knew that Durham would come after him again on the Russian investigation, and that February 2020 meeting was the first after the close of the leak investigation.

Q. So you know what it’s like to be under criminal investigation. Right?

A. Yes.

Q. You know what it’s like to be under criminal investigation by this man?

A. Yes.

Q. That’s Mr. Durham?

A. Yes.

Q. In fact, sir, in March of 2017 Mr. Durham was appointed by the Department of Justice to conduct a criminal investigation of the unauthorized disclosure of classified information to a reporter. Correct?

A. I don’t remember exactly when he was appointed, but that’s roughly correct based on my recollection of the timeframe.

Q. And you were a subject of that investigation?

A. I was never told that I was a subject.

Q. Is it fair to say that your lawyer refused to let you answer questions before Congress because you were under investigation?

A. He did object to certain questions — certain questions — because I was under investigation. That’s correct.

Q. Under criminal investigation. Right?

A. It was a criminal investigation was my understanding, yes.

Q. And you refused to answer those questions on the gounds that it might incriminate you?

A. I refused to answer those questions on advice of counsel, and it was a voluntary interview so I could refuse to answer any questions that I didn’t want to answer.

Q. And the investigation took place between 2017 and 2018. correct:

A. Say that again.

Q. The investigation took place between 2017 and 2019. correct?

A. I think it was not closed until 2020 by the Department.

[snip]

Q. And you, sir, were aware that Mr. Baker was — I mean, Mr. Durham was reappointed as special counsel, correct, in or around 2019?

A. For this matter?

Q. Yes.

A. Yes.

Q. And when that happened, you were concerned, were you not?

A. Concerned about what?

Q. That Mr. Durham might come and investigate you more?

A. I wasn’t concerned about it. I expected it.

[snip]

Q. It’s the first time you saw him after you were the subject of the criminal investigation by him?

A. Again, I was never told that I was a subject.

Q. Was that the first time?

A. Yeah, I think that was the first time.

In June 2020, Baker’s story started to evolve until ultimately, he testified, claiming 100% certainty about a story that had changed at least four times, to precisely the story Durham would want him to.

Most of the early 2020 interviews relied on by Durham in his report pertain to two topics: His reinvestigation of how the Clinton Foundation investigation proceeded, and his pursuit of a claim that Hillary framed Donald Trump (marked as “Russian intelligence” in the timeline).

Starting in June 2020, Durham appears to have started focusing on Igor Danchenko, burning him as a source, reviewing the long-dormant counterintelligence investigation into him, and focusing the same kind of pressure on Danchenko handler Kevin Helson (whom Durham seems to have referred for further investigation, on a date he doesn’t provide, for his handling of Danchenko). In July 2020, Barr provided Lindsey Graham the interview transcripts for Danchenko, which would lead to (or provide the excuse for) Danchenko’s exposure. In September 2020, the Senate Judiciary Committee would stage a FISA hearing to expose Danchenko’s past counterintelligence investigation.

None of these were effective investigative steps. Most witnesses didn’t testify at trial, and the one who did — Helson — was a devastating witness against Durham’s case (which may be why he was referred for further investigation). Those investigative steps did make Danchenko far more insecure, both legally and financially.

On September 29, John Ratcliffe would also share the report and, a week later, the underlying intelligence, around which Durham would build his Clinton conspiracy theory: A Russian intelligence Report that Hillary’s complaints about Trump’s pro-Russian bias stemmed from an attempt to cover up her email scandal and not from real concern about Russia or frustration with being victimized by a nation-state hack during an election.

On October 19, after Nora Dannehy disrupted Durham’s plan to release an initial report before the election, Barr made him Special Counsel so he could stick around for two more years to try to build the case he hadn’t done by 2020.

One of the most telling things about Durham’s actions in 2020 is that he didn’t do any of the ground work he needed to do to investigate the accusations he would make in late 2021. His primary work on the Alfa Bank case was making Danchenko far, far more vulnerable. He records virtually no obvious investigative work on the Alfa Bank allegations in 2020. He did little work on the dossier allegations. Some key investigative steps — getting a technical review of the Alfa Bank allegation and trying to secure Sergei Millian’s make-or-break testimony — waited until 2022, well after he had actually indicted these cases.

2021: Preparing actual indictments to hang failed conspiracy theories on

And it’s not just those two indictments Durham neglected in 2020. Here’s something Carter Page should think seriously about: John Durham did not do the investigation into the problems with his FISA application until the statutes of limitation started to expire in 2021. Given that investigative history, it’s fairly clear that Durham was never going to charge FBI agents in conjunction with those applications. Never. He had other priorities.

Instead, in 2021, he started making belated attempts to substantiate his Clinton conspiracy, with interviews to set up Charles Dolan as a witness.

Durham did no apparent interviews into Sergei Millian in 2021.

He did begin the effort — one paralleled and assisted by Alfa Bank lawsuit against the researchers in question, which to a DC judge seemed,”almost like they were written by the same people in some way,” — to spin the research into DNS anomalies into a deliberate plan by Hillary’s team.

In Durham’s investigations, however, there were obvious basic investigative failures. Durham didn’t interview people from Cendyn and Listrak until after the Sussmann indictment (and in the latter case, it’s not clear whether Durham spoke to anyone authoritative or even got the name of all the people interviewed).

I’ve already laid out how Durham didn’t even ask Michael Horowitz for relevant evidence until after the indictment. It was several months later before he asked Jim Baker to check his iCloud for the exculpatory communications that Sussmann correctly predicted would be there.

Durham didn’t interview Sergei Millian — and even then, he only did so remotely, with no agreement he would testify at trial — until February 2022, three months after indicting Danchenko.

These indictments — both of which could only have worked if charged as conspiracy indictments for which Durham had no evidence — were always bound to fail. They were bound to fail because they weren’t the result of an investigation, the logical progression from a clear crime committed. They were instead legal clothes hangers on which he could try to hang a conspiracy theory. They might have worked if Sussmann or Rodney Joffe or Danchenko had caved to the economic and legal pressure Durham was applying (as he did with Danchenko, Durham also got Joffe discontinued as an FBI source, but that had no financial repercussions for Joffe). But the charges were so flimsy Sussmann and Danchenko mounted a fairly clearcut defense.

Late 2021 to 2022: Chasing Clinton conspiracies

There’s a detail, though, that is all the more revealing given Durham’s failure to conduct an adequate investigation into these charges before indicting. As I noted last year, even after Sussmann was indicted, Durham refused the former Clinton lawyer’s demand for a list of the people on the Clinton campaign with whom he had coordinated his Alfa Bank efforts. It wasn’t until months later that it became clear — as Sussmann laid out in a filing — that Durham hadn’t even interviewed any of the people Sussmann purportedly coordinated with until after the indictment.

[T]he Special Counsel has alleged that Mr. Sussmann met with the FBI on behalf of the Clinton Campaign, but it was not until November 2021—two months after Mr. Sussmann was indicted—that the Special Counsel bothered to interview any individual who worked full-time for that Campaign to determine if that allegation was true.

Here’s what those interviews look like, as laid out in the Durham Report:

11/10/21: Jennifer Palmieri

11/12/21: Jake Sullivan

1/19/22: John Podesta (Russian Intelligence)

5/11/22: Hillary Clinton (Russian Intelligence)

Those questions weren’t focused on Sussmann, though. They were focused on Durham’s Clinton conspiracy, the claim that she had made a plan to frame Donald Trump.

During an interview of former Secretary Clinton, the Office asked if she had reviewed the information declassified by DNI Ratcliffe regarding her alleged plan to stir up a scandal between Trump and the Russians. 44 ° Clinton stated it was “really sad,” but “I get it, you have to go down every rabbit hole.” She said that it “looked like Russian disinformation to me; they’re very good at it, you know.” Clinton advised that she had a lot of plans to win the campaign, and anything that came into the public domain was available to her.

In addition, the Office interviewed several other former members of the Clinton campaign using declassified materials441 regarding the purported “plan” approved by Clinton.

The campaign Chairperson, John Podesta, stated that he had not seen the declassified material before, characterized the information as “ridiculous,” and denied that the campaign was involved in any such “plan.”442 Jake Sullivan, the campaign Senior Policy Advisor, stated that he had not seen the intelligence reporting before and had no reaction to it other than to say, “that’s ridiculous.”443 Although the campaign was broadly focused on Trump and Russia, Sullivan could not recall anyone articulating a strategy or “plan” to distract negative attention away from Clinton by tying Trump to Russia, but could not conclusively rule out the possibility. 444 The campaign Communications Director, Jennifer Palmieri, who was shown the Referral Memo, 445 stated that she had never seen the memorandum before, found its contents to be “ridiculous,” and could not recall anything “like this” related to the campaign. 446 She stated that Podesta, Mook, Sullivan and herself were aware of a project involving ties between Trump and Russia being conducted by Perkins Coie, the campaign law firm, but she did not think Clinton was aware of it, nor did she receive any direction or instruction from Clinton about the project.447

Another foreign policy advisor (“Foreign Policy Advisor-2”) confirmed that the campaign was focused on Trump and Russia, but that focus was due to national security concerns and not designed to distract the public from Clinton’s server issue. 448

Every single one of them called Durham’s conspiracy theories “ridiculous.”

