Posts

[Photo: National Security Agency, Ft. Meade, MD via Wikimedia]

18 USC 793e in the Time of Shadow Brokers and Donald Trump

/112 Comments/in , , , /by

Late last year, a Foreign Affairs article by former Principal Deputy Director of National Intelligence Sue Gordon and former DOD Chief of Staff Eric Rosenbach asserted that the files leaked in 2016 and 2017 by Shadow Brokers came from two NSA officers who brought the files home from work.

In two separate incidents, employees of an NSA unit that was then known as the Office of Tailored Access Operations—an outfit that conducts the agency’s most sensitive cybersurveillance operations—removed extremely powerful tools from top-secret NSA networks and, incredibly, took them home. Eventually, the Shadow Brokers—a mysterious hacking group with ties to Russian intelligence services—got their hands on some of the NSA tools and released them on the Internet. As one former TAO employee told The Washington Post, these were “the keys to the kingdom”—digital tools that would “undermine the security of a lot of major government and corporate networks both here and abroad.”

One such tool, known as “EternalBlue,” got into the wrong hands and has been used to unleash a scourge of ransomware attacks—in which hackers paralyze computer systems until their demands are met—that will plague the world for years to come. Two of the most destructive cyberattacks in history made use of tools that were based on EternalBlue: the so-called WannaCry attack, launched by North Korea in 2017, which caused major disruptions at the British National Health Service for at least a week, and the NotPetya attack, carried out that same year by Russian-backed operatives, which resulted in more than $10 billion in damage to the global economy and caused weeks of delays at the world’s largest shipping company, Maersk. [my emphasis]

That statement certainly doesn’t amount to official confirmation that that’s where the files came from (and I’ve been told that the scope of the files released by Shadow Brokers would have required at least one more source). But the piece is as close as anyone with direct knowledge of the matter — as Gordon would have had from the aftermath — has come to confirming on the record what several strands of reporting had laid out in 2016 and 2017: that the NSA files that were leaked and then redeployed in two devastating global cyberattacks came from two guys who brought highly classified files home from the NSA.

The two men in question, Nghia Pho and Hal Martin, were prosecuted under 18 USC 793e, likely the same part of the Espionage Act under which the former President is being investigated. Pho (who was prosecuted by Thomas Windom, one of the prosecutors currently leading the fake elector investigation) pled guilty in 2017 and was sentenced to 66 months in prison; he is processing through re-entry for release next month. Martin pled guilty in 2019 and was sentenced to 108 months in prison.

The government never formally claimed that either man caused hostile powers to obtain these files, much less voluntarily gave them to foreign actors. Yet it used 793e to hold them accountable for the damage their negligence caused.

There has never been any explanation of how the files from Martin would have gotten to the still unidentified entity that released them.

But there is part of an explanation how files from Pho got stolen. WSJ reported in 2017 that the Kaspersky Anti-Virus software Pho was running on his home computer led the Russian security firm to discover that Pho had the NSA’s hacking tools on the machine. Somehow (the implication is that Kaspersky alerted the Russian government) that discovery led Russian hackers to subsequently target Pho’s computer and steal the files. In response to the WSJ report, Kaspersky issued their own report (here’s a summary from Kim Zetter). It acknowledged that Kaspersky AV had pulled in NSA tools after triggering on a known indicator of NSA compromise (the report claimed, and you can choose to believe that or not, that Kaspersky had deleted the most interesting parts of the files obtained). But it also revealed that in that same period, Pho had briefly disabled his Kaspersky AV and downloaded a pirated copy of Microsoft Office, which led to at least one backdoor being loaded onto his computer via which hostile actors would have been able to steal the NSA’s crown jewels.

Whichever version of the story you believe, both confirm that Kaspersky AV provided a way to identify a computer storing known NSA hacking tools, which then led Pho — someone of sufficient seniority to be profiled by foreign intelligence services — to be targeted for compromise. Pho didn’t have to give the files he brought home from work to Russia and other malicious foreign entities. Merely by loading them onto his inadequately protected computer and doing a couple of other irresponsible things, he made the files available to be stolen and then used in one of the most devastating information operations in history. Pho’s own inconsistent motives didn’t matter; what mattered was that actions he took made it easy for malicious actors to pull off the kind of spying coup that normally takes recruiting a high-placed spy like Robert Hanssen or Aldrich Ames.

