Posts

Secret Documents! The Ten Month Privilege Fight Whingers Claim Didn’t Happen

/53 Comments/in , , /by

As always happens when people who don’t bother to check the public record get afraid, folks are complaining about Merrick Garland again, both that they didn’t notice the number of times Garland explained publicly that back in June 2021 DOJ had set up a special Election Task Force to prepare for this moment, and to complain that (they say) Garland hasn’t charged Donald Trump.

I was working on a timeline already when Politico’s two year effort to get the DC District Court to unseal grand jury proceedings bore fruit yesterday. Kyle Cheney has a story describing how the documents he liberated show both Beryl Howell and her successor as Chief Judge, James Boasberg, kept swatting back at Trump’s efforts to delay precisely because of the upcoming election.

More than 18 months ago, as Donald Trump sought to delay several high-profile witness’ testimony to a grand jury investigating his effort to subvert the 2020 election, Washington’s top federal district judge sensed a potential calamity.

“The special counsel’s investigation is moving quickly. There is an imperative that it moves quickly particularly so as not to interfere with the 2024 election cycle,” Chief Judge James Boasberg said on April 3, 2023, according to a newly unsealed transcript of the secret proceeding. “So when the former President’s pleading says that there will be a nominal impact from a delay, I think that is a vast understatement, that there would be a serious and deleterious impact from a delay.”

Boasberg’s warning in the early stages of special counsel Jack Smith’s investigation of the former president now rings prescient. A series of delays engineered by Trump, most notably an eight-month freeze while the Supreme Court considered his claim to be immune from the charges altogether, have caused the criminal proceedings to collide with the 2024 election cycle — and made it impossible for Trump to stand trial on the most serious charges he faces before Election Day.

The documents also confirm dates that, just yesterday, anti-Garland whingers claimed I made up. The fight over executive privilege started with a June 15, 2022 subpoena (probably to Greg Jacob and Marc Short) and continued through the next April, when Jack Smith — having come on after the precedents on executive privilege had already been set — got Mike Pence’s testimony on April 27.

Here’s the timeline mapped by the documents Politico liberated:

June 15, 2022: Subpoena to two officials (possibly Jacob and Short)

September 28, 2022: Order and opinion requiring testimony from two officials (possibly Jacob and Short)

October 6, 2022: Order and opinion denying stay of decision

November 19, 2022: Order and opinion requiring testimony (probably the two Pats, Cipollone and Philbin)

December 18, 2022: Order and opinion denying stay

January 23, 2022: Order and opinion extending appeal

December 9, 2022: Order and opinion requiring testimony (possibly Eric Hershmann, given description of his emails demanding written instructions)

January 10, 2023: Order and opinion denying stay

March 15, 2023: Order and opinion requiring testimony (this is the omnibus order covering eight people — see redacted list on page 2 — including Mark Meadows, Stephen Miller, and Dan Scavino)

March 25, 2023: Opinion requiring testimony, probably involving Mike Pence

April 3, 2023: Transcript of hearing, probably involving Mike Pence

April 10, 2023: Transcript of hearing, probably involving Mike Pence

Ashraf Shaaban Listed as Global Legal Head of National Bank of Egypt

/25 Comments/in , /by

As noted here, according to a newly unsealed passage of Beryl Howell’s September 19, 2018 opinion denying an Egyptian Bank’s motion to quash a subpoena in an investigation into a suspected $10M payment to Donald Trump, Ashraf Shaaban is the Group Legal Counsel for the Egyptian-owned bank in question.

According to the American Chamber of Commerce in Egypt, Shaaban is the Global Legal Head of the National Bank of Egypt.

The website for Mona Zulficar’s lawfirm also includes this complimentary comment from Shaaban:

“They have a very solid reputation in the Egyptian market and they provide world class quality legal services to their clients and have at the same time very strong business orientation in handling such legal matters.” – Mr. Ashraf Shaaban – Group General Counsel – National Bank of Egypt

That suggests that the bank suspected of funneling $10 million to Trump at a key point in the 2016 election is the National Bank of Egypt.

I think I’ll reup this annotated rant Trump went on when Bob Menendez was indicted for allegedly taking bribes from Egypt.

An Egyptian Bank Claimed Details of a Suspected $10 Million Payment to Trump Might be in China

/33 Comments/in , , , , /by

Back on September 19, 2018, then DC Chief Judge Beryl Howell denied a motion brought by an Egyptian bank to quash a subpoena for information on a suspected $10 million payment made to then-candidate Trump in fall 2016. That set off litigation that continued, at the District, Circuit, and Supreme Courts, for at least nine months.

As CNN described in 2020, not long after the investigation got shut down under Bill Barr, investigators had been trying to see whether Egypt (or some entity for which Egypt served as go-between) provided the money that Trump spent on his campaign weeks before the election.

For more than three years, federal prosecutors investigated whether money flowing through an Egyptian state-owned bank could have backed millions of dollars Donald Trump donated to his own campaign days before he won the 2016 election, multiple sources familiar with the investigation told CNN.

The investigation, which both predated and outlasted special counsel Robert Mueller’s probe, examined whether there was an illegal foreign campaign contribution. It represents one of the most prolonged efforts by federal investigators to understand the President’s foreign financial ties, and became a significant but hidden part of the special counsel’s pursuits.

The investigation was kept so secret that at one point investigators locked down an entire floor of a federal courthouse in Washington, DC, so Mueller’s team could fight for the Egyptian bank’s records in closed-door court proceedings following a grand jury subpoena. The probe, which closed this summer with no charges filed, has never before been described publicly.

Prosecutors suspected there could be a link between the Egyptian bank and Trump’s campaign contribution, according to several of the sources, but they could never prove a connection.

It took months of legal fight after Judge Howell denied that motion to quash before the Egyptian bank in question complied, and once they got subpoena returns, prosecutors repeatedly complained that the bank was still withholding information, which led prosecutors to reopen the investigation with a new grand jury.

That much we know from documentation unsealed back in 2019 (part one, part two, part three), in response to a Reporters Committee for Freedom of the Press request for unsealing.

On August 17, 2023, while she was still Chief Judge, Beryl Howell ordered the government to post newly unsealed sets of some of the orders she issued during the litigation. On Thursday, Chief Judge Boasberg ordered that newly redacted set of opinions to be released. While Howell released six opinions in June 2019 along with the other materials from the case — with redactions done digitally, thereby hiding the length of redactions — just three new versions of her orders got released last week:

These may be limited to orders incorporated as appendices in prior appeals, which might also explain why the first two appear twice in the newly-released materials.

Much of the newly unsealed material pertains to a fight over how much Alston & Bird, the law firm representing the Egyptian bank, could say about the litigation publicly. Among other things, prosecutors under Robert Mueller objected to their own names appearing publicly, out of a desire to tie this litigation to the narrow scope of Mueller’s investigation into interference in 2016.

One thing made clearer by a redaction in that January 2019 opinion on public comments is that the DC Circuit considered what public comments the two sides could make, in addition to SCOTUS, as part of its denial of cert.

It’s possible that the DC Circuit has weighed in, secretly. Among the details newly unsealed in the original opinion are the names of two of the bank’s other lawyers: Ashraf Shaaban (who appears to be or have been in-house counsel) and Mona Zulficar (who runs a Cairo corporate law firm). Those lawyers were named in conjunction with declarations they submitted arguing some part of the claim that Egyptian Anti-Money Laundering law would prohibit compliance with the subpoena as would unspecified law in a third country, described as Country B. 