For good reason. As I’ve laid out, the timeline Durham obscures, in which Trump’s rat-fucker had contact with Russia weeks before Hillary purportedly ginned up this plan, disproves the conspiracy theory.

Which explains something about the Sussmann trial — led by Andrew DeFilippis, the same AUSA who had willingly attempted to trump up a crime against John Kerry. Over and over, Durham’s prosecutors willfully ignored Judge Christopher Cooper’s orders, thereby introducing evidence with no evidentiary basis. They did so most blatantly when, minutes after Cooper ordered DeFilippis not to read from a paragraph of a Hillary Tweet calling on FBI to investigate the Alfa Bank allegations, he did so anyway, predictably leading the same outlets that wrote supine reviews of the Durham report to focus exclusively on something not before the jury.

After Judge Cooper said he would reserve his decision, Berkowitz noted that in fact, DeFilippis planned to use the tweet to claim the campaign wanted to go to the FBI when the testimony at trial (from both Elias and Mook) would establish that going to the FBI conflicted with the campaign’s goals.

[T]hey are offering the tweet for the truth of the matter, that that’s what the campaign desired and wanted and that it was a accumulation of the efforts.

Number one, it’s not the truth; and in fact, it’s the opposite of the truth. We expect there to be testimony from the campaign that, while they were interested in an article on this coming out, going to the FBI is something that was inconsistent with what they would have wanted before there was any press. And in fact, going to the FBI killed the press story, which was inconsistent with what the campaign would have wanted.

And so we think that a tweet in October after there’s an article about it is being offered to prove something inconsistent with what actually happened.

Then, after both Elias and Mook had testified that they had not sanctioned Sussmann going to the FBI, DeFilippis renewed his assault on Cooper’s initial exclusion, asking to introduce it through Mook’s knowledge that the campaign had tried to capitalize on the Foer story.

Having ruled in the past that the tweet was cumulative and highly prejudicial, Cooper nevertheless permitted DeFilippis to introduce the tweet if he could establish that Mook knew that the campaign tried to capitalize on the Foer story.

But Cooper set two rules: The government could not read from the tweet and could not introduce the part of the tweet that referenced the FBI investigation. (I explained what DeFilippis did at more length in this post.)

THE COURT: All right. Mr. DeFilippis, if you can lay a foundation that he had knowledge that a story had come out and that the campaign decided to issue the release in response to the story, I’ll let you admit the Tweet. However, the last paragraph, I agree with the defense, is substantially more prejudicial than it is probative because he has testified that had neither — he nor anyone at the campaign knew that Mr. Sussmann went to the FBI, no one authorized him to go to the FBI, and there’s been no other evidence admitted in the case that would suggest that that took place. And so this last paragraph, I think, would unfairly suggest to the jury, without any evidentiary foundation, that that was the case. All right?

MR. DeFILIPPIS: Your Honor, just two brief questions on that.

THE COURT: Okay.

MR. DeFILIPPIS: Can we — so can we use — depending on what he says about whether he was aware of the Tweet or the public statement, may we use it to refresh him?

THE COURT: Sure. Sure.

MR. DeFILIPPIS: Okay. And then, as to the last paragraph, could it be used for impeachment or refreshing purposes as well in terms of any dealings with the FBI?

THE COURT: You can use anything to refresh.

MR. DeFILIPPIS: Okay.

THE COURT: But we’re not going to publish it to the jury. We’re not going to read from it. And let’s see what he says. [my emphasis]

Having just been told not to read the tweet, especially not the part about the FBI investigation, DeFilippis proceeded to have Mook do just that.

The exhibit of the tweet that got  to the jury had that paragraph redacted and that part of the transcript was also redacted. But, predictably, the press focused on little but the tweet, including the part that Cooper had explicitly forbidden from coming into evidence.

In his report, Durham obscures the timeline of all this to falsely suggest that Hillary endorsed going to the FBI in September, before Sussmann met with the FBI, and not days before the election, when Franklin Foer reported the story.

On October 31, 2016 – about one week before the election – multiple media outlets reported that the FBI had received and was investigating the allegations concerning a purported secret channel between the Trump Organization and Alfa Bank. For example, Slate published an article that discussed at length the allegations that Sussmann provided to the FBI. 1530

Also on that day, the New York Times published an article titled Investigating Donald Trump, F.B.f Sees No Clear Link to Russia. 1531 The article discussed information in the possession of the FBI about ··what cyber experts said appeared to be a mysterious computer back channel between the Trump Organization and the Alfa Bank.” 1532 The article further reported that the FBI had “spent weeks examining computer data showing an odd stream of activity to a Trump Organization server,” and that the newspaper had been provided computer logs that evidenced this activity. The article also noted that at the time of the article, the FBI had not found “any conclusive or direct link” between Trump and the Russian government and that “Hillary Clinton’s supporters … pushed for these investigations.” 1533

As noted above, in the months prior to the publication of these articles, Sussmann had communicated with the media and provided them with the Alfa Bank data and allegations. 1534 Sussmann also kept Elias apprised of his efforts. 1535 Elias, in tum, communicated with the Clinton campaign’s leadership about potential media coverage of these issues. 1536

In addition, on September 15, 2016, Elias provided an update to the Clinton campaign regarding the Alfa Bank allegations and the not-yet-published New York Times article, sending an email to Jake Sullivan (HFA 154 ° Chief Policy Advisor), Robby Mook (HF A Campaign Manager), John Podesta (HF A Campaign Chairman), and Jennifer Palmieri (HFA Head of Communications), which he billed to the Clinton campaign as “email correspondence with J. Sullivan, R. Mook, J. Podesta, J. Palmieri re: Alfa Bank Article.” 1541

On the same day that these articles were published, the Clinton campaign posted a tweet through Hillary Clinton’s Twitter account which stated: “Computer scientists have apparently uncovered a covert server linking the Trump Organization to a Russian-based bank.” 1542 The tweet included a statement from Clinton campaign advisor Jake Sullivan which made reference to the media coverage article and stated, in relevant part, that the allegations in the article “could be the most direct link yet between Donald Trump and Moscow[,] that “[t]his secret hotline may be the key to unlocking the mystery ofTrump’s ties to Russia[,]” and that”[w ]e can only assume that federal authorities will now explore this direct connection between Trump and Russia as part oftheir existing probe into Russia’s meddling in our elections.”

In context, Durham falsely leaves the impression that Hillary supported going to the FBI in advance, even though both Robby Mook and Marc Elias testified that the last thing Hillary wanted to do was let the FBI get more involved in her campaign. In context, Durham falsely leaves the impression that Sussmann had sustained contacts with the NYT starting in September and never stopping, when the evidence he cites pertains exclusively to early September communications, after which Sussmann worked with the FBI to kill the story.

In a follow-up post, I will lay out just how grotesque Durham’s conspiracy theory is — the digital equivalent of slut-shaming a rape victim.

But for now, consider the abundant evidence that Durham didn’t investigate the charges he ultimately charged. He was far too busy, instead, pursuing this Clinton conspiracy theory he started chasing at least as early as February 2020.

Update: Added table showing the organization of Durham’s Report.


Dates

5/13/19: Preliminary review 

5/28/19: UK Legat-1

6/4/19: UK ALAT-1

6/17/19: SSA-1 (Steele Reports, Papadopoulos)

6/17/19: CIA Employee-1 (Page FISA)

6/18/19: SSA-1 (bias)

6/19/19: Case Agent-1 (defensive briefing, Steele Reports, Papadopoulos)

7/2/19: Handling Agent-1 (Page FISA)

7/2/19: NYFO ASAC-1 (Page FISA)

7/3/19: Michael Harpster (Steele Reports)

8/1/19: Mike Rogers

8/6/19: NYFO ADC-1

8/12/19: Randall Coleman (Clinton Foundation, Steele Reports)

8/12/19: Diego Rodriquez (Clinton Foundation)

8/14/19: HQ Analyst-3 

9/16/19: Cyber Agent-2 (Alfa)

10/17/19: SSA-2 (Clinesmith, Papadopoulos)

8/21/19: Case Agent-1

8/29/19: OGC Unit Chief-1 (bias, Australia referral, Page FISA)

9/5/19: NYFO Case Agent-1 (Page FISA)

10/9/19: Erika Thompson; Alexander Downer

12/9/19: DOJ IG Report

12/10/19: HQ Analyst-3 

1/6/20: David Johnson (Steele Reports)

1/15/20: NYFO Case Agent-1 (Clinton Foundation)

1/16/20: Diego Rodriquez (Clinton Foundation)

1/28/20: HQ Unit Chief-3 (Clinton Foundation)

2/6/20: Special Attorney to Attorney General (may reflect grand jury)

2/7/20: Jim Baker (defensive briefing)

2/13/20: Cyber Agent-3 (Alfa)

2/19/20: HQ Analyst-3 (Page FISA)

2/25/20: HQ Analyst-2 (Russian Intelligence, Clinesmith)

2/28/20: Jonathan Moffa (Russian Intelligence)

3/18/20: Paul Abbate (Clinton Foundation)

