Posts

John Durham’s Show Trials: A Preview of Coming Attractions

/12 Comments/in /by

On May 20, 2022 — a year after John Durham had obtained evidence showing that the draft SVR report that he always claimed was the basis of his investigation was based on “composite” emails, and as such, proof that the SVR was framing Hillary Clinton — his lead prosecutor, Andrew DeFilippis, openly defied a judge’s order. DeFilippis instructed Hillary Clinton’s former campaign manager, Robby Mook, to read a quote from Jake Sullivan about the Alfa Bank anomalies saying, “This secret hotline may be the key to unlocking the mystery of Trump’s ties to Russia. It certainly seems the Trump Organization felt it had something to hide, given that it apparently took steps to conceal the link when it was discovered by journalists.”

The quote seemed to confirm the conspiracy theory that Durham had otherwise failed to substantiate, that Hillary had a plan to frame Donald Trump.

The inclusion of the Tweet as trial evidence immediately created a firestorm among credulous journalists, leading right wingers, including Elon Musk, to claim this was proof of “an elaborate hoax about Trump and Russia.”

DeFilippis’ stunt introducing prejudicial hearsay he had just been ordered to exclude led to a redaction of the transcript and Tweet he contemptuously had Mook read. But, as Sussmann’s lawyer complained after Durham’s team pulled several more stunts like this, “the bell” of hearing prohibited testimony, “can never be unrung.” By cheating, Durham’s team presented six elements of the conspiracy theory based on the SVR attack on Hillary to the jury, in spite of rulings prohibiting them from doing so.

It didn’t help his case; less than two weeks later, a jury returned a humiliating acquittal, the first of two.

Yet Durham broke the rules to tell his manufactured story, and it worked in the public sphere.

Trump prosecutors already staged show trials

The prosecution of Michael Sussmann should never have gotten that far. Once Durham had the evidence to conclude that the emails behind the draft SVR report he claimed to be working off of were “composites,” he should have closed up shop. Instead, he charged Michael Sussmann and Igor Danchenko in an effort to sustain the story imagined by Russian spies five years earlier anyway.

Durham’s goals with Danchenko were modest (and fairly pathetic): to attempt to rewrite the genesis of the Steele dossier to make the business networking of a Democrat — and not Russian sources — the author of key claims in the dossier, and to attempt to turn Sergei Millian into the victim of the Steele dossier. After the judge in the case threw out one charge because Durham had charged Danchenko for lying about the pee tape in a literally true response he gave to an FBI question, the jury acquitted on four other counts pertaining to Millian.

Durham’s goals with Sussmann were far more ambitious: to use a single invented false statement as a lever to get inside Democratic networks to find the conspiracy that — even after concluding that the genesis of his entire investigation was an SVR fabrication — Durham nevertheless still believed had to exist.

It was utter madness. It was an egregious abuse of Sussmann’s rights — as I said here, Durham committed the precise crime that he claimed to be hunting. And it serves as a roadmap for where the sequel investigation Pam Bondi just announced might go.

In part because it serves as a roadmap for the stunt prosecutions Trump is ordering up, I want to take two posts to describe what happened. This post will use known interviews and my coverage of both cases — see also this earlier post attempting a similar project — to review the tactics Durham used to get this case to trial. In a follow-up, I hope to show how Durham’s show trials failed.

Pivot

What should have been the two final interviews on Durham’s Clinton conspiracy conspiracy theory investigation — the July 21 interview in which Julianne Smith disclaimed any knowledge of the Clinton plan and a July 8 2021 grand jury appearance where Peter Strzok denied receiving a referral mentioning it — happened almost five years after the events in question. The clock on any 5-year state of limitation was ticking.

So Durham pivoted.

The closest Durham came in his report to offering an explanation for why he continued after concluding these documents were fabricated came from speculation offered up by Brian Auten, the lead analyst on the team (and a MAGAt target ever since). At a time Durham knew he had no proof that the CIA referral to FBI had actually gotten to the Crossfire Hurricane team, he invited Auten to speculate.

Auten stated that it was possible he hand-delivered this Referral Memo to the FBI, as he had done with numerous other referral memos,419 and noted that he typically shared referral memos with the rest of the Crossfire Hurricane investigative team, although he did not recall if he did so in this instance. 420

[snip]

For example, Brian Auten stated that he could not recall anything that the FBI did to analyze, or otherwise consider the Clinton Plan intelligence, stating that it was “just one data point.”423

419 OSC Report of Interview of Brian Auten on July 26, 2021 at 13.

420 Id.

[snip]

423 OSC Report of interview of Brian Auten on July 26, 2021 at 13.

That interview was on July 26, 2021, at precisely the moment Durham should have packed up and gone home.

But consider the circumstances of that interview. At the Danchenko trial, Danchenko’s attorney Danny Onorato started his cross-examination of Auten by getting the FBI analyst to recall how — after his testimony in numerous other investigations was deemed credible — Durham started his first interview with Auten by informing him he was considered a subject of the investigation. (In that interview and one shortly thereafter, Durham seems to have used the threat of charges relating to the Carter Page FISA warrants to threaten Auten and one of the Crossfire Hurricane agents, precisely the theory of criminality that his investigation started to violate in those days.)

Q Does July 26 of 2021 sound fair?

A Yes, it does.

Q Okay. And when you met with them for the first time after you were meeting with people for 25 or 30 hours, did your status change from a witness to a subject of an investigation?

A Yes, it did.

Q Okay. And in your work for the FBI, has anyone ever told you that you are a subject of a criminal inquiry? A No.

Q Was that scary?

A Yes.

Hours later, after having walked Auten through a long list pertinent things Durham had not shown Auten when soliciting specific answers that incriminated Danchenko, including part of Auten’s own notes that he had underlined, Onorato got Auten to concede that his opinion about the credibility of Danchenko on the topic of Sergei Millian changed after that July 26, 2021 interview, in which he had been named a subject.

Yet even in that context, under threat of prosecution, Auten had no real memory of the referral and treated it as a data point if he actually did share it with Crossfire Hurricane. That’s what Durham rebuilt his debunked investigation on.

And having thus scripted an excuse to continue, Durham charged Sussmann on the very last day possible, September 16, 2021; he charged Danchenko in early November. As I wrote in those contemporaneous posts, both used ticky tack alleged lies to spin networked materiality claims insinuating a conspiracy that led sloppy journalists to adopt larger claims of conspiracy.

The belated investigation into false statements charged as a conspiracy

In the Sussmann case, Durham had been poring through subpoenaed documents from participants he imagined had played a part in his theory of conspiracy for over a year, but neither that nor immunized testimony from David Dagon in August had confirmed key premises of his conspiracy. Having failed to substantiate a conspiracy, then, Durham charged a different crime, a false statement charge. Such a belated change in prosecutorial strategy might explain how epically unprepared Durham was to prosecute the crime he actually charged. In the weeks and months that followed, Durham would serially confess he hadn’t taken some of the most basic investigative steps before indicting Sussmann, including:

  • Interviewing any full-time Clinton campaign staffer before accusing Sussmann of coordinating with the campaign (he would interview Jennifer Palmieri, Jake Sullivan, Victoria Nuland, James Clapper, John Podesta, and — just days before jury selection — Hillary Clinton in the eight months that followed); Durham’s report doesn’t reflect a Robby Mook interview; he was called as a defense witness at trial
  • Repeating FBI’s 2016 errors in belated interviews of DNS-related service providers
  • Testing the story Sussmann told Congress, under oath: that he reached out to the FBI to alert them to a story before the NYT covered it, which turned out to be confirmed by documentary records Durham only belatedly found at FBI
  • Learning how closely the FBI worked with Rodney Joffe on DNS-related issues
  • Checking how closely Michael Sussmann worked with the FBI, especially on the response to the Russian hacks; this was especially egregious as it debunked one of the ways he tried to implicate Julianne Smith in a made-up plot
  • Finding the January 31, 2017 CIA meeting record at which Sussmann clearly explained he was sharing an allegation at the request of a client
  • Finding notes from a May 2017 that debunked Durham’s accusations
  • Asking DOJ IG for evidence from their closely related investigation
  • Discovering a similar DNS tip that Sussmann had anonymously shared with DOJ IG on behalf of Rodney Joffe
  • Obtaining two James Baker phones, one of which Durham had been informed about years earlier
  • Subpoenaing or seizing Baker’s iCloud account for the text which would debunk Baker’s early memories and confirm Sussmann’s explanation
  • Searching FBI records for evidence that someone else — someone who once claimed to work for a Russian front company — had played a role Durham attributed to his conspirators

In short, Durham had little to sustain his 27-page indictment beyond theories of conspiracy that assumed as true the conspiracy theory he should have abandoned in July.

It really seems like, before that, Durham believed he would eventually find witnesses to a conspiracy who would confirm what only he believed to be true, and as a result never took the investigative steps that might — and did — debunk his conspiracy theory.

After embracing Russian disinformation, Durham embraced Russian grievances

One way Durham attempted to compensate for his failure to take very basic investigative steps was to embrace what Russians were peddling.

There were always hints that Durham went seeking (dis)information from Russians or people assumed to be Russian-assets involved in this operation. They was the famous junket to Italy looking for Joseph Mifsud. There were Ukrainians, who remain unnamed, but whose identity might explain why Durham reacted oddly when Andrii Derkach’s allies were sanctioned in early 2021. There’s even an email showing that future Charles McGonigal defense attorney Seth DuCharme treated Andrew McCabe request for help from Oleg Deripaska as an investigative lead, an email that might explain why Durham suppressed Deripaska’s centrality in this story.

But after he charged these flimsy indictments, Durham made purportedly aggrieved Russians a key prong of his strategy to turn a debunked Russian effort to frame Hillary into criminal prosecutions.

On the Danchenko prosecution, Durham insanely initially relied solely on Sergei Millian’s Tweets to substantiate the four charges associated with Millian. He did so without first interviewing George Papadopoulos, whom Millian seemed to be cultivating in precisely the period when Durham’s conspiracy theory was born and for months thereafter. As soon as I noted how problematic that was, Millian started getting squirrely.

Durham did eventually interview Millian, three months after charging Danchenko. But Millian refused to show up and answer questions under oath.

That left Durham stuck trying to admit inadmissible evidence, without which he was left with no substantive evidence for those four charges. All the while, Millian was ginning up the frothers, including (as we’ll see in my follow-up), to spin up Durham’s own misleading claims.

When Onorato introduced evidence of Millian’s communications with Papadopoulos at trial, Durham protested, “it certainly sounds creepy.” Nevertheless, Durham built four charges of an indictment around the Twitter claims of a guy involved in creepy outreach even before SVR’s imagined Clinton conspiracy was born, creepy outreach that by itself debunked the Russian conspiracy theory.

The way Millian handed Durham his ass would be funny if it didn’t totally upend Danchenko’s life.

But the way Durham piggybacked on Alfa Bank’s lawfare (lawfare pursued long after Mueller described how Vladimir Putin would make demands of oligarchs like Alfa Bank’s Petr Aven) is more troubling. In dual lawsuits in FL and PA, Alfa Bank purported to be trying to figure out who allegedly faked DNS records to make it look like Alfa was in contact with Trump back in 2016 so it could sue those people. Rather than finding anyone to sue, however, it instead spent its time subpoenaing experts to learn as much as it could about how the US tracks DNS records to prevent cyberattacks by — among other hostile countries — Russia.

After the Sussmann indictment, Alfa deposed several people targeted in the Sussmann investigation, including Fusion GPS tech person Laura Seago (from whom Durham ultimately obtained immunized testimony at trial) and Rodney Joffe (who was one of Durham’s key targets). Durham used that information as a sword in later privilege fights, but ignored sworn denials of key parts of his conspiracy theory. When Alfa pushed to accelerate this process even in spite of the ongoing criminal investigation, DC Superior Judge Shana Frost Matini observed that claims in the Alfa Bank lawsuit and Durham’s indictment see like, “they were written by the same people in some way.”

[R]ight now, given the — if the closeness of Alpha’s allegations, I mean, quite frankly, it’s — reading Alpha’s submissions and what the — and that compared to the indictment, there’s — it’s almost like they were written by the same people in some way. [Alpha misspelling original]

In the Sussmann case, Durham seemed to be delaying steps he took much earlier in the Danchenko prosecution, as if he was waiting for Alfa Bank to do that work for him.

All that ended with the Russian invasion of Ukraine and the sanctioning of Alfa Bank, which seemed to lead Durham to adopt a new strategy.

The Rodney Joffe statute of limitation

Two pieces of background are useful — particularly if Sussmann’s prosecution serves as a lesson of how Pam Bondi might try to wrench new prosecutions out of these same old tired events.

First, Durham went to great lengths to sustain his ability to charge Rodney Joffe, the source of the DNS records in question, which led Judge Charles Cooper to make a shitty ruling preventing Sussmann from calling Joffe to provide testimony that would entirely exonerate him. Durham was doing so, transparently, in hopes he might charge Joffe for a crime with a longer statute of limitations than lying: defrauding DOD.

But the successful bid to keep Joffe off the stand implicated something else: Durham’s attempt to suppress things he had discovered about the DNS data in question.

The month before Durham charged Sussmann, by mid-August, 2021, Durham’s team learned that the data Rodney Joffe and others used to conduct their research was absolutely real. In addition to debunking the most simplistic “DNC fabrication” theories Durham was chasing, the discovery made it impossible for Durham to continue to rely on the expert his team had been using.

The first thing Durham did in response was ask one of the two FBI agents who had fucked up the investigation in 2016 — the other of whom is a possible source of Durham’s false claim that the SVR conspiracy theory about Hillary claimed she was going to fabricate evidence against Trump — to serve as an expert to replace the one who knew Durham’s theories were false.

DeFilippis. How familiar or unfamiliar are you with what is known as DNS or Domain Name System data?

A. I know the basics about DNS.

[snip]

Berkowitz. And then, more recently, you met with Mr. DeFilippis and I think Johnny Algor, who is also at the table there, who’s an Assistant U.S. Attorney. Correct?

A. Yes.

Q. They wanted to talk to you about whether you might be able to act as an expert in this case about DNS data?

A. Correct.

Q. You said, while you had some superficial knowledge, you didn’t necessarily feel qualified to be an expert in this case, correct, on DNS data?

A. On DNS data, that’s correct.

After that, Durham sought out another (legit) expert, but asked him to do a review that deliberately blinded him to what Joffe, through Sussmann, had shared with the government.

The only thing the FBI’s top experts offer to debunk, other than the Tor node claim that the FBI knew the researchers had dropped, was a complaint about visibility. But their complaints about visibility were entirely manufactured by the scope of the review Durham requested and possibly by the curious status of the Blue Thumb Drive, as well as (if Durham is telling the truth about these being the same experts) willful forgetting of a review they had done on related issues less than a year earlier.

Durham created this blindness. By ensuring all the experts remain blind to visibility, Durham ensured the review would conclude that the researchers didn’t have the visibility that, the FBI knew well, they had.

So in parallel with Durham’s efforts to sustain an SVR hoax he had debunked in July 2021, he went to great length to invent false claims about real data to sustain a judgement from the two FBI Agents who fucked up this investigation in the first place. He did so at the last minute, long after he should have finalized his plans for expert witnesses.

Abusing privilege

He did one more thing at the last minute: he asked Judge Cooper to review a documents for privilege.

As NYT reported back in 2023, Durham started playing games with his DC grand jury not long before he concluded the entire SVR thing was a fabrication. After then-Chief Judge Beryl Howell rejected a bid to get a warrant for Leonard Benardo’s emails, they obtained them via the Open Society Fund directly, perhaps on threat of subpoena.

Mr. Durham set out to prove that the memos described real conversations, according to people familiar with the matter. He sent a prosecutor on his team, Andrew DeFilippis, to ask Judge Beryl A. Howell, the chief judge of the Federal District Court in Washington, for an order allowing them to seize information about Mr. Benardo’s emails.

But Judge Howell decided that the Russian memo was too weak a basis to intrude on Mr. Benardo’s privacy, they said. Mr. Durham then personally appeared before her and urged her to reconsider, but she again ruled against him.

Rather than dropping the idea, Mr. Durham sidestepped Judge Howell’s ruling by invoking grand-jury power to demand documents and testimony directly from Mr. Soros’s foundation and Mr. Benardo about his emails, the people said. (It is unclear whether Mr. Durham served them with a subpoena or instead threatened to do so if they did not cooperate.)

Rather than fighting in court, the foundation and Mr. Benardo quietly complied, according to people familiar with the matter. But for Mr. Durham, the result appears to have been another dead end.

A month before trial (and just weeks after the newly sanctioned Alfa Bank gave up its lawsuits), as part of a request that Cooper review the privilege claims that the Democrats, Joffe, and Fusion had made, Durham revealed he had been bypassing Howell.

In response, Sussmann accused Durham of abusing the same grand jury process he abused with Benardo (abuse, ironically, that debunked Durham’s conspiracy theory).

First, the Special Counsel’s Motion is untimely. Despite knowing for months, and in some cases for at least a year, that the non-parties were withholding material as privileged, he chose to file this Motion barely a month before trial—long after the grand jury returned an Indictment and after Court-ordered discovery deadlines had come and gone.

Second, the Special Counsel’s Motion should have been brought before the Chief Judge of the District Court during the pendency of the grand jury investigation, as the rules of this District and precedent make clear.

Third, the Special Counsel has seemingly abused the grand jury in order to obtain the documents redacted for privilege that he now challenges. He has admitted to using grand jury subpoenas to obtain these documents for use at Mr. Sussmann’s trial, even though Mr. Sussmann had been indicted at the time he issued the grand jury subpoenas and even though the law flatly forbids prosecutors from using grand jury subpoenas to obtain trial discovery. The proper remedy for such abuse of the grand jury is suppression of the documents.

Fourth, the Special Counsel seeks documents that are irrelevant on their face. Such documents do not bear on the narrow charge in this case, and vitiating privilege for the purpose of admitting these irrelevant documents would materially impair Mr. Sussmann’s ability to prepare for his trial.

He also revealed that some of those privilege claims went back to August — that is, the weeks after Durham should have closed up shop.

Email from Andrew DeFilippis, Dep’t of Just., to Patrick Stokes, Gibson, Dunn & Crutcher LLP, et al. (Aug. 9, 2021) (requesting a call to discuss privilege issues with a hope “to avoid filing motions with the Court”); Email from Andrew DeFilippis, Dep’t of Just., to Patrick Stokes, Gibson, Dunn & Crutcher LLP, et al. (Aug. 14, 2021) (stating that the Special Counsel “wanted to give all parties involved the opportunity to weigh in before we . . . pursue particular legal process, or seek relief from the Court”). And since January— before the deadline to produce unclassified discovery had passed—the Special Counsel suggested that such a filing was imminent, telling the DNC, for example, that he was “contemplating a public court filing in the near term.” Email from Andrew DeFilippis, Dep’t of Just., to Shawn Crowley, Kaplan Hecker & Fink LLP (Jan. 17, 2022). [my emphasis]

In a hearing on May 4, right before trial, Joffe’s lawyer revealed they had demanded Durham press a legal claim much earlier, in May 2021.

MR. TYRRELL: So if they wanted to challenge our assertion of privilege as to this limited universe of documents — again, which is separate from the other larger piece with regard to HFA — they should have done so months ago. I don’t know why they waited until now, Your Honor, but I want to be clear. I want to say without hesitation that it’s not because there was ever any discussion with us about resolving this issue without court intervention.

THE COURT: That was my question. Were you adamant a year ago?

MR. TYRRELL: Pardon me?

THE COURT: Were you adamant a year ago that —

MR. TYRRELL: Yes. We’ve been throughout. We were not willing to entertain resolution of this without court intervention.

THE COURT: Very well.

Ultimately, Cooper did bow to Durham’s demand, but prohibited them from using those documents at trial.

That didn’t prevent DeFilippis from attempting to use the privileged documents to perjury trap his one Fusion witness, the kind of perjury trap that might have provided a way to continue the madness indefinitely.

There must have been nothing interesting there: most of the Fusion documents were utterly irrelevant to the Sussmann charges, but could implicate the Danchenko ones, but Durham didn’t use them there, nor did he explain their content in his final report.

Scripting witnesses

I’ll end where I begin: How Durham managed to coach witnesses testimony by threatening them with charges.

In addition to Auten, Durham did this, over and over again, with his star Sussmann witness Jim Baker.

Perhaps most interestingly, he did it in the weeks before trial with witnesses who, documentary evidence showed, had been informed or would have assumed that Michael Sussmann was representing the DNC, the key thing Durham claimed Sussmann could have credibly lied to hide.

The first time FBI Agent Ryan Gaynor testified to John Durham in October 2020, for example, he told prosecutors that the DNC was the source of the allegation.

Q. Okay. So in your first meeting with the government, you — this is October of 2020, correct?

A. Yes.

Q. You told them multiple times that you believed that the Democratic National Committee was the source of the allegations of connections between Alfa-Bank and Russia, correct?

A. Correct, which was wrong.

Q. Okay. But you said that you thought the Democratic party itself was who provided the information, correct?

A. I did say that in the meeting.

That’s even what he wrote in a briefing document he kept in Fall 2016.

At the end of that October 2020 interview, prosecutors threatened Gaynor with prosecution.

In trial prep testimony, however, starting on May 13, 2022, he came to claim to believe that Sussmann was representing himself, because otherwise his client would have been material — precisely the materiality claim Durham needed to make the charges stick.

More striking was how Durham’s star cyber witness (one of the guys who botched the investigation in September 2016 without examining the data closely) explained why the text he received from his boss, Nate Batty, referring to the white paper as a “DNC report” on September 21, 2016, didn’t amount to notice that Sussmann brought the report on behalf of the DNC.

At trial, Michael Sussmann lawyer Sean Berkowitz asked Hellman how it could be that he would see a reference to a DNC report and not take from that it was a DNC report. Hellman described “the only explanation that … was discussed” — which is that it was a typo.

Q. What’s your explanation for it?

A. I have no recollection of seeing that link message. And there is — have absolutely no belief that either me or Agent Batty knew where that data was coming from, let alone that it was coming from DNC. The only explanation that popped or was discussed was that it could have been a typo and somebody was trying to refer to DNS instead of DNC.