In the aftermath of the Shadow Brokers investigation, the government’s counterintelligence investigators may have begun to place more weight on the gravity of merely bringing home sensitive files, independent of any decision to share them with journalists or spies.

Consider the case of Terry Albury, the FBI Agent who shared a number of files on the FBI’s targeting of Muslims with The Intercept. As part of a plea agreement, the government charged Albury with two counts of 793e, one for a document about FBI informants that was ultimately published by The Intercept, and another (about an online terrorist recruiting platform) that Albury merely brought home. The government’s sentencing memo described the import of files he brought home but did not share with The Intercept this way:

The charged retention document relates to the online recruitment efforts of a terrorist organization. The defense asserts that Albury photographed materials “to the extent they impacted domestic counter-terrorism policy.” (Defense Pos. at 37). This, however, ignores the fact that he also took documents relating to global counterintelligence threats and force protection, as well as many documents that implicated particularly sensitive Foreign Intelligence Surveillance Act collection. The retention of these materials is particularly egregious because Albury’s pattern of behavior indicates that had the FBI not disrupted Albury and the threat he posed to our country’s safety and national security, his actions would have placed those materials in the public domain for consumption by anyone, foreign or domestic.

And in a declaration accompanying Albury’s sentencing, Bill Priestap raised the concern that by loading some of the files onto an Internet-accessible computer, Albury could have made them available to entities he had no intention of sharing them with.

The defendant had placed certain of these materials on a personal computing device that connects to the Internet, which creates additional concerns that the information has been or will be transmitted or acquired by individuals or groups not entitled to receive it.

This is the scenario that, one year earlier, was publicly offered as an explanation for the theft of the files behind The Shadow Brokers; someone brought sensitive files home and, without intending to, made them potentially available to foreign hackers or spies.

Albury was sentenced to four years in prison for bringing home 58 documents, of which 35 were classified Secret, and sending 25 documents, of which 16 were classified Secret, to the Intercept.

Then there’s the case of Daniel Hale, another Intercept source. Two years after the Shadow Brokers leaks (and five years after his leaks), he was charged with five counts of taking and sharing classified documents, including two counts of 793e tied to 11 documents he took and shared with the Intercept. Three of the documents published by The Intercept were classified Top Secret.

Hale pled guilty last year, just short of trial. As part of his sentencing process, the government argued that the baseline for his punishment should start from the punishments meted to those convicted solely of retaining National Defense Information. It tied Hale’s case to those of Martin and Pho explicitly.

Missing from Hale’s analysis are § 793 cases in which defendants received a Guidelines sentence for merely retaining national defense information. See, e.g., United States v. Ford, 288 F. App’x 54, 61 (4th Cir. 2008) (affirming 72-month sentence for retention of materials classified as Top Secret); United States v. Martin, 1:17-cr-69-RDB) (D. Md. 2019) (nine-year sentence for unlawful retention of Top Secret information); United States v. Pho, 1:17-cr-00631 (D. Md. 2018) (66-month sentence for unlawful retention of materials classified as Top Secret). See also United States v. Marshall, 3:17-cr-1 (S.D. TX 2018) (41-month sentence for unlawful retention of materials classified at the Secret level); United States v. Mehalba, 03-cr-10343-DPW (D. Ma. 2005) (20-month sentence in connection with plea for unlawful retention – not transmission – in violation of 793(e) and two counts of violating 18 U.S.C. 1001; court departed downward due to mental health of defendant).

Hale is more culpable than these defendants because he did not simply retain the classified documents, but he provided them to the Reporter knowing and intending that the documents would be published and made available to the world. The potential harm associated with Hale’s conduct is far more serious than mere retention, and therefore calls for a more significant sentence. [my emphasis]

Even in spite of a moving explanation for his actions, Hale was sentenced to 44 months in prison. Hale still has almost two years left on his sentence in Marion prison.