4/14/20: Field Office-1 Handling Agent-3 

4/23/20 Field Office-1 Handling Agent (Clinton Foundation)

4/23/20: Michael Harpster (Steele Reports)

5/1/20: Mueller SSA-1

5/5/20 Field Office-1 Handling Agent (Clinton Foundation)

5/6/20: Steele Reports

5/28/20: HQ SSA-4 (Clinton Foundation)

6/11/20: Jim Baker (Russian Intelligence)

6/18/20: Jim Baker (Russian Intelligence)

6/25/20: SA-2 (Steele Reports)

6/29/20: Michael Steinbach (initial EC)

6/30/20: Referral regarding existing counterintelligence investigation

7/1/20: OI Attorney (Page FISA)

7/8/20: Ray Hülser (Clinton Foundation)

7/14/20: Kevin Helson (Page FISA)

7/22/20: SSA-1 (Russian intelligence, Steele Report) 

7/23/20: OGC Unit Chief-1 (Page FISA)

7/28/20: Baltimore Special Agent-2 (Danchenko)

8/13/20: Baltimore Case Agent-1 (Danchenko)

8/13/20: CIA Employee-2 (Alfa)

8/19/20: IC Officer #6 (Russian Intelligence)

8/20/20: WFO Clinton Foundation Case Agent-1 

8/21/20: John Brennan (Russian Intelligence)

9/9/20: Acting OGC Section Chief-1 (Clinton Foundation)

9/10/20: Field Office-1 SAC

9/22/20: Field Office-1 Handling Agent-3

9/29/20: Patrick Fallon (Clinton Foundation)

9/29/20: John Ratcliffe shares Russian Intelligence with Lindsey Graham

10/19/20: Special Counsel appointment

10/27/20: OI Unit Chief-1 (Page FISA)

11/24/20: Kevin Helson (Danchenko)

12/8/20: HQ Supervisory Analyst-1 (Danchenko)

12/15/20: HQ SSA-3 (Alfa)

12/18/20: Baltimore Special Agent-1 (Danchenko)

12/21/20: Designation to use classified information

12/23/20: IC Officer#12 (Russian Intelligence)

12/20: Referral regarding accuracy of info in non-Page FISA (possibly Millian?)

2/2/21: Tech Company-1 Employee 1 (Alfa)

2/11/21: DARPA Program Manager-1 (Alfa)

2/25/21: Tech Company-1 Employee 1 (Alfa)

3/3/21: SSA-1 signed statement on Steele Reports

3/18/21: SSA-3 (Page FISA)

3/21/21: SA-1 (Page FISA)

4/8/21: Field Office-1 SSA-1

4/13/21: US Person-1 (Dolan Associate) (Danchenko)

4/14/21: Research Exec-1 (Alfa)

4/22/21: HQ Unit Chief-2

5/5/21: SSA-2  (bias, Page FISA, Danchenko, Clinesmith, Papadopoulos)

5/5/21: Field Office-1 Handling Agent-2 (second CI investigation)

6/21/21: David Archey (Defensive briefings)

6/29/21: CIA Employee-3 (Alfa)

6/30/21: OGC Attorney-1 (Page FISA)

6/30/21: Danchenko Employer-1 Exec-1 

7/7/21: Field Office-1 ASAC-1

7/9/21: Jennifer Boone

7/9/21: Tech Company-1 Employee 1 (Alfa)

7/21/21: Foreign Policy Advisor-1 (Russian Intelligence)

7/21/21: SSA-1 (Page FISA)

7/22/21: University-1 Researcher-1 (Alfa)

7/26/21: Brian Auten (bias, Russian Intelligence, Steele Reports)

7/27/21: Kevin Helson (Danchenko)

8/21: University-1 Researcher-2 (Alfa) [appears to be one 302 on more than one conversation]

8/9/21: NJ-Based Company Exec (Danchenko)

8/10/21: University-1 Researcher-3

8/11/21: Handling Agent-1 (Page FISA)

8/16/21: Mueller Analyst-1 (Danchenko)

8/12/21: Tech Company-3 Exec-1 (Alfa)

8/31/21: Charles Dolan (Danchenko)

8/31/21: Mueller SSA-1 (Danchenko)

9/7/21: Charles Dolan (Danchenko)

9/16/21: Michael Sussmann indictment

9/17/21: Brookings Fellow-1 (Danchenko)

10/21/21: UCE-1 (Papadopoulos)

10/27/21: Listrak Employee-1 and personnel (Alfa)

10/29/21: Mueller Analyst-1 (Danchenko)

11/1/21: Charles Dolan (Danchenko)

11/3/21: Danchenko indictment

11/17/21: Cendyn CEO and CTO (Alfa)

11/9/21: Jonathan Winer (Steele Reports)

11/10/21: Jennifer Palmieri

11/12/21: Jake Sullivan

11/16/21: Brookings Fellow-2 (Danchenko)

11/17/21: Cendyn CEO and CTO (Alfa)

12/2/21: HQ Analyst-3 (Steele)

11/20/21: Victoria Nuland

11/30/21: Victoria Nuland (Steele Reports)

12/13/21: James Clapper

1/19/22: John Podesta (Russian Intelligence, Alfa)

2/2/22: David Cohen

2/5/22: Sergei Millian (Danchenko)

3/1/22: Handling Agent-1 (Page FISA)

3/28/22: Foreign Policy Advisor-2

5/11/22: Hillary Clinton (Russian Intelligence)

6/22/22: SSA-1 (Russian Intelligence)

8/9/22: Ritz GM (Danchenko)

12/14/22: Referral to DOD IG on DARPA

Share this entry

Eight Things Not Mentioned in the Durham Report

There are a whole lot of gaping holes in the Durham Report (my Twitter thread on the report is here; here’s a ThreadReader version). Here are eight of the most important things that Durham chose to leave out of his report on his four-year investigation.

1. All mention of the Italian referral on Trump. In January, NYT reported on the many problems with the Durham investigation, none of which shows up in his report. Most importantly, NYT reported that on a trip to Italy, the Italians gave Bill Barr and Durham a tip about crimes Trump may have committed.

On one of Mr. Barr and Mr. Durham’s trips to Europe, according to people familiar with the matter, Italian officials — while denying any role in setting off the Russia investigation — unexpectedly offered a potentially explosive tip linking Mr. Trump to certain suspected financial crimes.

Mr. Barr and Mr. Durham decided that the tip was too serious and credible to ignore. But rather than assign it to another prosecutor, Mr. Barr had Mr. Durham investigate the matter himself — giving him criminal prosecution powers for the first time — even though the possible wrongdoing by Mr. Trump did not fall squarely within Mr. Durham’s assignment to scrutinize the origins of the Russia inquiry, the people said.

Mr. Durham never filed charges, and it remains unclear what level of an investigation it was, what steps he took, what he learned and whether anyone at the White House ever found out. The extraordinary fact that Mr. Durham opened a criminal investigation that included scrutinizing Mr. Trump has remained secret.

By regulation, there should be some investigative result from this investigation in Durham’s report. It’s not in there.

2. All mention of the conspiracy theories Durham and Barr chased in Europe. The first year or so of the Durham investigation, Bill and John spend traipsing around the world chasing the conspiracy theories George Papadopoulos had floated in a 2018 House Oversight appearance. Barr has confessed they found nothing. But Durham doesn’t do that — or even mention the conspiracy theories — in his report. That’s important for a number of reasons: because Durham asserts that Congress should have no say in criminal investigations even though they dictated the initial direction of his own, because (as I’ll show) Durham badly whitewashes everything having to do with Papadopoulos, and because Durham also doesn’t mention the investigative steps he failed to take while running off to Italy to get Joseph Mifsud’s blackberries.

3. Durham’s own investigative failures. I’ve written at length about how Durham’s own investigative failures make anything Crossfire Hurricane did look tame by comparison. He failed to get relevant information from DOJ IG or ask Jim Baker to check his iCloud for what happened to be texts proving Michael Sussmann’s defense until after he indicted Sussmann. He never interviewed Papadopoulos, indicted Danchenko relying on what Sergei Millian said on Twitter, and then failed to obtain the messaging app evidence he would need to disprove a call between Millian and Danchenko. Durham focuses, at length, on steps he speculated the FBI didn’t take on the Carter Page FISC, but he had more egregious failures to pursue what turned out to be exculpatory information.

4. The Trump Tower Moscow deal. In a footnote, Durham concedes there are things that the FBI later found that corroborated ties between Trump and Russia that weren’t known when the investigation was opened. The only example he provides, however, is the June 9, 2016 meeting in Trump Tower in New York.

There were also at least some activities involving the Trump campaign and Russians that did not become public, and were not known to the FBI, until much later. For example, on June 9, 2016, senior representatives of the campaign met briefly with a private Russian lawyer, Natalia Veselnitskaya, and others at the Trump Tower. Mueller Report at 110, 117. Veselnitskaya “had previously worked for the Russian government and maintained a relationship with that government throughout this period oftime.” Id. at 110. The initial email to Donald Trump Jr. proposing the meeting said that the Crown prosecutor of Russia was offering to provide the campaign with documents and information that would incriminate Clinton. Id. The meeting at the Trump Tower only became public over a year later. Id. at 121.