Q. So you think it was a typo?

A. I don’t know.

Q. When you said the only one suggesting it — isn’t it true that it was Mr. DeFilippis that suggested to you that it might have been a typo recently?

A. That’s correct.

Q. Okay. You didn’t think that at the time. Right?

A. I did not. I had never seen it or had any memory of seeing it ever before it was put in front of me.

With some prodding, Hellman admitted that when he referred to “discussing explanations,” he meant doing so with Andrew DeFilippis. This exchange was, quite literally, Berkowitz eliciting Hellman to describe that DeFilippis told him what to think about evidence that should have sunk his case years earlier.

As I said, DeFilippis cheated. With lesser attorneys or more exhausted witnesses, it might have worked.

And they’re about to try again.

Share this entry

How John Durham Buried Evidence He Had Been Doing the Work of Russian Spies … and then Tulsi Gabbard Buried More

/25 Comments/in /by

As I’ve been showing, the Durham classified annex goes to significant lengths to hide that a Russian email discussing creating a conspiracy theory about the American Deep State, which he dates to July 26, precedes the draft SVR memo he claims has animated his years-long hunt, which dates to July 27 or later.

You can date the draft SVR memo (Durham doesn’t provide its date at all in the unclassified report, and if he does here, the date has been redacted) by tracking the inputs (red arrows) into the fake emails on which the draft memo is purportedly based (blue arrows), as I lay out here.

You can review a live copy of this (without the arrows) at this link.

The fake email integrated into the memo itself — bearing the date of July 25 but mentioning the Olympics — derives from the Thomas Rid story and the real Tim Maurer email — but it appears to have been altered to add the reference to the Olympics on July 27 (because a copy without the Olympics mention is attached to an email dated July 27).

And the fake email, bearing the date of July 27, claiming that Hillary approved a plan on July 26 appears to derive from the real July 27 Julianne Smith email soliciting a totally innocuous letter condemning Trump’s attack on NATO. We might learn more about its creation, except the email to which it is attached is entirely redacted in the annex.

That is, so long as his claim that the Deep State memo is dated “the day after” two emails purporting to be dated June 25 is accurate, then the emails and draft report that guided his entire investigation were the conspiracy theory proposed on July 26. Durham did the work of Russian spies for four years.

If this is, indeed, the timeline, then Durham — as well as John Ratcliffe and Kash Patel — should have recognized they were pursuing an investigation of Hillary Clinton based off a deliberate Russian spy hoax.

There’s one more thing that supports this argument — and reveals how problematic it is for Durham (who continued his investigation for two more years after he would have concluded the emails were “composites”) and the others: the extent to which he, as well as the person who redacted this for release, tried to obscure all this in the classified annex.

This kind of deceit was not remotely unusual for Durham (as I’ll return to when I review what Durham did do after concluding he was using a clear Russian hoax as his excuse to investigate Hillary Clinton). Andrew DeFilippis, especially, did this kind of stuff all the time. Here, where he used email timestamps in two different time zones to falsely suggest that Fusion was the source for a public link about the Alfa Bank anomalies, is just one such example.

The list below is overwhelming. The most important detail, however, is how Durham treats the real email from Julianne Smith asking people to sign onto some totally innocuous letter criticizing Trump’s attacks on NATO. Durham obtained one copy of the email from the SVR trove and another from a subpoena, presumably to Smith or CNAS, where she worked.

The annex separates the disclosure that Julianne Smith had also been hacked (noted in footnote 27) from the discussion of the email she sent on July 27, obscuring that Durham obtained two copies of that email, one from the SVR collection (cited in the annex as Document Classified Appendix Document 9, which also includes the Maurer email), and one via subpoena (cited in the unclassified report as XXXX-0014561). He does that even though discussion of the “certain emails, attachments, and documents that contain language and references with the exact same or similar verbiage to the materials referenced above” precedes that discussion. In the unclassified report, he treats this email differently, effectively treating it as corroboration for the claims in the fake report, rather than a source used to fabricate it (though he later uses it as corroboration after concluding that the underlying emails are composites based on … that email).

In either case, however, if he is treating Smith’s July 27 email as a source (and that’s one place it appears in his report), then the draft memo must post-date the July 26 Deep State email.

On July 26, Russian spies decided it’d be cool to start a conspiracy theory about the Deep State. And on July 27, having stolen that Smith email, they decided to claim that Hillary — as opposed to some other Deep State entity — decided to smear Donald Trump.

And everyone involved in this is working really hard to hide that they knew that.

Update: On the topic of Smith’s email, I’ve been puzzling over the redaction in this passage; I wondered if Durham expressed some obnoxious opinion about her.

It was suggested to me, however, that that redaction might hide Durham speculating about what Russian spooks thought — maybe something like, “it is a logical deduction that [Russian spies believed that]”… The mention of the spies would therefore justify classification on classification bases. But holy hell if it were something like that, it would mean Durham was trying to rationalize why Russian spooks fabricated emails to make up this claim.

Durham’s deceits

By July 2021, John Durham had evidence to conclude the emails behind a draft SVR memo on which his entire investigation rested were “composites,” that is, fabrications. But he continued on for two more years, attempting and failing to create evidence to substantiate that Russian disinformation by prosecuting Michael Sussmann and Igor Danchenko. To hide that he had done that, he engaged in a great deal of deceit in both his unclassified and classified reports.

  • Durham frames his focus around three bullets John Ratcliffe included in his 2020 memo sending these materials to Lindsey Graham. The first bullet claims to focus on “Russian intelligence analysis,” suggesting that his focus was on a draft SVR report that leads the narrative in the classified appendix, but is actually the last document temporally. But the second bullet refers to John Brennan notes that quote not the purported end analysis, but an email advancing the plot to frame Hillary.
  • The two exhibits — Brennan’s notes and a referral from the CIA that he couldn’t prove ever got sent to FBI — include redactions that obscure the actual content of both. Importantly, witnesses were not shown the full exhibits, though Brennan correctly stated that Durham misrepresented what his notes were about.
  • Durham misrepresented how many witnesses (and who) testified that they had not seen the referral memo.
  • Thereafter in the unclassified report, Durham referred to “Clinton Plan intelligence” as if it focused on that discreet claim or even the draft memo, when it referred to the larger body of intelligence obtained via the Dutch, and so in context the plan to frame Hillary. In the classified report, Durham referred to Clinton campaign plan, rather than the intelligence asserting it.
  • Durham mentioned two Leonard Benardo emails early in the annex (there were actually four documents claiming to be emails in the report), then discussed the earlier, apparently finished, intelligence from earlier 2016 implicating Loretta Lynch, suggesting they were the emails. He returns to this strategy later in the appendix.
  • Then, the beginning of the section focused on the SVR documents starts with the draft memo, not the specific emails. He keeps moving the ball.
  • The date of the draft memo appears nowhere in the unclassified report and may not appear in the classified report either (if it is there, it is redacted).
  • The annex separates the disclosure that Julianne Smith had also been hacked (noted in footnote 27) from the discussion of the email she sent on July 27, obscuring that Durham obtained two copies of that email, one from the SVR collection (cited in the annex as Document Classified Appendix Document 9, which also includes the Maurer email), and one via subpoena (cited in the unclassified report as XXXX-0014561). He does that even though discussion of the email appears after the introduction, “certain emails, attachments, and documents that contain language and references with the exact same or similar verbiage to the materials referenced above.” In the unclassified report, he treats this email differently, effectively treating it as corroboration for the claims in the fake email, rather than a source used to fabricate it (though he also uses it as corroboration after concluding that the underlying emails are composites based on … that email). In either case, however, if he is treating Smith’s July 27 email as a source, then the draft memo must post-date the July 26 Deep State email talking about ginning up a conspiracy theory.
  • After introducing the Benardo emails, the annex discloses there were several versions of the July 25 one, which helps to obscure that one copy of the earliest version was attached to a July 27 email, which in turn suggests the reference to the Olympics was added on July 27. As noted, the redactions exacerbate this sleight of hand.
  • The annex hides that the Deep State email predates the draft memo by discussing the two versions of the July 25 Benardo email in-between.
  • The annex doesn’t appear to explain that one of two copies of the first fake July 25 email (without the Olympics) is considered part of the same document as the July 27 “vilify” email.
  • The description that the real Tim Maurer email is the same date as the fake July 25 emails gives the impression that they were made the same day, when at least the revisions of the fake email probably happened on July 27.
  • Durham provides a description of this (then-dated) article about a voting hacker for hire, but does not provide a description of the Thomas Rid article discussed in the email, which is not only a clear source for the draft memo, but should make analysts look twice at the Russian idiom in English in the fake Benardo email, because Rid discusses the language games behind the Guccifer 2.0 persona at some length.
  • When Durham concedes the emails to which the draft memo is sourced are composites, he does not name CNAS, where Smith worked, even though earlier in the section he says she was hacked too.

Lying with redactions

  • The introduction to the draft memo redacts details about what is in it, most notably the emails the entire annex purports to focus on.
  • That continues in the redactions after the draft memo. This obscures which email was incorporated into the draft memo: the one referring to the Olympics. The redaction introducing the first fake July 25 email further obscures this, making it harder to figure out that Classified Appendix Document 6 is a July 27 email with one of the first versions of the July 25 email (that is, before the Olympics were added) attached.
  • The redaction of the email after the July 27 “vilify” one obscures that the July 27 Benardo email discussing Hillary’s approval is attached to that redacted email and not the “vilify” one, further obscuring that the emails dated July 25 were likely revised on July 27, to add the Olympics reference.
Share this entry

Andrew DeFilippis Had a Role in the Prosecution of Gal Luft’s Co-Conspirator-1

/20 Comments/in , , , /by

James Comer plans to rely on Gal Luft’s testimony in his efforts to gin up conspiracy theories against Joe Biden, even in spite of the indictment against Luft DOJ obtained before James Comer started pursuing his conspiracy theories.

Andrew DeFilippis handled the classified evidence in the Patrick Ho case

Because of that, I want to flag a detail about the Patrick Ho case, the case out of which this one arose.

Ho is the person described as Co-Conspirator-1 in the Luft indictment.

Ho was sentenced on March 25, 2019 for bribing Chadian and Ugandan officials; the former scheme started in a suite in Trump Tower in 2014.

Through a connection, HO was introduced to Cheikh Gadio, the former Minister of Foreign Affairs of Senegal, who had a personal relationship with President Déby. HO and Gadio met at CEFC China’s suite at Trump World Tower in midtown Manhattan, where HO enlisted Gadio to assist CEFC China in obtaining access to President Déby.

Days after Ho was sentenced, the two lead prosecutors on that case, Catherine Ghosh and Daniel Richenthal, flew to Brussels to meet with Luft. As alleged in the indictment, Luft lied to those prosecutors and four FBI agents about both the arms deals and Chinese influence peddling for which he has since been charged.

64. On or about March 28, 2019, in the Southern District of New York, Belgium, and elsewhere outside of the jurisdiction of any particular State or district of the United States, GAL LUFT, the defendant, who is expected to be first brought to and arrested in the Southern District of New York, a matter within the jurisdiction of the executive branch of the Government of the United States, knowingly and willfully made a materially false, fictitious, and fraudulent statement and representation, to wit, LUFT falsely stated during an interview at the United States Embassy in Brussels, Belgium with federal law enforcement officers and prosecutors, in connection with an investigation being conducted in the Southern District of New York, that LUFT had not sought to engage in or profit from arms deals, and instead merely had been asked by an Israeli friend who dealt in arms to check arms prices so that the friend could use this information in bidding on deals, a request that LUFT said he fulfilled by having CC-1 check prices with CC-2 and then relay this information to LUFT–when in fact LUFT had actively worked to broker numerous illegal arms deals for profit involving multiple different countries, both in concert with CC-1 and directly himself, including as described in paragraphs Forty-Four through Fifty-Three above.

[snip]

84. On or about March 29, 2019, in the Southern District of New York, Belgium, and elsewhere outside of the jurisdiction of any particular State or district of the United States, GAL LUFT, defendant, who is expected to be first brought to and arrested in the Southern District of New York, in a matter within the jurisdiction of the executive branch the Government of the United States, knowingly and willfully made a materially false, fictitious, and fraudulent statement and representation, to wit, LUFT falsely stated during an interview at the United States Embassy in Brussels, Belgium with federal law enforcement officers and prosecutors, in connection with an investigation being conducted in the Southern District of New York, that LUFT had tried to prevent CEFC China from doing an oil deal with Iran, that LUFT had been excluded from CEFC China meetings with Iranians, and that LUFT did not know of any CEFC China dealings with Iran while he was affiliated with the company–when in fact, including as described above in paragraphs Sixty-Six through Eighty, LUFT personally attended at least one meeting between CEFC China and Iranians and assisted in setting up additional such meetings for the purpose of arranging deals for Iranian oil, and also worked to find a buyer of Iranian oil while concealing its origin.

Starting in early 2018, DeFilippis handled the classified evidence on the Ho case — both CIPA and a FISA order. He would have spent a great deal of time reviewing what the spooks had obtained on Ho and his associates, undoubtedly including Luft.

Andrew DeFilippis investigated John Kerry for a year

DeFilippis’ efforts on the Ho case took place in parallel with his efforts to gin up a criminal investigation against John Kerry. Here’s how Geoffrey Berman described being ordered to do that by Main Justice.

On May 9, the day after the second Trump tweet, the co-chiefs of SDNY’s national security unit, Ferrara and Graff, had a meeting at Main Justice with the head of the unit that oversees counterintelligence cases at DOJ, which is under the National Security Division.

He said that Main Justice was referring an investigation to us that concerned Kerry’s Iran-related conduct. The conduct that had annoyed the president was now a priority of the Department of Justice. The focus was to be on potential violations of the Logan Act.

[snip]

From the outset, I was skeptical that there was a case to be made. I knew enough about the Logan Act to have strong doubts. Politicians from both sides of the aisle have talked about it from time to time, suggesting that some opponent is in violation of it. It never goes anywhere.

But I figured if they bring us a possible case, we’ll do our best. We’ll look into it. We brought a prosecutor from the national security unit, Andrew DeFilippis, into the investigation.

Trump, meanwhile, kept on tweeting. “John Kerry had illegal meetings with the very hostile Iranian Regime, which can only serve to undercut our great work to the detriment of the American people,” he wrote that September. “He told them to wait out the Trump Administration! Was he registered under the Foreign Agents Registration Act? BAD!”

DeFilippis’ efforts extended into 2019, overlapping with the trial of Ho and the interview with Luft. National Security prosecutors at Main Justice kept pressuring SDNY to advance the investigation into Kerry, but first, Berman had DeFilippis research whether the Logan Act would be chargeable even if Kerry had committed it.

The next step would have been to conduct an inquiry into Kerry’s electronic communications, what’s known as a 2703(d) order. That would have produced the header information—the to, from, date, and subject fields—but not the contents. I decided that before moving forward, it made sense to evaluate whether we would ever have a viable, appropriate charge that matched up with Kerry’s alleged conduct.

At the risk of stating the obvious, under our system of law, pissing off the president is not a chargeable offense. I asked DeFilippis to conduct additional legal research into the Logan Act and other potentially applicable theories. “Look, we’re talking about going to the next step here,” I said.

“But before we do any further investigation, I want to know what the law is on the Logan Act. Let’s say we gather additional documents—I want to know, how is that helping us?”

I wanted to answer the question, even if these things happened, was it a crime? Let’s cut to the chase and find that out, because we’ve got plenty of other work to do and I don’t want us to just be spinning our wheels on this.

For the next several months, DeFilippis conducted extensive research into the Logan Act as well as statutes relating to possible criminal ethics violations by former senior government employees.

On April 22, 2019, Trump tweeted, “Iran is being given VERY BAD advice by @JohnKerry and people who helped him lead the U.S. into the very bad Iran Nuclear Deal. Big violation of Logan Act?”

The tweet was in the morning. That afternoon, Ferrara got a call from Main Justice. He was told that David Burns, the principal deputy assistant attorney general for national security, wanted to know why we were delaying. Why had we not proceeded with a 2703(d) order—the look into Kerry’s electronic communications?

The next day, Burns spoke to Ferrara, Graff, and DeFilippis and repeatedly pressed them about why they had not submitted the 2703(d) order. The team responded that additional analysis needed to be done before pursuing the order.

SDNY decided not to pursue the case against Kerry in fall of 2019.

We spent roughly a year exploring whether there was any basis to further investigate Kerry. Memos were written, revised, and thoroughly discussed.

Our deep dive into the Logan Act confirmed why no one has ever been successfully prosecuted under it in the more than 220 years it has been on the books: the law is not useful. It definitely does not prohibit a former US secretary of state from talking to a foreign official. We did not find that Kerry violated any ethics statutes or any laws having to do with the improper handling of classified material.

In September 2019, DeFilippis advised the National Security Division at Main Justice that we would not be pursuing the case further. He had earlier attempted to tell the specific NSD attorney assigned to the case of our decision, but he couldn’t connect because that attorney was engaged in another matter: the Craig trial.

Sometime after that, DeFilippis became the lead prosecutor on the Durham team, leading the prosecution of Michael Sussmann.

Andrew DeFilippis oversaw the most abusive parts of the John Durham prosecution

Over the course of the Michael Sussmann prosecution, DeFilippis and his prosecution team:

As noted above, Geoffrey Berman boasted that the investigation into Kerry didn’t leak. Even ignoring the inexplicably perfect concert between Alfa Bank’s efforts and Durham’s, it’s not clear the same can be said about the Durham investigation.

And it’s not just that DeFilippis routinely tried to introduce evidence that served his narrative rather than matched the facts. It’s that DeFilippis repeatedly — most notably in the alleged complaint that researchers working on a DARPA project would attempt to identify which Russians were interfering in the US election — proved more sympathetic of Russian efforts to help get Trump elected than to conduct an ethical prosecution.

Last August, shortly before Durham confessed the utter humiliation of his team at the hand of Sergei Millian, DeFilippis withdrew from the Durham team with almost no notice, left DOJ, and returned — in a Special Counsel role, not as Partner — to Sullivan & Cromwell.

These are just data points. There is no reason, yet, to believe that DeFilippis continues to unethically gin up conspiracy theories against Democrats.

But they are data points I thought worth collecting in one place.

Share this entry

The Dishonest and Incompetent FBI Work John Durham Learned to Love

/23 Comments/in , , /by

In the Durham Report’s telling of the FBI investigation into the Alfa Bank anomalies, it describes that the two cyber agents who conducted the first technical review of the allegations, Scott Hellman (Cyber Agent-1) and Nate Batty (Cyber Agent-2, the guy who appears to have misplaced the Blue Thumb Drive with all the data), congratulated themselves on the fact that they had both come to the same conclusion in spite of “their own very different political views.”

Cyber Agent-1 testified that both he and Cyber Agent-2 did not agree with the conclusion in the white paper and assessed that (i) the authors of the white paper ‘jumped to some conclusions that were not supported by the technical data,” (ii) the methodology was questionable, and (iii) the conclusions drawn did not “ring true at all.” 1479 In interviews with the Office, both Cyber Agent-1 and Cyber Agent-2 said that they were proud of their work because they had both come to the same conclusion despite their own very different political views. [my emphasis]

The interviews at which these men told this story are not cited (elsewhere in this passage, Durham relies on Hellman’s trial testimony rather than any of his interviews for the report, though according to trial testimony, he interviewed with Durham six times).

It’s an odd measure of investigative rigor, particularly in a report complaining that other FBI agents let bias infect their work.

It’s also a good place to start to describe the multiple layers of deceit in which Durham engages to avoid admitting that Batty and Hellman steered him wrong.

  • Durham adopted his “fabrication” theory from Hellman and Batty
  • The “fabrication” theory came with an understanding the DNC was involved
  • Hellman and Batty made materially contradictory comments about politics
  • Durham covered up Cyber’s clear errors
  • Durham’s made post-indictment efforts to sustain his false claims (this will be a follow-up because this got too long)

Durham adopted his “fabrication” theory from Hellman and Batty

As noted, Durham cites Hellman’s trial testimony, rather than those interviews he doesn’t cite, for his description of what Hellman and Batty concluded. At trial, immediately after the exchange cited, Durham lead prosecutor Andrew DeFilippis had Hellman walk through the written summary the two cyber guys wrote.

DeFilippis used that document to improperly cue Hellman, who was not qualified as an expert — someone who had, minutes earlier, admitted he knew only the basics of DNS — to express his opinion about the white paper, which I laid out here. Coming as it did after weeks of wrangling over Durham’s belated attempt to spring a different expert on Sussmann, the stunt unsurprisingly drew an objection.

But DeFilippis wasn’t working with the full summary. A redaction in the Hellman-Batty summary DeFilippis introduced as part of this exchange hid part of Hellman and Batty’s immediate response to the white paper. But a different version of the same document (introduced by the defense), reveals more about their initial conclusion to the anomalies: The otherwise redacted information reveals that Hellman and Batty floated the possibility that the researchers had fabricated the data by spoofing it themselves.

In conclusion, ECOU 1 suggests there is currently no cyber intrusion component in this case and that the report provided contains questionable methods and intentions. Based on the information provided, it also remains a possibility that the report was fabricated. If the domain maill.trump-email.com were discovered by researchers, a computer at Alfa Bank could be configured to conduct multiple DNS inquiries to create the appearance that a Russian bank is communicating exclusively with the domain maill.trump-email.com. Furthermore, it appears suspicious that the presumed suspicious activity began approximately three weeks prior to the stated start of the investigation conducted by the researcher. [emphasis, which marks otherwise redacted language, my own]

Hellman didn’t just share this opinion in the summary, which was sent out to others no later than September 21 at 4;46PMET (some of these time zones are in CDT, so an hour behind). It was the primary conclusion they shared with the Chicago-based agents conducting the actual investigation. As Curtis Heide’s Lync notes show (these are probably UTC, so morning ET), 8 minutes after Heide made a second request for the thumb drives, Batty and Hellman asked Heide to get on the phone. They spoke for five minutes, after which Heide texted Pientka to tell him that “we’re leaning towards this being a fake server not attributed to the trump organization.”

While Hellman was on the phone with Heide, Batty was texting Heide’s boss, Dan Wierzbicki, that, “we think it’s a setup. it smells like a setup.” Minutes after these two exchanges another Cyber guy shared with Joe Pientka Phil Todd’s opinion, described below, that this was a DNC set-up timed for the debate.