That focus on other retention cases from the Hale filing was among the most prominent national references to yet another case of someone prosecuted during the Trump Administration for taking classified files home from work, that of Weldon Marshall. Over the course of years of service in the Navy and then as a contractor in Afghanistan, Marshall shipped hard drives of classified materials home.

From the early 2000s, Marshall unlawfully retained classified items he obtained while serving in the U.S. Navy and while working for a military contractor. Marshall served in the U.S. Navy from approximately January 1999 to January 2004, during which time he had access to highly sensitive classified material, including documents describing U.S. nuclear command, control and communications. Those classified documents, including other highly sensitive documents classified at the Secret level, were downloaded onto a compact disc labeled “My Secret TACAMO Stuff.” He later unlawfully stored the compact disc in a house he owned in Liverpool, Texas. After he left the Navy, until his arrest in January 2017, Marshall worked for various companies that had contracts with the U.S. Department of Defense. While employed with these companies, Marshall provided information technology services on military bases in Afghanistan where he also had access to classified material. During his employment overseas, and particularly while he was located in Afghanistan, Marshall shipped hard drives to his Liverpool home. The hard drives contained documents and writings classified at the Secret level about flight and ground operations in Afghanistan. Marshall has held a Top Secret security clearance since approximately 2003 and a Secret security clearance since approximately 2002.

He appears to have been discovered when he took five Cisco switches home. After entering into a cooperation agreement and pleading guilty to one count of 793e, Marshall was (as noted above) sentenced to 41 months in prison. Marshall was released last year.

Outside DOJ, pundits have suggested that Trump’s actions are comparable to those of Sandy Berger, who like Trump stole files that belong to the National Archives and after some years pled guilty to a crime that Trump since made into a felony, or David Petraeus, who like Trump took home and stored highly classified materials in unsecured locations in his home. Such comparisons reflect the kind of elitist bias that fosters a system in which high profile people believe they are above the laws that get enforced for less powerful people.

But the cases I’ve laid out above — particularly the lesson Pho and Martin offer about how catastrophic it can be when someone brings classified files home and stores them insecurely, no matter their motives — are the background against which career espionage prosecutors at DOJ will be looking at Trump’s actions.

And while Trump allegedly brought home paper documents, rather than the digital files that Russian hackers could steal while sitting in Moscow, that doesn’t make his actions any less negligent. Since he was elected President, Mar-a-Lago became a ripe spying target, resulting in at least one prosecution. And two of the people he is most likely to have granted access to those files, John Solomon and Kash Patel, each pose known security concerns. Trump has done the analog equivalent of what Pho did: bring the crown jewels to a location already targeted by foreign intelligence services and store them in a way that can be easily back-doored. Like Pho, it doesn’t matter what Trump’s motivation for doing so was. Having done it, he made it ridiculously easy for malicious actors to simply come and take the files.

Under Attorneys General Jeff Sessions and Bill Barr, DOJ put renewed focus on prosecuting people who simply bring home large caches of sensitive documents. They did so in the wake of a costly lesson showing that the compromise of insecurely stored files can do as much damage as a high level recruited spy.

It’s a matter of equal justice that Trump be treated with the same gravity with which Martin and Pho and Albury and Hale and Marshall were treated under the Trump Administration, for doing precisely what Donald Trump is alleged to have done (albeit with far fewer and far less sensitive documents). But as the example of Shadow Brokers offers, it’s also a matter of urgent national security.

Jim Baker’s “Doctored” Memory Forgot the Meeting He Had Immediately After His Michael Sussmann Meeting

/24 Comments/in , /by

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs of transcripts. But if you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations. This coverage reflects the culmination of eight months work. 

One of key piece of evidence to John Durham’s prosecution against Michael Sussmann are the notes that Bill Priestap took reflecting Baker saying that Sussmann, “said not doing this for any client.”

On the stand, Priestap remembered nothing about this meeting.

Baker, though, claims he remembers a bunch of things.

In response to Sean Berkowitz’s attempt to pin down his testimony the other day, Baker said that his meeting with Sussmann was thirty minutes long. That’s not actually a direct memory, it seems. It is one reconstructed, Baker says, from calendars and the chain of custody document.