Durham leaves out many others — like Manafort sharing campaign strategy and Trump having Manafort order Roger Stone to reach out to WikiLeaks. But because Durham focuses closely on Dmitry Peskov’s role in the Steele dossier and a brief nod he makes towards Russian disinformation in it, Durham’s silence about Michael Cohen’s January 2016 conversation with Dmitry Peskov’s office asking for help on a Trump Tower Moscow deal, using sanctioned banks and a former GRU officer as broker, is the most damning. Olga Galkina and Charles Dolan’s ties to Peskov — an interminable focus of this report — are important especially because Peskov was the one person in Russian who undeniably knew that Cohen had made a secret call to Russia during the campaign that both he and Trump were lying to cover up. Yet Durham simply ignores that critical context.

5. Konstantin Kilimnik’s name. Not only did Durham fail to mention most of the most damning things that Trump and his flunkies did, he also failed to mention some of the key people they did them with. None is more important than Konstantin Kilimnik, with whom Paul Manafort conspired to cover up his past pro-Russian Ukraine lobbying, to whom Manafort provided campaign strategy at a meeting where they also discussed millions in debt relief for Manafort, and about which meeting Amy Berman Jackson found Manafort had lied to prosecutors. Kilimnik is important for two reasons. First, Durham nods to the potential role of “Oligarch 1,” whom he doesn’t reveal was Oleg Deripaska, in disinformation in the dossier. He also confirms that Christopher Steele was working for Deripaska earlier in 2016 (in which discussion Durham does name the now-sanctioned Oligarch). But Durham never mentions that Manafort had direct ties to Deripaska through Kilimnik. And Durham repeatedly claims that, because the Intelligence Community had no record of ties between Trump and Russian intelligence services when the FBI opened Crossfire Hurricane, it’s proof the FBI shouldn’t have opened the investigation. Of course, the IC has since concluded that Kilimnik shared that campaign information from Manafort with Russian spooks and that he is himself a spook. Thus, the IC’s failures to identify Kilimnik’s intelligence ties (and those of other people more loosely tied to Russia and Trump) is not a reflection, at all, of the merit of the investigation, but instead a mark of the IC’s own failures in advance of the operation.

6. Description of Guccifer 2.0’s initial releases. Unlike Kilimnik, Durham at least mentions Guccifer 2.0, the persona GRU officers created as a cut-out through whom to release some of the files they stole. But Durham only mentions the persona in a discussion of what he calls a Clinton Plan to impose a political cost on Trump for cozying up to Russia.

Per FBI verbal request, CIA provides the below examples of information the CROSSFIRE HURRICANE fusion cell has gleaned to date [Source revealing information redacted]: [] An exchange … discussing US presidential candidate Hillary Clinton’s approval of a plan concerning US presidential candidate Donald Trump and Russian hackers hampering US elections as a means of distracting the public from her use of a private email server. According to open sources, Guccifer 2.0 is an individual or group of hackers whom US officials believe is tied to Russian intelligence services. Also, per open sources, Guccifer 2.0 claimed credit for hacking the Democratic National Committee (DNC) this year.

There’s much that is downright noxious about Durham’s treatment of his so-called Clinton Plan. But he fails to distinguish the treatment of whatever report this intelligence made of Guccifer 2.0 and the allegation about Hillary, including when discussing its briefing and dissemination. More problematic still, Durham claims that all this only happened in late July 2016, even though the Democrats identified the hack and its attribution, Guccifer 2.0 started releasing stolen files, and (per Rick Gates, at least) Roger Stone entered discussions with the persona about advance releases in mid-June. Durham’s silence (aside from this quotation) about Guccifer 2.0 not only serves his criminalization of Hillary’s response to being victimized by a nation-state attack, but it permits him to craft a completely false timeline on which his Clinton Plan conspiracy theory depends.

7. The biased FBI Agent running the Clinton Foundation informant. Durham engages in a good deal of false comparisons between how Hillary was treated and how Trump was. Most fall apart. For example, he points to a defensive briefing Hillary got in a different foreign influence investigation to claim that Trump should have gotten a defensive briefing in the Crossfire Hurricane investigation. But his own report shows she didn’t get that briefing until around ten months into the investigation; less than six months into the Russia investigation, Trump got a briefing, about Mike Flynn. Durham’s comparisons of the conduct of the Clinton Foundation investigation and Crossfire Hurricane are even more strained, since he engages in no reflection of how shoddy Clinton Cash was, which (unlike the Steele dossier here) was part of that predication. Nor does he contemplate the rampant leaking, during the campaign, about that investigation. Most dishonest, however, is Durham’s silence about the single informant run during 2016 known to be handled by biased agents, one targeting Clinton Foundation described in the Carter Page IG Report.

We reviewed the text and instant messages sent and received by the Handling Agent, the co-case Handling Agent, and the SSA for this CHS, which reflect their support for Trump in the 2016 elections. On November 9, the day after the election, the SSA contacted another FBI employee via an instant messaging program to discuss some recent CHS reporting regarding the Clinton Foundation and offered that “if you hear talk of a special prosecutor .. .I will volunteer to work [on] the Clinton Foundation.” The SSA’s November 9, 2016 instant messages also stated that he “was so elated with the election” and compared the election coverage to “watching a Superbowl comeback.” The SSA explained this comment to the OIG by saying that he “fully expected Hillary Clinton to walk away with the election. But as the returns [came] in … it was just energizing to me to see …. [because] I didn’t want a criminal to be in the White House.”

On November 9, 2016, the Handling Agent and co-case Handling Agent for this CHS also discussed the results of the election in an instant message exchange that reads:

Handling Agent: “Trump!”

Co-Case Handling Agent: “Hahaha. Shit just got real.”

Handling Agent: “Yes it did.”

Co-Case Handling Agent: “I saw a lot of scared MFers on … [my way to work] this morning. Start looking for new jobs fellas. Haha.”

Handling Agent: “LOL”

Co-Case Handling Agent: “Come January I’m going to just get a big bowl of popcorn and sit back and watch.”

Handling Agent: “That’s hilarious!” [my emphasis]

This exchange is similar to the texts that Durham uses to implicate Peter Strzok, Lisa Page, or Kevin Clinesmith. But in this case, this agent was directly handling an informant targeting the actual candidate during the election.

8. The response to Mike Flynn’s lies about Sergey Kislyak. In retrospect, another significant thing missing from this report is the investigation into how, in early 2017, the FBI responded to Mike Flynn’s lies about speaking with Sergey Kislyak. We know that Durham did investigate this. Much of what he investigated was handed to Jeffrey Jensen to launder into the effort to overturn the Flynn prosecution. But Durham doesn’t even whitewash the ultimate charges against Flynn, as he does, to hilarious effect, with George Papadopoulos. There’s nothing more than a passing reference to discomfort from investigators that could pertain to this investigative effort. I’m not sure what to make of its absence. It’s possible it was too closely related to the blow-up with Nora Dannehy. Possibly, the interim report the team drafted without her knowledge focused on Flynn and she debunked it, meaning there’s a prosecutorial judgment somewhere that undermines the claims Barr and others made. Possibly, the games Barr played after that — including the release of a Bill Barnett 302 that conflicted in key ways with the public record — have made those claims untenable. Whatever the reason, its absence in this report is notable.

There’s a lot more that’s missing from this report. But if Durham were to fill just a few of these critical gaps, the whole thing would crumble.

Update: Added an eighth missing item, the Mike Flynn prong of the investigation. Subsequently fixed Jensen’s first name.

Share this entry

John Durham Repeats Debunked Claims in Report to Garland

John Durham has, after four years, finally released a report.

It is corrupt. It harms America. It misrepresents FISA.

It also repeats claims that were debunked under oath. I’ll be reading it here. But for those who want to vent, this is your open thread.

Share this entry

Before Rand Paul Went to Moscow, He Was in a White House Meeting Discussing Lisa Page, Peter Strzok, and Andrew McCabe

Peter Strzok filed what is billed as a motion for clarification of Judge Amy Berman Jackson’s order last week requiring that Strzok’s deposition of FBI Director Chris Wray take place before Strzok’s deposition of Trump.

In part, it is a fact check, laying out all the ways that DOJ seems to have panicked after (and because) Strzok scheduled a deposition with the former President on May 24.

In part, it seems to be an effort to pre-empt DOJ’s threat to file for a writ of mandamus against ABJ because she permitted these depositions. For example, Strzok’s lawyers describe how much easier it was to schedule time with the unemployed former President than with the FBI Director. Under the Apex doctrine that DOJ claims to be adhering to, that should mean that Wray’s deposition should come after Trump’s (and indeed, that’s effectively what DOJ seemed to argue last year).

More interesting, though, are notes Strzok included to establish a need to depose Trump regardless of what Wray says, both taken by John Kelly when he was Chief of Staff.

According to Kelly’s own transcription, this February 21, 2018 note reads:

Potus, AG, Don McGahn

  • Deep state issues
  • Investigations
  • Firing love birds

McCabe?

  • Trust?

