Posts

Charlie Savage Plays with His Magic Time Machine To Avoid Doing Journalism

Charlie Savage just did something astonishing in the name of press freedom. He said that the truth doesn’t matter now, in 2021, because he reported a different truth eleven years ago.

He took issue with my headline to this piece, noting that he was obfuscating the facts about the Julian Assange prosecution so as to shoehorn it into a story about actual journalists.

Charlie made several obfuscations or clear errors in that piece:

  • He didn’t explain (as he hasn’t, to misleading effect, in past stories on Assange) the nature of the 2nd superseding indictment and the way it added to the most problematic first superseding one
  • He said the 2019 superseding indictment (again, he was silent about the 2020 superseding indictment) raised the “specter of prosecuting reporters;” this line is how Charlie shoehorned Assange into a story about actual journalists
  • He claimed that the decision to charge Assange for “his journalistic-style acts” arose from the change in Administrations, Obama to Trump (and specifically to Bill Barr), not the evidence DOJ had obtained about Assange’s actions over time

Charlie presented all this as actual journalism about the Assange prosecution, but along the way, he made claims that were either inflammatory and inexact — a veritable specter haunting journalism — or, worse, what I believe to be false statements, false statements that parrot the propaganda that Wikileaks is spreading to obscure the facts.

The “specter” comment, I take to be a figure of speech, melodramatic and cynical, but mostly rhetorical.

The silence about the 2020 superseding indictment is a habit I have called Charlie on before, but one that is an error of omission, rather than of fact.

It’s this passage that I objected to at length:

But the specter of prosecuting reporters returned in 2019, when the department under Attorney General William P. Barr expanded a hacking conspiracy indictment of Julian Assange, the WikiLeaks founder, to treat his journalistic-style acts of soliciting and publishing classified information as crimes.

Obama-era officials had weighed charging Mr. Assange for publishing leaked military and diplomatic files, but worried about establishing a precedent that could damage mainstream news outlets that sometimes publish government secrets, like The Times. The Trump administration, however, was undeterred by that prospect.

As presented, this passage made several claims:

  1. “Obama-era officials” had considered charging Assange for publishing activities, but “Obama-era officials” did not do so because it might damage “mainstream news outlets” like the NYT
  2. The reason that the Trump administration was willing to charge Assange for publishing was because they were “undeterred” from the prospect of doing damage to the NYT
  3. DOJ under Billy Barr expanded a hacking conspiracy “to treat his journalistic-style acts of soliciting and publishing classified information as crimes”

I believe the last claim is largely factual but misleading, as if the operative issue were Barr’s involvement or as if Barr deliberately treated Assange’s “journalistic-style acts” — as distinct from that of actual journalists — as a crime. There may be evidence that Barr specifically had it in for WikiLeaks or that Barr (as distinct from Trump’s other Attorneys General) treated Assange as he did out of the same contempt with which he treated actual journalists. There may be evidence that Barr — whose tenure as AG exhibited great respect for some of the journalists he had known since his first term as AG — was trying to burn down journalism, as an institution. But Charlie provides no evidence of that, nor has anyone else I know. (Indeed, Charlie’s larger argument presents evidence that Barr’s attacks on journalism, including subpoenas that may or may not have been obtained under Barr in defiance of guidelines adopted under Eric Holder, may only differ from Obama’s in their political tilt.)

Of course, one of the worst things that the Trump Administration did to a journalist, obtaining years of Ali Watkins’ email records, happened under Jeff Sessions, not Barr.

The first and second claims together set up a clear contrast. Obama-era officials — and by context, this means the entirety of the Obama Administration — did not prosecute Assange for publication because of what became known — based off a description that DOJ’s spox Matthew Miller gave publicly in 2013 — as the NYT problem, the risk that prosecuting WikiLeaks would endanger NYT. But the Trump Administration was willing to charge Assange for publication because they didn’t think the risk that such charges posed to the NYT were all that grave or damaging or important.

There’s no way to understand these two points except as a contrast of Administrations, to suggest that Obama’s Administration — which was epically shitty on leak investigations — wouldn’t do what the Trump Administration did do. It further involves treating the Department of Justice as an organization entirely subject to the whims of a President and an Attorney General, rather than as the enormous bureaucracy full of career professionals who guard their independence jealously, who even did so, with varying degrees of success, in the face of Barr’s unprecedented politicization of the department.

It’s certainly possible that’s true. It’s possible that Evan Perez and three other CNN journalists who reported in 2017 that what actually changed pertained to Snowden simply made that report up out of thin air. It’s certainly possible that under a President who attempted to shut down the Russian hacking investigation to protect Assange even after his CIA Director declared war on Assange, who almost blew up the investigation into Joshua Schulte, who entertained pardoning Assange in 2016, in 2017, in 2018, and in 2020, at the same time viewed the Assange prosecution as a unique opportunity to set up future prosecutions of journalists. It’s certainly possible that Billy Barr, who sabotaged the Mike Flynn and Roger Stone prosecutions to serve Trump’s interests, went rogue on the Assange case.

But given the abundant evidence that this prosecution happened in spite of Trump’s feelings about WikiLeaks rather than because of them, you would need to do actual reporting to make that claim.