Howell described that Alston & Bird are relying on,

conclusory declarations by [redacted] own Country A in-house and retained counsel, which themselves cite no legal authority on this question of [redaction] See Decl. of Ashraf Shaaban,, Mov’s Group Legal Counsel (“Shaaban Decl.”)¶7, ECF No. 3-6; Suppl. Decl. of Mona Zulficar, “Suppl. Zulficar Decl.”)¶ 4, ECF No. 12. The Court gives these declarations little weight. [bold newly unsealed, compare this passage with this one]

So if we can figure out who Shaaban works or worked for to ID the bank.

It’s the unspecific third country, Country B, that is the most interesting new disclosure, however.

The newly unsealed passages do not identify which country, described as Country A and which CNN identified as Egypt, owns this bank. But they do show that the bank or its lawyers wanted to share the subpoena with personnel in Cairo.

The newly unsealed passages do identify which third country’s laws, unspecified laws, might prohibit lawyers from searching for responsive documents in that country: China.

In other words, a bank owned by Egypt said it couldn’t comply with a subpoena seeking information on a suspected payment to Trump during the 2016 election, in part, because China’s laws would prevent that.

Update: Ashraf Shaaban works for the National Bank of Egypt.

Bankrupt!

/118 Comments/in /by

Rudy Giuliani admits he is bankrupt.

It’s unclear, given the Chapter 11 bankruptcy petition he filed today, whether it was his lying to cheat or his “scheme” to avoid paying taxes that was the final straw. He owes just shy of $1 million, to NY State and IRS, for two years of taxes.

Republicans have been quite clear that they believe that kind of tax negligence merits immediate incarceration — at least it does in Hunter Biden’s case.

In addition to the $148M judgement he owes Ruby Freeman and Shaye Moss, he also owes his co-defendant in the Hunter Biden lawsuit, Robert Costello, over $1.3M for past representation.

Ultimately, this is expected and a direct response to Beryl Howell’s order that he pay up immediately.

 

Rudy’s Seized Devices Were More Useful for Investigating January 6 than Marie Yovanovitch’s Firing

/39 Comments/in , , , /by

On April 28, 2021, the FBI seized up to 18 devices from Rudy Giuliani. On Tuesday, DOJ unsealed the affidavit behind that seizure.

The affidavit, read in conjunction with Barbara Jones’ Special Master reports, Rudy’s privilege log from the Ruby Freeman lawsuit, and a filing he submitted in that suit provide abundant evidence that the devices FBI seized on April 28, 2021 were more useful for investigating January 6 than any suspected FARA violations involved in the firing of Marie Yovanovitch.

And this goes well beyond Robert Costello’s claim that a number of the devices seized from Rudy were corrupted.

The affidavit, as written, was narrow: it only covered FARA violations tied to the role of Yuriy Lutsenko and other Ukranians in the firing of Ambassador Yovanovitch in spring 2019. While there is evidence cited in the affidavit from a broad period of time (for example, describing Rudy’s public admissions that he did certain things in early 2019 later that year), the last overt act described in the affidavit is of someone — probably Victoria Toensing — texting Rudy on May 9, 2019, complaining that people were asking about whether she had registered under FARA and denying that she had a client.

Remarkably, then, the affidavit asked for — and Judge Paul Oetken authorized — the authority to seize “any and all” devices at Rudy’s office and home almost two years after that last overt act.

Judge Oetken authorized that search and seizure even though one of the phones described in the affidavit — an Apple iPhone X that Rudy first started using on January 20, 2021 — could not possibly have been used in the suspected crime described in the affidavit. And three more of the devices described in it, including another iPhone, were only put in use later in 2019.

I’ve long argued that by September 2021, DOJ at least contemplated obtaining other warrants to access that content (because SDNY successfully argued to do the privilege review on all content that post-dated January 1, 2018). But given the scope of those devices, it looks likely that there was at least one other affidavit presented to Oetken in April 2021, one that would justify seizing those later devices.

This table shows (on the vertical axis) the devices that Rudy says were seized and (on the horizontal axis) the devices that FBI thought they’d find.

While Rudy’s own description of these devices (including the model number of the MacBook used in planning January 6, here listed as A22251) is as unreliable as everything else about him, the FBI didn’t find the two iPhone Xes — one used between January 8, 2018 and August 13, 2019, the other used between April 5 2018 and August 27, 2019, both marked in yellow above — that would have been Rudy’s primary phones during the events described in the affidavit.

Just three devices — two iPads and one iPhone 11 — clearly match the description of what the FBI expected to find.

All of them were, according to Rudy’s description (marked in the vertical “January 6 column”), among those used in planning January 6.

Whichever iPhone 11 they did find is almost certainly device that Special Master Jones labeled as device 1B05, the privilege review of which she described this way:

I next assigned for review the chats and messages that post-dated January 1, 2018 on Device 1B05, which is a cell phone. There were originally 25,481 such items, which later increased to 25,629 after a technical issue involving document attachments was identified. An initial release of non-designated items was made to the Government’s investigative team on November 11, 2021.1

Of the total documents assigned for review, Mr. Giuliani designated 96 items as privileged and/or highly personal. Of those 96 designated items, I agreed that 40 were privileged, Mr. Giuliani’s counsel withdrew the privilege designation over 19, and I found that 37 were not privileged. I shared these determinations with Mr. Giuliani’s counsel, and they indicated that they would not challenge my determination that the 37 items are not privileged. The 40 privileged documents have been withheld from the Government’s investigative team and the remaining 56 were released on January 19, 2022.

1 Additional non-designated items were released on January 19, 2022.

Those 25,000 chats were easily the most voluminous content turned over from any one device to the FBI. Of all the chats that Rudy attempted to withhold from that phone, he ultimately only succeeded in withholding 40 items. 40 chats or texts out of 25,000 total.

262 items in Rudy’s privilege log come from that phone. Another 127 come from a device, 1B09, also used to text about January 6 (including with Mark Meadows), which — given the date scope — must have been among the first devices Jones reviewed. That’s one possible source of a Ken Chesebro document included in the indictment but not identified in the January 6 Report.

And while Rudy withheld those documents from Ruby Freeman, since Jones only permitted Rudy to withhold 43 items total from DOJ, those must have been deemed non-privileged in the Special Master review. (I’ve noted before that there are easily 40 items that clearly relate to Rudy’s own lawyers.)

They were all turned over to DOJ, for use with whatever investigative teams had obtained warrants to access them, no later than January 21, 2022.

This is one thing Rudy accomplished by defaulting on discovery: Withholding from Ruby Freeman, and therefore from a public trial that would precede Republican primaries, documents that were turned over to DOJ in January 2022.

By April 2021 when — using warrants approved on Lisa Monaco’s first day on the job, but nevertheless a year after Bill Barr started obstructing this investigation — the FBI came looking for devices involved in Rudy’s suspected FARA violations tied to getting Marie Yovanovitch, they didn’t find the devices he would have been using at the time.

They did, however, find three devices on which Rudy planned January 6. And because of the way DOJ did the privilege review on those devices, those records would have been made available to any investigators with a lawful warrant no later than January 21, 2022.

Perjury Trapped: Rudy Giuliani’s Sync Sink

/27 Comments/in , , /by

As I noted here, I’m just beginning to go through the warrants from SDNY’s Lev Parnas and Rudy Giuliani investigation the NYT liberated.