This note establishes that pressure to fire Strzok and Page may have bypassed Wray. McCabe was fired weeks later.

More curious still, however, is this note:

Kelly transcribed the July 23, 2018 note this way:

Potus, Rand Paul +2

Security clearances

*add Page, McCabe, Stroch (sic)

For some reason, a week after Trump submitted to Vladimir Putin in Helsinki on July 16 and 15 days before Paul would carry a letter from Trump to Putin expressing an interest in remaining besties, Paul was in a meeting discussing the FBI officials Trump had a vendetta against (who also happen to be Russian experts).

Days after Paul returned from Moscow, the FBI fired Strzok.

Update: Per Rand’s Twitter account, he met with Trump to discuss revoking John Brennan’s security clearance that day.

Share this entry

Ben Smith Still Doesn’t Understand He Peddled Likely Russian Disinformation

I’m not sure whether it was just chance or whether Ben Smith knew in advance that BuzzFeed would announce the closure of its news division on the same day that he posted an account of publishing the Steele dossier. His account doesn’t explain whether the cost of defending against serial Russian lawfare for publishing the dossier made it harder, in the aftermath, to pay journalists’ salaries, but it’s a question that deserves an answer.

But Ben’s account — which focuses, as most of Ben’s writing does, on insider news media stuff — makes two grave errors.

The first is that — even though he quotes Pete Strzok describing how the dossier framed the Russian investigation, thereby inoculating Trump against accountability for the very real scandalous behavior he had with Russia — Ben falsely suggests that the dossier was the genesis of the public concern about Trump’s ties to Russia.

We had embedded it as a PDF, which meant that it could travel context-free, without our article’s careful disclaimers, and that’s exactly what happened. I watched uneasily as educated Democrats who abhorred Trump supporters’ crude rants about child sex rings in Washington pizza joints were led by the dossier into similar patterns of thought. They read screenshots of Steele’s report; they connected the dots. They retweeted threads about how the plane of a Russian oligarch—previously unknown to them, now sinister—had made a mysterious stop in North Carolina.

[snip]

It had blown wide open a Russia investigation and forced voters to ask just why Trump seemed so friendly with Vladimir Putin.

[snip]

An FBI agent who investigated Trump, Peter Strzok, later said the dossier “framed the debate” in a way that ultimately helped Trump: “Here’s what’s alleged to have happened, and if it happened, boy, it’s horrible—we’ve got a traitor in the White House. But if it isn’t true, well, then everything is fine.”

The notion that Democrats and national security hawks weren’t concerned about Trump’s Russian ties until January 10, 2017 is ludicrous. The effort to understand Trump’s Russian ties went into high gear on July 27, 2016, when he encouraged Russia to attack his opponent and floated recognizing the annexation of Crimea. It never stopped thereafter.

And, as I had to explain patiently to Columbia Journalism Review, even the intense press reporting on Trump’s real ties to Russia started before January 10, because the WaPo was already onto Mike Flynn’s lies about his outreach to Sergey Kislyak by then. Strzok’s point, I think, is that publishing the dossier made it easier for Trump to get away with attempting to undermine sanctions on Russia and all the rest because at least undermining sanctions wasn’t a pee tape.

No one needed the dossier to heighten concerns about Trump’s fondness for Russia. That’s a myth created by Russiagate [sic] peddlers trying to distract from the very real scandal of Trump’s ties to Russia.

Ben’s other silence, though, is irresponsible.

As I have noted, as the Carter Page IG Report makes clear, and as Republicans in Congress have come to agree, there’s abundant reason to believe that Russians started feeding Igor Danchenko with disinformation from the start. Lawyers for Oleg Deripaska were likely the client for a Steele collection effort targeting Paul Manafort in March 2016. According to declassified footnotes in the IG Report, Deripaska likely learned of the dossier project before the second report. And he demonstrably played a double game throughout 2016, getting Steele to feed Bruce Ohr damaging claims about Manafort at the same time as his aide, Konstantin Kilimnik, was exploiting Manafort’s legal and financial vulnerability to get information on the Trump campaign and a commitment to help carve up Ukraine.

This dynamic is utterly central to understanding the dossier. Someone who played a central role in the 2016 Russian operation knew about the dossier project, and had means to know of Danchenko’s collection network, almost from the start. And that makes it likely that at least some of the content of the dossier was tailored to be wrong in ways that benefitted the Russian operation.

Ben’s silence about the likelihood that he unwittingly peddled Russian disinformation is all the more embarrassing given how his post transitions directly from suggesting that John Durham had “poked holes in Steele’s sourcing” to noting that there was something that Trump actually was lying to cover up: the impossibly lucrative Trump Tower deal in Moscow.

Simpson then told Ken something he didn’t know: Steele had been working the case of the president-elect, Donald Trump, and he’d assembled evidence that Trump had close ties to the Kremlin—including claims that Michael Cohen, one of his lawyers, had held secret meetings with Russian officials in Prague, and that the Kremlin had a lurid video of Trump cavorting with prostitutes in the Ritz-Carlton Moscow that would come to be known as the “pee tape.”

[snip]

But although the biggest-picture claim—that the Russian government had worked to help Trump—was clearly true, the release of Special Counsel Robert Mueller’s investigation in April 2019 did not support Steele’s report. Indeed, it knocked down crucial elements of the dossier, including Cohen’s supposed visit to Prague. Internet sleuths—followed by a federal prosecutor—had poked holes in Steele’s sourcing, suggesting that he’d overstated the quality of his information.

And there had always been a more mundane version of the Trump-Russia story. Trump was the sort of destabilizing right-wing figure that Putin had covertly supported across Europe. Trump’s value to Putin was related not to a secret deal, but to the overt damage he could do to America. And Trump, BuzzFeed News’s Anthony Cormier and Jason Leopold discovered, had a more mundane interest in Russia as well: He had drawn up plans to build the biggest apartment building in Europe on the banks of the Moskva River. The Trump Organization planned to offer the $50 million penthouse to Putin as a sweetener.

That real-estate project wasn’t mentioned anywhere in the dossier. Yet it seemed to explain the same pattern of behavior, without the lurid sexual allegations or hints of devious espionage.

The man responsible for publishing both the Steele dossier and the best reporting on the Trump Tower Moscow deal seems not to understand that false claims about Michael Cohen in the dossier were likely there because of the Trump Tower deal.

Ben invokes what Durham’s failed prosecution revealed about (what Ben mistakenly claims to be) Danchenko’s sourcing, without laying out the import of Danchenko’s ties to Charles Dolan: Dolan gave the source of the Cohen claims in the dossier, Olga Galkina, direct access to Dmitri Peskov, the one man in Russia with proof that when Trump falsely claimed in July 2016 that he wasn’t pursuing real estate deals in Russia, he was lying. Even Durham implied this was the import of Dolan’s relationship with Galkina! Dolan was important because he put Galkina, who was sending dirt on Trump to her childhood buddy, Igor Danchenko, in close touch with Peskov.

The source of the claims that Cohen had secret communications with the Kremlin in the dossier had direct ties to the one guy in Russia, Peskov, who provably knew that Cohen really did have secret communications directly with the Kremlin that he and Trump were lying to hide.

Once Trump publicly lied about chasing real estate deals in Russia in July 2016, it made the notes Peskov’s aide took, showing that Cohen had agreed to work with sanctioned banks and a retired GRU officer as fixer in order to chase one such deal, far more valuable to Russia, particularly after it became clear in the US that the GRU was behind the hack of Hillary. So it is likely not random at all that someone with direct access to Peskov told Danchenko that Cohen — who was lying to hide his real direct contact with the Kremlin during the election — had other, more damning direct contact with the Kremlin. It raised the stakes of Trump’s and Cohen’s lies. It raised the value of Russia’s silence about the earlier conversation with Peskov. To the extent that everyone kept their shared secret — and they did for the entire first year of the Trump Administration — it provided cover for the lies that Cohen would tell to Congress.

From the start, the FBI had warnings that the Cohen in Prague story was disinformation. And it just so happens that the story, which came from someone with ties to Peskov, repeated a true fact that Peskov knew: that Cohen really did have secret communications with the Kremlin, communications that had already compromised Trump and Cohen with Russia before the hacking even started. If the Cohen in Prague story was disinformation (and, again, FBI got warnings it was the day after Ben published the dossier), it was disinformation that made that earlier compromise more powerful.

And Ben Smith, who played a key role in disseminating that likely disinformation, appears to not even understand that, much less want to reflect on his role in being an unwitting mule for Russian disinformation.

Share this entry

How the Government Proved Their Case against John Podesta’s Hacker

We’re almost seven years past the hack of the DNC, and self-imagined contrarians are still clinging to conspiracy theories about the attribution of that and related hacks. In recent weeks, both Matt Taibbi and Jeff Gerth dodged questions about the attribution showing Russia’s role in the hack-and-leak by saying that the Mueller indictment of twelve GRU officers would never be tested in court (even while, especially in Gerth’s case, relying on unsubstantiated claims in John Durham indictments from his two failed prosecutions).