In other words, the premature Hellman and Batty opinion that this was a set-up tainted everything that followed in the investigation. And they shared it before anyone else looked at the evidence.

Notably, this opinion led the FBI to take overt acts during a pre-election period that prevented the FBI from conducting a robust investigation afterwards. At 4:22PM ET that same day, Alison Sands wrote from Chicago to New York explaining that this probably wasn’t actually a Trump domain. At 4:53PM ET, Sands wrote back to correct that: Miami FBI agents had taken overt investigative steps during an election season (though they used a ruse as to why they were asking), and learned that it was a legitimate email server. At 1:53PM the next day, Sands wrote back to note that Cendyn had responded to FBI’s overt investigative steps by updating their DNS tables, tainting the investigation and public reporting on it irreparably.

More importantly, the opinion Hellman and Batty formed — that this was a setup — influenced more than the initial investigation. It’s the entire organizing logic of the September 16, 2021 indictment against Michael Sussmann. Durham accused Sussmann of packaging all this up in a “narrative” fed by “purported” data provided by April Lorenzen, whom he called “Originator-1,” and then sharing it with the FBI. That’s why Durham needed it to be the case that Sussmann intentionally hid a tie to the DNC.

And because Durham adopted that hasty Hellman and Batty theory as his own, to the extent that Hellman and Batty made grave errors, Durham had to (and has to) cover those errors up.

The “fabrication” theory came with an understanding the DNC was involved

And that means covering up how politics — or at least a suspicion about politics — played a part.

Durham treated Batty and Hellman’s initial conclusions as reliable, he said, because, “they had both come to the same conclusion despite their own very different political views.”

That’s remarkable because Durham includes something in his report that he chose not to introduce at trial under oath: that Nate Batty told him in 2019 that he and Hellman had considered filing a whistleblower complaint against Jim Baker because FBI’s General Counsel refused to tell them where the tip came from.

Cyber Agent-2 told the Office that he and Cyber Agent-1 considered filing a whistleblower claim about Baker’s failure to provide the information but ultimately decided that they would not because the data provided was not formal evidence in a criminal proceeding. 1492

1492 OSC Report of Interview of Cyber Agent-2 on Sept. 16, 2019 at 2.

This is likely where the whole idea of charging someone for lying to the FBI about this evidence came from.

What Durham didn’t say in his report — but what the public record strongly suggests — is that one or both of these guys were affirmatively dishonest with him about how significantly politics played into this investigation. Three pieces of evidence submitted at trial show that Batty understood this tip to have come from the DNC and one of his colleagues treated it as a set-up by the DNC.

First, there’s the Lync text showing Batty was informed that Sussmann was in the evidentiary chain even before he picked up the thumb drives on September 20 (remember, these are probably UTC).

As this post makes clear, Batty learned that Sussmann was in the chain of custody before he picked up the thumb drives from Baker. He didn’t need Baker to tell him where they came from. He already knew.

Less than a day after being told Sussmann was in the evidentiary chain, Batty wrote Hellman, saying they had been asked to write “a brief summary of what we think about the DNC report,” and then conceded maybe they should look at the actual DNS logs before writing such a summary.

Then, the next morning at 8:09AM, one of the Cyber supervisors, Phil Todd, wrote an email claiming that “the DNC person” who dropped the thumb drives off planned to release the Trump – Alfa Bank tie prior to the Presidential debate that would be on October 4.

The DNC person that provided these thumb drives stated to Baker that he/she was going to release the information concerning the Trump server, and direct contact with the Russians through Alpha Bank in Moscow, to the press on Friday, 9/23/16, prior to the upcoming Trump / Clinton debate this weekend.

Sussmann obviously didn’t tell Baker his outreach to the press was timed for the debate. It’s something the Cyber guys made up and put into writing. But it shows that people in the Cyber division didn’t just make conclusions before investigating, but did so through that political lens, precisely the political lens Durham claimed that Sussmann thwarted by allegedly lying to Jim Baker.

And while there’s no evidence Batty shared the assumed tie between the tip and the DNC with the agents in Chicago, it’s important background to the way Hellman and Batty reached out to Heide and his boss to explain, in a way that would leave no written record, why they believed this was not a real server, an opinion that Heide would cite as one of four reasons he dismissed the allegations. Batty shared that opinion before sharing the substantive materials in the white paper with the Chicago agents.

These records should have led any sane prosecutor to conclude he had no case against Sussmann. These, along with at least two more exhibits (Bill Priestap’s notes and Ryan Gaynor’s briefing notes), show that numerous people in the FBI, including one of the guys who conducted the initial technical review of the anomalies, believed the white paper had a DNC tie. And at least some people at the FBI had concluded, absent evidence, that it was a political hit job.

How could Sussmann’s alleged lie be material if the initial conclusions about the anomaly presumed Sussmann was bringing the white paper for the DNC?

Hellman and Batty made materially contradictory comments about politics

As noted, Batty’s claim, made in a 2019 interview with Durham, seems to conflict with the record showing that he was informed of Sussmann’s involvement before he first obtained the thumb drives.

All the evidence that people in Cyber knew of and considered the role of the DNC in this tip — plus the way Durham measured Batty and Hellman’s reliability based on their partisanship — makes Hellman’s testimony at trial suspect, too. Hellman claimed, under oath, that he and Batty didn’t talk about whether these allegations had political origins in advance.

Q. And you and Special Agent Batty at least talked about whether this had political origins, didn’t you?

A. At that point I think the only thing that came up was just questioning the motive of somebody providing — like, who provided this report? I don’t recall any discussion about political motivations.

Q. Who would it have helped if the allegations were true?

A. It would have helped the opposing — it would have helped the democratic party.

Q. And that didn’t occur to you at all that that motivation might have been involved?

A. No.

This is one of several reasons I find it so curious that Durham didn’t cite the actual interviews in which Hellman and Batty talked about how they responded to the white paper by invoking politics: If Sussmann’s attorneys had received 302s reflecting they had, as Brady or even Jencks in Hellman’s case, you’d think they would have followed up on Hellman’s claim that politics didn’t come up by noting that he and Batty had both told Durham differently.

Hellman also claimed, under oath, that he never saw that text mentioning the DNC screencapped above, to which he responded by writing up a report, until 2020.

Q. All right. And then, with respect to Stranahan, he asks you and Nate to write a report about the — write a summary of the DNC report. Correct? That’s what it says?

A. That’s what it says in this chat, yes.

Q. And did you understand, sir, that the information had come from a DNC, meaning Democratic National Committee, source?

A. I did not understand that, no.

Q. Did you know what Nate Batty knew about it?

A. I don’t think he knew anything about it.

Q. Did you call up Tim and say, what a second. This is a DNC report? That’s political motivation.

A. No.

Q. Didn’t do anything or it didn’t occur to you?

A. The first time I saw this was two years ago when I was being interviewed by Mr. DeFilippis, and I don’t recall ever seeing it. I never had any recollection of this information coming from the DNC. I don’t remember DNC being a part of anything that we read or discussed.

Q. Okay. When you say, the first time you saw it was two years ago when you met with Mr. DeFilippis, that’s not accurate. Right? You saw it on September 21st, 2016. Correct?

A. It’s in there. I don’t have any memory of seeing it.

Later Berkowitz returned to the text. He asked Hellman how it could be that Batty could refer to the white paper from a lawyer who represented the DNC, in a text to Hellman, as the DNC report, without Hellman becoming aware that someone — his superior — was calling it a DNC report.

Q. And although you were surprised to see it today, it appears that at least somebody, such as Mr. Batty was aware and you were aware that somebody was calling this white paper a DNC report. Correct?

A. I was not aware that anybody was calling it a DNC report, and I don’t believe Mr. Batty knew that either.

Q. But you saw the link message. Right?

A. I did see the link message, yes.

Then Berkowitz asked Hellman how it could be that he would see a reference to a DNC report and not take from that it was a DNC report. Hellman responded by describing “the only explanation that … was discussed” — was that it was a typo.

Q. What’s your explanation for it?

A. I have no recollection of seeing that link message. And there is — have absolutely no belief that either me or Agent Batty knew where that data was coming from, let alone that it was coming from DNC. The only explanation that popped or was discussed was that it could have been a typo and somebody was trying to refer to DNS instead of DNC.

Q. So you think it was a typo?

A. I don’t know.

Q. When you said the only one suggesting it — isn’t it true that it was Mr. DeFilippis that suggested to you that it might have been a typo recently?

A. That’s correct.

Q. Okay. You didn’t think that at the time. Right?

A. I did not. I had never seen it or had any memory of seeing it ever before it was put in front of me.

That is, Hellman responded by explaining that Durham’s lead prosecutor Andrew DeFilippis, rather than asking whether the Lync text refreshed Hellman’s memory that he had been already been told this was a DNC report when he conducted the analysis, rather than recognizing that the evidence actually undermined his entire case, instead scripted an alternate explanation.

Just a typo.

And then Hellman repeated that script on the stand.

Under oath.

There are no declination decisions in Durham’s Report assessing how Hellman and Batty’s statements — in the 2019 interview and under oath on the stand — can be squared with the public record. Of course there aren’t declinations! When faced with documentary evidence that his disclaimer about awareness of a DNC role was suspect, Hellman simply parroted Durham’s own team.

But the fact that Durham didn’t even consider whether there was more evidence that Batty and Hellman lied to him than that Sussmann did is a testament to the fact that any misstatements they made would upend his entire project.

At trial, when Durham was desperate to claim that the five different exhibits that showed the FBI knew this report came from a DNC lawyer didn’t mean that the FBI had treated this as a DNC report, his star witness Scott Hellman said there was no discussion of politics when he and his boss assessed this report.

But in his report itself, Durham’s proof that their analysis was sound was that both FBI agents had told him (in interviews that he doesn’t cite) that they approached the report through a lens of politics.

Durham covered up Cyber’s clear errors

The fact that a supervisor in the Cyber Division concluded that this was a Democratic hit job timed to the debate makes Durham’s silence about Batty and Hellman’s clear errors all the more problematic.

I wrote them up in this post describing Hellman’s advice to newbie agent Alison Sands that, “any chance you get to work something like this that truly has 0 repercussions if you mess it up ….take those opportunities.”

The two most problematic clear errors bookend the otherwise redacted claim that they suspected this was a set up.

As that Lync text itself above makes clear: Hellman and Batty had already made conclusions about the white paper before he opened the thumb drive with the data that — Hellman later testified — is what made the two of them more qualified to assess this report than the counterintelligence agents who would later conduct the investigation. After having made a conclusion prior to reviewing the logs, Hellman and Batty claimed that the anomaly had only been going on for three weeks before the researchers started looking at it. That was probably a misreading of one of two histographs in the white paper. But it would have easily been debunked had they reviewed just the DNS logs provided, much less the data provided on the misplaced Blue Thumb Drive itself. There’s no way you make that error after having reviewed the DNS logs. Yet they did make that error, an error Durham never mentions in his report.

And Durham knows this claim is wrong, because the expert report he cites in his own report — which examined the smaller set of two logs included on the Red Thumb Drive — notes that the researchers included logs dating from May to September.

Durham repeats in his report, without correction, an even more serious error. Durham states, truthfully, that Batty and Hellman — two of the only FBI agents who investigated anything having to do with Russia in 2016 who haven’t subsequently been disciplined for their fuck-ups — claimed that there was no allegation of hacking in the white paper.

The report’s summary stated that they had “assess[ed] there is no CyD [Cyber Division] equity in this report and that the research conducted in the report reveals some questionable investigative steps taken and conclusions drawn.” 1477 The report acknowledged that there was no allegation of hacking and so there was no reason for the Cyber Division to investigate further.

But Durham doesn’t reveal that this claim — there was no allegation of hacking in the report — was false. Rather, he adopts it as his own.

As a footnote in the white paper Sussmann shared described, one reason the researchers offered that Spectrum might not have known it had this weird occurrence on its network (which the researchers incorrectly concluded was a Tor node) was because they had been hacked.

We discovered that Spectrum Health victim of a network intrusion. Therefore, Spectrum Health may not know what has a TOR exit node on is network. Alternatively. the De Vos family may have people at Spectrum who know here is a TOR node, i.e., TOR node could have been placed there with inside help.

“Network intrusion.” That’s a hack.

Outside researchers informed the FBI of an anomaly involving an IP address known to have been hacked. And yet the cyber guys concluded not just that this white paper was shit, but also that there was no Cyber Division equity — a hack — in it, and did so in just over a day.

The researchers were wrong about Tor, but they were right about the hack. When the FBI checked the Spectrum IP in question, they found that it had been compromised.

One reason this error is so problematic — aside from it discredits everything else Hellman and Batty did — is because it came as supervisors in the Cyber Division were trying to spin off this investigation because they had concluded, with no evidence, that it was a pre-debate set-up. Hellman and Batty concluded there was no hack not because of the evidence, but because they didn’t want to do this case.

John Durham congratulates these men because a Democrat and a Republican agreed about this white paper. But he doesn’t reveal that, in addition to getting several other key technical details wrong, they failed at their one job, to determine whether there was a hack involved. So instead of revealing that they failed in their one job in his report, Durham instead repeats their false claim, “The report acknowledged that there was no allegation of hacking,” and boasts because a Democrat and Republican ended up being badly, embarrassingly wrong together.

Now, as I noted, Durham covers up some of the other problems with this investigation.

The two most important are that the FBI violated the rule prohibiting overt investigative steps during the pre-election period, and perhaps partly because of that (as well as FBI’s failure to act immediately after Sussmann provided Eric Lichtblau’s name on September 22), by the time the FBI spoke to Alfa Bank, the potential suspect in this crime drama — the potential suspect which reached out to FBI rather than vice versa — Alfa had no log files left to review.

That’s the other big error the investigative team made, which Durham also covers up. The FBI didn’t understand that Mandiant’s judgement was useless until a March 2017 interview with Mandiant. Curtis Heide described at trial that he never — never!! — actually learned that the reassurances Alfa Bank had offered were based on a claim that a bank had no log files to review.

Q. And were you aware, while you were doing the investigation, that Mandiant, when it went to talk to AlfaBank to look into these allegations, did not have any historical data, that Alfa-Bank did not provide any historical data to Mandiant? Did you know that?

A. No

Here’s how Durham covered up that embarrassing failure in his report:

Mandiant provided the FBI with its findings, which too concluded that there was no evidence to support the allegations of a secret communications channel nor any evidence of direct communications between the Alfa Bank servers and Trump Organization servers.

In his report, Durham cites only an October 2016 302, not the March 2017 one where the FBI first learned how useless the Mandiant review would have been. Again, he makes absolutely no mention that a potential suspect in this story reached out to the FBI told the FBI that a potential crime scene had been wiped of digital fingerprints and did nothing.

Durham complains about other problems with the part of the investigation conducted by the counterintelligence agents — they made an error in their opening memo, for example.

But rather than bitching and moaning about the outright errors the FBI cyber agents committed during the investigation, like he did for every other FBI agent in his report (including the counterintelligence agents on the Alfa Bank investigation), Durham simply … covered those errors up. Repeated their false claims. Perpetuated the foundational error in the Alfa Bank anomaly investigation.

Durham couldn’t treat Hellman and Batty with the same ruthless contempt as he did all the other FBI agents he interviewed. That’s because the materially inconsistent claims and outright errors they made were all foundational to Durham’s project. Durham can’t admit that Hellman and Batty were among the most suspect and incompetent of every FBI agent involved. That’s because Durham built his entire case on the conclusion they drew before they even opened the thumb drives.

And that’s important for another reason: because of the investigative steps Durham took on DNS-related issues after he indicted Sussmann on September 16, 2021, and what they say about Durham’s efforts to manufacture claims to discredit the anomalies.

Share this entry

“Ridiculous:” Durham’s Failed Clinton Conspiracy Theory

/43 Comments/in , /by

I put together a very rough list of the interviews that John Durham included in his Report and a table showing the organization of his report.

I’d like to describe what appears to have happened with the investigation. Remember a few things about this list: It won’t include everything. Even just among witnesses who testified at trial, Durham was known to have done initial interviews, then threatened them with prosecution, in an often successful attempt to shade their testimony (see this post for an example). With others, Durham is being affirmatively misleading by stating that people who did appear before the grand jury were unwilling to be interviewed.

This list is just a list of interviews that actually support his narrative.

2019: Manufacturing a new origin story

As noted, most of the junkets that Durham and Barr did in the first year of the investigation don’t appear. The only overseas investigative steps noted in 2019 include the Legal Attaché personnel in London and the two Australian sources, Alexander Downer and Erika Thompson (described as Australian Diplomat-1), behind the original tip on George Papadopoulos. Durham did two separate interviews with the Australians, done on the same day, months before the DOJ IG Report determined the investigation was properly predicated.

Durham relies heavily on Downer, instead of Thompson, and claims to have discovered a conflict in their two accounts.

The Australian account reflects that two meetings of a casual nature took place with Papadopoulos. 215 These meetings were documented by Downer on May 11, 2016 and by Australian Diplomat-I later in the month. 216 Both diplomats advised that prior to the Spring of 2016, Papadopoulos was unknown to them. 217 Notably, the information in Paragraph Five does not include any mention of the hacking ofthe DNC, the Russians being in possession of emails, or the public release of any emails. In addition, when interviewed by the Office, Downer stated that he would have characterized the statements made by Papadopoulos differently than Australian Diplomat-1 did in Paragraph 5. According to Downer, Papadopoulos made no mention of Clinton emails, dirt or any specific approach by the Russian government to the Trump campaign team with an offer or suggestion of providing assistance. Rather, Downer’s recollection was that Papadopoulos simply stated “the Russians have information” and that was all. 218

As recounted to the FBI on August 2, 2016, by Australian Diplomat-1, the substance of Paragraph Five was written in a “purposely vague” way. 219 This was done because Papadopoulos left a number of things unexplained and “did not say he had direct contact with the Russians.” 220 The impression Papadopoulos made on the Australian diplomats was wide ranging. On the one hand, he “had an inflated sense of self,” was “insecure,” and was “trying to impress.” 221 On the other hand, he was “a nice guy,” was “not negative,” and “did not name drop.” 222

Downer noted that he

was impressed Papadopoulos acknowledged his lack of expertise and felt the response was uncommon for someone of Papadopoulos’ age, political experience and for someone thrust into the spotlight overnight. Many people in a similar position would represent themselves differently and [Downer] would have sniffed them out. If [Downer] believed Papadopoulos was a fraud [he] would not have recorded and reported on the meeting [he] had with Papadopoulos. 223

Downer also said that he “did not get the sense Papadopoulos was the middle-man to coordinate with the Russians.” 224 The Australian diplomats would later inform the FBI, and subsequently the Office, that the impetus for passing the Paragraph Five information in late-July was the public release by WikiLeaks ( on July 22, 2016) of email communications that had been hacked from the DNC servers. 225

215 We note there is an inconsistency in the statements given by Australian Diplomat-1 and former-High Commissioner Downer to the Crossfire Hurricane interviewers in August 2016 and what they told the Office when interviewed in October 2019. Australian Diplomat-1 and Downer were interviewed together in August 2016, and, according to the FD-302 prepared afterward by Supervisory Special Agent- 1, Papadopoulos made the statements about the Russians during the May 6, 2016 introductory meeting when he met only with Australian Diplomat-1. When the two diplomats were interviewed separately by the Office in October 2019, investigators were advised that Papadopoulos made the statements in front of both Australian Diplomat-1 and Downer during the second meeting on May 10, 2016.

216 The meetings with Papadopoulos took place on May 6 and 10, 2016. Australia 302 at 1- 2. The Australian diplomats documented the meetings in two cables dated May 11 and May 16, 2016; OSC Report of Interview ofAlexander Downer on Oct. 9, 2019 at 2; OSC Report of Interview ofAustralian Diplomat-1 on Oct. 9, 2019 at 3.

217 OSC Report of Interview of Alexander Downer on Oct. 09, 2019 at 1; OSC Report of Interview of Australian Diplomat-I on Oct. 09, 2019 at 1-2.

218 OSC Report of Interview of Alexander Downer on Oct. 09, 2019 at 2 (and related field notes); Downer also is reported to have stated in an interview that in talking with Papadopoulos there was “no suggestion that there was collusion between Donald Trump or Donald Trump’s campaign and the Russians.” Brooke Singman, Diplomat Who Helped Launch Russia Probe Speaks Out, Defends Role, Fox News (May 10, 2019), https://www.foxnews.com/politics/forrner-ausralian-diplomat-alexander-downer-defendswork-pushes-back-on-claim-he-tried-to-trap-papadopoulos. 219 Australia 302 at 2.

There’s no conflict.

Papadopoulos appears to have told the story about advance notice of Russia’s help to Thompson twice, once on May 6 and again, with Downer present, on May 10. She explains that not everything Papadopoulos said made it into her report. It’s likely Papadopoulos said more at the first meeting (I believe the record reflects that he drank more at the first meeting).

But by relying on Downer instead of Thompson, Durham claims that there was less to the tip than Thompson appears to have taken from it.

Having manufactured an alternate story about the initial predication, it’s no wonder Durham pushed Michael Horowitz not to say the investigation was fully predicated.

Durham also appears to have investigated why it took so long for the Steele reports to make their way from New York to DC. This is a fairly remarkable and sustained part of his report, because Durham is basically complaining that the pee tape report wasn’t immediately taken seriously.

Finally, from the very first year, Durham started doing investigations into the treatment of the Clinton Foundation investigation. As I have noted, his report leaves out really important details of that investigation: that agents who exhibited every bit as much bias as Durham finds in Peter Strzok, Lisa Page, or Kevin Clinesmith were running a key informant on the investigation, something no one has alleged happened with investigations into Trump’s associates.

That silence is all the more important given how Durham compares the predication of the Crossfire Hurricane investigation with that of Clinton Foundation, which relied in significant part on the Steve Bannon-linked Clinton Cash book which was every bit as shoddy as the Christopher Steele dossier, with a much more aggressive bias.