I want to start with a very minor point about the apparent inconsistencies between what SDNY found when they conducted searches on Rudy’s cloud and what Rudy claimed — purportedly under penalty of perjury — before Beryl Howell.

In the Ruby Freeman case — the first one, not her renewed suit to enjoin him from continued lies about her — Rudy claimed that he didn’t need to separately search his messaging accounts, because his phones were all synced to his iCloud.

All of my [redacted]@icloud.com iCloud data would have also been included in the TrustPoint data because I synced my iCloud to my devices.

But SDNY, when they searched his iCloud back in 2019, discovered that known messages were not there.

On or about November 4, 2019, the USAO and FBI sought and obtained from the Honorable J. Paul Oetken, United States District Judge for the Southern District of New York, a warrant (the “November 4 Warrant”) for records in iCloud accounts belonging to Giuliani and [Victoria Toensing].

[snip]

As discussed above, on November 4, 2019, the FBI and USAO sought and obtained a search warrant for, among other things, Giuliani’s iCloud account. However, the iCloud did not contain many of the text messages outlined above with Parnas and [Fruman] during the December 2018 to April 2019 time frame. Based on my training and experience, as well as my review of records provided by Apple, I believe the iCloud account did not contain text communications from early 2019 because Giuliani did not backup that content, or removed it from the backup, and not because it does not exist. Indeed, for the reasons set forth below, including Giuliani’s public statement that he has retained potentially relevant communications on his cellphones, there is probable cause to believe that, unlike the iCloud account, evidence of the Subject Offenses continue to be maintained on the Subject Devices.

But, according to Robert Costello, in a declaration that — unlike Rudy’s — was actually notarized and so worth something if you ignore the obvious spin in his representations of what SDNY told him — when SDNY reviewed at least seven of those devices, they were corrupted.

Rudy’s messaging wasn’t in his iCloud when SDNY looked in 2019. And it wasn’t in his phones when SDNY looked in 2021. And yet this year, he claimed the content in both places would be the same.

Beryl Howell Scoffs That We Think We Know Anything about the Trump Investigations

/94 Comments/in , /by

On February 16, CNN published a story describing that there were eight sealed grand jury matters in the twin investigations into Trump. In addition to the not-yet filed Mike Pence challenge to his own testimony, it named seven other sealed proceedings:

  • The crime-fraud ruling pertaining to Evan Corcoran
  • DOJ’s bid to hold Trump in contempt for failing to turn over all stolen documents in his possession
  • Trump’s Executive Privilege claim with Greg Jacob and Marc Short
  • Trump’s Executive Privilege claim with the two Pats, Cipollone and Philbin
  • Scott Perry’s Speech and Debate challenge to the warrant for his phone
  • The privilege fight over Jeffrey Clark, John Eastman, Ken Klukowski, and one other person’s content
  • The order compelling Kash Patel to testify

Just over a week later, on February 24, Xitter’s lawyers would include that story in package of media articles it claimed — in its reply brief to vacate the gag order — showed that DOJ didn’t need to keep the warrant for Trump’s Xitter account sealed any longer.

That story about how little we knew of sealed grand jury proceedings became part of yet another sealed grand jury proceeding in the investigation into Donald Trump.

The reply motion itself made a bunch of claims about how much was known about the investigation, with more links to news articles.

3 Mr. Trump may be unique in this regard for this investigative step. Because he was announced as a principal subject of investigation and because the public reporting has focused on investigative actions directed at him, he may have a unique level of knowledge about investigative actions regarding him—even relative to other investigations of him that were conducted with far less public awareness.

4 The news articles Twitter cited its initial motion are attached here as Exhibit A. The articles cited in this Reply are attached as Exhibit B.

5 Maggie Haberman & Michael S. Schmidt, Jared Kushner and Ivanka Trump Subpoenaed in Jan. 6 Investigation, N.Y. TIMES (Feb. 22, 2023), available at [link redacted]

6 Maggie Haberman & Glenn Thrush, Pence Gets Subpoena From Special Counsel in Jan. 6 Investigation, N.Y. TIMES (Feb. 9, 2023), available at [link redacted]

7 C. Ryan Barber & Sadie Gurman, Mark Meadows, Trump’s Last Chief of Staff, Subpoenaed by Grand Jury, WALL STREET JOURNAL (Feb. 15, 2023), available at [link redacted]

8 C. Ryan Barber & Alex Leary, Trump Lawyers Appeared Before Grand Jury as Part of Classified-Documents Probe, WALL STREET JOURNAL (Feb. 11, 2023), available at [link redacted]

9 Katelyn Polantz et al., Special counsel is locked in at least 8 secret court battles in Trump investigations, CNN (Feb. 16, 2023), available at [link redacted]

10 C. Ryan Barber & Alex Leary, Trump Lawyers Appeared Before Grand Jury as Part of Classified-Documents Probe, WALL STREET JOURNAL (Feb. 11, 2023).

11 Jim Small, GOP Arizona legislators, including leaders of the house and senate, subpoenaed to testify in special counsel probe of Trump, Arizona Mirror (Feb. 17, 2023), available at [link redacted]

That February 24 package was actually the second package of news articles Xitter cited or linked to support its argument that revealing the warrant wouldn’t help Trump because so much of the investigation had been publicly reported; it cited a bunch in the initial motion to vacate, too.

First, the Department of Justice’s criminal investigation into former President Trump and his potential role in the efforts to overturn the 2020 presidential election and the January 6, 2021 attack on the United States Capitol, has been public for several months prior to the issuance of this Warrant. Specifically, the news media has reported extensively that presidential advisors, including White House counsel and senior staff, have been subpoenaed to testify before a federal grand jury investigating those events. See e.g., Casey Gannon et al., Former Trump White House Counsel and His Deputy Testify to Jan. 6 Criminal Grand Jury, CNN (Dec. 2, 2022), available at [link redacted] First on CNN: Top Trump Advisor Stephen Miller Testifies to January 6 Federal Grand Jury, CNN (Nov. 29, 2022), available at [links redacted]; Bart Jansen, Justice Department Subpoenas Dozens of Trump Aides in Apparent Escalation of Investigation, According to Reports, USA Today (Sept. 12, 2022),  available at [link redacted]; Kyle Cheney, Two Top Pence Aides Appear Before Jan. 6 Grand Jury, POLITICO (Jul. 25, 2022), available at [link redacted].

[snip]

It is also well known that, as part of its investigation, the Department of Justice is closely examining the private communications of people within the scope of its investigation, including the former president’s aides and allies. Indeed, the Department of Justice has obtained search warrants for electronic devices of numerous close associates of former President Trump. See e.g., Steve Benen, DOJ Seizes Team Trump Phones as Part of Intensifying Jan. 6 Probe, MSNBC (Sept. 13, 2022), available at [link redacted]; Ella Lee, Pennsylvania Rep. Scott Perry, a Trump Ally, Says FBI Agents Seized His Cellphone, USA TODAY (Aug. 10, 2022), available at [link redacted]; Scott Gleeson, MyPillow CEO, Trump Ally Mike Lindell Says FBI Issued Subpoena, Seized Phone at a Hardee ‘s, USA TODAY (Sept. 14, 2022), available at [link redacted]; Alan Feuer & Adam Goldman, Federal Agents Seized Phone of John Eastman, Key Figure in Jan. 6 Plan, N.Y. Times (Jun. 27, 2022), available at [link redacted]. The Federal Bureau of Investigation (“FBI”) has also executed a search warrant at the home of a Trump ally to seize electronic devices. See e.g. Alan Feuer at al., Federal Authorities Search Home of Trump Justice Dept. Official, N.Y. Times (Jun 23, 2022), available at [link redacted].