And while’s it’s likely true that DOJ will never extradite any of those twelve men to stand trial, DOJ did successfully convict one of their co-conspirators on a different hack: the hack-and-trade conspiracy involving Vladimir Klyushin and accused John Podesta hacker, Ivan [Y]Ermakov.

(The Mueller indictment and Ermakov’s second US indictment, for hacking anti-doping agencies, transliterated his name with a Y, the Boston one does not.)

That trial provides a way to show how DOJ would prove the 2018 indictment if one of the twelve men charged ever wandered into a jurisdiction with an extradition treaty with the US.

As laid out at trial, between 2018 and 2020, the co-conspirators hacked two securities filing agencies, Toppan Merrill and Donnelly Financial, to obtain earnings statements in advance of their filing, then traded based off advance knowledge of earnings. Klyushin was one of seven people (two charged in a separate indictment, three who were clients of Klyushin’s company M-13) who did the trading. Ermakov didn’t trade under his own name. He may have been compensated for Klyushin’s side of the trades with a Moscow home and a Porsche. But at least as early as May 9, 2018, forensic evidence introduced at trial shows, an IP address at which Ermakov’s iTunes account had just gotten updates was used to steal some of the filings.

Ermakov did not show up in a courtroom in Boston to stand trial and Klyushin has launched a challenge to his conviction that rests entirely on a challenge to venue there. But the jury did convict Klyushin on the hacking charge along with the trading charges, meaning a jury has now found DOJ proved Ermakov’s hacking beyond a reasonable doubt.

And they did it using the same kind of evidence cited in the Mueller indictment.

The crime scene

Start with the crime scene: the servers of the two filing agencies victimized in the hack-and-trade, Toppan Merrill and Donnelly Financial.

According to the trial record, neither figured out they had been hacked on their own. As the FBI had tried to do for months beforehand in the case of the DNC, a government agency, the SEC, had to tell them about it. The SEC had seen a number of Russians making big, improbable stock trades from clients of the two filing agencies, all in the same direction, and wanted to know why. So it sent subpoenas to both companies.

As the DNC did with CrowdStrike in 2016, both filing agencies hired an outside incident response contractor — Kroll Cyber in the case of Toppan Merrill, Ankura in the case of Donnelly Financial — to conduct an investigation.

The lead investigators from those two contractors were the first witnesses at trial. Each explained how they had been brought in in 2019 and described what they found as they began investigating the available logs, which went back six months, a year, and two years, depending on the type and company. The witness from Kroll described finding signs of hacking in Toppan Merrill’s logs:

The Ankura witness described how they first found the account of employee Julie Soma had been compromised, then used the IP addresses associated with that compromise to find other employees whose accounts were used to download reports or other unauthorized activity.

In sum, the two incident response witnesses described providing the FBI with the forensic details of their investigation — precisely the same thing that CrowdStrike provided to FBI from the DNC hack. There’s not even evidence that they shared a full image of the filing agencies’ servers (though an FBI agent described going back to Donnelly to search for the domain names behind the intrusions that Kroll had found at Toppan Merrill), which was one of the first conspiracy theories about the DNC hack Republicans championed: that the FBI failed to adequately investigate the DNC hack because it didn’t insist on seizing the actual victim servers during the middle of an election.

The forensic evidence wasn’t the only evidence submitted at trial from the crime scene. One after another of the employees whose credentials had been misused testified. Each described why they normally accessed customer records, if at all, how and when they would normally access such records, and from what locations they might access corporate servers remotely, including their use of the corporate VPN. Julie Soma — the Donnelly employee whose credentials were used most often to download customer filings — described that she would never have done what was done in this case, download one after another filing from Donnelly customers in alphabetical order.

Q. Would you ever go from client to client and alphabetically access those types of documents?

A. No.

Both interview records from the Mueller investigation (one, two, three) and documents from the Michael Sussmann case show that the FBI did similar interviews in the DNC hack. The Douglass Mackey trial, too, featured witnesses describing how the Hillary campaign identified that attack on the campaign as well.

In proving their case against John Podesta’s hacker, DOJ presented witness testimony that eliminated insiders as the culprit.

Fingerprinting

Having established the forensic data tied to intruders through the incident response contractors, prosecutors then called FBI agents as witnesses to describe how — largely through the use of IP addresses obtained using subpoenas or pen registers and the materials found in the suspects’ iCloud accounts — they tied Klyushin’s company, M-13, to both the hacking and the trading.

The trading was fairly easy: the co-conspirators accessed the two online brokers used to execute the trades under their own names and from IP addresses tied to M-13. An SEC witness described in detail how trades always shortly followed hacks but preceded the public filing of earnings statements.

Tying M-13 to the hacking took a few more steps.

For the hacking conducted via the domains Kroll identified, the FBI first found the account that registered the domains. Each was registered under a different name, but each of the names were based on a Latvian-based email service and used similar naming conventions. Each had been accessed from the same set of 3 IP addresses.

For IPs that Kroll identified, the FBI found BitLaunch servers created by an account in the name of Andrea Neumann, which was controlled from one of the same IP addresses that had registered the domain names. The FBI got search warrants to obtain images of those BitLaunch servers.

Another IP address used to steal filings, several FBI agents explained, was from an Italian-run VPN, AirVPN. The FBI used a pen register to show that someone accessed AirVPN from the M-13 IP address during the same period when the AirVPN IP was stealing records from the filing companies. The FBI also showed that Klyushin had accessed his bank at the same time from that same IP address. The FBI also showed that eight common IP addresses had accessed Ermakov’s iTunes account and the AirVPN IP address (in this case, the access was not at the same time because the FBI only had a pen register on the VPN for two months in 2020). While FBI witnesses couldn’t show that the specific activity tied to an AirVPN IP at the victim companies tied back to M-13, they did show that both Klyushin and Ermakov routinely used AirVPN.

Plus there were the filing thefts — noted above — that were done on May 9, 2018 using the same IP address that, four minutes earlier, had downloaded an Apple update from Ermakov’s iTunes account. As I’ve noted repeatedly, before Ermakov was first indicted by Mueller, he had already left a smoking gun in the servers at Donnelly in the form of IP activity that the FBI obtained over a year later inside the US.

In fact, much of the evidence used to prove this case (particularly establishing the close relationship between the conspirators) came from Apple, including WhatsApp chats saved in Klyushin and other co-conspirators’ iCloud accounts. We know Mueller used the same source of evidence. In March of this year, emails stolen by hacktivists revealed, Apple informed another of the GRU officers charged in the DNC hack that the FBI had obtained material from his Apple account in April 2018, in advance of the Mueller indictment.

The indictment likely also relied on warrants served on Google, especially on Ermakov’s account. The Mueller indictment (as well as the later anti-doping one) attributes much of the reconnaissance conducted in advance of the hacks to Ermakov: the names of some victims; information on the DNC, the Democratic Party, and Hillary; how to use PowerShell (which would be used against Toppan Merrill); and CrowdStrike’s reporting on GRU tools. If he did this research via Google, it would all be accessible with a warrant served on the US tech company.

The getaway car

One pervasive conspiracy theory about the Mueller indictment stems from testimony that Shawn Henry gave to the House Intelligence Committee in December 2017, describing that Crowdstrike did not see the data exfiltrated from the DNC servers. Denialists claim that is proof that the information was never exfiltrated by the GRU hackers. The conspiracy theory is ridiculous in any case, since there were so many other Russian hacks involving so many other servers, including servers run by Google and Amazon that had a different kind of visibility on the hack (something that Henry alluded to in his testimony), and since the indictment describes that the DNC hackers destroyed logs to cover their tracks.

But the Klyushin trial featured testimony about a tool used in the hack-and-trade conspiracy that has a parallel in the DNC hack: the AMS panel, hidden behind an overseas middle server, which the Mueller indictment described this way:

X-Agent malware implanted on the DCCC network transmitted information from the victims’ computers to a GRU-leased server located in Arizona. The Conspirators referred to this server as their “AMS” panel. KOZACHEK, MALYSHEV, and their co-conspirators logged into the AMS panel to use X-Agent’s keylog and screenshot functions in the course of monitoring and surveilling activity on the DCCC computers. The keylog function allowed the Conspirators to capture keystrokes entered by DCCC employees. The screenshot function allowed the Conspirators to take pictures of the DCCC employees’ computer screens.

[snip]

On or about April 19, 2016, KOZACHEK, YERSHOV, and their co-conspirators remotely configured an overseas computer to relay communications between X-Agent malware and the AMS panel and then tested X-Agent’s ability to connect to this computer. The Conspirators referred to this computer as a “middle server.” The middle server acted as a proxy to obscure the connection between malware at the DCCC and the Conspirators’ AMS panel. On or about April 20, 2016, the Conspirators directed X-Agent malware on the DCCC computers to connect to this middle server and receive directions from the Conspirators.

[snip]

For example, on or about April 22, 2016, the Conspirators compressed gigabytes of data from DNC computers, including opposition research. The Conspirators later moved the compressed DNC data using X-Tunnel to a GRU-leased computer located in Illinois.