Q. How long was the meeting?

A. Which meeting?

Q. September 19th, 2016

A. About 30 minutes.

Q. How sure are you of that?

A. I’m going from the calendar entries and the entries on that chain of custody document.

Q. Okay. Not from your memory? You’re looking at documents?

A. I remember it was a short meeting. I would view a 30-minute meeting as a short meeting.

The chain of custody document shows that Baker took possession of the thumb drives at 2:30PM on September 19, 2016.

There are problems with relying on the chain of custody document to reconstruct your memory though, because it was, itself, reconstructed after the fact, the next day. One FBI agent discussing this process even joked that this amounted to “doctoring” the chain of custody — and with it, six years later, doctoring Baker’s current memory.

Baker professes to be slightly more certain about his meeting with Priestap, at which he relayed what had happened in the meeting with Sussmann. Baker “immediately or very close afterwards” called Priestap and told him what happened in the meeting.

Q. Okay. Now, taking us back to our time period, 15 we’ve left you getting the information from Mr. Sussmann on the 19th, and you immediately or very close afterwards called Mr. Priestap?

A. Yes, sir.

And the meeting was ten or fifteen minutes long.

Q. How long was the conversation with Mr. Priestap?

A. I don’t think it was a very long conversation. Ten minutes, maybe, fifteen minutes, something like that.

That’s a problem for Durham’s narrative. That’s because according to Baker’s own calendar, he had a meeting immediately after the one with Sussmann. The meeting with Sussmann ended at 2:30, his calendar showed, which is what the “doctored” chain of custody document says. Immediately after that he had a meeting with someone named Rich.

In fact, per his calendar, Baker was busy straight through until 4PM (though it’s unclear from Baker’s calendar precisely when the meeting with Rich happened). And the first Deputies Committee meeting after his meeting with Sussmann — which is the best explanation for Trisha Anderson’s notes — happened the next day, on September 20.

I haven’t yet seen how Sussmann’s lawyers got this into evidence yesterday (I’m still working through the morning transcript). But it’s possible that Baker never refreshed his memory with this calendar.

That’s because this calendar was extracted from Baker’s Samsung phone by DOJ Inspector General’s Office back in 2018. This is the phone that Durham had been told about in real time in 2018 (when Durham was investigating Baker for something else), but nevertheless didn’t think to look for the phone before charging Sussmann, and so only found it four months after the indictment.

When confessing all this confusion to Judge Cooper (as I explained in this post), Durham explained he hadn’t taken the basic investigative step of reviewing the contents of Baker’s phone before charging Sussmann because his memory didn’t go back four whole years — or even two, which is when Durham started interviewing Baker in this investigation.

Paragraph 10(a)(ii) states: “[I]n early January 2022, the Special Counsel’s Office learned for the first time that the OIG currently possesses two FBI cellphones of the former FBI General Counsel to whom the defendant made his alleged false statement, along with forensic reports analyzing those cellphones.” Id. The Government wishes to provide some additional context for this statement.

After reviewing the Special Counsel’s Office’s public filing, the DOJ Office of Inspector General (“OIG”) brought to our attention based on a review of its own records that, approximately four years ago, on February 9, 2018, in connection with another criminal investigation being led by then-Acting U.S. Attorney Durham, an OIG Special Agent who was providing some support to that investigation informed an Assistant United Attorney working with Mr. Durham that the OIG had requested custody of a number of FBI cellphones. OIG records reflect that among the phones requested was one of the two aforementioned cellphones of the thenFBI General Counsel. OIG records further reflect that on February 12, 2018, the OIG Special Agent had a conference call with members of the investigative team, including Mr. Durham, during which the cellphones likely were discussed. OIG records also reflect that the OIG subsequently obtained the then-FBI General Counsel’s cellphone on or about February 15, 2018. Special Counsel Durham has no current recollection of that conference call, nor does Special Counsel Durham currently recall knowing about the OIG’s possession of the former FBI General Counsel’s cellphones before January 2022. [my emphasis]

Durham forgot that he knew about the phone.

And because he forgot that he knew about the phone until it was too late, it’s not actually clear whether Baker’s reconstructed memory has faced the fact that he could not have had a 30 minute meeting with Sussman followed by a 10 minute call with Priestap and still made his 2:30PM meeting with Rich.