Then it included those articles as an appendix in its opposition to show cause to hold it in contempt.

Over and over again, Xitter argued that the media coverage of the investigation provided a thorough understanding of the steps taken so far in the investigation.

It was an argument that then-Chief Judge Beryl Howell, deep into presiding over her second and third investigations — that we know of! — into Donald Trump found wildly unpersuasive.

She and AUSA Gregory Bernstein discussed it at some length in the February 7 hearing on the warrant.

At first, she asked how much Xitter really knew so she could figure out whether Xitter had refused to respond to a warrant thinking that no one would protect Trump’s privileges — thinking that somehow Judge Howell, deep into presiding over her second and third investigation of Donald Trump, had ignored those sensitivities.

Howell: I need to be clear about what Twitter has  seen of the warrant package. I don’t know how many of you at Twitter’s table have ever been prosecutors; but you know the warrant is a very thin little part — important part, critical part, it is a court order — a thin part of a warrant package. I am not clear from this record what Twitter has seen and what it hasn’t. It doesn’t know very much at all, although it thinks it does, about the government’s investigation; but it certainly doesn’t know, I don’t think, very much about the warrant that I signed and all of its parts. But I need to be clear about what it does and doesn’t know about that.

[snip]

THE COURT: ALL right. Now let’s turn to the warrant package. Okay.

So the warrant package consisted of an incredibly lengthy affidavit, the warrant itself. The warrant itself had Attachment A, property to be searched; it had Attachment B, particular things to be searched; and Attachment B had different parts.

Now, certainly, Twitter hasn’t seen the application part of the package; it hasn’t seen the affidavit part of the package. Is that right?

MR. BERNSTEIN: Yes, Your Honor.

THE COURT: That’s correct?

MR. BERNSTEIN: That’s correct, Your Honor.

THE COURT: Certainly, Twitter has seen the warrant and Attachment A; is that correct?

MR. BERNSTEIN: That’s correct, Your Honor.

THE COURT: And out of Attachment B, has Twitter seen any part other than Part 1?

MR. BERNSTEIN: No, Your Honor.

THE COURT: Okay. Well, that’s sort of what I thought, but I wanted to make sure.

So Twitter, as it sits here, has zero idea and zero affirmation about whatever filter protocol or procedure there is attached to this warrant in terms of processing any warrant returns; is that correct?

MR. BERNSTEIN: That’s correct, Your Honor.

THE COURT: And if they know, it’s not from the government.

MR. BERNSTEIN: I’m sorry. Can you repeat the question, Your Honor?

THE COURT: They wouldn’t know from the government.

MR. BERNSTEIN: They would not know from the government, Your Honor, that’s correct.

THE COURT: ALL right. So to the extent that Twitter is standing here, as I understand their position, trying to protect any privilege of the account user with this solution of providing prior notice to the account user, they are taking no account because they can’t — because they haven’t seen it and they don’t know anything about any filter protocol that might be attached to this warrant.

MR. BERNSTEIN: That’s correct, Your Honor. They do not know about any Filter protocol that could or could not be attached to the warrant.

THE COURT: Got it. Okay.

I just want to make it clear, when providers step in here and take up my time on what should be a simple processing of a warrant, exactly how much in the dark they are. Okay.

But then she returned to the question — and the first of Xitter’s two big packets of articles on the investigation — when trying to ascertain whether Xitter had any basis to claim that revealing the warrant wouldn’t alter the balance of the public knowledge on the investigation.

THE COURT: Okay. So Twitter, in its opposition, had, like, I don’t know, I counted like pages of an exhibit of all these press reports about the special counsel investigation; I didn’t look at it in detail.

But, in sum, Twitter’s argument is: Hey, the government’s interest in maintaining the NDO isn’t compelling because look at all this press. Lots of people know about this investigation going on. The Attorney General has an order on the DOJ website saying: I have appointed the special counsel to look at the following issues.

Twitter goes on to say that the press has been doing its job, thankfully. And so, as a consequence, we all know that, you know, the government, in aggressively pursuing this investigation, has been looking at the communications of a number of people.

So it sums up by saying: It strains credulity to believe that the incremental disclosures of this warrant could somehow alter the current balance of public knowledge in any meaningful way so as to cause harm to the investigation.

So just like Twitter doesn’t know much about the warrant here at all, and has only seen a small sliver of the entire warrant package, do you think that it strains credulity to believe the incremental disclosure of this order would somehow alter the current balance of public knowledge in any meaningful way?

MR. BERNSTEIN: Absolutely not, Your Honor.

There is an incredible difference between the public knowing about the existence of the investigation and the account holder in this case knowing about a concrete, investigative step that the government has taken.

And, again, I have to be careful about what I say in this setting because I don’t want to disclose information that’s covered by 6(e) or that otherwise would compromise the investigation. With that said, Your Honor, I think when Your Honor gets our ex parte filing with respect to the NDO, I think Your Honor will wholeheartedly reject the assertion that it strains credulity to think that there could be serious adverse consequences from the President finding out about this search warrant.

Howell and Bernstein returned to the question a short time later, when Bernstein said, “they don’t know anything” but where making “confident factual assertions without knowing the actual facts of the investigation.”

Howell: So do you want to respond to that? — to Twitter’s comment that there is no reason to believe notification would suddenly cause Trump or potential confederates to destroy evidence, intimidate witnesses, or to flee prosecution, or are you waiting on that for an ex parte submission?

MR. BERNSTEIN: We are waiting. But I can give Your Honor two responses in the meantime.

First, they don’t know anything. I mean, they know some stuff. They know what they have read in the newspapers. But they’re making these confident factual assertions without knowing the actual facts of the investigation.

Number two, they have cited a number of news articles. They seem to have a robust understanding of what is in the public record. They seem to be ignoring the fact that there is an entirely separate public investigation into the former President for doing just that, for taking obstructive efforts with respect to NARA’s request to retrieve classified documents, and then the government — the grand jury’s request to subpoena classified documents  from the former President, and the steps that he took to obstruct those efforts. So there will be considerably more detail about the basis for the NDO when we brief this issue.

For now, though, the assertion that they’re making, one, is not based on any factual foundation that they could possibly be aware of; and then, second, to the extent that they are able to ascertain details from the public record, they seem to be ignoring those details.

Xitter had no factual foundation to make the confident assertions about the investigation, an AUSA who had been involved in crafting the warrant explained.

DOJ repeated that argument in its opposition to Xitter’s motion to vacate the order of contempt.

Twitter offers (Twitter’s Mem. 8–14) two unpersuasive arguments to the contrary. First, Twitter contends (id. at 8–12) that because some aspects of the investigation are publicly known, it “strains credulity to believe” that providing the Warrant to the former president will “alter the current balance of public knowledge in any meaningful way” because such a disclosure would be merely “incremental.” Id. at 11. That contention is flawed in several respects. Although the investigation’s existence is no longer secret, it does not follow that the specific ongoing investigative steps the Government is pursuing are therefore publicly known. Many of the media accounts that Twitter cites (id. at 8–10) attempt to fill in gaps based on discrete pieces of information or courthouse sightings of witnesses.4 Whatever the effect of those accounts on the “current balance of public knowledge,” id. at 11, they provide nowhere close to the detail supplied in the Warrant. Providing the Warrant to the former president at this point in the investigation would thus far exceed some mere “incremental” step in informing the former president, as described in the ex parte submission.