In the hack-and-trade conspiracy, the hackers set up a similar structure, using the servers given names like “developingcloud” and “finshopland” as reverse proxies, with a final server behind them all executing orders on the hacked servers at Toppan Merrill (and the implication is, Donnelly, though the forensics came from Toppan Merrill via Kroll). The “computers numbered 1 through 7” in what follows are the servers identified by Kroll stealing earnings filings from Toppan Merrill.

A. So this is a digital depiction of the servers that I examined on the right there, so they each have a number on them, 1 through 9.

Q. Let me focus you first on the computers numbered 1 through 7. Do you see them there?

A. Yes.

Q. Are they kind of in a sideways V configuration?

A. Yes.

Q. Okay. And what do computers 1 through 7 show on this Exhibit DDD?

A. They functioned as gatekeepers for the furthest machine to the right, server number 8.

Q. And when you say “gatekeeper,” is there a technical term for that?

A. Yes. So the technical term is a “reverse proxy.”

Q. Can you explain to the jury, in a easy for me to understand way, what a reverse proxy or gatekeeper is in this chart, 1 through 7.

A. Yes. So in this chart, it would function — so the seven that are in that V formation, they would pass traffic to server number 8, if it was coming from an infected machine; and if it was something else, it would send the traffic to some other website.

This structure would have made it impossible for Toppan Merrill to understand the source or function of the anomalous traffic on its servers because any attempt to do so would be redirected away from the control server.

But not the FBI, because they obtained images of the servers with a warrant.

The forensic witness describing this structure showed, command by command, that the forensic clues identified by Kroll on the Toppan Merrill servers were controlled via that final server running PowerShell (the same tool that Mueller alleged Ermakov researched during the DNC hacks in 2016).

Q. And is there something on this log that you found that tells you the name of the program that was running on the victim’s computer at Toppan Merrill?

A. Yes, the process name line, and that reads rdtevc.

Q. And is process another name for computer program?

A. Yes.

Q. So this is a log that shows that a program named RDTEVC was running on a Toppan Merrill computer, right?

A. Yes.

Q. But it’s stored in the hacker computer?

[snip]

Q. And what does PowerShell do? You can call it anything, right? You can call it RDTEVC?

A. That’s probably a randomly chosen name.

Q. But no matter what it’s called, what does it do?

A. So it allows it to be remotely controlled and accessed.

Q. Allows what to be remotely controlled and accessed?

A. The infected machine.

The same forensic expert explained that he didn’t find any downloads of stolen files.

But he also explained why.

He had also found secure tunnels, readily available but similar in function to a proprietary GRU tool Crowdstrike found in the DNC server. As he described, these would be used to transfer data in encrypted form, making it impossible to identify the content of the data while it was in transit.

Q. Mr. Uitto, are you familiar with the concept of exfiltration?

A. Yes.

Q. Big word, but what does it mean?

A. It means to steal data, take data.

Q. And in your review, did you find evidence — you told Mr. Nemtsev you didn’t find evidence of the taking of data from the victim computers to these particular hacker servers; is that right?

A. That’s right, but I did see secure tunnels that were created.

Q. So when you say there were secure tunnels, were you able to tell what was going through those secure tunnels?

A. No.

Q. Those were encrypted, right?

A. Yes.

Q. So you actually don’t know whether or not there was financial information in those tunnels?

A. That’s correct.

Q. Or sports scores or anything?

A. That’s correct.

Q. It’s encrypted.

A. Yes.

[snip]

Q. What role does encryption serve in this hacker architecture?

[snip]

A. Yes, so it can be used to hide data or information.

Q. So if it’s encrypted, we can’t know what’s being passed?

To prove the hack, you would have to — and FBI did, in both cases — prove that the stolen data made it to the end point.

This testimony is important for more than explaining where you’d need to look to find proof of a hack (at the end points). It shows the import of understanding not just the crime scene and those end points, but the infrastructure used to control the hack and exfiltrate the data. With both the hack-and-trade conspiracy and the hack of the DNC, the FBI got forensics about the victim from the incident response contractors, but they obtained the data from these external servers directly, with warrants.

The denialists looking for proof in the DNC server were focused on just the crime scene, but not what I’ve likened to a getaway car, one to which the FBI had direct access but Crowdstrike did not.

Follow the money

Another specialized kind of fingerprint prosecutors used to prove the case against Klyushin parallels the one in the Mueller indictment (and, really, virtually all hacking cases these days): the cryptocurrency trail. As the Mueller indictment explained, the hackers who targeted the DNC used the same cryptocurrency account to pay for different parts of their infrastructure, thereby showing they were all related.

The funds used to pay for the dcleaks.com domain originated from an account at an online cryptocurrency service that the Conspirators also used to fund the lease of a virtual private server registered with the operational email account [email protected]. The dirbinsaabol email account was also used to register the john356gh URL-shortening account used by LUKASHEV to spearphish the Clinton Campaign chairman and other campaign-related individuals.

[snip]

For example, between on or about March 14, 2016 and April 28, 2016, the Conspirators used the same pool of bitcoin funds to purchase a virtual private network (“VPN”) account and to lease a server in Malaysia. In or around June 2016, the Conspirators used the Malaysian server to host the dcleaks.com website. On or about July 6, 2016, the Conspirators used the VPN to log into the @Guccifer_2 Twitter account. The Conspirators opened that VPN account from the same server that was also used to register malicious domains for the hacking of the DCCC and DNC networks.

By following the money, prosecutors were able to show the jury how these pieces of infrastructure fit together.

In the case of the hack-and-trade, the conspirators did nothing fancy to launder the cryptocurrency used in the operation. The servers obtained in the name of Andrea Neumann were paid using three successive cryptocurrency accounts, each with different names but accessed from the same IP address. The third name was Wan Connie. An interlocked Wan Connie email account had been accessed from M-13’s IP address. So while the cryptocurrency itself couldn’t tie the conspirators to the hack, the interlocked infrastructure did.

The conspiracy

To prove the hack, prosecutors at trial showed how the FBI had used evidence from the crime scene, the “getaway” car, the money trail, and evidence obtained at the end point from iCloud accounts to tie the hack back to Ermakov personally and M-13 more generally. The biggest smoking gun came from matching the IP addresses to which Ermakov got his iTunes updates to the infrastructure used in the hack (or, in the case of the May 9, 2018 thefts, directly to someone exploiting Julie Soma’s stolen credentials.

All that was left in the Klyushin case was proving the conspiracy, showing that Klyushin and others had used this stolen information to make millions by trading in advance of earnings announcements. This would be the functional equivalent of tying the records stolen from Democrats (and some Republicans) to their release via Guccifer 2.0, dcleaks, and WikiLeaks.

At Klyushin’s trial, the government proved the conspiracy via two means: an SEC analyst presented a bunch of coma-inducing analysis showing how the trades attributed to online brokerage accounts that Klyushin and others had in their own names lined up with the thefts. The analyst explained that odds of seeing those trading patterns would be virtually impossible.

More spectacularly, prosecutors introduced Klyushin’s role with a bunch of pictures establishing that he was “besties” with Ermakov (and, eventually, that there were unencrypted and encrypted communications, along with a picture of Klyushin’s yacht, sent via Ermkaov to two guys in St. Petersburg who didn’t work for M-13 but who were making the same pattern of trades); I looked at some of that evidence here. One picture found in Klyushin’s account showed Ermakov, crashed on a chair, wearing an M-13 sticker, taken in the same period as some of the logs provided by Kroll showed hacking activity. About the only thing the FBI found in Ermakov’s iCloud account was the online brokerage account used to execute the insider trading, in Klyushin’s name, but that tied him to the trading side of the conspiracy.

As their trades began to attract attention, Ermakov and another M-13 employee attempted to craft cover stories, evidence of which prosecutors found via Apple. Prosecutors even introduced Threema chats in which Ermakov told Klyushin, his boss, not to share details about their trading clients or he might end up a defendant in a trial.

He did.

And at that trial, prosecutors were able to prove a hacking conspiracy against Klyushin using evidence and victim testimony from the crime scene, but also from other data readily available with a subpoena or warrant inside the US.

Update: Tweaked language describing secure tunnels.

Share this entry

The Long List of Reasons Why Potential Intimidation of Proud Boy Jurors Must Be Taken Seriously

Enrique Tarrio has already been investigated by a grand jury in Prettyman Courthouse for any role he had in threats to undermine a criminal prosecution.

That’s important background to Brandi’s report, at the end of her update on the Proud Boys trial, of how much of last week the trial was halted for a series of sealed hearings.

Apart from routine objections launched by the defense to even the most mundane of issues and separate from the unending series of motions for mistrial, last week featured a new and unwelcome variable: the sealed hearing.

A sealed hearing, or a hearing closed to the public and press, is typically held when sensitive or classified matters are being discussed by the parties. Trial days were stopped and started three times last week for sealed hearings that stretched for more than an hour. A press coalition moved to unseal proceedings on at least one of those days but was promptly denied by Judge Kelly for reasons he failed to describe on the record.

Though the exact reason was not disclosed by the court (nor would one expect it to be at this point), CNN reported that multiple sources said the sealed hearing was prompted after a juror raised concerns that she was being followed. Another juror has said they were “accosted” but no further details were available.

As CNN reported, a juror had become worried that someone was following her.