And given that both Baker and Priestap have testified, it’s probably too late to doctor a new memory to explain this all.

OTHER SUSSMANN TRIAL COVERAGE

Scene-Setter for the Sussmann Trial, Part One: The Elements of the Offense

Scene-Setter for the Sussmann Trial, Part Two: The Witnesses

The Founding Fantasy of Durham’s Prosecution of Michael Sussmann: Hillary’s Successful October Surprise

With a Much-Anticipated Fusion GPS Witness, Andrew DeFilippis Bangs the Table

John Durham’s Lies with Metadata

emptywheel’s Continuing Obsession with Sticky Notes, Michael Sussmann Trial Edition

Brittain Shaw’s Privileged Attempt to Misrepresent Eric Lichtblau’s Privilege

The Methodology of Andrew DeFilippis’ Elaborate Plot to Break Judge Cooper’s Rules

Jim Baker’s Tweet and the Recidivist Foreign Influence Cheater

That Clinton Tweet Could Lead To a Mistrial (or Reversal on Appeal)

John Durham Is Prosecuting Michael Sussmann for Sharing a Tip on Now-Sanctioned Alfa Bank

Apprehension and Dread with Bates Stamps: The Case of Jim Baker’s Missing Jencks Production

Technical Exhibits, Michael Sussmann Trial

Brittain Shaw’s Privileged Attempt to Misrepresent Eric Lichtblau’s Privilege

/11 Comments/in , , /by

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

In the first words of her opening argument in the Michael Sussmann case, Durham prosecutor Brittain Shaw argued that this case is all about Sussmann’s privilege, his purported ability to exploit high level ties at DOJ to seed what she claims would be a smear campaign against the guy who was, in fact, hiding secret communications with the Kremlin and soliciting hacks of his opponent.

The evidence will show that this is a case about privilege: the privilege of a well-connected D.C. lawyer with access to the highest levels of the FBI; the privilege of a lawyer who thought that he could lie to the FBI without consequences; the privilege of a lawyer who thought that for the powerful the normal rules didn’t apply, that he could use the FBI as a political tool.

The really painful irony of this case, though, is that Sussmann is being significantly hamstrung because of privilege, attorney-client privilege, because it is limiting his ability to present evidence about what really happened.

When Judge Christopher Cooper ruled that a subset of emails that had been protected under privilege were not, after all, he explained that, the documents, “do not strike the Court as being particularly revelatory.” Even so, Sussmann and Fusion can’t, ethically, simply offer up emails over which the Democrats are claiming privilege. There’s good reason to believe if they could, they could show that significant parts of Durham’s conspiracy theory have been based on imagining that Democrats were hiding the worst possible plotting behind privilege claims, when in fact the reality was much more mundane.

Take two exhibits from the trial as an example. Durham is making much of a September 15, 2016 email from Marc Elias to top people on the campaign. Its subject line was “Alfa article.” But it appears to be sharing an article about “testimony of an oil trader.” If Sussmann could share it, it might simply show that Elias had seen an article about corruption and seen some tie with the Alfa Bank allegations. He can’t, because Elias is the one who made that connection.

Meanwhile, two exhibits Sussmann introduced into evidence show Robby Mook — who is not a lawyer — sharing Sidney Blumenthal “intelligence” with him that the Trump campaign was freaking out because they had gotten advance word of a NYT article about Trump’s ties with Russia.

The Trump campaign is having “a major league freak-out,” according to a Republican source who has been reliable in the past. What is causing the Trump “freak-out” is anticipation of an investigative story to be published by the New York Times. The subject is described as “Russia” and “a disaster.” “That is completely the story of everything going on since Thursday,” insists the source. The Times story, says the source, accounts for Tramp’s extraordinarily defensive aggressive reactions–his declaration that he will sue the New York Times, his personal tweeting attack on Maureen Dowd as “wacky” and a neuSidney rotic dope,” (though the source says “that’s just him anyway”), his call for the assassination of HRC, and the campaign’s push to the media of the flat-out lie that I was behind birtherism in 2008. On Saturday night, Trump tweeted: “My lawyers want to sue the tailing @nytimes so badly for irresponsible intent. I said no (for now), but they are watching. Really disgusting.” Trump did not specify why the Times might be guilty of”irresponsible intent,” which in any case lacks any legal weight. Earlier on Saturday, he tweeted that the Times was “a laughingstock rag.” The atmosphere inside the campaign is described as chaotic, frenetic and “spontaneous.” Bannon and Bossie are said to be grasping at anything to throw back in order to distract from and fend off the coming story. Journalistic sources have independently said that reporters at the Times are working on a Tromp-Russia story.