4 The same is true of the 80 pages of articles and other documents that Twitter submitted as an exhibit to its opposition to the Government’s Motion to Show Cause. See Twitter’s Opposition to Government’s Motion for an Order to Show Cause, Exhibit B (filed Feb. 6, 2023).

At the same time as we were having very public, ugly battles about what TV lawyers were sure they knew about the investigation, Beryl Howell and Gregory Bernstein were scoffing at the idea that anyone would have a thorough understanding of the investigation based off what witnesses shared with the press or what journalists spied from staking out Prettyman Courthouse.

While Politico sussed out that WilmerHale was involved in a high level fight with Jack Smith’s team when the lawyers came back for an appellate hearing in May, no one knew way back in early February that the pitched battle was already, at that point, several weeks in progress.

Neither Politico nor CNN — the two best outlets for staking out the courthouse — knew their own work had been cited as proof that the public knew all there was to know about the investigation, only to have Beryl Howell scoff at the idea.

No one knew that Jack Smith had obtained Trump’s Xitter account. And even after seeing 500 pages from the fight over that warrant, no one yet knows precisely what they were looking for.

I take that back.

After Judge Tanya Chutkan crafted a protective order last week, Trump got his first batch of discovery. And here’s what he described learning about the investigation, in his bid to delay the January 6 trial until April 2026.

It, among other things, interviewed and subpoenaed hundreds of witnesses, executed over 40 search warrants, and compiled information from countless individual sources. The government included some, but not all, of these materials in a massive, 8.5-terabyte initial production, totaling over 11.5 million pages, together with native files, recordings, and other electronic data not amenable to pagination. [my emphasis]

We’ve spent the last two weeks entranced by a single warrant, making grand conclusions about what Xitter — which also knew nothing — was emphasizing to win a legal battle.

We know of perhaps ten other warrants, if Jack Smith is sharing the warrants for Trump’s co-conspirators and close aides (though he doesn’t have a Fourth Amendment interest in any of those warrants).

  1. Rudy’s devices (likely a warrant served on the FBI in NY)
  2. Ken Klukowski’s Google account
  3. Jeffrey Clark’s Outlook account
  4. Jeffrey Clark’s Google account
  5. Jeffrey Clark’s phone
  6. The fourth account from an as-yet unidentified non-lawyer
  7. John Eastman’s Chapman University emails
  8. John Eastman’s phone
  9. Boris Epshteyn’s phone
  10. Mike Roman’s phone

We know of subpoenas targeting Sidney Powell. We know nothing — literally nothing — about the investigation targeting Ken Cheseboro, one of Trump’s unindicted co-conspirators (except that investigators would have been very interested to learn why he was tailing Alex Jones during the attack on the Capitol, filming him on his phone).

We know of subpoenas obtaining information from NARA. We know of other phones that were seized — like Scott Perry’s and some of the key fake electors and Owen Shroyer — but those present sensitivities that make it less likely they would get shared with Trump, that they would be among the 40 warrants he knows about but we don’t.

We can assume that DOJ obtained warrants for every little last shred of cloud content available from Trump and his co-conspirators, long before they would have started seizing phones.

We can be sure that Trump’s Xitter file would be the last to be seized, not the first. The filings themselves cite how Trump and his associates use Xitter, which DOJ would have learned by seizing those associates’ Xitter accounts first.

Donald Trump is looking at forty warrants and we only know of one with his name on it, and even there we have no idea what DOJ was really after.

I’d say that Beryl Howell was right to scoff at Xitter’s lawyers, at us, for our confident statements about the investigation.

As Xitter’s Lawyer Stalled DOJ, Elon Musk Met with Jim Jordan (Twice!) and Kevin McCarthy

/52 Comments/in , , /by

Elon Musk has been eerily quiet about being held in contempt by Beryl Howell since the DC Circuit opinion was first released on August 9.

It’s not like him to pass up the opportunity to make an obnoxious comment.

Which is why I’m interested in what Musk was doing during the period when Xitter’s counsel was stalling on the DOJ request — including a visit to Kevin McCarthy on January 26.

Beryl Howell approved the warrant on January 17. After several failed attempts, the government served it to the official portal on January 19. But then Xitter’s senior-most legal person stalled for 12 days, until she told DOJ that Xitter was going to make a First Amendment challenge so Trump could invoke executive privilege.

The government’s initial service attempts on Twitter filed twice, with the government’s receipt both times of an automated message indicating that Twitter’s “page [was] down.” Gov’t’s Mot. at 2 (alteration in original). On January 19, 2023, the government was finally able to serve Twitter through the company’s Legal Requests Submissions site. Id

Twitter, however, somehow did not know of the existence of the Warrant until January 25, 2023—two days before the Warrant returns were due. That day, the government contacted Twitter about the status of the company’s compliance with the Warrant, and Twitter’s Senior Director of Legal, JN [redacted], indicated she was not aware of the Warrant but would consider it a priority.” Id; see also Decl. of [redacted], Senior Director of Legal for Twitter (“[redacted] Decl”) 2 (SEALED), ECF No. 9-1. The government indicated that they were looking for an on time production in two days time” to which [J redacted] responded, “without knowing more or taking any position that would be a very tight turn around for us.” [Jl Decl. ¶ 2. The government sent the six pages of the Warrant and the NDO directly to [J redacted] later that evening Meanwhile, [J redacted] directed Twitter’s personnel to preserve data available in its production environment associated with the Target Account, and “have confirmed that the available data was preserved.” Id. ¶ 4.

Twitter notified the government in the evening of January 26, 2023, that the company “would not comply with the Warrant by the next day, “Id. 5, and responded to the government’s request for more specific compliance information, by indicating that “the company was prioritizing the matter and taking it very seriously” but that [redactedl had the Warrant and NDO only “for two days,” id. ¶ 8, even though the government had tried to submit the Warrant and NDO through Twitter’s Legal Requests Submissions site nine days earlier. The Warrants deadline for compliance makes no exception for the provider’s failure to have a fully operational and functioning system for the timely processing of court orders.

On January 31, 2023, Twitter indicated for the first time that the company would not comply with the Warrant without changes to the NDO, stressing as “essential to Twitter’ business model including [its] commitment to privacy, transparency, and neutrality) that [Twitter] communicate with users about law enforcement efforts to access their data.” 1d. 10.

The Legal Director’s declaration is more obnoxious than that. She made no mention of DOJ’s attempts to serve the warrant before she got involved and makes much of a claim that it took the AUSA two efforts to email a separate copy to her. Her assurances that everything was preserved — made as of January 25 — don’t rule out any deletions before that.

It wasn’t until February 1 that WilmerHale was officially involved.

And in the meantime, Elon Musk had made a widely covered trip to DC. He met with Jim Jordan on Thursday January 26, Kevin McCarthy that evening, and then Jordan (again) with James Comer the next day (Axios, NYT, CNN)

As of now, at least, Jordan and McCarthy are two of the just 51 people that Trump follows, who could have sent him DMs.

The next week, Comer formally announced his dick pics hearing, which (as Allison Gill observed yesterday) took place the day between two hearings on the warrant, as contempt fees started piling up. In that hearing, Republicans spun Musk’s willful violation of the consent decree against Xitter as an assault on the First Amendment.

As it was happening, Musk posted a tweet with nothing more but a period.