A juror told the court an individual came up to her outside of a Washington, DC, metro station and asked if she was a juror, multiple sources told CNN. The juror told court staff she had seen the same individual on several occasions and thought they might be following her.

Some jurors appear to be split on their views of the incidents, people familiar said. One juror told the judge he thought it was possible the interactions were random and it might have been someone experiencing homelessness in the area.

[snip]

When other jurors found out about the incident, they also began to look out for the individual and had taken at least one picture of the person, according to someone familiar with the matter.

Other jurors also told the court in sealed hearings this week that they had been “accosted,” one source told CNN, though it’s unclear to what extent.

But that report and some of the discussions I’ve seen elsewhere didn’t describe the list of reasons why such threats should be taken seriously.

First, there’s the fact that defendant Enrique Tarrio has already been investigated in this courthouse for his potential role in a threat against a judge. In 2019, Amy Berman Jackson put Roger Stone under oath and asked how he came to post an Instagram post of her with crosshairs on it. He blamed the “volunteers” who had made the meme — one of whom, he named, was Tarrio.

Amy Berman Jackson. How was the image conveyed to you by the person who selected it?

Stone. It was emailed to me or text-messaged to me. I’m not certain.

Q. Who sent the email?

A. I would have to go back and look. I don’t recognize. I don’t know. Somebody else uses my —

THE COURT: How big is your staff, Mr. Stone?

THE DEFENDANT: I don’t have a staff, Your Honor. I have a few volunteers. I also — others use my phone, so I’m not the only one texting, because it is my account and, therefore, it’s registered to me. So I’m uncertain how I got the image. I think it is conceivable that it was selected on my phone. I believe that is the case, but I’m uncertain.

THE COURT: So individuals, whom you cannot identify, provide you with material to be posted on your personal Instagram account and you post it, even if you don’t know who it came from?

THE DEFENDANT: Everybody who works for me is a volunteer. My phone is used by numerous people because it can only be posted to the person to whom it is registered.

[snip]

[AUSA] Jonathan Kravis. What are the names of the five or six volunteers that you’re referring to?

Stone. I would — Jacob Engles, Enrique Tarrio. I would have to go back and look

As CNN itself later reported, those whom Stone named were subpoenaed to testify about whether Stone had paid them to make threatening memes targeting his judge.

Tarrio, the leader of the Proud Boys, had been helping him ​with his social media, Stone said under oath, as had the Proud Boys’ Florida chapter founder Tyler Ziolkowski, who went by Tyler Whyte at the time; Jacob Engels, a Proud Boys associate who is close to Stone and identifies himself as a journalist in Florida; and another Florida man named Rey Perez, whose name is spelled Raymond Peres in the court transcript​.

A few days later, federal authorities tracked down the men and gave them subpoenas to testify to a grand jury, according to Ziolkowski, who was one of the witnesses.

Ziolkowski and the others flew to DC in the weeks afterwards to testify.

“They asked me about if I had anything to do about posting that. They were asking me if Stone has ever paid me, what he’s ever paid me for,” Ziolkowski told CNN this week. When he first received the subpoena, the authorities wouldn’t tell Ziolkowski what was being investigated, but a prosecutor later told him “they were investigating the picture and if he had paid anybody,” Ziolkowski said. He says he told the grand jury Stone never paid him, and that he hadn’t posted the photo.

So four years ago, in this very courthouse, Tarrio or his associates were questioned about the circumstances of any participation they had in threatening a judge.

That wasn’t the only role the Proud Boys had in Stone’s witness tampering in that case. The first contact that Randy Credico had with FBI agents investigating 2016 was not the highly publicized grand jury testimony to which he brought his comfort dog Bianca. It was a Duty to Warn contact earlier that summer after the FBI had identified credible threats against him. Those credible threats came from the gangs, including the Proud Boys, that Stone hung out with.

In entirely unrelated news, Credico posted pictures showing him in Moscow last week.

It didn’t end with Stone’s guilty verdict, either. After the verdict, Stone associates got leaked copies of the jury questionnaires. Mike Cernovich started hunting down details on the jurors to retroactively cast doubt on the judgment, and Trump joined in the effort to create a mob. In the wake of those efforts, the jurors expressed fear and some regret at having served.

ALL 12 OF the jurors in the Roger Stone case have expressed fear in court filings on Wednesday. They worry they will continue to be harassed and they fear for the safety of themselves and their families if their identities are revealed.

According to The National Law Journal, jurors cited tweets from President Trump and remarks from conspiracy theorist Alex Jones as the reason “the threats to the jurors’ safety and privacy persist” after the trial ended in November.

One juror wrote, “I try to stay away from danger, but now it seems like the danger is coming to me.”

The jurors are looking to thwart the legal efforts of right-wing conspiracy theorist Mike Cernovich, who is attempting to make public the pretrial questionnaires the jurors filled out. Those questionnaires include jurors’ private information and employment history. The supposed aim of the petition to release the questionnaires is to vet them for bias in hopes of getting a new trial for Stone.

Another juror wrote, “Given the current climate of polarization and harassment, I do not want to draw any attention to myself, my family, or my employer in any way, shape, or form. It is intimidating when the president of the United States attacks the foreperson of a jury by name.”

“I am frightened that someone could harm my family simply because I was summoned and then chosen to serve on the jury,” another juror wrote.

The efforts to intimidate have continued to this case. During a period when Zach Rehl was reportedly considering a plea, Tarrio sent messages to other Proud Boys about remaining loyal.

“The bigger problem with that is the guys that are in prison right now are holding on to hope that everybody is f—ing staying put because they didn’t do anything wrong,” Tarrio said. “The moment that they think one of the guys flipped, it throws everything off and it makes everybody turn on each other, and that’s what we are trying to f—ing avoid.”

Asked about the audio message, Tarrio told Reuters he was simply trying to stop members from speculating that anyone had decided to help prosecutors who are examining the deadly insurrection. “What I was trying to avoid is them turning against each other because of media stories,” he said.

Trial testimony showed that witnesses for the defense — in this case Fernando Alonzo — made threatening comments about Eddie Block for posting the video of the Proud Boys he shot on January 6. [Warning: he used an ableist slur against Block, who relies on a mobility scooter.]

Witnesses for other January 6 defendant have been harassed, as when one January 6 participant confronted Sergeant Aquilino Gonell during the trial of Kyle Fitzsimons on assault charges.

[January 6 participant Tommy] Tatum also tried to confront another officer, this one with the Capitol Police, in a courthouse elevator on Wednesday. He recorded and posted clips of both exchanges with the officers and identified himself outside the courthouse.

U.S. Capitol Police Sgt. Aquilino Gonell, who is also testifying in the trial, said that Tatum told him that he should be ashamed of himself in an exchange near the bathroom inside the courthouse on Wednesday. Shortly after, Tatum got into an expletive-laden confrontation with David Laufman, an attorney for Gonell, after he tried to get into an elevator with Gonell, Laufman and an NBC News reporter.

NBC News separately heard Tatum make negative comments inside the courthouse about how he believed Gonell was acting. Outside the courthouse, Tatum recorded himself accusing Gonell of committing perjury.

The confrontations with Gonell came before the conclusion of his testimony in the case against Fitzsimons, who is accused of assaulting Gonell inside the tunnel. Gonell’s cross-examination by Fitzsimons’ federal public defender will continue on Thursday morning.

“For Sgt. Gonell to be accosted like that, within the courthouse and while he remains a live witness at trial, was outrageous and amounts to witness intimidation that promptly should be addressed by the court as well as the FBI and the Department of Justice,” Laufman, who is representing Gonell pro bono, told NBC News on Wednesday night.

Finally, there are other key players in January 6 — most notably former Green Beret, Ivan Raiklin, who played a key role in Operation Pence Card, the effort to pressure Pence to overturn the election — who lurk around all events associated with January 6. Fellow Proud Boy Gabriel Garcia, in a recent bid to avoid pre-trial release sanctions for going to CPAC after he told Judge Amy Berman Jackson he was coming to DC to observe — among other things — the Proud Boys trial, claimed that he hung out with Raiklin at CPAC to formulate his defense.

While at CPAC, Mr. Garcia was working on his defense to these charges. Indeed, he asked Congressman M. Gaetz, who is from Mr. Garcia’s home state, how and when could his defense team access the 40,000 hours of unreleased video Capitol Police have. Also, he and his counsel met, and conferred extensively with, attorney Ivan Raiklin, whom they may retain for assistance and trial preparation. Mr. Raiklin had spoken to Mr. Garcia on March 2 at CPAC, and he told Mr. Garcia to return the next day with his counsel to discuss at length defense strategies, which they did.

Former Army Captain Garcia is one of the Proud Boys who, in exhibits submitted at trial (here, Gabriel PB), was issuing the most chilling threats in advance of January 6.

None of this makes things easier for Tim Kelly, as he tries to sustain this jury long enough to get through deliberations. It’s not yet clear whether the jurors, watching testimony about the extent to which Proud Boys using intimidation to protect their organization, are seeing shadows, or whether there’s a real attempt to intimidate jurors before they start deliberating.

But given the history of individuals directly associated with the defendants, the threat is not an idle one.

Share this entry