Once again, the investigative actions taken by FBI Headquarters in the Foundation matters contrast with those taken in Crossfire Hurricane. As an initial matter, the NYFO and WFO investigations appear to have been opened as preliminary investigations due to the political sensitivity and their reliance on unvetted hearsay information (the Clinton Cash book) and CHS reporting. 388 By contrast, the Crossfire Hurricane investigation was immediately opened as a full investigation despite the fact that it was similarly predicated on unvetted hearsay information. Furthermore, while the Department appears to have had legitimate concerns about the Foundation investigation occurring so close to a presidential election, it does not appear that similar concerns were expressed by the Department or FBI regarding the Crossfire Hurricane investigation. Indeed, in short order after opening the Crossfire Hurricane file and its four subfiles, the FBI was having one of its long-time CHSs meet not with just one Trump campaign associate, but meet and record conversations with three such insiders. And a little more than a month after opening the Crossfire Hurricane file on Page, a “senior U.S. law enforcement official” was publicly reported as confirming for Michael Isikoff and Yahoo! News that the FBI had Page on its radar screen. 389

Durham says two Australians who had no stake in the election (and who likely didn’t want to create a row with a major political candidate) have the same credibility as a long term political hoaxster paid by Trump’s ultimate campaign manager.

And in making this comparison, Durham doesn’t consider the urgency of the ongoing Russian attack on democracy (something that he generally ignores throughout the report). The underlying crime behind the Papadopoulos tip was potential (and real, in the case of both Paul Manafort and Roger Stone) ongoing involvement in Russia’s efforts to interfere in the election.

2020: Laying the ground work for the Clinton conspiracy

Early in 2020, Barr made Durham a Special Counsel, giving him authority to use a grand jury.

The very next day, he met with Jim Baker.

In cross-examination at the Sussmann trial, Baker lawyer Sean Berkowitz situated this meeting and another, in June 2020, when Baker’s story about the Sussmann meeting was still radically different than the one he told at trial, in terms of a leak investigation into Baker that had just closed. Baker had recently been criminally investigated by Durham, he knew that Durham would come after him again on the Russian investigation, and that February 2020 meeting was the first after the close of the leak investigation.

Q. So you know what it’s like to be under criminal investigation. Right?

A. Yes.

Q. You know what it’s like to be under criminal investigation by this man?

A. Yes.

Q. That’s Mr. Durham?

A. Yes.

Q. In fact, sir, in March of 2017 Mr. Durham was appointed by the Department of Justice to conduct a criminal investigation of the unauthorized disclosure of classified information to a reporter. Correct?

A. I don’t remember exactly when he was appointed, but that’s roughly correct based on my recollection of the timeframe.

Q. And you were a subject of that investigation?

A. I was never told that I was a subject.

Q. Is it fair to say that your lawyer refused to let you answer questions before Congress because you were under investigation?

A. He did object to certain questions — certain questions — because I was under investigation. That’s correct.

Q. Under criminal investigation. Right?

A. It was a criminal investigation was my understanding, yes.

Q. And you refused to answer those questions on the gounds that it might incriminate you?

A. I refused to answer those questions on advice of counsel, and it was a voluntary interview so I could refuse to answer any questions that I didn’t want to answer.

Q. And the investigation took place between 2017 and 2018. correct:

A. Say that again.

Q. The investigation took place between 2017 and 2019. correct?

A. I think it was not closed until 2020 by the Department.

[snip]

Q. And you, sir, were aware that Mr. Baker was — I mean, Mr. Durham was reappointed as special counsel, correct, in or around 2019?

A. For this matter?

Q. Yes.

A. Yes.

Q. And when that happened, you were concerned, were you not?

A. Concerned about what?

Q. That Mr. Durham might come and investigate you more?

A. I wasn’t concerned about it. I expected it.

[snip]

Q. It’s the first time you saw him after you were the subject of the criminal investigation by him?

A. Again, I was never told that I was a subject.

Q. Was that the first time?

A. Yeah, I think that was the first time.

In June 2020, Baker’s story started to evolve until ultimately, he testified, claiming 100% certainty about a story that had changed at least four times, to precisely the story Durham would want him to.

Most of the early 2020 interviews relied on by Durham in his report pertain to two topics: His reinvestigation of how the Clinton Foundation investigation proceeded, and his pursuit of a claim that Hillary framed Donald Trump (marked as “Russian intelligence” in the timeline).

Starting in June 2020, Durham appears to have started focusing on Igor Danchenko, burning him as a source, reviewing the long-dormant counterintelligence investigation into him, and focusing the same kind of pressure on Danchenko handler Kevin Helson (whom Durham seems to have referred for further investigation, on a date he doesn’t provide, for his handling of Danchenko). In July 2020, Barr provided Lindsey Graham the interview transcripts for Danchenko, which would lead to (or provide the excuse for) Danchenko’s exposure. In September 2020, the Senate Judiciary Committee would stage a FISA hearing to expose Danchenko’s past counterintelligence investigation.

None of these were effective investigative steps. Most witnesses didn’t testify at trial, and the one who did — Helson — was a devastating witness against Durham’s case (which may be why he was referred for further investigation). Those investigative steps did make Danchenko far more insecure, both legally and financially.

On September 29, John Ratcliffe would also share the report and, a week later, the underlying intelligence, around which Durham would build his Clinton conspiracy theory: A Russian intelligence Report that Hillary’s complaints about Trump’s pro-Russian bias stemmed from an attempt to cover up her email scandal and not from real concern about Russia or frustration with being victimized by a nation-state hack during an election.

On October 19, after Nora Dannehy disrupted Durham’s plan to release an initial report before the election, Barr made him Special Counsel so he could stick around for two more years to try to build the case he hadn’t done by 2020.

One of the most telling things about Durham’s actions in 2020 is that he didn’t do any of the ground work he needed to do to investigate the accusations he would make in late 2021. His primary work on the Alfa Bank case was making Danchenko far, far more vulnerable. He records virtually no obvious investigative work on the Alfa Bank allegations in 2020. He did little work on the dossier allegations. Some key investigative steps — getting a technical review of the Alfa Bank allegation and trying to secure Sergei Millian’s make-or-break testimony — waited until 2022, well after he had actually indicted these cases.

2021: Preparing actual indictments to hang failed conspiracy theories on

And it’s not just those two indictments Durham neglected in 2020. Here’s something Carter Page should think seriously about: John Durham did not do the investigation into the problems with his FISA application until the statutes of limitation started to expire in 2021. Given that investigative history, it’s fairly clear that Durham was never going to charge FBI agents in conjunction with those applications. Never. He had other priorities.

Instead, in 2021, he started making belated attempts to substantiate his Clinton conspiracy, with interviews to set up Charles Dolan as a witness.

Durham did no apparent interviews into Sergei Millian in 2021.

He did begin the effort — one paralleled and assisted by Alfa Bank lawsuit against the researchers in question, which to a DC judge seemed,”almost like they were written by the same people in some way,” — to spin the research into DNS anomalies into a deliberate plan by Hillary’s team.

In Durham’s investigations, however, there were obvious basic investigative failures. Durham didn’t interview people from Cendyn and Listrak until after the Sussmann indictment (and in the latter case, it’s not clear whether Durham spoke to anyone authoritative or even got the name of all the people interviewed).

I’ve already laid out how Durham didn’t even ask Michael Horowitz for relevant evidence until after the indictment. It was several months later before he asked Jim Baker to check his iCloud for the exculpatory communications that Sussmann correctly predicted would be there.

Durham didn’t interview Sergei Millian — and even then, he only did so remotely, with no agreement he would testify at trial — until February 2022, three months after indicting Danchenko.

These indictments — both of which could only have worked if charged as conspiracy indictments for which Durham had no evidence — were always bound to fail. They were bound to fail because they weren’t the result of an investigation, the logical progression from a clear crime committed. They were instead legal clothes hangers on which he could try to hang a conspiracy theory. They might have worked if Sussmann or Rodney Joffe or Danchenko had caved to the economic and legal pressure Durham was applying (as he did with Danchenko, Durham also got Joffe discontinued as an FBI source, but that had no financial repercussions for Joffe). But the charges were so flimsy Sussmann and Danchenko mounted a fairly clearcut defense.

Late 2021 to 2022: Chasing Clinton conspiracies

There’s a detail, though, that is all the more revealing given Durham’s failure to conduct an adequate investigation into these charges before indicting. As I noted last year, even after Sussmann was indicted, Durham refused the former Clinton lawyer’s demand for a list of the people on the Clinton campaign with whom he had coordinated his Alfa Bank efforts. It wasn’t until months later that it became clear — as Sussmann laid out in a filing — that Durham hadn’t even interviewed any of the people Sussmann purportedly coordinated with until after the indictment.

[T]he Special Counsel has alleged that Mr. Sussmann met with the FBI on behalf of the Clinton Campaign, but it was not until November 2021—two months after Mr. Sussmann was indicted—that the Special Counsel bothered to interview any individual who worked full-time for that Campaign to determine if that allegation was true.

Here’s what those interviews look like, as laid out in the Durham Report:

11/10/21: Jennifer Palmieri

11/12/21: Jake Sullivan

1/19/22: John Podesta (Russian Intelligence)

5/11/22: Hillary Clinton (Russian Intelligence)

Those questions weren’t focused on Sussmann, though. They were focused on Durham’s Clinton conspiracy, the claim that she had made a plan to frame Donald Trump.

During an interview of former Secretary Clinton, the Office asked if she had reviewed the information declassified by DNI Ratcliffe regarding her alleged plan to stir up a scandal between Trump and the Russians. 44 ° Clinton stated it was “really sad,” but “I get it, you have to go down every rabbit hole.” She said that it “looked like Russian disinformation to me; they’re very good at it, you know.” Clinton advised that she had a lot of plans to win the campaign, and anything that came into the public domain was available to her.

In addition, the Office interviewed several other former members of the Clinton campaign using declassified materials441 regarding the purported “plan” approved by Clinton.

The campaign Chairperson, John Podesta, stated that he had not seen the declassified material before, characterized the information as “ridiculous,” and denied that the campaign was involved in any such “plan.”442 Jake Sullivan, the campaign Senior Policy Advisor, stated that he had not seen the intelligence reporting before and had no reaction to it other than to say, “that’s ridiculous.”443 Although the campaign was broadly focused on Trump and Russia, Sullivan could not recall anyone articulating a strategy or “plan” to distract negative attention away from Clinton by tying Trump to Russia, but could not conclusively rule out the possibility. 444 The campaign Communications Director, Jennifer Palmieri, who was shown the Referral Memo, 445 stated that she had never seen the memorandum before, found its contents to be “ridiculous,” and could not recall anything “like this” related to the campaign. 446 She stated that Podesta, Mook, Sullivan and herself were aware of a project involving ties between Trump and Russia being conducted by Perkins Coie, the campaign law firm, but she did not think Clinton was aware of it, nor did she receive any direction or instruction from Clinton about the project.447

Another foreign policy advisor (“Foreign Policy Advisor-2”) confirmed that the campaign was focused on Trump and Russia, but that focus was due to national security concerns and not designed to distract the public from Clinton’s server issue. 448

Every single one of them called Durham’s conspiracy theories “ridiculous.”

For good reason. As I’ve laid out, the timeline Durham obscures, in which Trump’s rat-fucker had contact with Russia weeks before Hillary purportedly ginned up this plan, disproves the conspiracy theory.

Which explains something about the Sussmann trial — led by Andrew DeFilippis, the same AUSA who had willingly attempted to trump up a crime against John Kerry. Over and over, Durham’s prosecutors willfully ignored Judge Christopher Cooper’s orders, thereby introducing evidence with no evidentiary basis. They did so most blatantly when, minutes after Cooper ordered DeFilippis not to read from a paragraph of a Hillary Tweet calling on FBI to investigate the Alfa Bank allegations, he did so anyway, predictably leading the same outlets that wrote supine reviews of the Durham report to focus exclusively on something not before the jury.

After Judge Cooper said he would reserve his decision, Berkowitz noted that in fact, DeFilippis planned to use the tweet to claim the campaign wanted to go to the FBI when the testimony at trial (from both Elias and Mook) would establish that going to the FBI conflicted with the campaign’s goals.

[T]hey are offering the tweet for the truth of the matter, that that’s what the campaign desired and wanted and that it was a accumulation of the efforts.

Number one, it’s not the truth; and in fact, it’s the opposite of the truth. We expect there to be testimony from the campaign that, while they were interested in an article on this coming out, going to the FBI is something that was inconsistent with what they would have wanted before there was any press. And in fact, going to the FBI killed the press story, which was inconsistent with what the campaign would have wanted.

And so we think that a tweet in October after there’s an article about it is being offered to prove something inconsistent with what actually happened.

Then, after both Elias and Mook had testified that they had not sanctioned Sussmann going to the FBI, DeFilippis renewed his assault on Cooper’s initial exclusion, asking to introduce it through Mook’s knowledge that the campaign had tried to capitalize on the Foer story.

Having ruled in the past that the tweet was cumulative and highly prejudicial, Cooper nevertheless permitted DeFilippis to introduce the tweet if he could establish that Mook knew that the campaign tried to capitalize on the Foer story.

But Cooper set two rules: The government could not read from the tweet and could not introduce the part of the tweet that referenced the FBI investigation. (I explained what DeFilippis did at more length in this post.)

THE COURT: All right. Mr. DeFilippis, if you can lay a foundation that he had knowledge that a story had come out and that the campaign decided to issue the release in response to the story, I’ll let you admit the Tweet. However, the last paragraph, I agree with the defense, is substantially more prejudicial than it is probative because he has testified that had neither — he nor anyone at the campaign knew that Mr. Sussmann went to the FBI, no one authorized him to go to the FBI, and there’s been no other evidence admitted in the case that would suggest that that took place. And so this last paragraph, I think, would unfairly suggest to the jury, without any evidentiary foundation, that that was the case. All right?

MR. DeFILIPPIS: Your Honor, just two brief questions on that.

THE COURT: Okay.

MR. DeFILIPPIS: Can we — so can we use — depending on what he says about whether he was aware of the Tweet or the public statement, may we use it to refresh him?

THE COURT: Sure. Sure.

MR. DeFILIPPIS: Okay. And then, as to the last paragraph, could it be used for impeachment or refreshing purposes as well in terms of any dealings with the FBI?

THE COURT: You can use anything to refresh.

MR. DeFILIPPIS: Okay.

THE COURT: But we’re not going to publish it to the jury. We’re not going to read from it. And let’s see what he says. [my emphasis]

Having just been told not to read the tweet, especially not the part about the FBI investigation, DeFilippis proceeded to have Mook do just that.

The exhibit of the tweet that got  to the jury had that paragraph redacted and that part of the transcript was also redacted. But, predictably, the press focused on little but the tweet, including the part that Cooper had explicitly forbidden from coming into evidence.

In his report, Durham obscures the timeline of all this to falsely suggest that Hillary endorsed going to the FBI in September, before Sussmann met with the FBI, and not days before the election, when Franklin Foer reported the story.

On October 31, 2016 – about one week before the election – multiple media outlets reported that the FBI had received and was investigating the allegations concerning a purported secret channel between the Trump Organization and Alfa Bank. For example, Slate published an article that discussed at length the allegations that Sussmann provided to the FBI. 1530

Also on that day, the New York Times published an article titled Investigating Donald Trump, F.B.f Sees No Clear Link to Russia. 1531 The article discussed information in the possession of the FBI about ··what cyber experts said appeared to be a mysterious computer back channel between the Trump Organization and the Alfa Bank.” 1532 The article further reported that the FBI had “spent weeks examining computer data showing an odd stream of activity to a Trump Organization server,” and that the newspaper had been provided computer logs that evidenced this activity. The article also noted that at the time of the article, the FBI had not found “any conclusive or direct link” between Trump and the Russian government and that “Hillary Clinton’s supporters … pushed for these investigations.” 1533

As noted above, in the months prior to the publication of these articles, Sussmann had communicated with the media and provided them with the Alfa Bank data and allegations. 1534 Sussmann also kept Elias apprised of his efforts. 1535 Elias, in tum, communicated with the Clinton campaign’s leadership about potential media coverage of these issues. 1536

In addition, on September 15, 2016, Elias provided an update to the Clinton campaign regarding the Alfa Bank allegations and the not-yet-published New York Times article, sending an email to Jake Sullivan (HFA 154 ° Chief Policy Advisor), Robby Mook (HF A Campaign Manager), John Podesta (HF A Campaign Chairman), and Jennifer Palmieri (HFA Head of Communications), which he billed to the Clinton campaign as “email correspondence with J. Sullivan, R. Mook, J. Podesta, J. Palmieri re: Alfa Bank Article.” 1541

On the same day that these articles were published, the Clinton campaign posted a tweet through Hillary Clinton’s Twitter account which stated: “Computer scientists have apparently uncovered a covert server linking the Trump Organization to a Russian-based bank.” 1542 The tweet included a statement from Clinton campaign advisor Jake Sullivan which made reference to the media coverage article and stated, in relevant part, that the allegations in the article “could be the most direct link yet between Donald Trump and Moscow[,] that “[t]his secret hotline may be the key to unlocking the mystery ofTrump’s ties to Russia[,]” and that”[w ]e can only assume that federal authorities will now explore this direct connection between Trump and Russia as part oftheir existing probe into Russia’s meddling in our elections.”

In context, Durham falsely leaves the impression that Hillary supported going to the FBI in advance, even though both Robby Mook and Marc Elias testified that the last thing Hillary wanted to do was let the FBI get more involved in her campaign. In context, Durham falsely leaves the impression that Sussmann had sustained contacts with the NYT starting in September and never stopping, when the evidence he cites pertains exclusively to early September communications, after which Sussmann worked with the FBI to kill the story.

In a follow-up post, I will lay out just how grotesque Durham’s conspiracy theory is — the digital equivalent of slut-shaming a rape victim.

But for now, consider the abundant evidence that Durham didn’t investigate the charges he ultimately charged. He was far too busy, instead, pursuing this Clinton conspiracy theory he started chasing at least as early as February 2020.

Update: Added table showing the organization of Durham’s Report.

Dates

5/13/19: Preliminary review 

5/28/19: UK Legat-1

6/4/19: UK ALAT-1

6/17/19: SSA-1 (Steele Reports, Papadopoulos)

6/17/19: CIA Employee-1 (Page FISA)

6/18/19: SSA-1 (bias)

6/19/19: Case Agent-1 (defensive briefing, Steele Reports, Papadopoulos)

7/2/19: Handling Agent-1 (Page FISA)

7/2/19: NYFO ASAC-1 (Page FISA)

7/3/19: Michael Harpster (Steele Reports)

8/1/19: Mike Rogers

8/6/19: NYFO ADC-1

8/12/19: Randall Coleman (Clinton Foundation, Steele Reports)

8/12/19: Diego Rodriquez (Clinton Foundation)

8/14/19: HQ Analyst-3 

9/16/19: Cyber Agent-2 (Alfa)

10/17/19: SSA-2 (Clinesmith, Papadopoulos)

8/21/19: Case Agent-1

8/29/19: OGC Unit Chief-1 (bias, Australia referral, Page FISA)

9/5/19: NYFO Case Agent-1 (Page FISA)

10/9/19: Erika Thompson; Alexander Downer

12/9/19: DOJ IG Report

12/10/19: HQ Analyst-3 

1/6/20: David Johnson (Steele Reports)

1/15/20: NYFO Case Agent-1 (Clinton Foundation)

1/16/20: Diego Rodriquez (Clinton Foundation)

1/28/20: HQ Unit Chief-3 (Clinton Foundation)

2/6/20: Special Attorney to Attorney General (may reflect grand jury)

2/7/20: Jim Baker (defensive briefing)

2/13/20: Cyber Agent-3 (Alfa)

2/19/20: HQ Analyst-3 (Page FISA)

2/25/20: HQ Analyst-2 (Russian Intelligence, Clinesmith)

2/28/20: Jonathan Moffa (Russian Intelligence)

3/18/20: Paul Abbate (Clinton Foundation)

4/14/20: Field Office-1 Handling Agent-3 

4/23/20 Field Office-1 Handling Agent (Clinton Foundation)

4/23/20: Michael Harpster (Steele Reports)

5/1/20: Mueller SSA-1

5/5/20 Field Office-1 Handling Agent (Clinton Foundation)

5/6/20: Steele Reports

5/28/20: HQ SSA-4 (Clinton Foundation)

6/11/20: Jim Baker (Russian Intelligence)

6/18/20: Jim Baker (Russian Intelligence)

6/25/20: SA-2 (Steele Reports)

6/29/20: Michael Steinbach (initial EC)

6/30/20: Referral regarding existing counterintelligence investigation

7/1/20: OI Attorney (Page FISA)

7/8/20: Ray Hülser (Clinton Foundation)

7/14/20: Kevin Helson (Page FISA)

7/22/20: SSA-1 (Russian intelligence, Steele Report) 

7/23/20: OGC Unit Chief-1 (Page FISA)

7/28/20: Baltimore Special Agent-2 (Danchenko)

8/13/20: Baltimore Case Agent-1 (Danchenko)

8/13/20: CIA Employee-2 (Alfa)

8/19/20: IC Officer #6 (Russian Intelligence)

8/20/20: WFO Clinton Foundation Case Agent-1 

8/21/20: John Brennan (Russian Intelligence)

9/9/20: Acting OGC Section Chief-1 (Clinton Foundation)

9/10/20: Field Office-1 SAC

9/22/20: Field Office-1 Handling Agent-3

9/29/20: Patrick Fallon (Clinton Foundation)

9/29/20: John Ratcliffe shares Russian Intelligence with Lindsey Graham

10/19/20: Special Counsel appointment

10/27/20: OI Unit Chief-1 (Page FISA)

11/24/20: Kevin Helson (Danchenko)

12/8/20: HQ Supervisory Analyst-1 (Danchenko)

12/15/20: HQ SSA-3 (Alfa)

12/18/20: Baltimore Special Agent-1 (Danchenko)

12/21/20: Designation to use classified information

12/23/20: IC Officer#12 (Russian Intelligence)

12/20: Referral regarding accuracy of info in non-Page FISA (possibly Millian?)