And, as noted, I asked Charlie whether he had done the reporting to sustain that claim before I wrote the post…

… just as I — months earlier — asked Charlie why he was falsely claiming Assange was charged in 2018 rather than within a day of a Russian exfiltration attempt in 2017, something that probably has far more to do with why DOJ charged Assange when and how they did than who was Attorney General at the time.

After his bullshit attempt to explain that date error away, Charlie removed the date, though without notice of correction, must less credit to me for having to fact check the NYT.

Anyway, Charlie apparently didn’t read the post when I first wrote it, but instead only read it yesterday when I excused Icelandic journalists for making the same error — attributing the decision to prosecute Assange to Billy Barr’s animus rather than newly discovered evidence — that Charlie had earlier made. And Charlie went off on a typically thin-skinned tirade. He accused me (the person who keeps having to correct his errors) of being confused. He claimed that the thrust of my piece — that he was misrepresenting the facts about Assange — was “false.” He claimed the charges against and extradition of Assange was a precedent not already set by Minh Quang Pham’s extradition and prosecution. He accused me of not grasping that this was a First Amendment argument and not the journalism argument he had shoehorned it into. He suggested my insistence on accurate reporting about the CFAA overt acts against Assange (including the significance of Edward Snowden to them) was a “hobbyhorse,” and that I only insisted on accurate reporting on the topic in an effort to, “us[e] something [Charlie] said as a peg to artificially sex it up (dumb NYT!) even though it doesn’t actually fit.” He then made a comment that still treats the prosecution of Assange as binary — the original indictment on a single CFAA charge or the first superseding indictment that added the dangerous Espionage Act charges — rather than tertiary, the second superseding indictment that, at least per Vanessa Baraitser, clearly distinguished what Assange did from what journalists do.

That’s when things went absolutely haywire. Pulitzer prize winning journalist Charlie Savage said that his repeated claim that the charges against Assange arose from a change in Administration rather than a changed understanding of Assange did not rely on what Miller said, because he had “been writing since 2010 about deliberations inside DOJ re wanting to charge Assange/WL,” linking to this story.

 

That is, Charlie presented as a defense to my complaint that he was misrepresenting what happened in 2016 and 2017 by pointing to reporting he did in 2010, which — I pointed out — is actually before 2013 and so useless in offering a better reason to cling to that 2013 detail rather than rely on more recent reporting. Because DOJ did not have the same understanding of WikiLeaks in 2010 as they got after Julian Assange played a key role in a Russian intelligence operation against the United States, obtained files from a CIA SysAdmin after explicitly calling on CIA SysAdmins to steal such things (in a speech invoking Snowden), attempted to extort the US with those CIA files, and then implicitly threatened the President’s son with them, Charlie Savage says, it’s okay to misrepresent what happened in 2016 and 2017. Charlie’s reporting in 2010 excuses his refusal to do reporting in 2021.

Given his snotty condescension, it seems clear that Charlie hasn’t considered that, better than most journalists in the United States, I understand the grave risks of what DOJ did with Assange. I’ve thought about it in a visceral way that a recipient of official leaks backed by an entire legal department probably can’t even fathom. But that hasn’t stopped me from trying to understand — and write accurately about — what DOJ claims to be doing with Assange. Indeed, as someone whose career has intersected with WikiLeaks far more closely than Charlie’s has and as someone who knows what people very close to Assange claim to believe, I feel I have an obligation to try to unpack what really happened and what the real legal implications of it are, not least because that’s the only way to assess where DOJ is telling the truth and whether they’re simply making shit up to take out Assange. DOJ is acting ruthlessly. But at the same time, at least one person very close to Assange told me explicitly she wanted me to misrepresent the truth in his defense, and WikiLeaks has been telling outrageous lies in Assange’s defense with little pushback by people like Charlie because, I guess, he thinks he’s defending journalism.

As I understand it, the entire point of journalism is to try to write the truth, rather than obfuscate it in an attempt to protect an institution called journalism. It does no good to the institution — either its integrity or the ability to demonstrate the risks of the Assange prosecution — to blame it all on Billy Barr rather than explore how and why DOJ’s institutional approach to Assange has changed over time.

DOJ’s Failures to Follow Media Guidelines on the WaPo Seizure

I wanted to add a few data points regarding the report that DOJ subpoenaed records from three WaPo journalists.

This post is premised on three pieces of well-justified speculation: that John Durham, after having been appointed Special Counsel, obtained these records, that Microsoft challenged a gag, and that Microsoft’s challenge was upheld in some way. I’m doing this post to lay out some questions that others should be asking about what happened.

An enterprise host (probably Microsoft) likely challenged a gag order

The report notes that DOJ did obtain the reporters’ phone records, and tried, but did not succeed, in obtaining their email records.

The Trump Justice Department secretly obtained Washington Post journalists’ phone records and tried to obtain their email records over reporting they did in the early months of the Trump administration on Russia’s role in the 2016 election, according to government letters and officials.

In three separate letters dated May 3 and addressed to Post reporters Ellen Nakashima and Greg Miller, and former Post reporter Adam Entous, the Justice Department wrote they were “hereby notified that pursuant to legal process the United States Department of Justice received toll records associated with the following telephone numbers for the period from April 15, 2017 to July 31, 2017.” The letters listed work, home or cellphone numbers covering that three-and-a-half-month period.