It wouldn’t be a high profile political trial, I guess, if Sid Blumenthal didn’t make a showing. Note that Mike Flynn’s Mueller interviews show him responding to some Sid Blumenthal stuff in precisely this period, so it’t clear Sid was talking to Republicans.

Anyway, that part — Blumenthal sharing with Mook — was not privileged. And that part makes it clear that Elias was right to be concerned about Trump suing if the Hillary campaign made factual observations about his ties with Russia. It also may (though this is uncertain) back Sussmann’s understanding that Eric Lichtblau was close to publishing the Alfa story, so close that Trump’s moles at the NYT had alerted him to it. But whatever Mook said about it to Elias, the campaign’s lawyer guarding against lawsuits, is privileged, as whatever Elias said to Sussmann and the Fusion guys when he forwarded Mook’s comment would be.

Whatever was said may have influenced Sussmann’s decision to go to the FBI, though, as this was shortly before he texted Jim Baker and asked to meet.

In his testimony, Elias stated that he had not given Sussmann permission to go to the FBI with the Alfa Bank story. He doesn’t think he knew until shortly afterwards, though could have learned before (the Blumenthal story may serve to explain a call that Sussmann knows prosecutors plan to dramatically reveal).

You testified that you became aware that Mr. Sussmann went to the FBI. Correct?

A. Yes.

Q. And your testimony was that you think that you were told right after, although there’s a possibility it was right before?

A. Yes.

Q. Your best recollection is which of those?

A. Is after.

Q. Okay. Did you tell him to go to the FBI?

A. No.

Q. Did he seek your permission to go to the FBI?

A. No.

Q. Did you authorize him to go to the FBI?

A. No.

Q. Are you aware of anyone at the Clinton Campaign that authorized Mr. Sussmann to go to the FBI to share the possibility of The New York Times story?

A. Not that I’m aware of. No.

Q. Did you consent to his going to the FBI?

A. No, not that I remember. No.

Elias even explained what a colossally bad idea it would be for a candidate whose campaign had been badly damaged by Jim Comey to go to the FBI.

A. First of all, the FBI had in my view not been particularly helpful in investigating or doing anything to prevent the leaks of the emails. The exfiltration is one thing, you know, the stealing of the emails. But the publication of the emails, it was not just this one time. I mean, we were dealing with multiple publications of emails. And it was not just this one client.

And I think my sense was that the FBI was not for a variety of reasons going to do anything that was going to be — like stop bad things from happening, which would be one reason to go for the FBI.

The second, which is more unique to the Clinton Campaign, is that I think he was then the FBI director, but James Comey had taken public stances in around that time period that were in my view unfair and putting a thumb on the scale against Secretary Clinton.

So I’m not sure that I would have thought that the FBI was going to be — give a fair shake to anything that they viewed as anti-Trump or pro-Clinton.

And then the final thing is that if The New York Times was going to run this story, like that’s the goal. Right? The New York Times runs the story. If you get the FBI involved, any number of things could prevent that from happening. Right?

In the most extreme instance, the FBI can go to the publication and say: Please don’t. But the second is, the newspaper itself might then want to do further reporting on the FBI investigation and delay its story. Right?

So, like, even in a world in which, like, the FBI is being helpful — not being helpful; even in a world in which the FBI is doing stuff, the media may not run the story because they want to get the full picture because they view the FBI piece of it as an essential piece of the story.

It’s certainly possible that, given this advance warning of a Trump shit-storm, Sussmann decided it would be best to give FBI a head’s up. Sussmann, however, can’t ethically share the communications between Elias and him, even if it would help him. That’s how privilege works.