2/2/21: Tech Company-1 Employee 1 (Alfa)

2/11/21: DARPA Program Manager-1 (Alfa)

2/25/21: Tech Company-1 Employee 1 (Alfa)

3/3/21: SSA-1 signed statement on Steele Reports

3/18/21: SSA-3 (Page FISA)

3/21/21: SA-1 (Page FISA)

4/8/21: Field Office-1 SSA-1

4/13/21: US Person-1 (Dolan Associate) (Danchenko)

4/14/21: Research Exec-1 (Alfa)

4/22/21: HQ Unit Chief-2

5/5/21: SSA-2  (bias, Page FISA, Danchenko, Clinesmith, Papadopoulos)

5/5/21: Field Office-1 Handling Agent-2 (second CI investigation)

6/21/21: David Archey (Defensive briefings)

6/29/21: CIA Employee-3 (Alfa)

6/30/21: OGC Attorney-1 (Page FISA)

6/30/21: Danchenko Employer-1 Exec-1 

7/7/21: Field Office-1 ASAC-1

7/9/21: Jennifer Boone

7/9/21: Tech Company-1 Employee 1 (Alfa)

7/21/21: Foreign Policy Advisor-1 (Russian Intelligence)

7/21/21: SSA-1 (Page FISA)

7/22/21: University-1 Researcher-1 (Alfa)

7/26/21: Brian Auten (bias, Russian Intelligence, Steele Reports)

7/27/21: Kevin Helson (Danchenko)

8/21: University-1 Researcher-2 (Alfa) [appears to be one 302 on more than one conversation]

8/9/21: NJ-Based Company Exec (Danchenko)

8/10/21: University-1 Researcher-3

8/11/21: Handling Agent-1 (Page FISA)

8/16/21: Mueller Analyst-1 (Danchenko)

8/12/21: Tech Company-3 Exec-1 (Alfa)

8/31/21: Charles Dolan (Danchenko)

8/31/21: Mueller SSA-1 (Danchenko)

9/7/21: Charles Dolan (Danchenko)

9/16/21: Michael Sussmann indictment

9/17/21: Brookings Fellow-1 (Danchenko)

10/21/21: UCE-1 (Papadopoulos)

10/27/21: Listrak Employee-1 and personnel (Alfa)

10/29/21: Mueller Analyst-1 (Danchenko)

11/1/21: Charles Dolan (Danchenko)

11/3/21: Danchenko indictment

11/17/21: Cendyn CEO and CTO (Alfa)

11/9/21: Jonathan Winer (Steele Reports)

11/10/21: Jennifer Palmieri

11/12/21: Jake Sullivan

11/16/21: Brookings Fellow-2 (Danchenko)

11/17/21: Cendyn CEO and CTO (Alfa)

12/2/21: HQ Analyst-3 (Steele)

11/20/21: Victoria Nuland

11/30/21: Victoria Nuland (Steele Reports)

12/13/21: James Clapper

1/19/22: John Podesta (Russian Intelligence, Alfa)

2/2/22: David Cohen

2/5/22: Sergei Millian (Danchenko)

3/1/22: Handling Agent-1 (Page FISA)

3/28/22: Foreign Policy Advisor-2

5/11/22: Hillary Clinton (Russian Intelligence)

6/22/22: SSA-1 (Russian Intelligence)

8/9/22: Ritz GM (Danchenko)

12/14/22: Referral to DOD IG on DARPA

Share this entry

“Tentacles” with the “Potential to Spiral:” Geoffrey Berman, Bill Barr, and Hunter Biden’s Dick Pics

/38 Comments/in /by

Given recent news relating to Rudy Giuliani and Hunter Biden[‘s dick pics], I want to belatedly look at what Geoffrey Berman’s book, Holding the Line, says about the Lev Parnas investigation.

Berman’s memoir is, as all autobiographies are, a complex narrative. There are many reasons why that’s true in this case. We all tell ourselves and others false stories about ourselves, often as not unconsciously. There are one or two points in Berman’s story where he makes claims belied by publicly-released documents; I assume those are inadvertent, but they serve as interesting signposts of the limits of his own firsthand knowledge of particular matters. Someone with access to classified or confidential information will be forced, as Berman seems to have been, to either nod to or entirely avoid big parts of the story, probably a really big factor in the matters I write about below. And finally, famous, powerful people shade the truth for posterity and to hide inconvenient truths. There’s a whole bunch of that in this book, a long form effort to pitch his association with the Trump Administration, not unfairly, as a worthwhile opportunity to do a lot of important work holding sex traffickers accountable (including, but not limited to, Jeffrey Epstein) and in key moments, protecting investigations from the interference of all three of Trump’s Attorneys General.

How Berman tells this story — how anyone tells their autobiography — can say as much as the facts relayed.

The most fascinating narrative construction in Berman’s autobiography comes in his discussion of Bill Barr’s confirmation.

It appears immediately after Berman’s recounting of DOJ’s effort to force SDNY to prosecute John Kerry for interfering in Trump’s plan to overturn the Iran Deal. (The SDNY prosecutor in charge of that effort, Andrew DeFilippis, played the most abusive role on John Durham’s team and resigned unexpectedly before the Igor Danchenko trial, but that’s obviously not part of the story of what transpired at SDNY.) Given the timeline laid out in Berman’s book, in which SDNY’s investigation into Kerry lasted for about a year starting on May 9, 2018, that effort must have continued until May 2019. In fact, Berman ties pressure to bring charges from DOJ on April 23, 2019 with Barr: “By the time we got pressured in April 2019, on the same day as one of the Trump tweets, Bill Barr was the attorney general.”

From there, Berman shifts back in time to talk about the turnover at Attorney General. After a short anecdote about Matt “Big Dick Toilet Salesman” Whitaker trying to glom onto Berman’s good press in NY, Berman introduces Barr’s confirmation by suggesting polarization was the cause of Barr’s close confirmation vote in the Senate.

In one marker of how much more polarized our politics have become, Barr’s first confirmation hearing in 1991 was described at the time as “placid.” He was approved unanimously by the Senate Judiciary Committee, then confirmed by the full Senate in a voice vote. When Barr’s second nomination went before the Senate early in 2019, he was confirmed, but in a roll-call vote—with the 54–45 count mostly breaking down along party lines.

This was, of course, not a mark of polarization. It was a mark of Barr’s unsuitability to be Attorney General, and it was specifically attributed to his audition for the job in the form of a memo, seemingly based entirely on claims Barr picked up watching Fox News, attacking Mueller’s investigation, as well as his role in shutting down the Iran-Contra inquiry. Spinning the close vote, in a book released in 2022, as partisanship allows Berman to suggest that the close vote wasn’t entirely justified. That, in turn, makes the insipid note Berman wrote welcoming Barr to the post (a note which presumably would be accessible under FOIA) less ridiculous.

I was elated that we were getting somebody to come in to take Whitaker’s spot, and I had high hopes. The new boss was experienced and highly intelligent. He had a reputation as an institutionalist, someone who would respect the traditions and norms of the department. Most of all, I believed Barr would be a steady hand in turbulent times.

I sent him a handwritten note, relating that in his first tour of duty he had signed my certificate when I started out as a young AUSA. I said we had never had an opportunity to meet, but I was looking forward to that soon.

I added that he was “just what the doctor ordered.” Like so many other establishment Republicans, I thought he would clean things up at DOJ and respect the rule of law.

Blech! Yick!

Then, immediately after describing this suck-up note, Berman describes the reason he, of all people, should have known better then to think Barr would “respect the rule of law”: because he knew, as someone who had worked on the Iran-Contra investigation, Barr’s past history interfering in an investigation of the President.

Berman tells a superb anecdote that I hope is not embellished about how, the only time Barr was in Berman’s office, the Attorney General saw a picture of Berman with Iran-Contra Independent Counsel Lawrence Walsh, on whose team Berman had worked very early in his career. As Berman describes (there’s an extended history of Iran-Contra in-between — go buy the book), Barr simply stared at the picture for a minute.

The one time that Barr met with me in my personal office at the Southern District involved an uncomfortable moment, and it was telling. It happened after he noticed a photo on the wall of me with Lawrence Walsh, the independent counsel in the Iran-Contra affair. It was signed, “Thank you Geoff, for all your good work.”

[snip]

That day in my office, Barr fixed his gaze on the picture of Walsh and me. He looked at it for almost a minute straight without saying a word. Just stared with a sour look on his face. It was awkward as hell. [my emphasis]

Only after describing what Berman suggests was an unfairly close confirmation vote, his own sycophantic note to Barr after it, and this exchange of indeterminate date, does Berman turn to what he calls (justifiably) a philosophical divide between him and Barr over the role of presidential power. After describing Barr’s November 2019 Federalist Society speech in which he falsely claimed that Presidential powers had been encroached over the years, Berman reviewed Donald Ayer’s June 2019 article explaining “why Bill Barr is so dangerous.”

There were critics—among them some lawyers who worked in prior Republican administrations—who felt that Barr soft-pedaled his views during the confirmation process and later acted in extreme ways on Trump’s behalf. One of them was Donald Ayer, a highly regarded lawyer who served in the administrations of Ronald Reagan and George H. W. Bush.

In a 2019 essay in The Atlantic, Ayer wrote, “In securing his confirmation as attorney general, Barr successfully used his prior service as attorney general in the by-the-book, norm-following administration of George H. W. Bush to present himself as a mature adult dedicated to the rule of law who could be expected to hold the Trump administration to established legal rules. Having known Barr for four decades, including preceding him as deputy attorney general in the Bush administration, I knew him to be a fierce advocate of unchecked presidential power, so my own hopes were outweighed by skepticism that this would come true.”

Ayer’s piece appeared after the release of the Mueller report, which many believed Barr had both preempted and misrepresented. Ayer continued, “But the first few months of his current tenure, and in particular his handling of the Mueller report, suggest something very different—that he is using the office he holds to advance his extraordinary lifetime project of assigning unchecked power to the president.”

Much of this political back-and-forth was beyond the scope of my concerns in the Southern District. I was a working prosecutor, and my focus was to lead the dedicated and hardworking public servants under me who came into work every day and busted their asses. My political views—and whatever my thoughts might have been on Barr’s high-altitude insights into the Constitution—were beside the point.

But the fact was, Barr’s top-down, unitary theories of power extended to how he viewed himself, how he ran the Justice Department, and how he felt about the people who worked for me. If Barr believed that the president could properly instruct the DOJ to take actions involving specific individuals, including his friends and enemies, that was a concern of mine. [my emphasis]

The narrative structure of this goes: Barr’s close February 2019 confirmation vote, Berman’s insipid note, the undated meltdown when Barr saw a picture of Berman with Walsh, Barr’s November 2019 discussion of views already evident in his June 2018 audition memo, and finally Ayer’s June 2019 description of the danger of Bill Barr, which had most recently been exhibited by his March 2019 response to the Mueller report. In sum, it provides a permissibly partisan frame in which to criticize Barr. But that jumbles the real timeline. Such a narrative structure allows Berman to introduce Barr’s authoritarian views in such a way as to absolve a former member of Lawrence Walsh’s team for writing a FOIAble letter claiming Barr was “just what the doctor ordered” around February 2019. It’s not that the Democrats were right to vote against Barr, the narrative allows Berman to suggest, it’s just that Ayer hadn’t written his condemnation of Barr yet.

And for some reason, Berman puts that exchange in his office, of indeterminate date, in the middle of it all. The single time, Berman says, that Barr visited Berman’s office.

It’s awfully curious that Berman doesn’t date that meeting, because Berman’s story of the Parnas and Fruman prosecution doesn’t describe the visit to SDNY that Barr was reported to have made, in real time, the day that Rudy’s flunkies were indicted — a visit to New York that also included a meeting with Rupert Murdoch. Berman actually tells the story of that day twice, first in conjunction with a contentious fight with Main Justice over whether SDNY must join in the effort to assume Trump’s defense in Cy Vance’s investigation, then in his telling of the Parnas and Fruman indictment. Both were going on at the same time. But in neither telling does Berman describe that the Attorney General showed up in New York, purportedly to meet with people like him and people who worked for him, at a time when Berman was in at least one really contentious fight with the Attorney General’s office.

Maybe Barr went to New York to visit SDNY and got lost at Murdoch’s place and so never showed up??

The Parnas and Fruman story, as told here, begins on October 8, when Berman got pulled out of Yom Kippur service to be told that Parnas and Fruman had just booked one way tickets to Europe.

What he told me was that Lev Parnas and Igor Fruman had just bought airline tickets for travel the next day to Frankfurt, Germany—one-way tickets—and we had to decide whether to arrest them before they boarded the plane.

As Berman described it no one else on the prosecution team supported indicting Rudy’s flunkies before they boarded a plane.

It was quickly apparent to me that I was in a minority of one. I would describe one call as almost like an intervention. I answered and six people were on the line: Audrey Strauss, the chief of the criminal division, Laura Birger, Chief Counsel Craig Stewart, Ilan Graff, Russ Capone, and Ted Diskant. Every one of them said we should let them travel.

Berman got the NY FBI Assistant Director, William Sweeney, to agree with him, and then (having apparently thus won the argument with the line prosecutors) the team worked overnight to complete the indictment, finishing (if I have my timeline correct) less than three hours before the announcement of Barr’s visit to NY.

Donaleski and Roos came into the office at about 11:00 p.m., and I joined them with coffee I had made at my apartment. (The local coffee shops were closed.) They drafted the indictment through the night, with review and revision by others either in the office or from home. Because the charges included campaign finance violations, we needed sign-off from the career attorneys at Main Justice’s Public Integrity Section. Diskant was on the phone with them at 4:00 a.m. and got the approval.

At 7:00 a.m., everyone came into the office for a final edit. At 9:00 a.m., the draft was finished, and [Rachel] Donaleski and [Nicholas] Roos went before the grand jury. By 2:00 p.m., they returned an indictment. Time to spare!

In a later post I’ll come back to that 4AM approval from Public Integrity. But note that Berman doesn’t describe getting approval from anyone else at Main Justice, even though after the indictment DOJ confirmed that Barr had been briefed from shortly after his confirmation. Just career attorneys at Public Integrity at 4AM.

Having told the heroic story of how prosecutors pulled together a last minute indictment, Berman then goes back and explains where the investigation came from. It came not from a referral from Federal Election Commission (which Republicans had made entirely dysfunctional at the time), but because SDNY’s Public Integrity section read the complaint that was submitted to the FEC.

Our public corruption unit monitors complaints filed with the FEC for possible investigation. Nick Roos read the complaint and persuaded Capone and Diskant to open the investigation. Roos and Donaleski began to put the pieces together. We confirmed that Global Energy was nothing but a shell with no business and no capital investment. Lev and Igor ran foreign money through it for the purpose of contributing to political candidates and committees in the United States.

The description of the part of the indictment relating to the firing of Marie Yovanovitch — the part of the indictment that was shelved in 2020 and which just died without charges — covers several pages. The first paragraph starts with a sentence — about the Russian donor behind some of the influence peddling — that should be in the prior paragraph. Then it lumps in the stuff implicating Rudy as a mere addition, almost an afterthought (probably necessitated, in part, by DOJ guidelines about uncharged persons).

[Andrey] Muraviev’s money was also used to donate to statewide races in Nevada. In addition, Lev and Igor contributed money, also through straw donors, to Pete Sessions, who at the time was a congressman from Texas and chairman of the powerful House Rules Committee. The outreach to Sessions was connected to their effort to get Marie Yovanovitch fired from her post as US ambassador to Ukraine. [my emphasis]

This is how it appears in the indictment:

In addition to the contributions made and falsely reported in the name of GEP, LEV PARNAS and IGOR FRUMAN, the defendants, caused illegal contributions to be made in PARNAS’s name that, in fact, were funded by FRUMAN, in order to evade federal contribution limits. Much as with the contributions described above, these contributions were made for the purpose of gaining influence with politicians so as to advance their own personal financial interests and the political interests of Ukrainian government officials, including at least one Ukrainian government official with whom they were working. For example, in or about May and June 2018, PARNAS and FRUMAN committed to raise $20,000 or more for a then-sitting U.S. Congressman (“Congressman-1”), who had also been the beneficiary of approximately $3 million in independent expenditures by Committee-1 during the 2018 election cycle. PARNAS and FRUMAN had met Congressman-1 at an event sponsored by an independent expenditure committee to which FRUMAN had recently made a substantial contribution. During the 2018 election cycle, Congressman-1 had been the beneficiary of approximately $3 million in independent expenditures by Committee-1. At and around the same time PARNAS and FREEMAN committed to raising those funds for Congressman-1, PARNAS met with Congressman-1 and sought Congressman-1’s assistance in causing the U.S. Government to remove or recall the then-U.S. Ambassador to Ukraine. [my emphasis, footnote omitted]

After a few paragraphs about Sessions’ excuses for deciding out of the blue that Yovanovitch should be fired, Berman describes that SDNY was still “exploring” whether this meeting might one day become a FARA charge.

The indictment made reference to this meeting with Sessions. It included an allegation that Lev, at the request of a Ukrainian official, had sought the removal of the US ambassador to Ukraine and had met with a congressman (Sessions) to solicit his support for the removal. We were still exploring whether these allegations might later form the basis of a FARA charge against Lev and others who, through lobbying or media appearances, sought the removal of Yovanovitch at the request of a foreign official without registering as a foreign agent.

As Berman describes it, when they included this Pete Sessions donation in the indictment (a footnote describes that the contribution was made under Fruman’s name, but misspelled), they were “exploring” the possibility that it might tie to illegal foreign influence peddling in part by “others who … sought the removal of Yovanovitch at the request of a foreign official without registering as a foreign agent.” Without naming Rudy yet, this passage suggests that they were only beginning to consider whether Rudy had committed a FARA violation when they prepared an indictment overnight on October 9 — with approval only from Public Integrity, not the FARA people in National Security Division who would one day get involved in the investigation — to arrest Rudy’s grifters before they flew to Europe.

Remember: by November 4, less than a month later, SDNY got warrants targeting Rudy, investigating FARA, 18 USC 951, and conspiracy.

I wonder whether some of the prosecutors opposed arresting Parnas and Fruman because they wanted to see what would happen at the meeting with Dmitry Firtash and what other Ukrainian government officials were involved besides Yuri Lutsenko.

Some paragraphs later, after describing Rudy’s role in the Fraud Guarantee stuff (which was superseded later, in 2020, when the Yovanovitch firing was taken out), Berman acknowledges that Rudy had also been trying to get Yovanovitch fired, effectively confirming that Rudy was one of the “others who” had tried to get Yovanovitch fired.

Yovanovitch’s removal was a major goal of Giuliani’s—and of other Trump allies—who believed that she was an obstacle to their efforts to unearth damaging information about the then presidential candidate Joe Biden and his son Hunter. The ambassador was considered an anticorruption advocate, and some Ukrainian officials—including those working with Lev and Igor—wanted her moved aside.

And then, a few paragraphs after that, Berman acknowledges that Parnas and Fruman were some of the agents mentioned in the articles of impeachment alleged to be soliciting Ukrainian influence to help him get reelected, even while asserting “we had no role to play” in impeachment.

It was, of course, impossible for me or anyone else to be unaware of how politically charged all of this was. The nation was in the third year of Donald Trump’s combustible presidency, and the 2020 election cycle was underway. Two months after the indictment of Lev and Igor, the House of Representatives voted to impeach President Trump.

The first of the two articles of impeachment alleged that the president “solicited the interference of a foreign government” to take actions that would “benefit his reelection, harm the election prospects of a political opponent, and influence the 2020 United States Presidential election to his advantage.” The foreign government was Ukraine, and the reference to Trump’s being assisted by “his agents within and outside the United States Government” obviously would have to include Lev and Igor.

Impeachment is a political process. We had no role to play in it.

This passage is almost the entirety of any discussion in the entire book of the Ukraine impeachment. Berman makes no mention of the months of focus leading up to impeachment.

Of particular note, he makes no mention of the release of the Perfect Transcript in late September, less than two weeks before SDNY suddenly charged Parnas and Fruman. He doesn’t describe whether the release of the transcript alerted SDNY (if they didn’t already know) how some of the matters under investigation by SDNY — Parnas’ ask of Pete Sessions to help oust Yovanovitch — were centrally connected to the impeachment, with Trump raising them explicitly with Ukraine’s president.

I heard you had a prosecutor who was very good and he was shut down and that’s really unfair. A lot of people are talking about that, the way they shut your very good prosecutor down and you had some very bad people involved. Mr. Giuliani is a highly respected man. He was the mayor of New York City, a great mayor, and I would like him to call you. I will ask him to call you along with the Attorney General. Rudy very much knows what’s happening and he is a very capable guy. If you could speak to him that would be great. The former ambassador from the United States, the woman, was bad news and the people she was dealing with in the Ukraine were bad news so I just want to let you know that. The other thing, There’s a lot of talk about Biden’s son, that Biden stopped the prosecution and a lot of people want to find out about that so whatever you can do with the Attorney General would be great. Biden went around bragging that he stopped the prosecution so if you can look into it … It sounds horrible to me.

[snip]

Well, she’s going to go through some things. I will have Mr. Giuliani give you a call and I am also going to have Attorney General Barr call and we will get to the bottom of it. I’m sure you will figure it out. I heard the prosecutor was treated very badly and he was a very fair prosecutor so good luck with everything. [my emphasis]

Berman also makes no mention of the references to Barr that Trump made while trying to coerce Volodymyr Zelenskyy, including those bolded above. Each reference to Barr here appears in close proximity to Trump’s attacks on Yovanovitch, that part of the Parnas indictment that SDNY was “exploring” whether it constituted a FARA violation.

Berman makes no mention of any of that. “We had no role to play” in impeachment.

But all of that had to have been central considerations to the prosecution, not least on October 8 when Berman interrupted his Yom Kippur worship to engage in a debate about whether they should pull together an indictment to charge Parnas and Fruman before they left the country, and not just to pull together an indictment, but to include the traces of a Yovanovitch charge which (Berman admits here) they were “still exploring whether these allegations might later form the basis of a FARA charge against Lev and others.”

As he describes it, they just called some folks in Public Integrity at 4AM to get approval and included the Yovanovitch charge which could implicate the investigation that would become Trump’s first impeachment.

Way before this narrative of the case in the book, and then briefly afterwards, Berman describes how Barr’s Chief of Staff inquired before the arrest announcement (what would have been October 10) about what SDNY was going to do, then bitched out Berman after the fact because it got a whole lot of press attention.