[snip]

The letters to the three reporters also noted that prosecutors got a court order to obtain “non content communication records” for the reporters’ work email accounts, but did not obtain such records. The email records sought would have indicated who emailed whom and when, but would not have included the contents of the emails. [my emphasis]

What likely happened is that DOJ tried to obtain a subpoena on Microsoft or Google (almost certainly the former, because the latter doesn’t care about privacy) as the enterprise host for the newspaper’s email service, and someone challenged or refused a request for a gag, which led DOJ to withdraw the request.

There’s important background to this.

Up until October 2017, when the government served a subpoena on a cloud company that hosts records for another, the cloud company was often gagged indefinitely from telling the companies whose email (or files) it hosted. By going to a cloud company, the government was effectively taking away businesses’ ability to challenge subpoenas themselves, which posed a problem for Microsoft’s ability to convince businesses to move everything to their cloud.

That’s actually how Robert Mueller obtained Michael Cohen’s Trump Organization emails — by first preserving, then obtaining them from Microsoft rather than asking Trump Organization (which was, at the same time, withholding the most damning materials when asked for the same materials by Congress). Given what we know about Trump Organization’s incomplete response to Congress, we can be certain that had Mueller gone to Trump Organization, he might never have learned about the Trump Tower Moscow deal.

In October 2017, in conjunction with a lawsuit settlement, Microsoft forced DOJ to adopt a new policy that gave it the right to inform customers when DOJ came to them for emails unless DOJ had a really good reason to prevent Microsoft from telling their enterprise customer.

Today marks another important step in ensuring that people’s privacy rights are protected when they store their personal information in the cloud. In response to concerns that Microsoft raised in a lawsuit we brought against the U.S. government in April 2016, and after months advocating for the United States Department of Justice to change its practices, the Department of Justice (DOJ) today established a new policy to address these issues. This new policy limits the overused practice of requiring providers to stay silent when the government accesses personal data stored in the cloud. It helps ensure that secrecy orders are used only when necessary and for defined periods of time. This is an important step for both privacy and free expression. It is an unequivocal win for our customers, and we’re pleased the DOJ has taken these steps to protect the constitutional rights of all Americans.

Until now, the government routinely sought and obtained orders requiring email providers to not tell our customers when the government takes their personal email or records. Sometimes these orders don’t include a fixed end date, effectively prohibiting us forever from telling our customers that the government has obtained their data.

[snip]

Until today, vague legal standards have allowed the government to get indefinite secrecy orders routinely, regardless of whether they were even based on the specifics of the investigation at hand. That will no longer be true. The binding policy issued today by the Deputy U.S. Attorney General should diminish the number of orders that have a secrecy order attached, end the practice of indefinite secrecy orders, and make sure that every application for a secrecy order is carefully and specifically tailored to the facts in the case.

Rod Rosenstein, then overseeing the Mueller investigation, approved the new policy on October 19, 2017.

The effect was clear. When various entities at DOJ wanted records from Trump Organization after that, DOJ did not approve the equivalent request approved just months earlier.

If DOJ withdrew a subpoena rather than have it disclosed, it was probably inconsistent with media guidelines

If I’m right that DOJ asked Microsoft for the reporters’ email records, but then withdrew the request rather than have Microsoft disclose the subpoena to WaPo, then the request itself likely violated DOJ’s media guidelines — at least as they were rewritten in 2015 after a series of similar incidents, including DOJ’s request for the phone records of 20 AP journalists in 2013.

DOJ’s media guidelines require the following:

  • Attorney General approval of any subpoena for call or email records
  • That the information be essential to the investigation
  • DOJ has taken reasonable attempts to obtain the information from alternate sources

Most importantly, DOJ’s media guidelines require notice and negotiation with the affected journalist, unless the Attorney General determines that doing so would “pose a clear and substantial threat to the integrity of the investigation.”

after negotiations with the affected member of the news media have been pursued and appropriate notice to the affected member of the news media has been provided, unless the Attorney General determines that, for compelling reasons, such negotiations or notice would pose a clear and substantial threat to the integrity of the investigation, risk grave harm to national security, or present an imminent risk of death or serious bodily harm.

But a judge can review the justifications for gags before issuing them (for all subpoenas, not just media ones).

Just as an example, the government obtained a gag on Twitter, Facebook, Instagram and Google when obtaining Reality Winner’s cloud-based communications a week after they had arrested her (at a time when she was in no position to delete her own content). After a few weeks, Twitter challenged the gag. A judge gave DOJ 180 days to sustain the gag, but in August 2017, DOJ lifted it.

That was a case where DOJ obtained the communications of an accused leaker, with possible unknown co-conspirators, so the gag at least made some sense.

Here, by contrast, the government would have been asking for records from journalists who were not alleged to have committed any crime. The ultimate subject of the investigation would have no ability to destroy WaPo’s records. The records — and the investigation — were over three years old. Whatever justification DOJ gave was likely obviously bullshit.

Hypothetical scenario: DOJ obtains cell phone records only to have a judge rule a gag inappropriate

Let me lay out how this might have worked to show why this might mean DOJ violated the media guidelines. Here’s one possible scenario for what could have happened:

  • In the wake of the election, John Durham subpoenaed the WaPo cell providers and Microsoft, asking for a gag
  • The cell provider turned over the records with no questions — neither AT&T nor Verizon care about their clients’ privacy
  • Microsoft challenged the gag and in response, a judge ruled against DOJ’s gag, meaning Microsoft would have been able to inform WaPo

That would mean that after DOJ, internally — Billy Barr and John Durham, in this speculative scenario — decided that warning journalists would create the same media stink we’re seeing today and make the records request untenable, a judge ruled that that a media stink over an investigation into a 3-year old leak wasn’t a good enough reason for a gag. If this happened, it would mean some judge ruled that Barr and Durham (if Durham is the one who made the request) invented a grave risk to the integrity of their investigation that a judge subsequently found implausible.