With that in mind, consider what Shaw said in Durham’s bid to keep Eric Lichtblau off the stand (this appears to have been filed two days after Judge Cooper ordered it, but one of the Durham lawyers has had a family emergency so they may have gotten an extension).

After explaining that prosecutors need to question Lichtblau about things the scope of which have been specifically excluded in the trial, a footnote claims that they won’t violate Judge Cooper’s rules about such things (they have, serially, during the trial).

The government should be permitted to cross-examine Lichtblau about any communications he had with other individuals, including, but not limited to, Fusion GPS personnel and computer researchers, regarding the alleged connections between the Trump Organization and Alfa bank. To the extent Sussmann, Fusion GPS, or others (including computer researchers) approached or communicated with Lichtblau concerning Alfa Bank or related matters, the government should be permitted to question Lichtblau about such exchanges, as they are relevant to the defendant’s communications with Lichtblau on these same issues and are probative of the defendant’s alleged actions on behalf of clients (Rodney Joffe and the Clinton Campaign). The government also intends to cross-examine Lichtblau on issues pertaining to the credibility and reliability of his testimony. 1

[snip]

If Fusion GPS (which was hired by the defendant’s firm on behalf of the Hillary for America Campaign) and other persons known to Joffe and/or Sussmann similarly supplied opposition research-type information to Lichtblau regarding the Trump Organization as a part of a coordinated effort, this would be relevant to demonstrate that Sussmann was not acting merely as a concerned citizen trying to help the FBI when he met with FBI General Counsel and that his contrary representations were false. Indeed, the Government is aware that Sussmann and Joffe did enlist and/or task one or more other computer researchers to communicate with the media (including Lichtblau) concerning these matters

1 The government will abide by the Court’s order of May 7, 2022 and, in accordance with that order, will not “put on extensive evidence” about the accuracy of the data provided by Sussmann or his clients to the FBI, Lichtblau, or others. See Op. & Order (“In Limine Order”) at 5, ECF No. 121. [my emphasis]

Here, Shaw states as fact that the computer research was opposition research. It was not.

I am 100% certain that if Lichtblau could testify about all the people he spoke with on this story, he could explain that many if not most of the people involved — as well as a bunch of other people, including at least one whom prosecutors have affirmatively claimed did not have a role in chasing down this anomaly — believed the anomaly was real and were motivated out of a genuine alarm about the Russian attack that year. Yes, the NYT found people who pushed back (more so after the FBI killed the story). But that’s what makes Lichtblau’s work reporting, not opposition research.

If Lichtblau is able to testify, he could also provide a key piece of important context to evidence the government has already presented. Yesterday, Jim Baker described how, starting on September 21, he reached out to Sussmann for the name of the reporter working on the story.

Baker provided Lichtblau’s name to Bill Priestap before noon on September 22. But Lichtblau didn’t meet with the FBI until Monday, September 26.

We know that in between, the FBI called Cendyn, leading them to alter their DNS address, and the NYT called a representative for Alfa Bank which later — NYT believed, at least — led Alfa to alter their DNS address. The NYT believed that there was a response from Alfa that indicated they were trying to hide this activity.

A key part of Durham’s claim is that NYT wasn’t close to publishing when Sussmann went to the FBI and that Sussmann was, instead, trying to provide urgency for the story. That doesn’t accord with my understanding and it doesn’t accord with what Dexter Filkins has written. Durham can keep telling it so long as Lichtblau doesn’t testify.

One thing that happened, though — in addition to initial contacts that would have alerted Lichtblau that the FBI didn’t want him to publish — was the response to those calls after Sussmann and Joffe decided to share Lichtblau’s name. There was new news that Lichtblau had to try to understand that created a new delay.

As with Sussmann, it would be nice for Lichtblau if he could describe all the efforts he made to verify the story. If he could, it would demonstrably undercut several of the claims Durham is making. He can’t, because he has separate confidentiality agreements with those other sources.