A few hours before we were to announce the charges, Rabbitt asked me, “What are you planning to do for publicity for Lev and Igor?” I said, “I’m going to have a press statement,” and he said, “Okay. Fine.”

Later that day, we made our statement. It was in front of cameras, and it got huge coverage. When I got back to my desk, Rabbitt called me up, livid. “I thought you said it was going to be a press statement?” he barked.

I replied, “I didn’t take questions. It was a press statement. If it were a press conference, we would have had questions.” I thought that was perfectly legit, but Rabbitt wasn’t satisfied. The exchange with him was a little uncomfortable, but the Lev and Igor indictments came at a fortuitous time. (It just happened that way; we didn’t intend it and couldn’t have anticipated the international travel that prompted their arrests.) If Main Justice took action against me in any way, or even just got in a public flap, the media would have assumed it was retribution after we indicted these two individuals who moved in Republican circles. It would have played as blowback from the arrests.

After we got press attention on a big matter and our visibility was high, I always felt sort of bulletproof, at least temporarily. It gave me a couple more months of grace.

[Fifteen page break, including the description of the Parnas and Fruman indictment laid out above]

Except for the concern that we not have a press conference to announce the indictments, Main Justice and Barr did not interfere in the prosecution of Lev and Igor.

The longer description of the exchanges with Brian Rabbitt comes fifteen pages before the reference back to it. In context, the reference to being “bulletproof” seems to pertain to the conflict with Barr’s people over the Vance intervention. By the time we get through the description of the Parnas charges (which Berman put in an entirely different chapter), a reader might well have forgotten that Berman recognized a high profile press conference of the sort that Barr’s Chief of Staff complained about would make it harder to fire him.

But it all makes more sense when you consider the decision to indict Rudy’s grifters overnight with approval only from career officials who happened to be working at 4AM in Public Integrity. It all makes more sense when you think about the reported visit Barr made to SDNY that Berman never mentions (which, admittedly, may never have happened).

Berman’s brief reference back to that Rabbitt complaint appears immediately after he writes, “Impeachment is a political process. We had no role to play in it,” but in a new section. It kicks off a four page section, covering events starting in January 2020 and lasting (based on documents released under FOIA) well past March, describing efforts Barr made to stymie any further investigation from SDNY. Barr wasn’t so much trying to protect Rudy, Berman describes: he thought Barr viewed the President’s personal lawyer as a potential rival. Rather, the Attorney General was trying to prevent “tentacles” from reaching others.

Main Justice and Barr did not interfere in the prosecution of Lev and Igor.

[snip]

To the extent all of this tarnished Rudy, I think Barr was fine with it. But the case had tentacles. It raised other questions and suggested new areas of inquiry. It potentially led to other subjects. And Barr certainly did involve himself in those potentialities.

[snip]

He has no way of knowing where it might go—and really, nobody does—but it looks to him as if it has the potential to spiral. [my emphasis]

In the four pages following this introduction, Berman describes how Barr effectively prevented SDNY from going any further with their investigation, first by assigning the next steps of the Rudy investigation to EDNY (to Richard Donoghue, with whom Barr had tried to replace Berman to kill the Michael Cohen investigation, but who may have gone on to save the Republic on January 3, 2021). That reportedly had the effect of prohibiting SDNY from investigating Rudy’s meetings with Andrii Derkach, who was dangling dirt that closely resembled what would come to be known as the “Hunter Biden” “laptop.” Berman describes what likely is the Derkach investigation this way:

In addition, Donoghue, as part of his new role, was given a sensitive Ukraine investigation that I thought should have gone to us.

Then Berman describes Barr assigning the intake of Rudy’s dirt on Hunter Biden (though he doesn’t describe it as such) to Scott Brady in Pittsburgh.

I didn’t know Brady well, but I considered him a solid guy.

This post describes how that all worked, and pointed to some communications about it all that the Attorney General’s office seemed to have no longer available when they were FOIAed.

The entire section is worth reading — buy the book — for the way it lays out aspects of Barr’s corrupt actions that haven’t gotten as much focus as his intervention in the Roger Stone and Mike Flynn prosecutions.

The one piece of news Berman discloses is that the FBI was withholding the 302s from the intake of Rudy’s Russian disinformation from NY’s Assistant Director, William Sweeney.

There were FBI reports of those meetings, called 302s, which we wanted to review. So did Sweeney. Sweeney’s team asked the agents in Pittsburgh for a copy and was refused. Sweeney called me up, livid.

“Geoff, in all my years with the FBI I have never been refused a 302,” he said. “This is a total violation of protocol.”

This detail is worth considering given the still ongoing GOP witch hunt targeting recently retied FBI Senior Analyst Timothy Thibault because of the compartmented way this information was all treated.

[I]t has been alleged that in September 2020, investigators from the same FBI HQ team were in communication with FBI agents responsible for the Hunter Biden information targeted by [Brian] Auten’s assessment. The FBI HQ team’s investigators placed their findings with respect to whether reporting was disinformation in a restricted access sub-file reviewable only by the particular agents responsible for uncovering the specific information. This is problematic because it does not allow for proper oversight and opens the door to improper influence.

Third, in October 2020, an avenue of additional derogatory Hunter Biden reporting was ordered closed at the direction of ASAC Thibault. My office has been made aware that FBI agents responsible for this information were interviewed by the FBI HQ team in furtherance of Auten’s assessment. It’s been alleged that the FBI HQ team suggested to the FBI agents that the information was at risk of disinformation; however, according to allegations, all of the reporting was either verified or verifiable via criminal search warrants. In addition, ASAC Thibault allegedly ordered the matter closed without providing a valid reason as required by FBI guidelines. Despite the matter being closed in such a way that the investigative avenue might be opened later, it’s alleged that FBI officials, including ASAC Thibault, subsequently attempted to improperly mark the matter in FBI systems so that it could not be opened in the future.

Chuck Grassley is focusing on later compartmentalization of this investigation, when the origin of that compartmentalization stemmed from Barr’s efforts to limit the tentacles of the SDNY investigation. Instead of reviewing what Barr did, he is hounding one of the last remaining people at FBI who had investigated Trump’s Russian ties, with Chris Wray doing nothing to support the Bureau.

All the more so given that, both the end of this section — which is followed by a section in which Berman describes how the Parnas case ended up with one 2021 jury verdict and one 2022 guilty plea — and at the end of the entire chapter, Berman emphasizes that Barr’s tampering in the Rudy case was exceptional, even amidst all the other tampering he engaged in (to include interference in the Michael Cohen, John Kerry, Halkbank, and Cy Vance cases).

The episode was one of the crazier things I encountered over the whole course of my tenure, which is really saying something.

[snip]

The “intake process in the field” nonsense was clearly not driven by his sense that all that Ukraine material would be too much for the Southern District to handle. The only burden we needed lifted from us was the attorney general’s improper meddling.

And, when Berman describes what must include this investigation among the list of reasons why Barr fired him in June 2020, he includes it under an oblique reference to “prosecutions and ongoing investigations of those in his inner circle.”

I never speculated about the specific reasons Barr wanted me out. As an attorney, I avoid allegations that I do not yet have the facts to support. But it was no secret to me that much of what we did at the Southern District—and did not do—displeased Trump. And if it displeased the president, it would have displeased Barr. That’s how it worked.

From the Greg Craig case through the non-prosecution of John Kerry and on up to the prosecutions and ongoing investigations of those in his inner circle, it was clear to Trump that he could not control SDNY. We were not loyal to him; our fealty was to the mission.

At the time I was fired in mid-June 2020, the presidential election was less than five months away. I’m sure that Barr was tired of the Southern District’s independence. But it is also fair to assume there was a political component in his move to oust me.

Barr did the president’s bidding, no matter how he may try to deny that now. He no doubt believed that by removing me he could eliminate a threat to Trump’s reelection. [my emphasis]

I think there’s a good deal of evidence that Barr was not just trying to remove any threat to Trump’s reelection. He was trying to ensure that any investigations into Trump and his flunkies could not continue if and when Trump lost. In this period Barr not only closed, but disclosed the closure, of investigations into Paul Manafort’s slush funds, a suspected $10 million donation funneled through an Egyptian bank that had kept Trump afloat in September 2016, and probably parts of an investigation into Erik Prince. He replaced Donoghue in EDNY at a time when Tom Barrack was close to being charged (in the since failed prosecution). I’ve raised questions about how it became possible to disclose, literally the day before the 2020 election, the once ongoing investigation into whether Roger Stone conspired with Russia on a hack-and-leak campaign — one that may have involved “solid guy” Scott Brady. During this same period, another hand-picked US Attorney was literally presenting altered documents in the Mike Flynn docket in an attempt to blow up that prosecution (which had the side of effect of making any obstruction charges against Trump post-Presidency untenable); by September, one of those altered documents would serve as a prop in an attack Trump launched on Biden in the first debate.

Berman describes a lot of Barr’s related interventions that happened earlier — what he calls a “hostile takeover” of the DC US Attorney’s Office. But he doesn’t describe the rest of Barr’s tampering. And that tampering, which had more permanent effect, would have extended to SDNY’s investigation had Berman not dug in when Barr first tried to fire him.

Still, I find it interesting that Berman, the guy who saw how Barr prevented his office from receiving copies of the garbage that Rudy Giuliani brought home from Ukraine, describes it instead in terms of removing all threats to Trump’s reelection. As noted above, the part of the investigation that Barr assigned to EDNY rather than SDNY reportedly pertains at least in part to suspected Russian agent Andrii Derkach’s efforts to help Rudy obtain dirt on Hunter Biden, dirt that looks remarkably like the “Hunter Biden” “laptop,” dirt which Rudy brought to “solid guy” Scott Brady rather than SDNY. If Berman believes that an SDNY investigation into those matters, consolidated into one investigation, would have threatened Trump’s reelection chances, it suggests any scrutiny on Rudy’s effort to get dirt on Hunter Biden — the kind of dirt he eventually released!! — would have sunk Trump.

Instead, the circumscribed investigation that Berman managed to protect ended without charges.

As James Comer and Kevin McCarthy prioritize their investigation into Hunter Biden’s dick pics, Democrats might do well to investigate the full effect of Barr’s efforts to dismantle the investigation into Rudy’s meetings with Russian agents to obtain dirt that Trump could use in his reelection bid. Some of the same witnesses, including computer repairman Mac Issac, Rudy lawyer Robert Costello, and Rudy himself would be pertinent to both investigations.

All that’s the story included in the book, proper.

But Berman included an epilogue, perhaps a narrative feature dictated by publishing schedule or a desire to change the emphasis. In it, he describes an exchange that took place around March 9, 2020, during a period when “solid guy” Scott Brady was actively processing dirt that Rudy had obtained from suspected Russian agent Andrii Derkach. Berman describes that between the time Barr spun out the investigation into Rudy and the time when Barr fired Berman in hopes of protecting Trump’s reelection, he answered a question about the Parnas investigation in such a way that implied Barr had interfered in the Parnas investigation for political reasons.

In March 2020, I was asked if Bill Barr had interfered in our Lev and Igor prosecution. The question came to me during a press conference on an unrelated case, having to do with illicit doping of Thoroughbred horses.

“The Southern District of New York has a long history of integrity and pursuing cases and declining to pursue cases based only on the facts and the law and the equities, without regard to partisan political concerns,” I replied. “My primary commitment is and has been to maintain those core values and that’s how our office is operating.”

This was my only public statement as US attorney about the office’s political independence, and it was mild. But I did not answer that Barr never interfered for partisan reasons, because that would not have been true. That might have earned me another demerit. I was fired a few months later.

Though as Berman described it in the book, it wasn’t the Parnas investigation that Barr was interested in. It wasn’t even Rudy. It was the “tentacles” that had the “potential to spiral.”

To be clear, by March 2020, according to the book, Barr had interfered politically in several other ways — John Kerry, Greg Craig, Michael Cohen, Turkey, and others. This is not a comment limited to Rudy’s grifters.

But Berman chose to cap his book — which, as mentioned, focuses significantly on Berman’s success on unrelated cases, including things like the Epstein case — with something that occurred in March 2020, chronologically while Barr’s efforts to prevent the Rudy investigation from spiraling out of control were ongoing. That changes the lesson of Berman’s book, then, to a focus on Barr’s political interference.

Just months ago, the US Attorney for SDNY published a book that laid out in detail how Trump’s corrupt Attorney General intervened to prevent the tentacles of a Hunter Biden adjacent investigation from spiraling out of his own control. And yet that has all been lost amid the din of outrage that Twitter took down Hunter Biden’s non-consensual dick pics.

Full transparency: On Twitter (they’re not coming up on a search of the Elmo-degraded site), I’m sure I also made comments about career people at DOJ preferring Barr to BDTS. I did so even while writing posts — one, two, three, four — that noted his role in Iran-Contra and the specious claims he had already made about the Mueller investigation.

Share this entry

DOJ Inspector General Report on the Tensions Created by Parallel Construction

/26 Comments/in , /by

Before you read this report on tensions between FBI Office of General Counsel’s National Security and Cyber Law Branch (NSCLB)  and DOJ’s National Security Division (NSD), remember the following things:

  • In significant part because of jurisdictional limitations, DOJ Inspector General blamed FBI for everything that went wrong with the Carter Page FISA applications, and in the wake of that report, Bill Barr, Trump, and his allies in Congress used it to damage the career every single person at FBI who had been involved with the Russian investigation (except for the two guys who made multiple mistakes in dismissing the Alfa Bank allegations).
  • John Durham then used that damage to attempt to coerce testimony, sometimes false, from FBI figures in his never-ending witch-hunt.
  • For the same jurisdictional limitations, any abuse John Durham engages in or Andrew DeFilippis engaged in can only be reviewed by DOJ’s feckless Office of Professional Responsibility, not by DOJ IG.
  • After that report, DOJ IG developed proof that Carter Page was not special; by some measures, his FISA application was better than those of people who hadn’t been fired by a future President for precisely the same foreign ties that the FISA was meant to assess.
  • The NSD then dismissed those findings from DOJ IG, largely by adopting a standard different from the one that had been adopted with Carter Page (it’s unclear whether DOJ IG is still trying to resolve these discrepancies or not).
  • None of the stuff that happened thus far addresses the substantive problems with the Page applications.

The report talks about the “historically strained” relationship between these two sets of lawyers, without laying out the role that the Carter Page review — and the Trump DOJ’s use of DOJ IG to punish his enemies generally — did to make things worse.

That tension plays out in the report. For example, Horowitz only provides recommendations to NSCLB and FBI’s OGC, not NSD. In each case, FBI is directed to coordinate with NSD, without the counterpart recommendation. The tension is particularly critical to something that DOJ IG cannot, therefore, recommend: That NSD have access to FBI case files, which would allow them to play a more proactive role in the vetting of FISA applications. It would also make NSD share in accountability for any problems that arise (as they should have with Page), though, and unsurprisingly NSD doesn’t want that.

NSCLB attorneys expressed their concern that although NSD attorneys assist agents in drafting the FISA applications submitted to the FISC, they do not share accountability when compliance incidents are reported to the FISC. Although NSCLB officials acknowledged the oversight role that NSD has related to FISA, they emphasized the need for FISA to be a team effort and not an adversarial relationship and stated their belief that the number of compliance incidents would be reduced if NSD would review the FISA-related documents housed in the FBI’s IT systems. However, according to NSCLB attorneys, NSD has expressed disinterest in ensuring FISA compliance on the front end and has said that it is the agent’s responsibility to identify in the first instance, anything that is necessary to be reported to the FISC. We were also told by NSCLB attorneys that NSD has said that it is concerned that an appearance of NSD attorneys having knowledge of the underlying documents would imply that they have full knowledge of all of the supporting documents, which would not be practicably feasible for them to have.

A senior NSD official that we spoke with told us that NSD has limited resources, and it does not have direct access to FBI systems.

NSD wants none of this accountability and DOJ IG can’t make them.

For all the tensions, though, it’s a fascinating report, as useful for providing both historical and bureaucratic background on this process as anything else. Much of this tension arises out of DOJ’s admitted parallel construction — using alternative sources for certain facts to protect sources and methods. There’s even a paragraph that describes NSCLB’s role as such (though not by name).

For instance, we were told that NSD relies on NSCLB to review documents such as search warrants and criminal complaint affidavits for law enforcement or other sensitivity concerns before they are filed with the court by prosecutors. When this process is not followed, it can become particularly problematic if NSCLB later finds that sensitive information was contained in the court filing. For example, if the FBI used a sensitive platform to obtain information, prosecutors may decide that a description of the platform is needed to support the search warrant or complaint. In such instances, NSCLB may ask prosecutors to anonymize that information. However, if NSCLB does not review the case agent’s draft affidavit in support of a search warrant or complaint before the agent provides it to the prosecutor, sensitive information may be exposed. Also, senior NSCLB officials told us that including an NSCLB attorney early in this process can provide an effective means of ensuring prosecutors have information necessary to support their case. Specifically, NSCLB can help identify which information may be difficult to use from a classification and sensitivity perspective and provide suggestions to obtain the information from an independent source without implicating sensitive techniques.

The report claims the particular roles of each side are not well-defined. I’m not convinced that’s the case, though. As described, NSCLB protects national security and the secrets that go along with that (including secret intelligence techniques). And NSD fulfills the needs of prosecutions as well as “protect[ing] FISA as a tool so the FBI can continue to use it.”

In one telling explanation,

NSCLB senior officials highlighted the fact that criminal prosecution is not necessarily the FBI’s aim in every national security investigation and that the FBI sometimes appropriately pursues investigations with the aim of disrupting threats or collecting intelligence.20

These are tensions, but they are not necessarily bad tensions. And it doesn’t seem like this report considers how this compares to the relationship between a prosecutor and a case agent where there are none of the national security (and classification) concerns.

In any case, the report attributes that tension for two radically different understandings about the standards involved in two FISA concepts, including one — material facts that must be disclosed to the FISA Court — that was at the core of the Carter Page case.

In the case of materiality, the FBI seems to be playing dumb (perhaps to avoid opening a whole historical can of worms given the aftermath of the Page IG Report).

The 2009 Accuracy Memorandum defined material facts as, “those facts that are relevant to the outcome of the probable cause determination.” The FBI had interpreted this standard as facts that are outcome determinative, or facts that would invalidate the legal determination. However, NSD had applied a broader standard than the FBI, with NSD’s interpretation of material facts being facts that are capable of influencing the requested legal determination. An NSD senior official told us that the FBI’s viewpoint was based on the FBI’s involvement in the criminal law enforcement arena where the threshold for materiality in a criminal search warrant is outcome determinative. This official also stated that most material errors reported to the FISC do not invalidate the legal determination, and that the FISC still expects for these types of errors to be reported to them.

Senior NSD officials stated NSD had applied the same standard for at least 15 years and NSCLB had known of NSD’s application of the standard because it was reflected in previous Rule 13 notices filed with the FISC. For example, in the OIG’s report on the FBI’s Crossfire Hurricane Investigation, NSD supervisors stated that “NSD will consider a fact or omission material if the information is capable of influencing the court’s probable cause determination, but NSD will err on the side of disclosure and advise the court of information that NSD believes the court would want to know.”41 Similarly, in a FISC filing on January 10, 2020, NSD referred to this statement in the OIG report while describing its oversight and reporting practices when errors or omissions are identified.42 However, senior NSCLB officials told us that NSCLB was first made aware of NSD’s interpretation of the materiality standard in the OIG’s Crossfire Hurricane Investigation report and NSD’s subsequent January 2020 FISC filing.43

In the case of the claimed differing understand of  querying techniques under 702 (in which, by my read, both sides were pretending this hasn’t dramatically changed as FISC became aware of how 702 collection was really used), NSD seems to engage in the knowing bullshit.

In contrast, NSD told us that the query standard has been the same since 2008. A senior NSD official stated that the FBI had a fundamental misunderstanding of the standard and that compliance incidents were not identified sooner because NSD can only review a limited sample of the FBI’s queries and NSD improved upon its ability to identify non-compliant queries over time.

I knew the standard the FBI was using. It is not credible that I knew what it was and NSD did not.

In both cases, this claimed disagreement seems to be an effort to avoid applying the standards adopted post-Page to the FISA approach (and not just on individualized orders) applied before then.

The report confirms something that had been obvious from heavily redacted sections of the last several 702 reauthorizations: FBI had been using 702 collection (and FISA collection generally) to vet potential confidential human sources.

For example, we were told disputes occurred related to queries conducted for vetting purposes.52 Specifically, according to the FBI, it was concerned that as a result of the change to the query standard it could no longer perform vetting queries on raw FISA information before developing a confidential human source (CHS). FBI officials told us that it was important for agents to be able to query all of its databases, including FISA data, to determine whether the FBI has any derogatory or nefarious information about a potential CHS. However, because of the implementation of the 2018 standard, the FBI is no longer able to conduct these queries because they would violate the standard (unless the FBI has a basis to believe the subject has criminal intent or is a threat to national security). According to the FBI, because its goal is to uncover any derogatory information about a potential CHS prior to establishing a relationship, many agents continue to believe that it is irresponsible to engage in a CHS relationship without conducting a complete query of the FBI’s records as “smoking gun” information on a potential CHS could exist only in FISA systems. Nevertheless, these FBI officials told us that they recognize that they have been unsuccessful when presenting these arguments to NSD and the FISC and, as noted below, they follow NSD’s latest revision of query standard guidance.

Using back door searches to vet informants is an approved use on the NSA and, probably, CIA side. In the FBI context, my understanding is that informants understand they’re exchanging Fourth Amendment protections as part of their relationship with the FBI. Perhaps if the FBI had simply made this public, it could have been an approved use. Instead, we’re playing all these games about the application.

The report describes — but doesn’t really address — how the tension between NSCLB and NSD undermined National Security Reviews which,

examine (1) whether sufficient predication exists for FBI preliminary and full investigations, (2) whether a sufficient authorized purpose exists for assessments, (3) whether tools utilized during or prior to the assessment are permitted, and (4) all aspects of National Security Letters issued by the FBI.

There was a huge backlog of these until NSD hurriedly closed a bunch of them in 2020, which is the kind of thing that when Bush did them with FISA tools in 2008 was itself a symptom. So, too, may be some policy memos that happened in Lisa Monaco’s first days and John Demers’ last ones.