It would mean the request itself was dubious, to say nothing of the gag.

Once again, DOJ failed to meet its own notice requirements

And with respect to the gag, this request broke another one of the rules on obtaining records from reporters: that they get notice no later than 90 days after the subpoena. The Justice Manual says this about journalists whose records are seized:

  • Except as provided in 28 C.F.R. 50.10(e)(1), when the Attorney General has authorized the use of a subpoena, court order, or warrant to obtain from a third party communications records or business records of a member of the news media, the affected member of the news media shall be given reasonable and timely notice of the Attorney General’s determination before the use of the subpoena, court order, or warrant, unless the Attorney General determines that, for compelling reasons, such notice would pose a clear and substantial threat to the integrity of the investigation, risk grave harm to national security, or present an imminent risk of death or serious bodily harm. 28 C.F.R. 50.10(e)(2). The mere possibility that notice to the affected member of the news media, and potential judicial review, might delay the investigation is not, on its own, a compelling reason to delay notice. Id.
  • When the Attorney General has authorized the use of a subpoena, court order, or warrant to obtain communications records or business records of a member of the news media, and the affected member of the news media has not been given notice, pursuant to 28 C.F.R. 50.10(e)(2), of the Attorney General’s determination before the use of the subpoena, court order, or warrant, the United States Attorney or Assistant Attorney General responsible for the matter shall provide to the affected member of the news media notice of the subpoena, court order, or warrant as soon as it is determined that such notice will no longer pose a clear and substantial threat to the integrity of the investigation, risk grave harm to national security, or present an imminent risk of death or serious bodily harm. 28 C.F.R. 50.10(e)(3). In any event, such notice shall occur within 45 days of the government’s receipt of any return made pursuant to the subpoena, court order, or warrant, except that the Attorney General may authorize delay of notice for an additional 45 days if he or she determines that for compelling reasons, such notice would pose a clear and substantial threat to the integrity of the investigation, risk grave harm to national security, or present an imminent risk of death or serious bodily harm. Id. No further delays may be sought beyond the 90‐day period. Id. [emphasis original]

Journalists are supposed to get notice if their records are seized. They’re supposed to get notice no later than 90 days after the records were obtained. AT&T and Verizon would have provided records almost immediately and this happened in 2020, meaning the notice should have come by the end of March. But WaPo didn’t get notice until after Lisa Monaco was confirmed as Deputy Attorney General and, even then, it took several weeks.

DOJ’s silence about an Office of Public Affairs review

While it’s not required by guidelines, in general DOJ has involved the Office of Public Affairs in such matters, so someone who has to deal with the press can tell the Attorney General and the prosecutor that their balance of journalist equities is out of whack. At the time, this would have been Kerri Kupec, who was always instrumental in Billy Barr’s obstruction and politicization.

But it’s not clear whether that happened. I asked Acting Director of OPA Marc Raimondi (the guy who has defended what happened in the press; he was in National Security Division at the time of the request), twice, whether someone from OPA was involved. Both times he ignored my question.

The history of Special Counsels accessing sensitive records and testimony

There’s a history of DOJ obtaining things under Special Counsels they might not have obtained without the Special Counsel:

  • Pat Fitzgerald coerced multiple reporters’ testimony, going so far as to jail Judy Miller, in 2004
  • Robert Mueller obtained Michael Cohen’s records from Microsoft rather than Trump Organization
  • This case probably represents John Durham, having been made Special Counsel, obtaining records that DOJ did not obtain in 2017

There’s an irony here: Durham has long sought ways to incriminate Jim Comey, who is represented by Pat Fitzgerald and others. In 2004, as Acting Attorney General, Comey approved the subpoenas for Miller and others. That said, given the time frame on the records request, it is highly unlikely that he’s the target of this request.

Whoever sought these records, it is virtually certain that the prosecutor only obtained them after making decisions that DOJ chose not to make when these leaks were first investigated in 2017, after Jeff Sessions announced a war on media leaks in the wake of having his hidden meeting with Sergey Kislyak exposed.

That suggests that DOJ decided these records, and the investigation itself, were more important in 2020 than Jeff Sessions had considered them in 2017, when his behavior was probably one of the things disclosed in the leak.

The dubious claim that these records could have been necessary or uniquely valuable

Finally, consider one more detail of DOJ’s decision to obtain these records: their claims, necessary under the media policy, that 3-year old phone and email records were necessary to a leak investigation.

When these leaks were first investigated in 2017, DOJ undoubtedly identified everyone who had access to the Kislyak intercepts and used available means — including reviewing the government call records of the potential sources — to try to find the leakers. If they had a solid lead on someone who might be the leaker, the government would have obtained the person’s private communication records as well, as DOJ did do during the contemporaneous investigation into the leak of the Carter Page FISA warrant that ultimately led to SSCI security official James Wolfe’s prosecution.