This was happening in the period when Xitter was doing more intensive searches to get — for example — the second preservation of Trump’s account from January 12, 2021 and all other accounts associated, via common device, cookie, or IP, with Trump’s own.

In the February 7 hearing, then-Chief Judge Beryl Howell questioned whether Xitter was stalling on this production because Musk “wants to cozy up with the former President, and that’s why you are here?”

But it may be more than that.

Musk is solidly part of the far right culture that might have been involved in any DM lists organizing the insurrection. One of the main reasons he started considering buying Xitter is because of the efforts Xitter took in the aftermath to crack down on violence.

And in the lead-up to Musk’s purchase of Xitter, someone — there’s reason to believe it might be Stephen Miller, who had been interviewed by Jack Smith’s prosecutors in November, before he was interviewed in a privilege-waived interview in April — texted Musk personally to raise the sensitivities of restoring Trump to Xitter.

And one of Musk’s phone contacts appears to bring Trump up. However, unlike others in the filings, this individual’s information is redacted.

“It will be a delicate game of letting right wingers back on Twitter and how to navigate that (especially the boss himself, if you’re up for that),” the sender texted to Musk, referencing conservative personalities who have been banned for violating Twitter’s rules.

The anonymous texter then offers up a suggestion for “someone who has a savvy cultural/political view to be the VP of actual enforcement.” That suggestion: “A Blake Masters type.”

Any delays and obstruction may not just be an effort to protect Trump.

It could be Musk’s effort to protect his own network — and people in DC like Jim Jordan.

Death by Tweet: “User Attribution Is Important”

/102 Comments/in , , /by

Donald Trump nearly killed his Vice President by tweet — the tweet he sent at 2:24PM on January 6, 2021.

111. At 2:24 p.m., after advisors had left the Defendant alone in his dining room, the Defendant issued a Tweet intended to further delay and obstruct the certification: “Mike Pence didn’t have the courage to do what should have been done to protect our Country and our Constitution, giving States a chance to certify a corrected set of facts, not the fraudulent or inaccurate ones which they were asked to previously certify. USA demands the truth!”

112. One minute later, at 2:25 p.m., the United States Secret Service was forced to evacuate the Vice President to a secure location.

113. At the Capitol, throughout the afternoon, members of the crowd chanted, “Hang Mike Pence!”; “Where is Pence? Bring him out!”; and “Traitor Pence!”

114. The Defendant repeatedly refused to approve a message directing rioters to leave the Capitol, as urged by his most senior advisors-including the White House Counsel, a Deputy White House Counsel, the Chief of Staff, a Deputy Chief of Staff, and a Senior Advisor.

As the indictment tells it, at the time Trump sent his potentially lethal tweet, inciting the mob bearing down on Mike Pence, Pence’s spouse, and daughter, Donald Trump was alone in his dining room with the murder weapon: an unknown phone, and his Twitter account.

But when DOJ served a warrant on Twitter for Trump’s Twitter account on January 17, they couldn’t be sure who was holding the murder weapon. They also wouldn’t know whether triggering the murder weapon was coordinated with other events.

That explains why, as Thomas Windom described in a February 9 hearing, metadata from Trump’s Twitter account showing any other account associated with his own may have been just as important for the investigation as any DMs obtained with the warrant.

MR. HOLTZBLATT: Well, Your Honor, we don’t — the issue, Your Honor — there isn’t a category of “associated account information”; that’s not information that Twitter stores.

What we are doing right now is manually attempting to ascertain links between accounts. But the ascertainment of links between accounts on the basis of machine, cookie, IP address, email address, or other account or device identifier is not information that Twitter possesses, it would be information that Twitter needs to create. So that’s the reason why we had not previously produced it because it’s not a category of information that we actually possess.

[snip]

MR. WINDOM: It is, as explained more fully in the warrant — but for these purposes, it is a useful tool in identifying what other accounts are being used by the same user or by the same device that has access to the account is oftentimes in any number of cases, user attribution is important. And if there are other accounts that a user is using, that is very important to the government’s investigation.

[snip]

MR. HOLTZBLATT: That’s right. If the records — if the linkage between accounts, which is what we understand this category to be referring to, is not itself a piece of information that we keep, then it’s not a business record that we would ordinarily produce.

What I understand the government to be asking is for us to analyze our data, as opposed to produce existing data. And we are trying to work with the government in that respect, but that is the reason that it is not something that — that is a different category of information. [my emphasis]

By that point, DOJ would have had Cassidy Hutchinson’s testimony describing what she saw sitting outside Trump’s dining room door (and once, going in to pass off Mark Meadows’ phone). They would have had two grand jury appearances from the two Pats, Cipollone and Philbin, the White House Counsel and Deputy Counsel described in the passage. They would have had at least one interview with Eric Herschmann — the Senior Advisor trying to calm him down.

They did not yet have privilege waived testimony from the Chief of Staff — Mark Meadows — or the Deputy Chief of Staff — Dan Scavino.

And Dan Scavino was the most likely other person to know about that near murder by tweet, because Dan Scavino was in his position, the Deputy Chief of Staff, first and foremost because he had masterminded Trump’s own mastery of Twitter going back to 2016.

So one thing DOJ needed to know before they conducted an interview that took place after Beryl Howell rejected yet another frivolous Executive Privilege claim in March was how Dan Scavino accessed Trump’s Twitter account when he did, from what device.

Who else had access to Trump’s Twitter account, one part of the murder weapon?

When DOJ asked Twitter to go back and figure out which other accounts shared IP addresses, cookies, or other device identifier with Trump’s Twitter account, they were asking for a list of other people (or at least clues to identify those people) who might be holding that murder weapon on January 6, Trump’s Twitter account, instead of Donald Trump.

Before Dan Scavino told the grand jury that he wasn’t in the room when that tweet was sent, as he must have, DOJ would have needed a better idea whether Scavino sent the tweet, to know whether he was telling the truth once he did sit for a privilege waived interview.

But they were also asking for a very specific clue about the other part of that murder weapon: some way to identify the phone from which the potentially deadly tweet was sent. Identifying which phone was alone in the room with Donald Trump on January 6 would also identify which phone to go seize to learn who else Trump was communicating with when he was sitting alone in his dining room as he watched his supporters assault the Capitol. Identifying which phone was alone in the room with Donald Trump on January 6 would help to fill the gap in communications that the January 6 Committee never completely filled.

And not just that phone.

Obtaining the associations to Trump’s Twitter account would also help explain one of the most enduring mysteries about January 6: What happened between the time Sidney Powell left after a screaming meeting on December 18 and the time Trump announced the rally in the early hours of December 19, leading thousands of his most rabid followers to start planning to come to DC?

87. On December 19, 2020, after cultivating widespread anger and resentment for weeks with his knowingly false claims of election fraud, the Defendant urged his supporters to travel to Washington on the day of the certification proceeding, tweeting, “Big protest in D.C. on January 6th. Be there, will be wild!” Throughout late December, he repeatedly urged his supporters to come to Washington for January 6.

That December 19 tweet, and the phone it was sent from, was another kind of murder weapon, the shot that would set off the entire riot. And to figure out who was wielding it, the circumstances in which it went off, investigators would work backwards from where it was stored, on Twitter.

They would want to know, too, how Ali Alexander and Alex Jones copped on so quickly — whether any of the participants in the DM lists via which Stop the Steal was coordinated had a user who also had access to Trump’s Twitter account.

Even before Trump became President, his communication habits made it very difficult to pin down his actions. Roger Stone, for example, would call Trump during the 2016 election on Trump’s cell, his Trump Tower phone, two work phones, via three different assistants, and Keith Schiller. And Stone often used other people’s phones to call on.