The section I found to be most interesting (and one that DOJ IG could not or chose not to address in recommendations) pertains to the tension over declassification of material for prosecutions.

According to the FBI’s Declassification of Classified National Security Information Policy Guide, NSCLB must participate in the approval of discretionary declassification decisions concerning FBI classified information. NSCLB assists in ensuring that the declassification of either FISA derived material or other FBI classified information is: (1) necessary to protect threats against national security; (2) will not include classified materials obtained from foreign governments; (3) will not include classified materials obtained from other U.S. agencies (unless authorized by the originating agency); (4) will not reveal any sensitive or special techniques; and (5) will not adversely impact other FBI investigations.

[snip]

Despite the FBI’s limited support role, NSD and DOJ staff we spoke with told us that they believe NSCLB has involved itself inappropriately in discovery matters. For example, an NSD senior official told us that NSCLB has attempted to second guess discovery decisions made by prosecutors. This NSD official believed that NSCLB’s role is not to participate in the determination of how the prosecutors choose to protect a piece of classified information, but instead to identify information that is classified, its level of classification, and how a declaration from the owner of that information would explain to a court why the information presents a national security concern. According to this official, NSCLB may rightfully conclude the information is too sensitive to provide in discovery and, as a result, prosecutors may have to dismiss that case. However, we were told that discovery issues do not generally reach that point. We also were told by some AUSAs that they have had to remind NSCLB attorneys that AUSAs have the discovery obligations to courts and will make discoverability determinations.

An official from one USAO told us that, while it is understood that satisfying discovery obligations is the responsibility of the prosecutor, the FBI’s interest in protecting its equities may justify challenging a prosecutor’s discovery decisions. The official explained that such back and forth may be necessary to reach a balance between the needs of discovery and the protection of sensitive information; however, when the FBI’s role in the process extends into making assessments of what is discoverable it can slow the process down and necessitate the prosecutor asserting authority over discovery decisions.

[snip]

By contrast, senior NSCLB officials noted that several factors outside of NSCLB’s control can cause the declassification process to take a considerable amount of time. According to these officials, the FBI addresses the risk of disclosing information that could cause significant harm to the American public by using a thorough, deliberate process which can be impacted by the volume of information, the sensitivities involved, and the resources available to conduct a review. In defending NSCLB’s role in the discovery process, a senior NSCLB official expressed the view that AUSAs tend to err on the side of making material discoverable, even when it involves national security information, and do not appreciate how the disclosure of information may affect other FBI or USIC operations. This official told us that NSD often prefers to declassify all information that could be relevant, necessary, or discoverable to ease the prosecution of the case or the discovery process. .

This is, in my opinion, the description of what lawyers for an intelligence agency would do. That seems to be the role NSCLB is playing, for better or worse. In light of the cases described out of which the more specific tensions arise, I find the complaint that NSCLB is delaying discovery rather telling. If prosecutors choose to make a case that NSCLB believes would have been better handled via disruption, for example, or are entirely frivolous, such tensions are bound to surface. That said, if FBI’s General Counsel’s Office has been coopted people trying to protect sources and methods, NSD lawyers are going to look like the only ones guarding due process (though I’m sure they would with CIA’s lawyers, too).

There’s a lot of worthwhile observations in this report. But it’s hard to shake the conclusion that the most important takeaway is that DOJ cannot continue to have such asymmetry in the oversight that FBI and DOJ experience.

Share this entry

On the Belated Education of John Durham

/59 Comments/in , /by

In a filing on September 2 in the Igor Danchenko case, John Durham confirmed that Danchenko had been a paid FBI source from March 2017 through October 2020.

In March 2017, the FBI signed the defendant up as a paid confidential human source of the FBI. The FBI terminated its source relationship with the defendant in October 2020.

I had heard this — though not with the sourcing such that I could publish. Apparently it was news to the frothers, who’ve been wailing about it ever since. Here’s Margot at the Federalist Faceplant, Jonathan Turley, and Chuck Ross at his new digs at the outlet that first hired Christopher Steele. Here’s the former President during an obsequious Hugh Hewitt interview.

Danchenko’s status was implicit in a lot of what is public. Even absent the frothers doing any kind of journalism, or even critical thinking, what did they think this reference in Danchenko’s motion to dismiss meant?

The government had unfettered access to Mr. Danchenko for approximately four years following his first interview in January 2017, and not once did any agent ever raise concerns about the now purportedly contradictory post-call emails.

As I hope to show in a follow-up, it actually makes a lot of sense.

Meanwhile, in Danchenko’s response to that filing, he revealed that information he provided to the FBI was used in a memorandum supporting the opening of an investigation into Charles Dolan, one of Durham’s star witnesses against Danchenko. (Note, this reference stops short of saying that the FBI did open an investigation into Dolan, just that someone proposed doing so.)

[T]he Special Counsel ignores, and conceals from this Court, that Mr. Danchenko was interviewed dozens of times and during the course of those interviews, particularly when asked specific questions about Dolan (which was not often), Mr. Danchenko (1) told the FBI about the Moscow trips with Dolan, (2) told the FBI that Steele knew of Dolan, (3) told the FBI that not only was Dolan doing work with Olga Galkina but that Mr. Danchenko himself had introduced them, and (4) told the FBI that Dolan had connections and relationships with high-level Kremlin officials, including President Putin’s personal spokesperson, Dmitry Peskov. Indeed, when agents drafted a December 2017 communication in support of opening an investigation into Dolan, they included the information Mr. Danchenko provided them as support for opening the investigation. 3 [emphasis original]

This may not be the last surprise investigation we hear about. Back in the original filing on September 2, Durham argued he should be able to talk about the 2008 allegation that led to a counterintelligence investigation into Danchenko, in part, because (Durham predicted bitterly) Danchenko will likely raise investigations into others, plural, who will “feature prominently at trial.”

[T]he Government expects the defense to introduce evidence of FBI investigations into other individuals who the Government anticipates will feature prominently at trial. Thus, the introduction of the defendant’s prior counterintelligence investigation – should the defense open the door – does not give rise to unfair prejudice that substantially outweighs its probative value.

Effectively, Durham is arguing that if Danchenko points out that Durham’s witnesses should not be considered reliable based on suspicions they were working for Russia’s interests, then he should be able to point out that Danchenko was once similarly suspected as well. Durham also wants to point out that Dolan twice asserted that Danchenko might be a Russian spook, but also allegedly always knew of his role at Orbis — assertions that, in tandem, could actually hurt Durham’s case, given the subsequent disclosure that Dolan was investigated himself. Durham may not understand that, yet.

One of these people whose investigation Danchenko will raise at trial is undoubtedly Sergei Millian, whose cultivation of George Papadopoulos in exactly the same time period Danchenko claims to have believed he spoke to Millian was one of a number of things the FBI investigated starting in 2016.

Danchenko’s response to Durham’s demand that he be allowed to raise the 11-year old counterintelligence investigation into Danchenko (besides providing a somewhat different timeline) was basically to say, “Bring it!” He intends to raise that counterintelligence investigation himself, he claims. Note: Durham doesn’t note, but it is clear from the January interviews of Danchenko, that FBI interviewers probed Danchenko about that prior investigation in their very first interviews in 2017.

As noted, I hope to return to all this dizzying spy-versus-spy shit in a follow-up. By then we’re likely to have several more disclosures, plus some details about the known investigation into Millian.

This all shows there was not a shred of prosecutorial discretion exercised before charging Danchenko. Even if Danchenko had done grievous harm to the US, no sane prosecutor would have charged this case with such easily impeached witnesses. Even Durham now seems to understand his materiality claims are flimsy. And yet, to prove a five year old false statements allegation, he has forced the government to declassify a whole range of sensitive material, including this detail about Dolan.

And that process apparently continues to be a struggle for Durham (as I predicted it would be).

Consider the timeline implied by Danchenko’s footnote about the Dolan revelation. Danchenko claims that he only just learned about the Dolan investigation opening memo.

3 The December communication is highly exculpatory with regard to the essential element of materiality and it is not clear why it was only produced 30 days from the start of trial. It was produced as Jencks material (also late by the terms of the Court’s Order requiring all Jencks to be produced by September 1) but is obviously Brady evidence. The defendant understands that the CIPA procedures may have slowed the production of certain categories of discovery but given the Indictment’s allegations about the materiality of Mr. Danchenko’s failure to attribute public information to Dolan, the production of this specific document should have been a priority for declassification.

When Danchenko says that Counterintelligence Information Procedures Act may have slowed the production of this, he’s suggesting (charitably) that someone at DOJ took a long time to release this information to Durham and that Durham had no control over that process. That’s another thing I predicted in this post about how CIPA would affect this case: “it can end up postponing the time when the defendant actually gets the evidence he will use at trial. So it generally sucks for defendants.”

The trial starts on October 11. This footnote suggests that Danchenko only received this information 30 days before trial, so around September 11, in the week before he filed this. Whenever it was disclosed, if he received it after the September 1 deadline, that would make it too late for the September 2 deadline for Danchenko’s own motion to dismiss. It would put it after Durham’s September 2 filing — the one bitching about how much of the trial Danchenko will use to focus on the investigations into witnesses, plural, against him — which means the plural reference may not have incorporated Dolan. Danchenko would have learned about this over a month after his own deadline to lay out what classified information he intended to use at trial, and at least a week after the August 30 CIPA conference, at which the two sides debated about what classified information Danchenko should be allowed to use at trial.

It also comes after a series of delays in Durham’s classified discovery. In May, I described what was publicly billed as the last one.

It’s that record that makes me so interested in Durham’s second bid to extend deadlines for classified discovery in the Igor Danchenko case.

After Danchenko argued he couldn’t be ready for an April 18 trial date, Durham proposed a March 29 deadline for prosecutors to meet classified discovery; that means Durham originally imagined he’d be done with classified discovery over six weeks ago. A week before that deadline, Durham asked for a six week delay — to what would have been Friday. Danchenko consented to the change and Judge Anthony Trenga granted it. Then on Monday, Durham asked for another extension, this time for another month.

When Durham asked for the first delay, he boasted they had provided Danchenko 60,000 unclassified documents and promised “a large volume” of classified discovery that week (that is, before the original deadline).

To date, the government has produced over 60,000 documents in unclassified discovery. A portion of these documents were originally marked “classified” and the government has worked with the appropriate declassification authorities to produce the documents in an unclassified format.

[snip]

Nevertheless, the government will produce a large volume of classified discovery this week

This more recent filing boasts of having provided just one thousand more unclassified documents and a mere 5,000 classified documents — for a case implicating two known FISA orders and several past and current counterintelligence investigations.

To date, the Government has produced to the defense over 5,000 documents in classified discovery and nearly 61,000 documents in unclassified discovery. The Government believes that the 5,000 classified documents produced to date represent the bulk of the classified discovery in this matter.

Danchenko waited six weeks and got almost nothing new.

But then on August 16, Durham filed a supplemental CIPA filing, suggesting there were more substitutions of classified information he wanted Judge Anthony Trenga to approve (a supplemental filing is not, by itself, unusual).

The point is, for months, Durham kept saying he’d have all the secrets delivered to Danchenko by his new deadline in June, promise, and then he dropped this bombshell on Danchenko just weeks before trial.

In the August 29 hearing on all this, Judge Trenga deferred most CIPA decisions until after Danchenko files a new CIPA filing on September 22 — so if any of this remains classified, Danchenko still has a chance, with just days notice, to argue he needs it at trial. They’ll fight about these issues again on September 29.

But given Durham’s performance in the Sussmann case, it’s not entirely clear these missed classified deadlines are DOJ’s fault. After all, Durham never even asked DOJ IG for relevant discovery in Sussmann’s (and therefore, we should assume, this) case until after Sussmann was charged. He didn’t investigate Rodney Joffe’s true relationship with the FBI and other agencies until Sussmann asked him to. He didn’t ask Jim Baker for his own iCloud content until early this year, after belatedly rediscovering Baker phones he had been told about years ago.

It’s not just his belated request for information from DOJ IG that we know to have affected this case too. Durham also has never interviewed George Papadopoulos — not before he went on a junket to Italy chasing Papadopoulos’ conspiracy theories, and not since. Thus, Durham never tested whether Millian’s cultivation of Papadopoulos undermines his evidence against Danchenko — and it does, obviously and materially.

Because of Durham’s obvious failures to take the most basic investigative steps before charging wild conspiracy theories, there are several possible explanations why he’s only providing Danchenko news of this Dolan memo a month before trial:

  1. Someone tried to hide this from Danchenko and ultimately was overridden. If that’s the explanation, it makes Andrew DeFilippis’ August departure from the team and, according to the NYT, DOJ, all the more interesting.
  2. DOJ delayed the time until they let Durham disclose this because of some sensitivity about the investigation. Recall that Dolan has ties to Putin spox Dmitri Peskov, who was sanctioned earlier this year, followed by his family.
  3. Durham didn’t know.

The last possibility — that Durham had no fucking clue that one of his star witnesses had been (at least considered) for investigation — is entirely plausible. It’s entirely consistent with what we saw in the Sussmann case, though worse even than that case in terms of timing.

Durham came into this investigation treating the conspiracy theories of Papadopoulos and Trump as credible. He seems to have believed, all along, that Sergei Millian was a genuinely aggrieved victim and not someone playing him, for at least a year, for a fool. He seems to have decided that he knew better than FBI’s experts about who had credibility about Russia and who didn’t. Along the way he forced the FBI to cut its ties with Joffe and — given the October 2020 cut-off of Danchenko’s ties to the FBI, probably Danchenko as well. He did all this with a lead prosecutor who believed it was problematic for DARPA to investigate the Guccifer 2.0 persona used by the GRU.

Durham walked into this investigation believing and parroting, without first testing, Trump’s claims that the Russian investigation was abusive. Based on those beliefs, he chased all manner of conspiracy theory in an attempt to allege pre-meditation and malice on the part of Hillary and everyone else involved with the dossier. His Sussmann prosecution ended in humiliating failure. This prosecution, win or lose, may do worse for Durham’s project: it may reveal unknown details about Russian efforts to tamper in 2016, efforts that harmed both Republicans and Democrats alike.

The Durham prosecutions have been shitshows and undoubtedly a disaster for those targeted. It’s not yet clear what will happen with the Danchenko trial (or even whether it will go to trial; given that CIPA issues still have to be resolved, there’s still a chance Durham will have to dismiss it rather than going to trial). Durham will still write a report that may try to resuscitate his conspiracy theories that were disproven in the Sussmann trial.

But thus far, the actual record of the Durham investigation shows that when actually bound by the rules of evidence, when actually obligated to dig through DOJ’s coffers to discover what DOJ learned as it tried to understand Russia’s intervention in 2016, reality looks nothing like the conspiracy theories Durham has chased for three years.

John Durham’s education process has been a painful process for all personally involved (except maybe Sergei Millian, gleefully dicking around from afar). But along the way he’s debunking many of the conspiracy theories he was hired to sustain.

Update: Chuck Ross is outraged that I suggested his boss had paid for Steele (and lying that I said Paul Singer paid for the dossier, which I pointedly did not say). It is true that the payment for Fusion GPS’ Trump project had shifted to Perkins Coie before Steele first sent Danchenko to Russia.

It’s also true that, based on length of project, Ross’ current boss paid for much of Nellie Ohr’s work on Trump’s ties to Russia, which includes some of Fusion’s early work on Paul Manafort and Felix Sater, and possibly early work on Millian (she continued to work on Millian until she left Fusion).

And since Chuck is so upset, I should point out that his former co-columnist, Oleg Deripaska, also reportedly paid for Steele’s work (in that case, research on Paul Manafort), though also through the cut-out of a law firm.

Share this entry

“Desperate at Best:” Igor Danchenko Starts Dismantling John Durham’s Case against Him

/21 Comments/in , , /by

Since he was charged on November 3 last year, Igor Danchenko and his legal team have been virtually silent, mostly watching as John Durham’s team repeatedly failed to meet classified discovery dates.

But as we draw closer to the October 11 trial date, there has been more activity.

On August 1, there was a hilariously short status conference, all of four minutes, where Durham himself showed up. On August 21, Andrew DeFilippis — the most abusive of Durham’s prosecutors — dropped off the docket. Last week, Durham’s team asked for and got permission to file their motions in limine under seal — perhaps in an effort to avoid the inflammatory claims they made during the Michael Sussmann trial. Even the Classified Information Procedures Act (CIPA) conference, at which the two sides argued over how much classified information Danchenko needs at trial and whether the government can substitute information to make it less sensitive, seems to have ended inconclusively. Afterwards, Judge Anthony Trenga deferred decision until September 29, in part because the two sides are seemingly still trying to work things out amicably.

Before the hearing, the parties had successfully resolved all issues as to many of the listed documents and during that hearing, the parties agreed to engage in further discussions and efforts with respect to the remaining documents at issue, including Defendant’s willingness to withdraw his notice as to certain listed documents and the Government’s willingness to review the classified nature of certain listed documents and provide summaries with respect to other listed documents, following which Defendant will advise the Court concerning what further interest, if any, he has in using the listed documents at trial in light of the totality of the information provided to him by the Government.

In short, it has lacked all the pre-trial drama of the Sussmann case (perhaps because DeFilippis so badly overstepped, and still lost, in the Sussmann case).

But things may about to get interesting.

In a motion to dismiss the indictment filed Friday, Danchenko calls one of the government’s arguments (pertaining to the four Sergei Millian-related charges) “desperate at best.” The bases Danchenko challenges the indictment against him largely map some of the problems I laid out here: The questions FBI asked are not ones about the topics Durham has charged and Danchenko’s answers — he convincingly argues — were true.

For nearly a year, from January 2017 through November 2017, Mr. Danchenko sat through numerous voluntary FBI interviews and provided hours of truthful information to the government. Four years later, Special Counsel John Durham returned an indictment that alleges Mr. Danchenko knowingly made false statements about two matters when he: (1) acknowledged to the FBI that he talked with PR Executive-1 about issues “related” to the content of the Company Reports but stated that he did not talk about “specific” allegations contained in one of the reports; and (2) made four consistent statements to the FBI about his equivocal “belief” that an anonymous man who called him may have been Chamber President-1. These equivocal and ambiguous answers were prompted by fundamentally ambiguous questions, are literally true, and are immaterial as a matter of law.

Further, the government’s attempt here to stretch § 1001(a)(2) to a defendant’s equivocal and speculative statements about his subjective belief appears to be a first. And it would be a first for good reason. In order to meet its burden of proof in a case predicated on a subjective belief the government would need to prove not whether something did or did not happen but that the defendant did not truly subjectively believe what he said happened or did not happen. That would be a heavy burden in any case and it is an insurmountable one here.

Danchenko also argues (as Sussmann did) his claimed lies could not be material, in this case because Durham’s materiality claim is based in the influence of the Steele dossier, which (as Danchenko notes) he didn’t even know about, much less write.

Significantly, the indictment does not allege that Mr. Danchenko’s allegedly false statements themselves were material, but instead alleges only that the Company Reports, and the information contained in those reports, some of which allegedly came from Mr. Danchenko, were material.

In my series of posts on Danchenko’s case, I even missed some problems with the indictment. I had noted, for example, that Durham entirely misrepresented the question Danchenko was asked about Chuck Dolan on which Durham built one of the false statement charges. Durham claimed the FBI asked Danchenko if Dolan was a source for Danchenko. As I noted and as Danchenko does in this MTD, the question was actually whether Dolan was another sub-source directly for Christopher Steele.

But Danchenko notes two more problems with the charge.

First, he was asked whether Dolan and he “spoken” about the matters in the dossier; and to prove they did, Durham provides an email. 

Count One alleges that Mr. Danchenko made a false statement when “he denied to agents of the FBI that he had spoken with PR Executive-1 about any [specific] material contained in the Company Reports, when in truth and in fact, and as the defendant well knew, PR Executive-1 was the source for an allegation contained in a Company Report dated August 22, 2016 and was otherwise involved in the events and information described in the reports.”

[snip]

For “proof” of the alleged false statement under this charge, the indictment relies on an email exchange between PR Executive-1 and Mr. Danchenko on or about August 19-20, 2016.

More problematic still, in context, the question was about whether Danchenko and Dolan had spoken about allegations that remained in the dossier after Steele wrote them up, a conversation that (because neither had seen Steele’s reports in real time) could only have taken place after January 11, when BuzzFeed published the dossier.

Next, when asked whether Mr. Danchenko and PR Executive-1 ever “talked . . . about anything that showed up in the dossier [Company Reports],” Mr. Danchenko responded, “No. We talked about, you know, related issues perhaps but no, no, no, nothing specific.” Indictment at 18 (emphasis added). The most reasonable reading of this question is whether Mr. Danchenko and PR Executive-1 talked about the Company Reports themselves after they were published. Mr. Danchenko’s answer to this question was literally true because he never talked to PR Executive-1 about the specific allegations contained in the Company Reports themselves, but they did talk about issues “related” to the allegations later published in those reports. Moreover, the specific question posed to Mr. Danchenko was whether Mr. Danchenko and PR Executive-1 “talked” about anything in the dossier. That part of the question was not ambiguous and, importantly, FBI Agent1 never asked whether Mr. Danchenko and PR Executive-1 had ever exchanged emails about information that showed up in the dossier. For that reason alone, evidence that PR Executive-1 allegedly emailed Mr. Danchenko about information contained in the Reports does not make Mr. Danchenko’s answer false

In arguing that his comments about Dolan weren’t material, Danchenko later confirms something I suspected: the FBI wasn’t much interested in the dossier report at the heart of Durham’s purported smoking gun evidence.

[T]he government apparently never even asked Mr. Danchenko about the specific information regarding Campaign Manager-1 that was contained in the relevant Company Report.

Remember: Durham tried to make this exchange stand in for the pee tape report (it worked with the press, too!!). But he didn’t actually charge anything pertaining to the pee tape.

Danchenko similarly notes that the government never asked Danchenko about something else Durham treated as a smoking gun: Emails from after the time, in July 2016, when Danchenko failed to meet someone he believed to be Sergei Millian, one of which Danchenko turned over himself in his first meeting with the FBI.

Danchenko was never asked about that email because it did nothing to clarify whether Chamber President-1 had been the anonymous caller and because it was, in truth and in fact, ultimately immaterial to the FBI’s investigation.