Jeff Sessions had literally declared war within days of one of the likely leaks under investigation here, and would approve a long-term records request from Ali Watkins in the Wolfe investigation and a WhatsApp Pen Register implicating Jason Leopold in the Natalie Edwards case. After Bill Barr came in, he approved the use of a Title III wiretap to record calls involving journalists in the Henry Frese case.

For the two and a half years between the time Sessions first declared war on leaks and the time DOJ decided these records were critical to an investigation, DOJ had not previously considered them necessary, even at a time when Sessions was approving pretty aggressive tactics against leaks.

Worse still, DOJ would have had to claim they might be useful. These records, unlike the coerced testimony of Judy Miller, would not have revealed an actual source for the stories. These records, unlike the Michael Cohen records obtained via Microsoft would not be direct evidence of a crime.

All they would be would be leads — a list of all the phone numbers and email addresses these journalists communicated with via WaPo email or telephony calls or texts — for the period in question. It might return records of people (such as Andy McCabe) who could be sources but also had legal authority to communicate with journalists. It would probably return a bunch of records of inquiries the journalists made that were never returned. It would undoubtedly return records of people who were sources for other stories.

But it would return nothing for other means of communication, such as Signal texts or calls.

In other words, the most likely outcome from this request is that it would have a grave impact on the reporting equities of the journalists involved, with no certainty it would help in the investigation (and an equally high likelihood of returning a false positive, someone who was contacted but didn’t return the call).

And if it was Durham who made the request, he would have done so after having chased a series of claims — many of them outright conspiracy theories — around the globe, only to have all of those theories to come up empty. Given that after years of investigation Durham has literally found nothing new, there’s no reason to believe he had any new basis to think he could solve this leak investigation after DOJ had tried but failed in 2017. Likely, what made the difference is that his previous efforts to substantiate something had failed, and Barr needed to empower him to keep looking to placate Trump, and so Durham got to seize WaPo’s records.

Billy Barr has been hiding other legal process against journalists

Given the disclosure that Barr approved a request targeting the WaPo about five months ago and that under Barr DOJ used a Title III wiretap in a leak investigation (albeit targeting the known leaker), it’s worth noting one other piece of oversight that has lapsed under Barr.

In the wake of Jeff Sessions declaring war on leaks in 2017 (and, probably, the leak in question here), Ron Wyden asked Jeff Sessions whether the war on leaks reflected a change in the new media guidelines adopted in 2015.

Wyden asked Sessions to answer the following questions by November 10:

  1. For each of the past five years, how many times has DOJ used subpoenas, search warrants, national security letters, or any other form of legal process authorized by a court to target members of the news media in the United States and American journalists abroad to seek their (a) communications records, (b) geo-location information, or (c) the content of their communications? Please provide statistics for each form of legal process.
  2. Has DOJ revised the 2015 regulations, or made any other changes to internal procedures governing investigations of journalists since January 20, 2017? If yes, please provide me with a copy.

In response, DOJ started doing a summary of the use of legal process against journalists for each calendar year. For example, the 2016 report described the legal process used against Malheur propagandist Pete Santilli. The 2017 report shows that, in the year of my substantive interview with FBI, DOJ obtained approval for a voluntary interview with a journalist before the interview because they, “suspected the journalist may have committed an offense in the course of newsgathering activities” (while I have no idea if this is my interview, during the interview, the lead FBI agent also claimed to know the subject of a surveillance-related story I was working on that was unrelated to the subject of the interview, though neither he nor I disclosed what the story was about). The 2017 report also describes obtaining Ali Watkins’ phone records and DOJ’s belated notice to her. The 2018 report describes getting retroactive approval for the arrest of someone for harassing Ryan Zinke but who claimed to be media (I assume that precedent will be important for the many January 6 defendants who claimed to be media).

While I am virtually certain the reports — at least the 2018 one — are not comprehensive, the reports nevertheless are useful guidelines for the kinds of decision DOJ deems reasonable in a given year.

But as far as anyone knows, DOJ stopped issuing them under Barr. Indeed, when I asked Raimondi about them, he didn’t know they existed (he is checking if they were issued for 2019 and 2020).

So we don’t know what other investigative tactics Barr approved as Attorney General, even though we should.

The Significance of the James Wolfe Sentence for Mike Flynn, Leak Investigations, and the Signal Application

Yesterday, Judge Ketanji Brown Jackson sentenced former SSCI head of security James Wolfe to two months in prison for lying to the FBI. In her comments announcing the sentence, Jackson explained why she was giving Wolfe a stiffer sentence than what George Papadopoulos and Alex van der Zwaan received: because Wolfe had abused a position of authority.

“This court routinely sentences people who come from nothing, who have nothing, and whose life circumstances are such that they really don’t have a realistic shot of doing anything other than committing crimes,” Jackson said. “The unfortunate life circumstances of those defendants don’t result in a lower penalty, so why should someone who had every chance of doing the right thing, a person who society rightly expects to live up to high moral and ethical standards and who has no excuse for breaking the law, be treated any better in this regard.”

[snip]

Wolfe’s case was not part of special counsel Robert Mueller’s investigation, but the judge compared his situation to two defendants in the Mueller probe who also pleaded guilty to making false statements — former Trump campaign adviser George Papadopoulos, who spent 12 days in prison, and Dutch lawyer Alex van der Zwaan, who was sentenced to 30 days. Jackson concluded that Wolfe’s position as head of security for the Intelligence Committee was an “aggravating” factor.