Trump still has a habit of using other people’s phones. The stolen documents indictment reflects Molly Michael telling Walt Nauta that Trump had had her phone. Several of Trump’s aides were asked by J6C whether Trump ever used their phones; several probably didn’t tell the truth in response.

But much of execution of January 6 went through the single most stable means of communication Donald Trump had: his Twitter account. And to attribute any actions that happened using Trump’s Twitter account, DOJ needed as much data as possible about who else used it and in what circumstances.

User attribution is important. Especially with a guy who has the ability to murder by tweet.

“Poor Mr. Zebley:” Both Xitter’s Lawyers and Journalists Responding to Boilerplate Need to re-Read Mueller

/53 Comments/in , /by

I’ve stopped trying to convince Russian denialists on Xitter that they’re willfully ignorant of facts. At this point, denialists are just trolls exploiting Xitter’s algorithm to create scandal.

I try to focus my time, instead, on conspiracy theorists platformed by prominent schools of journalism.

But when others try to correct denialists on Xitter, they almost always say the denialists haven’t read the Mueller Report closely enough.

So I found it wildly ironic that Chief Judge Beryl Howell, during a period in February when Elon Musk was letting denialists like Matty Dick Pics Taibbi invade the privacy of then-Twitter’s users so he could spew conspiracy theories, Howell scolded Twitter’s lawyer George Varghese that he hadn’t read the Mueller Report closely enough.

THE COURT: You need to read the Mueller report a little bit more carefully.

The transcript of the court hearing and much of the rest of the back-up to Xitter’s attempt to stall compliance of the warrant was unsealed yesterday.

Mind you, Howell was trying to convey to Twitter’s team that there is precedent for investigating Donald J. Trump without giving him advance warning of every investigative step.

MR. VARGHESE: Yes, Your Honor. Our —- by

THE COURT: You think that for 230 orders, 2800 subpoenas, and 500 search and seizure warrants the Mueller team gave advance notice to the former President of what they were about?

MR. VARGHESE: I don’t know that, Your Honor.

THE COURT: You do not know that.

The hearing made it pretty clear that Howell is convinced that Trump will stop at nothing to obstruct criminal investigations into himself.

Howell, who knows what went into the Mueller Report as well as anyone outside the investigative team, does know that.

In fact, when she told Varghese he should have read the Mueller Report more closely, she had just pointed to private comms described in the Mueller Report — the ones where Trump told Mike Flynn to stay strong — where Trump had not gotten advance notice, as prosecutors were demanding he not get advance notice about a warrant to Twitter.

THE COURT: Because the Mueller report talks about the hundreds of Stored Communications Act — let me quote.

Let’s see.

The Mueller report states that: As part of its investigation, they issued more than 2800 subpoenas under the auspices of the grand jury in the District of Columbia.

They executed nearly 500 search and seizure warrants, obtained more than 230 orders for communications records under 18 U.S.C. Section 2703(d); and then it goes on and on and on for all of the other things they did.

And some of those communications included the former President’s private and public messages to General Flynn, encouraging him to “Stay strong,” and conveying that the President still cared about him, before he began to cooperate with the government.

So what makes Twitter think that, before the government obtained and reviewed those Trump-Flynn communications, the government provided prior notice to the former President so that he can assert executive privilege?

MR. VARGHESE: My understanding, Your Honor, is that the Mueller investigators were in contact with the White House counsel’s office about executive privilege concerns.

THE COURT: You quoted the one part that said that, and that was for testimony, testimony, where it was not covert.

Side note: Xitter’s lawyers may not have been entirely wrong about consultations with the White House counsel, even for materials obtained covertly.

This exchange happened on February 7. Two days later there was a follow-up hearing, and WilmerHale counsel Aaron Zebley — someone who knows better than Beryl Howell what happened to the materials for which Howell approved legal process after it got handed over but before they ended up in the Report itself — filed an appearance in this challenge. He never spoke though; he showed up late, if at all, and at one point, after Twitter had presented their opening argument, Howell asked someone to check whether “poor Mr. Zebley” was standing outside a locked door waiting to get in.

THE COURT: Okay. Well, let me just —

Mr. Windom, do you want to think about that or do you want to respond?

Do you think Mr. Zebley is standing outside the locked door?

MR. HOLTZBLATT: I think there is a chance.

THE COURT: Could you check? Poor Mr. Zebley.

MR. WINDOM: Should I wait, Your Honor, or proceed?

THE COURT: Proceed. In my chambers we wait for no man.

Twitter was trying to make an argument that someone had to attend to potential Executive Privilege claims. Howell and the prosecutors nodded several times to a filter protocol addressing privilege issues, of which Twitter was ignorant. And yet Twitter was refusing to comply unless they had the opportunity to tell Donald Trump about the warrant in advance.

Beryl Howell, who was years into her second investigation of Donald Trump at this point, might be forgiven for impatience with lawyers who don’t understand how many Executive Privilege disputes she had presided over between those two investigations. They might be forgiven for their ignorance of all the resolutions of Trump’s current challenges to Executive Privilege in the January 6 investigation.

That said, Twitter’s lawyers aren’t the only ones who should have read the Mueller Report more closely. So are the journalists reporting on this.

One after another journalist (CNN, NYT, Politico, all involving journalists who covered the Mueller investigation) has mistaken DOJ’s request for data — attachment B to the warrant — as some kind of statement of what DOJ was most interested in receiving. Based on that, their stories focus on the fact that DOJ asked for or obtained DMs involving the former President.

But that attachment looks to be largely boilerplate. It is not much different from warrants obtained five years ago, in the Mueller investigation, such as this one, also served on Twitter, apparently targeting Trump’s rat-fucker Roger Stone in an investigation into whether he was serving as a foreign agent of Russia, a warrant that also came with a gag, one Twitter did not contest. One main — telling — difference, is that the Trump request included standard subscription information, which Mueller’s investigators appear to have already requested; one of the items on which Twitter held up compliance, in fact, was Trump’s gender, a sure testament to obstruction within the company.

While Twitter’s services have changed significantly in the interim years, both ask for the same kind of information: DMs, drafts, deleted content, favorited content.

And for good reason!!! These warrants may well have been targeting the same kind of behavior, the kind of organized troll campaigns that exploit Twitter’s algorithms, in which users use a variety of means to obscure their identity. There is a significant likelihood these warrants were targeting precisely the same group of far right online activity, the very same people.

One of the most important Twitter users leading up to January 6, Ali Alexander, is the protégé of Roger Stone and the effort to drive attendance at January 6, Stop the Steal, was a continuation of the effort Stone started in 2016, an effort that may well have been covered by that 2018 warrant or one of the others targeting Stone’s Twitter activity.

To be sure: There are DMs in Trump’s account, though it’s not entirely clear when they date to. Without reading any of the DMs, Twitter checked to see whether the volume of data in Trump’s account indicated the presence of DMs.

MR. VARGHESE: So, Your Honor, we went back — because this was an important issue for us to compare, whether or not there were potentially confidential communications in the account, and we were able to confirm that.

THE COURT: How?

MR. VARGHESE: So, Your Honor, there was a way that we compared the size of what a storage would be for DMs empty versus the size of storage if there were DMs in the account. And we were able to determine that there was some volume in that for this account. So there are confidential communications. We don’t know the context of it, we don’t know —

THE COURT: They are direct messages. What makes you think — do you think that everything that a President  says, which is generically a presidential communication, is subject to the presidential communications privilege?