And with regards the Millian questions, Danchenko notes that Durham doesn’t even argue his responses were material. He instead argues the dossier was (though I think Durham will rebut this one).

As an initial matter, the indictment itself fails to even allege that Mr. Danchenko’s statements to the FBI were material. Instead, the indictment argues that the Company Reports created by U.K. Person-1 prior to Mr. Danchenko’s statements to the FBI were material:

(1) the FBI’s investigation of the Trump Campaign relied in large part on the Company Reports to obtain FISA warrants on Advisor-1, (2) the FBI ultimately devoted substantial resources attempting to investigate and corroborate the allegations contained in the Company Reports, including the reliability of Danchenko’s sub-sources; and (3) the Company Reports, as well as information collected for the Reports by Danchenko, played a role in the FBI’s investigative decisions and in sworn representations that the FBI made to the Foreign Intelligence Surveillance Court throughout the relevant time period. Indictment at 4.

The materiality of the Company Reports, if any, is irrelevant to the materiality of the statements that Mr. Danchenko later made to the FBI and cannot provide a basis for a false statement charge against Mr. Danchenko. 7

He notes, as I did, that his answers in interviews after the first two Carter Page applications could not have been material to those applications.

Motions to dismiss rarely work, and this one is unlikely to either (though I think Danchenko’s argument with respect to the Dolan charge is particularly strong).

But if Durham adheres to the same sloppiness they did in the Sussmann case, the MTD may be useful to Danchenko for other reasons, besides framing the case for Judge Trenga. MTDs are supposed to rely entirely on what is charged in the indictment. But in addition to the observations that Danchenko was asked neither about the Dolan email Durham has made central to the indictment nor Danchenko’s own emails after the failed July 2016 meeting in NYC, Danchenko’s argument is also premised on there not being further evidence to substantiate what appears on the face of the indictment. For example, if Durham had testimony from Dolan about conversations with Danchenko about the pee tape, Danchenko might not have argued as he has. And Danchenko explicitly states that the indictment does not claim a July 2016 phone call Danchenko believed to be from Millian did not happen — a weakness in the indictment I raised several times.

Notably, the indictment does not allege that Mr. Danchenko did not receive an anonymous phone call in or about late July 2016. Instead, the indictment alleges only that Mr. Danchenko “never received such a phone call or information from any person he believed to be Chamber President-1[.]” The alleged false statement is that Danchenko did not truly believe that the anonymous caller was Chamber President-1. The indictment also alleges that Mr. Danchenko “never made any arrangements to meet Chamber President-1.” However, Mr. Danchenko never stated that he made such arrangements. Rather, he told the FBI that he arranged to meet the anonymous caller, but the anonymous caller never showed up for the meeting.

Nine months into discovery, Danchenko would know for a fact if Durham had conclusive proof that he didn’t get a call. He’d probably know the substance of Dolan’s testimony against him.

But in response to an attack on the shoddiness of this indictment, Durham may well — as he did with Sussmann — talk about what they would prove at trial, not what was in the indictment. If Durham has proof the call didn’t happen or thinks he can argue it, he may well reveal it in response. In the Sussmann case, anyway, Durham didn’t have the goods.

And along the way, Danchenko has nodded to where this will go if the indictment is not dismissed. Most notably, Danchenko asserts, as fact, that the FBI investigation into Millian long preceded his interviews.

Indeed, the FBI was already investigating Chamber President-1’s potential involvement with Russian interference efforts long before it had ever interviewed or even identified Mr. Danchenko.

The scope and results of the investigation into Millian is presumably one of the classified details that Danchenko has argued (correctly) he needs at trial, and if he has, then Trenga will be quite familiar with the substance of the evidence. If Danchenko does make an argument about the folly of relying on Millian as a key witness, then Danchenko’s trial may be even more of an indictment of the Durham investigation than Sussmann’s was.

In fact, early in this motion, Danchenko makes the contrast I keep making: between Mueller’s substantive results and Durham’s failure thus far to undermine that substance with shoddy false statements indictments.

Between January and November 2017, Mr. Danchenko not only answered every question to the best of his ability, even when asked to speculate, but also provided emails and contact information for other potential sources of information in the Reports. The investigation into the Reports was ultimately completed by Special Counsel Robert S. Mueller, III, in or about November 2017 and the Special Counsel’s office closed its entire investigation into possible Trump/Russia collusion in March 2019. Approximately thirty-four individuals were charged by Mueller’s office, including several for providing false statements to investigators. Mr. Danchenko was not among them. To the contrary, not only did investigators and government officials repeatedly represent that Mr. Danchenko had been honest and forthcoming in his interviews, but also resolved discrepancies between his recollection of events and that of others in Mr. Danchenko’s favor.

In or about April 2019, and just one month after Mueller had concluded his investigation, then President Trump’s Attorney General, William Barr, tapped John Durham, the U.S. Attorney for the District of Connecticut, to review the origins of the Russia investigation and efforts by law enforcement to investigate the Trump campaign. Just prior to the end of former President Trump’s term, Barr appointed Mr. Durham Special Counsel to carry out his investigation. Through the instant indictment, the Durham Special Counsel’s Office now claims to have uncovered false statements made by Mr. Danchenko that the previous special counsel did not, despite relying substantially on the same evidence, the same statements, and the same agents involved in the Mueller investigation.

While he doesn’t say it explicitly, in several places Danchenko makes clear that both Mueller and Michael Horowitz will affirm that, for years, Danchenko was consistently viewed as candid and his candid views were material to both those investigations.

And because Durham is now claiming otherwise, based off issues that weren’t even of interest to investigators, Durham risks putting himself on trial in October.

Share this entry

“Something Like This Has 0 Repercussions if You Mess Up:” John Durham Debunked the Alfa Bank Debunkery

/67 Comments/in , , /by

As you know, John Durham failed spectacularly in trying to use a false statement charge against Michael Sussmann to cement a wild conspiracy theory against the Democrats.

But Durham did succeed in one thing (though you wouldn’t know it from some of the reporting from the trial): He utterly discredited the FBI investigation into the Alfa Bank allegations. Lead prosecutor Andrew DeFilippis even conceded as much in his closing argument.

Now, ladies and gentlemen, you have heard testimony about how the FBI handled this investigation. And, ladies and gentlemen, you’ve seen that the FBI didn’t necessarily do everything right here. They missed opportunities. They made mistakes. They even kept information from themselves.

That’s a fairly stunning concession from DeFilippis. After all, DeFilippis asked the guy who was responsible for some of the worst failures in the investigation, Scott Hellman, to be his expert witness, even though Hellman, by his own admission, only “kn[e]w the basics” of the DNS look-ups at the heart of the investigation. Along with Nate Batty, Hellman wrote an analysis of the Alfa Bank white paper in less than a day that:

  • Misstated the methodology behind the white paper
  • Blew off a reference to “global nonpublic DNS activity” that should have been a tip-off about the kinds of people behind the white paper
  • Falsely claimed that the anomaly had only started three weeks before the white paper when in fact it went back months
  • Asserted that there was no evidence of a hack even though a hack is one of the hypotheses presented in the white paper for the anomaly at Spectrum Health (Spectrum itself said the look-ups were the result of a misconfigured application)

Later testimony showed that, after speaking to Hellman and before even checking whois records, the Chicago-based agent who had a lead role in the investigation told a supervisor that “we’re leaning towards this being a false server.”

Within hours, Miami-based agents had confirmed with Cendyn that was false.

In spite of being so egregiously misled from the start by the guys in Cyber, agent Curtis Heide testified in cross-examination by Sussman’s attorney, Sean Berkowitz, that Hellman’s analysis was one of the four things that he believed supported a finding that the anomaly was not substantiated.

Q. Okay. I think near the end of your examination by Mr. Algor he questioned you about your basis for concluding that there was — that the allegations were unsubstantiated. And I think you gave four reasons. I’m going to run through them. If there’s more, that’s okay. Number one, you said the assessment done by Agents Hellman and Batty. Correct?

A. Yes.

Q. Two, the review of the logs. Correct?

A. Yes.

Q. Three, the Mandiant conclusion. Correct?

A. Yes.

Q. And four, the discussions with Spectrum Health about the TOR node. Correct?

A. Yes.

Q. Anything else that you can recall, sir, as to why it was that your investigation, or rather the investigation that you oversaw, suggested that the allegations were unsubstantiated?

A. The only other thing I can think of would be my training and experience with — relating to Russia and cyber investigations.

Q. And is there anything in particular about that that you recall today?

A. With respect to the white paper, it didn’t — when I read through it initially, I had several questions, and it didn’t appear to be consistent with Russian TTPs.

Another thing Heide relied on was the analysis from Mandiant, which Alfa Bank hired to investigate after NYT reached out. According to Franklin Foer’s story, Lichtblau reached out to Alfa on September 21, after Sussmann had given the FBI a heads up but before the FBI asked Lichtblau to hold the story on September 26, so in the window when the FBI had a chance — but failed — to protect the investigation.

One of the truly insane parts of this investigation, by the way — which was conducted entirely during the pre-election window when overt actions were prohibited — was that FBI big-footed to Cendyn and Listrak before sending NSLs to them. And by that point, Alfa Bank was calling the FBI.

A report that was not explained amid the primary resources from the investigation, but which was concluded by October 3, reveals that Chicago’s conclusion was almost entirely based on what Alfa told the FBI and Mandiant.

There was nothing in the case documentation until a 302 for a March 27, 2017 interview done in association with Alfa’s 2017 claims of spoofed DNS traffic (the interview may have been done with Kirkland and Ellis) that documented that, when Mandiant arrived the previous year to investigate, there were no logs to investigate.

Indeed, Heide testified on cross-examination that he had never learned of that fact. At all.

Q. And were you aware, while you were doing the investigation, that Mandiant, when it went to talk to AlfaBank to look into these allegations, did not have any historical data, that Alfa-Bank did not provide any historical data to Mandiant? Did you know that?

A. No

We now know that at a time when “Executives at the highest level of ALFA BANK leadership” had been hoping to “exonerate them[selves]” in 2017, Petr Aven had already started acting on specific directives from Vladimir Putin, including trying to open a back channel to Trump.

Plus, at least as far as Listrak could determine, while the marketing server had sent materials to Spectrum, it had never sent anything to Alfa Bank. The stated explanation that this was spam, then, conflicts with what FBI was seeing in the logs.

As for Spectrum — another of the reasons Heide pointed to — there’s no evidence of anyone reaching out to them (as compared to interactions with agents in Philadelphia and Miami who reached out to Listrak and Cendyn, respectively).

It’s true that the anomaly at Spectrum was not a Tor node (something that researchers came to understand themselves around the time Sussmann shared the allegations with the FBI). But it’s also true that, per Cendyn (which only looked back a month), the identified IP address at Spectrum was reaching out to the Trump server.

The IP address in question showed up in traffic that may be associated with Chinese hacking.

This then might have corroborated the hypothesis, from the white paper, of a hack of Spectrum, but by this point, Hellman had long before decided there was no evidence of a hack and this was, “just garbage.”

That leaves the logs, Heide’s fourth reason for believing FBI had debunked the Alfa Bank allegations. As far as the logs in question, former agent Allison Sands (who was assigned the investigation as a brand new case agent) told one of the tech people on September 26 that, “the end user [possibly Cendyn] is willing to provide logs but they dont have what we need.” Cendyn did share details of their own spam filter, which wouldn’t address the DNS look-ups themselves.

Then, on October 12, Sands told Heide that,

the ‘logs’ we got from Listrak were not network logs

they basically just confirm that trump org is one of their email clients, but they dont show destination email addresses or IPs or anything that we can use to[ ]determine any communications

[snip]

it was two excel spreadsheets

that was all we got

The FBI did get something. Sands testified that the FBI obtained upwards of 600,000 records (she described obtaining records from Cendyn, Listrak, and GoDaddy, but not Spectrum or Alfa Bank). But it’s not clear how useful those records really were. There’s a reference to the “take” elsewhere (see below), and redacted entries that look like intelligence targeting, plus a reference to an OGA partner reporting “no attempts.” (Here’s a reference to the OGA analysis that is redacted in other versions of the same email chain.) So it seems any useful logs came from another agency. But if that’s right, it would be targeted overseas.

In trial testimony, Sands described that her task was to prove that the allegation wasn’t true, not to explain what the anomaly was.

I knew still I had to rebuild from scratch and prove that this allegation wasn’t true.

In real time, too, she saw her task as disproving that emails had been shared, not even disproving that covert communication had occurred.

I have a few more logs to definitely prove there are no emails, and then Im putting it to bed

That’s a particularly problematic description given that the FBI had been told via other channels that there was some activity reflecting more than DNS look-ups.

That leaves, according to Heide’s judgement, just the observation that the DNS traffic was not consistent with known Russian techniques. Newbie agent Sands said something similar to Chris Trifiletti, Joffe’s handler and apparently sensitive for some other reasons. In response, he mused about whether Russia was “trying other things now that look more non traditional.”

We don’t know the answer to that, because the FBI didn’t try to figure it out.

Scott Hellman, the cyber agent who insisted at every opportunity he got that this was garbage was wrong about how long the anomaly had lasted, but he was right about one thing. On October 4, he advised newbie agent Sands that,

any chance you get to work something like this that truly has 0 repercussions if you mess it up ….take those opportunities

He did mess it up. It wasn’t just his own analysis; his repeated insistence that this was “garbage” appears to have made all the other investigators less careful, too. Six years later, we’re still no closer to understanding what happened.

Hellman was right about facing “zero repercussions if you mess it up.” By all appearances, he’s one of the few people who escaped any consequences for trying to investigate Russia in 2016. We know that several people — including Jim Comey, Andrew McCabe, Peter Strzok, and Bruce Ohr — were fired for their efforts to investigate Russia. We learned at the trial that Ryan Gaynor was threatened with criminal investigation for not answering questions the way Andrew DeFilippis wanted. Curtis Heide remains under FBI Inspection Division investigation for things he did in 2016. Rodney Joffe was discontinued as an FBI informant, according to him, at least, because he refused to cooperate with Durham’s investigation. Everyone who actually tried to investigate Russia in 2016 has faced adverse consequences.

But Hellman appears to have suffered none of those adverse consequences for fucking up an investigation into a still unexplained anomaly. On the contrary, he’s been promoted; he’s now a Supervisory Special Agent, leading a team of people who will, presumably, similarly blow off anomalies that might be politically inconvenient to investigate.

That’s the lesson of the Sussmann trial then: The only people who face zero consequences are the ones who fuck up.

Update: Corrected spelling of Hellman’s last name. Added Comey and McCabe to the list of those fired for investigating Russia. Removed Lisa Page–she quit before she was fired. In this podcast, Peter Strzok said that all FBI agents named in the DOJ IG Report are still under investigation.

Update: All the links to exhibits should be live now.

Update: Added detail that Listrak says Trump never sent marketing mail to Alfa Bank.

Timeline

I’ve put (what I believe are) all the exhibits about the FBI investigation below.

These times are surely not all correct. Durham consistently shared evidence without marking what time zone the evidence reflected. Importantly, some, but probably not all of the FBI Lync messages reflect UTC time; where I was fairly certain, I tried to reflect the time in ET, but in others, the timeline below doesn’t make sense (I’ll keep tweaking it). Some of the emails reflect the Chicago time zone.

September 19, 2:00PM: Sussmann Meeting

September 19: Priestap notes

September 19: Anderson notes

September 19, 3:00PM: Strzok accepts materials

September 19, 4:31PM: Gessford to Pientka: Moffa with info dropped off to Baker

September 19, 5:00PM: Sporre accepts materials

September 20, 9:30AM: Nate Batty to Jordan Smith: A/AD has two thumb drives.

September 20, 12:29PM: Batty accepts materials

September 20, 4:54PM: Batty and Hellman re analysis

September 21, 8:48AM: Batty to Hellman: at least look at the thumb drives [Batty Lync]

September 21, 4:25PM: Pientka Lync to Heide: People on 7th floor fired up about this server

September 21, 4:46PM: Batty to Heide and others: initial assessment

September 21, 1:10PM [time uncertain] Sands to Pape: Director level interest

September 21, 4:57PM: Norwat to Todd: Not a cyber matter

September 21, 5:06PM: Todd to Heide, cc Pientka

September 21, 5:52PM: Pientka to Heide: Nat [sic] Batty ha the thumb drives

September 22, 4:58AM: Hubiak to Heide: Let me know if you need anything from PH

September 22, 8:09AM: Todd to Marasco [noting thumb drives came from DNC, suggesting tie to debate]

September 22, 8:33AM: Pientka to Heide: Less than 24 hours to investigate, determine nexus, before losing traffic, watched by Comey

September 22, 9:30AM: Pientka to Moffa: Cyber, ugh. Read first email.

September 22, 9:59PM: Hellman to Heide: can you talk on link

September 22, 10:23AM: Marasco to Pientka: FYI

September 22, 11:13AM: Sands to Hubiak: Suspect email domain hosted on Listrak server — if you can help out with a knock and talk it would be great.

September 22, 11:14AM: Baker to Comey and others: Reporter is Lichtblau

September22, 11:34AM: Hubiak to Sands: Will start working on this now

September 22, 12:02PM: Batty to Wierzbicki: We think it’s a setup

September 22, 12:10PM: Heide to Pientka: We’re leaning to this being a false server.

September 22, 2:00PM: Pientka to Hubiak: Thanks for all your efforts. The CROSSFIRE HURRICANE Team greatly appreciates you running this to ground.

September 22, 4:22PM: Sands to all: open full investigation, summary of Hellman’s conclusions [OGA partner targeting Alfa?]

September 22, 5:33PM: Heide to Pientka: it’s a legit domain

September 22, 4:53PM: Sands to all: Cendyn agrees to cooperate, legit mail server

September 23, 8:26AM: Sands to Hubiak: Cendyn willing to cooperate and provide logs

September 23, 1:09PM: Heide to Sands: once we get that case opened, let’s cut a lead to the MM division requesting assisting with the interview, etc.

September 23, 1:53PM: Sands to others: Cendyn, as of this morning no longer resolves, picture of Barracuda spam filter

September 23, 4:04PM: Heide to Gaynor: Cyber’s review

September 23: EC Opening Memo [without backup]

September 26: Gaynor notes

September 26: Intelligence Memo

September 26, 8:02AM: Lichtblau to Kortan: You know what time we’re meeting?

September 26, 9:29AM: Kortan to Lichtblau: Baker’s tied up until later this afternoon.

September 26, 10:02AM: Lichtblau to Kortan: planning to bring Steve Myers

September 26, 10:15: Heide to Pientka: We want to interview the source of the whitepaper?

September 26, 12:09: Kortan to Baker and Priestap: some kind of recap later today?

September 26, 12:29: Sands to Hubiak: I’m writing a justification for an NSL to GoDaddy

September 26, 4:19PM: Heide to Shaw: apparently it’s going to hit the times?

September 26, 4:55PM: Heide to Hellman: We think it’s a bunk report still…

September 26, 5:02PM: Soo to Sands: searching current and historical lists of Tor exit nodes

September 26, 6:20PM: Sands to all, cc Heide: Spectrum hit at Cendyn, NSLs for Listrak, GoDaddy, redacted, Tor results

October 2, 12:02PM: Grasso to Wierzbicki: Two IP addresses

October 2, 7:02PM: Heide to Hellman: Check this out….

October 3: Tactical Product

October 3: Communications Exploitation

October 3, 1:48PM: Gaynor to Heide: Did white paper start with person of interest?

October 3, 2:49PM: Heide to Gaynor and Sands: Interview source

October 3, 3:00PM: Wierzbicki to Gaynor, cc Moffa: I agree with Heide, interview source

October 4: Kyle Steere to Wierzbicki and Sands: Documenting contents of thumb drive

October 4, 8:26AM: Sands to Hellman: 2 random IP addresses we got from tom grasso

October 4, 8:28AM: Sands to Hellman: we got a report on the Alfa Bank side that they also think this is nothing

October 4, 8:43AM: Hellman to Sands: any chance you get to work something like this that truly has 0 repercussions if you mess it up ….take those opportunities [alt version]

October 4, 10:00AM: Gaynor to Wierzbicki et al, cc Moffa: We need to know what we can learn from the logs [CT version]

October 4, 9:50PM: Grasso to Sands: SME who can help give context to the data we discussed

October 4, 11:08PM: Sands to Grasso: Sounds great.

October 5, 1:20PM: Trifiletti to Sands: i reminded him once more that he has never proceeded with anything when he wasnt absolutely sure

October 5, 1:33PM: Hosenball request for comment

October 5, 3:02PM: Strzok to Gaynor, forwarding Hosenball with Mediafire package

October 5, 4:08PM: Sands to Trifiletti: We need to speak to Dave dagon now too

October 5, 5:07PM: Sands to all: Update on CHS conversation — redacted explanation for why Alfa changed

October 5, 6:58PM: Grasso to Sands: I told Dagon that you would be able to protect his identity so that his name is not made public

October 6: Gaynor notes and drawing [alt version, more redacted]

October 6, 4:20PM: Materials to storage

October 6, 4:28PM: Christopher Trifiletti: CHS report (Spectrum: misconfigured server)

October 6, 4:54PM: Trifiletti to Sands: Actual text of 1023 submitted

October 6, 6:21PM: Wierzbicki to Gaynor: CHS debrief

October 7, 8:59AM: Sands to Trifiletti

October 12, 8:01AM: Sands to Heide: the “logs” we got from listrak were not network logs

October 13, 5:45PM: Gaynor to Wierzbicki: Mediafire (includes link)

October 19, 8:05AM: Sands to Heide: we spoke to mandiant and that we are talkingt o [sic] the tech people at the ISP today

October 19, 10:15AM: Gaynor to Wierzbicki: 2 IP addresses, Mediafire, Dagon author?

November 1, 3:09PM: Sands to Trifiletti: I have a few more logs to definitely prove there are no emails, and then Im putting it to bed

November 14, 2:52PM: Steere to Sands: [report on September 30 receipt of logs from Cendyn]

January 18, 2017: Closing Memo

March 27, 2017: Sands 302 with Alfa reports that Mandiant reported no historic data

July 24, 2017: Moffa to Priestap: Includes several other reports

July 24, 2017, 3:10PM: Sands accepts custody

Share this entry