The public shame he had endured, and the loss of his job and reputation, were not punishment enough, the judge said, but were rather the “natural consequence of having chosen to break the law.”

“You made blatant false statements directly to FBI agents who questioned you about matters of significance in the context of an ongoing investigation. And if anything, the fact that you were a government official tasked with responsibility for protecting government secrets yourself seems to make you more culpable than van der Zwaan and Papadopoulos, who held no such positions,” Jackson said.

While the resolution of this case is itself notable, it has likely significance in three other areas: for Mike Flynn, for DOJ’s leak investigations, and for encrypted messaging apps.

Emmet Sullivan will cite this sentence as precedent

It’s still far from clear that Emmet Sullivan will be sentencing Mike Flynn three months from now. Given Trump’s increasingly unstable mood, Flynn might get pardoned. Or, Flynn might try to judge shop, citing Sullivan’s invocation of treason Tuesday.

But if Sullivan does eventually sentence Flynn and if he still feels inclined to impose some prison time to punish Flynn for selling out his country, he can cite both this sentence and the language Jackson used in imposing it. Like Wolfe, Flynn occupied a (arguably, the) position of great responsibility for protecting our national security. Sullivan seems to agree with Jackson that, like Wolfe, Flynn should face more consequences for abusing the public trust. So Wolfe’s sentence might start a countertrend to the David Petraeus treatment, whereby the powerful dodge all responsibility.

(Note, this is a view that Zoe Tillman also expressed yesterday.)

DOJ may rethink its approach to using false statements to avoid the difficulties of leak cases

I have zero doubt that DOJ prosecuted Wolfe because they believe he is Ellen Nakashima’s source for the story revealing that Carter Page had been targeted with a FISA order, which is how they came to focus on him in the first place. But instead of charging him with that, they charged him for lying about his contacts with Nakashima, Ali Watkins, and two other journalists (and, in their reply to his sentencing memo, made it clear he had leaked information to two other young female national security reporters). In the sentencing phase, however, the government asked for a significant upward departure, a two year sentence that would be equivalent to what he’d face if they actually had proven him to be Nakashima’s source.

While the government provided circumstantial evidence he was Nakashima’s source — in part, her communications to him in the aftermath of the story — he convincingly rebutted one aspect of that claim (a suggestion that she changed her email footer to make her PGP key available to him). More importantly, he rightly called out what they were doing, trying to insinuate he had leaked the FISA information without presenting evidence.

The government itself admitted no fewer than four times in its opening submission that it found no evidence that Mr. Wolfe disclosed Classified Information to anyone. See infra Part I.A. Nonetheless, the government deploys the word “Classified” 58 times in a sentencing memorandum about a case in which there is no evidence of disclosure of Classified Information—let alone a charge.

[snip]

The government grudgingly admits that it lacks evidence that Mr. Wolfe disclosed Classified Information to anyone. See, e.g., Gov. Mem. at 1 (“although the defendant is not alleged to have disclosed classified information”); id. at 6 (“notwithstanding the fact that the FBI did not uncover evidence that the defendant himself disclosed classified national security information”); id. at 22 (“[w]hile the investigation has not uncovered evidence that Wolfe disclosed classified information”); id. at 25 n.14 (“while Wolfe denied that he ever disclosed classified information to REPORTER #2, and the government has no evidence that he did”).

The Court should see through the government’s repetition of the word “Classified” in the hope that the Court will be confused about the nature of the actual evidence and charges in this case and sentence Mr. Wolfe as if he had compromised such information.1

1 Similarly, the government devotes multiple pages of its memorandum describing the classified document that Mr. Wolfe is not accused of having disclosed. And although the government has walked back its initial assertion that Mr. Wolfe “received, maintained, and managed the Classified Document” (Indictment ¶ 18) to acknowledge that he was merely “involved in coordinating logistics for the FISA materials to be transported to the SSCI” (Gov. Mem. at 10), what the government still resists conceding is the fact that Mr. Wolfe had no access to read that document, let alone disclose any part of it. Beyond providing an explanation of how the FBI’s investigation arose, that document has absolutely no relevance to Mr. Wolfe’s sentencing, but it and its subject, an individual under investigation for dealings with Russia potentially related to the Trump campaign, likely have everything to do with the vigor of the government’s position.

It’s unclear, at this point, whether the government had evidence against Wolfe but chose not to use it because it would have required imposing on Nakashima’s equities (notably, they appear to be treating Nakashima with more respect than Ali Watkins, though it may be that they only chose to parallel construct Ali Watkins’ comms) and introduce classified evidence at trial. It may be that Wolfe genuinely isn’t the culprit.

Or it may be that Wolfe’s operational security was just good enough to avoid leaving evidence.

Whatever it is, particularly in a culture of increasing aggressiveness on leaks, the failure to get Wolfe here may lead DOJ to intensify its other efforts to pursue leakers using the Espionage Act.

DOJ might blame Signal and other encrypted messaging apps for their failure to find the Carter Page FISA culprit

And if DOJ believes they couldn’t prove a real case against Wolfe because of his operational security, they may use it to go after Signal and other encrypted messaging apps.