MR. VARGHESE: No, Your Honor.

But Twitter’s focus on DMs arose from their frivolous basis for delaying response to the warrant — their claim that some of these DMs might be subject to a claim of Executive Privilege.

Moreover, having DMs in the account is not the same thing as a prosecutor confirming that they ultimately obtained DMs, or that any DMs were relevant to the investigation, or that DMs were one of the things they were most interested in.

I don’t doubt that’s likely! But what prosecutors asked for and what was in the larger account is not the same thing as what DOJ ultimately received and used.

And the DMs — most of them, anyway — are something that were available elsewhere. At least as represented in the dispute, NARA already has Trump’s DMs from the period (DOJ chose not to go to NARA, in part, because they wanted to avoid notice that NARA has provided to Trump along the way).

There were three more things that DOJ showed perhaps more interest in, requiring Twitter to go beyond their normal warrant response tools to comply.

The first has to do with emails to Twitter about the account, of which prosecutor Thomas Windom was most interested in emails from people on behalf of Trump.

But this information about, you know, what it is that we say that we’re most specifically interested in, I did not represent that we were most interested in communications betueen government officials and Twitter regarding the account.

We did point out that — much as Your Honor did just now — it seemed beyond comprehension that there weren’t communications regarding the account when it was suspended and terminated, but that doesn’t mean government officials at least cabined to that. It can mean campaign officials. It can be anybody acting on behalf of the user of the account, or the user of the account himself.

THE COURT: So any person regarding the account is broader than what you just said, though, Mr. Windom.

“Any person regarding the account” is quite broad. It could be all the complaints of all of the Trump supporters out in the world saying: What are you doing, Twitter?

So I take it, from what you just said, that you are interested only in =- rather than “any person,” a person who was the subscriber or user of the account or on behalf of that person regarding the account?

MR. WINDOM: Yes, ma’am. An agent thereof.

When Twitter cut Trump off in 2021, they cut off active plans for follow-up attacks. And these emails might indicate awareness of how Trump was using Twitter as a tool to foment insurrection.

Another item on which Windom focused in the following hearing was associated accounts — other accounts the identifiers used with Trump’s accounts also use. Twitter claims they don’t have that — at least not in their law enforcement portal — and so had to collect it manually. But DOJ did ask them to produce it. (Note, the fact that Xitter doesn’t store this is one reason why they’re so bad at tracking information operation campaigns, because visibility on these kind of associations are how you discover them.)

MR. HOLTZBLATT: Well, Your Honor, we don’t — the issue, Your Honor — there isn’t a category of “associated account information”; that’s not information that Twitter stores.

What we are doing right now is manually attempting to ascertain links between accounts. But the ascertainment of links between accounts on the basis of machine, cookie, IP address, email address, or other account or device identifier is not information that Twitter possesses, it would be information that Twitter needs to create. So that’s the reason why we had not previously produced it because it’s not a category of information that we actually possess.

[snip]

MR. WINDOM: It is, as explained more fully in the warrant — but for these purposes, it is a useful tool in identifying what other accounts are being used by the same user or by the same device that has access to the account is oftentimes in any number of cases, user attribution is important. And if there are other accounts that a user is using, that is very important to the government’s investigation.

[snip]

MR. HOLTZBLATT: That’s right. If the records — if the linkage between accounts, which is what we understand this category to be referring to, is not itself a piece of information that we keep, then it’s not a business record that we would ordinarily produce.

What I understand the government to be asking is for us to analyze our data, as opposed to produce existing data. And we are trying to work with the government in that respect, but that is the reason that it is not something that — that is a different category of information.

As Windom explained, this information is critical to any attribution, but it’s also important to learning the network of people who would Tweet on Trump’s behalf, and any overlap between his account and their own (as Roger Stone’s showed in 2016).

Then there’s something that remains only partially explained. For some reason — even Twitter could not figure out why — there were two preservations of Trump’s account in January 2021, before the preservation associated with this warrant. One was on January 9. The other covered January 11 and 12. And when asked, the government of course wanted the latter preservation too — and it is in the possession of Twitter, and so covered by the warrant.

MR. HOLTZBLATT: At 5 p.m. on February 7th, I think that was our day, we produced all data in this category that was in the standard production tools of Twitter.

We communicated with the government on February 8th that there were prior preservations of the subject account that are not within Twitter’s standard production tools and that would, therefore, require engineering to obtain information. And we asked the government whether it wished us to undertake that effort, and the government confirmed that it did.

And we have since then — when we produced on February 7, we indicated to the government in our production letter that there was potentially deleted data that might exist, which is what would be found in prior preservations, but that it would require additional engineering efforts.

At 2 a.m. last night, or this morning, Twitter produced additional information from those prior preservations that falls within category 2A. There are —

THE COURT: When you say “prior preservations” what are you talking about?

Prior litigation holds of some kind or that you  had a stash or a cache of preserved data sitting in different places? What are you talking about?

MR. HOLTZBLATT: I am referring — with respect to this particular account, I am referring to preservations from two specific dates. There is a preservation that was made that includes the subject account covering January 3rd to 9th, 2021. There is a second preservation of this that includes this account that covers January 11 to 12, 2021.

Those are collections of data that — they are not — it’s not coterminous with the categories that would exist in the active account right now and — and that’s data that does not exist within a production environment. So it’s not data that you can just click — we have a system to just click a button and produce, which is why we indicated that further engineering efforts might be necessary.

We asked the government if they wished us to undertake those efforts. We had an engineer working through the night, after the government asked us to, to undertake those efforts. At 2 a.m. in the morning we produced additional information that came from those preservation.

There are two categories of information that — actually, I’m sorry, three categories of information that we are still working to produce because of the engineering challenges associated.

One of those categories is the list of — I am not sure this is from 2A. But I think, for purposes of coherence, it would be helpful for me to describe it now because it connects to this preservation; that is,  followers — a list of followers for this account that were contained within the January 11 through 12th prior preservation. We have segregated that information. It is a complicated and large set of information. And we are unable to deliver it in the manner that we normally deliver information to law enforcement, which is to send a token.

We believe right now it would require physical media to put that information on and to hand it over to the government.

[snip]

MR. HOLTZBLATT: As I mentioned, Your Honor, there were two prior preservations, and then there is the current production tools. In two of the three of those sets, the January 3 through 9 and the current one, we have produced the tweets and related tweet information for the account.

In the January 11 to 12th prior preservation, the way that the tweet and tweet-related information is stored, it goes all the way back to 2006. We don’t have a warrant — that is contents of user communications. He don’t nave a warrant that would permit us to produce the entirety of that information. So what we have is a tool 7 that — what we refer to as a redaction (sic) tool or trimming tool. Because this is not a production environment, a human being has to go in and manually trim the information to isolate the date range. That, I think Your Honor can understand, is a laborious process, including for this particular account, given the time frame; and we need to isolate it, I think, over a three-month, four-month period, I’m sorry, Your Honor. So we are undertaking it.

Unsurprisingly, DOJ wanted to be able to compare the accounts as they existed on January 8 and January 12, 2021, because Trump’s attack was still ongoing and because people were beginning to delete data.

Trump’s DMs, if he used them or even just received them in this period, would be critically important. But Twitter was one of Trump’s most important tools in sowing an insurrection. And the data showing how he used the account, and who also used it, is as important to understanding how the tool worked as the non-public content.