That’s because Wolfe managed to hide a great deal of his communications with journalists until they had sufficient evidence for a Rule 41 warrant to search his phone (which may well mean they hacked his phone). Here’s what it took to get Wolfe’s Signal texts.

Once the government discovered that Wolfe was dating Watkins, they needed to find a way to investigate him without letting him know he was a target, which made keeping classified information particularly difficult. An initial step involved meeting with him to talk about the leak investigation — purportedly of others — which they used as an opportunity to image his phone.

The FBI obtained court authority to conduct a delayed-notice search warrant pursuant to 18 U.S.C. § 3103a(b), which allowed the FBI to image Wolfe’s smartphone in October 2017. This was conducted while Wolfe was in a meeting with the FBI in his role as SSCI Director of Security, ostensibly to discuss the FBI’s leak investigation of the classified FISA material that had been shared with the SSCI. That search uncovered additional evidence of Wolfe’s communications with REPORTER #2, but it did not yet reveal his encrypted communications with other reporters.

Imaging the phone was not sufficient to discover his Signal texts.

Last December and this January, the FBI had two more interviews with Wolfe where they explicitly asked him questions about the investigation. At the first one, even after he admitted his relationship with Watkins, Wolfe lied about the conversations he continued to have on Signal.

The government was able to recover and view a limited number of these encrypted conversations only by executing a Rule 41 search warrant on the defendant’s personal smartphone after his January 11, 2018 interview with the FBI. It is noteworthy that Signal advertises on its website that its private messaging application allows users to send messages that “are always end-to-end encrypted and painstakingly engineered to keep your communication safe. We [Signal] can’t read your messages or see your calls, and no one else can either.” See Signal Website, located at https://signal.org. The government did not recover or otherwise obtain from any reporters’ communications devices or related records the content of any of these communications.

Then, in a follow-up meeting, he continued to lie, after which they seized his phone and found “fragments” of his Signal conversations.

It is noteworthy that Wolfe continued to lie to the FBI about his contacts with reporters, even after he was stripped of his security clearances and removed from his SSCI job – when he no longer had the motive he claimed for having lied about those contacts on December 15. During a follow-up voluntary interview at his home on January 11, 2018, Wolfe signed a written statement falsely answering “no” to the question whether he provided REPORTER #2 “or any unauthorized person, in whole or in part, by way of summary, or verbal [or] non-verbal confirmation, the contents of any information controlled or possessed by SSCI.” On that same day, the FBI executed a second search warrant pursuant to which it physically seized Wolfe’s personal telephone. It was during this search, and after Wolfe had spoken with the FBI on three separate occasions about the investigation into the leak of classified information concerning the FISA application, that the FBI recovered fragments of his encrypted Signal communications with REPORTERS #3 and #4.

They specify that this second warrant was a Rule 41 warrant, which would mean it’s possible — though by no means definite — that they hacked the phone.

The government was able to recover and view a limited number of these encrypted conversations only by executing a Rule 41 search warrant on the defendant’s personal smartphone after his January 11, 2018 interview with the FBI. It is noteworthy that Signal advertises on its website that its private messaging application allows users to send messages that “are always end-to-end encrypted and painstakingly engineered to keep your communication safe. We [Signal] can’t read your messages or see your calls, and no one else can either.” See Signal Website, located at https://signal.org.

Mind you, this still doesn’t tell us much (surely by design). In another mention, they note Signal’s auto-delete functionality.

Given the nature of Signal communications, which can be set to delete automatically, and which are difficult to recover once deleted, it is impossible to tell the extent of Wolfe’s communications with these two reporters. The FBI recovered 626 Signal communications between Wolfe and REPORTER #3, and 106 Signal communications between Wolfe and REPORTER #4.

Yet it remains unclear (though probably likely) that the “recovered” texts were Signal (indeed, given that he was lying and the only executed the Rule 41 warrant after he had been interviewed a second time, he presumably would have deleted them then if not before). DOJ’s reply memo also reveals that Wolfe deleted a ton of his texts to Watkins, as well.

The defendant and REPORTER #2 had an extraordinary volume of contacts: in the ten months between December 1, 2016, and October 10, 2017, alone, they exchanged more than 25,750 text messages and had 556 phone calls, an average of more than 83 contacts per day. The FBI was unable to recover a significant portion of these text messages because they had been deleted by the defendant.

All of this is to say two things: first, the government would not pick up Signal texts — at least not deleted ones — from simply imaging a phone. Then, using what they specify was a Rule 41 warrant that could indicate hacking, they were able to obtain Signal. At least some of the Signal texts the government has revealed pre-date when his phone was imaged.

That’s still inconclusive as to whether Wolfe had deleted Signal texts and FBI was able to recover some of them, or whether they were unable to find Signal texts that remained on his phone when they imaged it in October.

Whichever it is, it seems clear that they required additional methods (and custody of the phone) to find the Signal texts revealing four relationships with journalists he had successfully hidden until that point.

Which is why I worry that the government will claim it was unable to solve the investigation into who leaked Carter Page’s FISA order because of Signal, and use that claim as an excuse to crack down on the app.

Journalist Records from the “Last Five Years”

Some weeks ago, there was some concern raised by DOJ’s response to an October 10, 2017 letter from Ron Wyden, written in the wake of an August Jeff Sessions press conference asking how many times DOJ has seized journalists’ records.

  1. For each of the past five years, how many times has DOJ used subpoenas, search warrants, national security letters, or any other form of legal process authorized by a court to target members of the news media in the United States and American journalists abroad to seek their (a) communications records, (b) geo-location information, or (c) the content of their communications? Please provide statistics for each form of legal process.
  2. Has DOJ revised the 2015 regulations, or made any other changes to internal procedures governing investigations of journalists since January 20, 2017? If yes, please provide me with a copy.

In response, in a letter claiming to provide all the “requests for information from January 2012 to the present,” DOJ pointed to the 2013 collection of AP records and the 2014 subpoena of James Risen. It also claimed,

The Federal Bureau of Investigation does not currently use national security letters to advance media leak investigations.

DOJ’s letter was written after Ali Watkins received notice, on February 13, that her phone and email records had been seized in the investigation of James Wolfe. It also comes after DOJ subpoenaed the Twitter information of Dissent Doe and Popehat last spring in conjunction with DOJ’s dumb persecution of Justin Shafer, both of whom have websites providing original content.

Whether DOJ has gotten more aggressive about seizing reporters’ phone records or content is a question I’m unsurprisingly very interested in.

All that said, DOJ may simply be playing word games, at least thus far.

Note, first of all, that Wyden only asked for the “past five years.” While DOJ claimed to present records spanning into the present, had DOJ responded to the actual request, it might have only presented past requests. Additionally, if Watkins got 90 day notice of her records being seized, the request itself would have taken place after the Wyden request.

While more specious, the May 2017 Twitter subpoena may have been deemed to be the same year as Wyden’s request.

Note three other details. First, Wyden’s letter (though not DOJ’s response) describes “targeting” journalists. Obviously, that word has a specific meaning in the context of surveillance, and I could see DOJ claiming that the Shafer investigation, for example, targeted Shafer, not his Tweeps.

Additionally, Wyden only asks about US news media and US journalists overseas. That’s not going to include an obvious target (whether or not DOJ still considers him a publisher): Julian Assange, an Australian publisher living in what counts as Ecuadoran territory.

Finally, note that DOJ specifies they don’t use NSLs for “media leak investigations.” That, too, has a specific meaning, one that probably doesn’t include the Shafer investigation on trumped up cyberstalking charges.

The Watkins case, especially, demands explanation. But finding it might just require rewording the questions.

Google at Temple: Did DOJ Follow Its New Guidelines on Institutional Gags?

On October 19, 2017, DOJ issued new guidelines on default gag orders under the Stored Communications Act. It required that prosecutors “conduct an individualized and meaningful assessment requiring the need for protection from disclosure prior to seeking” a gag “and only seek an order when circumstances require.” Sometime after that, in association with its investigation of leaks about Carter Page, DOJ sought Ali Watkins’ call records, including her email subscriber records from when she was an undergraduate at Temple.

Under Justice Department regulations, investigators must clear additional hurdles before they can seek business records that could reveal a reporter’s confidential sources, such as phone and email records. In particular, the rules require the government to have “made all reasonable attempts to obtain the information from alternative, non-media sources” before investigators may target a reporter’s information.

In addition, the rules generally require the Justice Department to notify reporters first to allow them to negotiate over the scope of their demand for information and potentially challenge it in court. The rules permit the attorney general to make an exception to that practice if he “determines that, for compelling reasons, such negotiations would pose a clear and substantial threat to the integrity of the investigation, risk grave harm to national security, or present an imminent risk of death or serious bodily harm.”

Top Justice Department officials must sign off on any attempt to gain access to a journalist’s communications records.

It is not clear whether investigators exhausted all of their avenues of information before confiscating Ms. Watkins’s information. She was not notified before they gained access to her information from the telecommunications companies. Among the records seized were those associated with her university email address from her undergraduate years.

This request would almost certainly not have been presented to Temple University. It would have been presented to Google, which provides email service for Temple. At least, that’s what appears to have happened in the case of Professor Xiaoxiang Xi in DOJ’s investigation of him for carrying out normal academic discussions about semiconductors with colleagues in China.

Thus far (as reflected here with the NYT coverage), the focus on whether DOJ followed its own regulations pertains to whether they followed guidelines on obtaining the records of a journalist. But the circumstances surrounding their request for Temple records should focus as much attention on whether the government followed its brand new regulations on imposing gags even when obtaining records from an institutional cloud customer like Temple.

The new guidelines were adopted largely in response to a challenge from Microsoft on default, indefinite gags. While few noted it at the time, what Microsoft most worried about was its inability to give its institutional customers notice their records had been subpoenaed. That meant that certain kind of cloud customers effectively gave up a legal right to challenge legal process by outsourcing that service to Microsoft. Microsoft dropped its suit to legally force this issue when DOJ adopted the new guidelines last year. Best as I understand, those guidelines should have governed whether Google could tell Temple that DOJ was seeking the records of a former student.

So it’s not just that DOJ didn’t give Watkins an opportunity to challenge this subpoena, but also whether they gagged Google from telling Temple, and providing Temple the opportunity to challenge the subpoena on academic freedom grounds.

Given how they treated Xi, it’s unlikely Temple would have done much to protect their former student. But some universities — and other institutions with special First Amendment concerns that use Microsoft or Google for their email service — might. They can only do so, however, if DOJ doesn’t obtain frivolous gags to prevent them from doing so.