Shaw, who accuses Sussmann of being privileged, completely flips how privilege works on its head (including by mis-citing the David Tatel concurrence in the Judy Miller subpoena, which as I understand it would support Lichtblau making the call about the scope of his testimony). She ties it to a topic rather than a privileged relationship to accuse Lichtblau of trying to selectively pick which parts of the story he can tell.

The D.C. Circuit has “declined to adopt a selective waiver doctrine” in the context of attorney-client communications that “would allow a party voluntarily to produce documents covered by the attorney-client privilege to one party and yet assert the privilege as a bar to production to a different party.” United States v. Williams Companies, Inc., 562 F.3d 387, 394 (D.C. Cir. 2009). “The client cannot be permitted to pick and choose among his opponents, waiving the privilege for some and resurrecting the claim of confidentiality to obstruct others.” Permian Corp. v. United States, 665 F.2d 1214, 1221 (D.C. Cir. 1981). Privilege holders must instead “treat the confidentiality of attorney-client communications like jewels—if not crown jewels” because courts “will not distinguish between various degrees of ‘voluntariness’ in waivers of the attorney-client privilege.” In re Sealed Case, 877 F.2d 976, 980 (D.C. Cir. 1989).

This principle—which restricts a privilege of “ancient lineage and continuing importance,” In re Sealed Case, 877 F.2d at 980—necessarily governs the novel and qualified reporter’s privilege advanced in this case. Sussmann subpoenaed Lichtblau to appear as a witness and Lichtblau has not moved to quash. Lichtblau and defendant Sussmann cannot “tactical[ly] employ[]” the asserted privilege to pick and choose the topics that may be put to Lichtblau on the witness stand. Permian Corp., 665 F.2d at 1221. Privileges are not “tool[s] for selective disclosure.” Ibid

I get why someone in the grips of a fevered conspiracy theory would make this argument. Durham believes that everyone involved with the Alfa Bank story was part of the same malicious conspiracy targeting poor Donald Trump, even though DOJ has in its possession abundant proof that’s false. Yet even in this case, Cooper has distinguished between the privileged relationships that Joffe has with what the Democrats have, and he has also pointed to affirmative evidence that this wasn’t one big conspiracy.

But Shaw would have you believe that Lichtblau’s privilege obligations are tied to a project, a story, and not a bunch of individuals, many of whom he had existing relationships with well before this story.

A lawyer not in the grip of a fevered conspiracy theory, however, would understand that that kind of privilege doesn’t make you special, it creates an obligation, even if the obligation prevents you from using your profession from helping yourself.

emptywheel’s Continuing Obsession with Sticky Notes, Michael Sussmann Trial Edition

/15 Comments/in , /by

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

Longtime readers of emptywheel are no doubt familiar with my obsession with the weird prevalence of sticky notes that appear on exhibits used by prosecutors Bill Barr appointed to launch politicized witch hunts. These posts provide a background, but the tl;dr is that I caught the Jeffrey Jensen crew adding dates on sticky notes, some inaccurate, to FBI notes as part of the effort to kill the Mike Flynn prosecution.

The Jeffrey Jensen “Investigation:” Post-It Notes and Other Irregularities (September 26, 2020)

Shorter DOJ: We Made Shit Up … Please Free Mike Flynn (October 27, 2020)

John Durham Has Unaltered Copies of the Documents that Got Altered in the Flynn Docket (December 3, 2020)

John Durham Is Hiding Evidence of Altered Notes (April 5, 2022)

As I noted here, there some reason to believe Durham’s evidence comes from the same collection of documents as Jeffrey Jensen’s.

Durham released the trial versions of Bill Priestap and Trisha Anderson’s notes yesterday. So without further commentary (for now), I’d like to post how these notes appeared in the filing he used to get the notes admitted in the first place with what the jury will see.

Priestap notes motion version

Priestap notes trial exhibit version

Anderson notes motion version

Anderson notes trial exhibit version

Scene-Setter for the Sussmann Trial, Part One: The Elements of the Offense

/46 Comments/in , , /by

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

In the first of what will be a number of “scene-setters” for the Michael Sussmann trial next week, Devlin Barrett makes two significant errors. First, he misrepresents what Sussmann said in a text to James Baker on September 18, 2016.

In a text message setting up the meeting, Sussmann claimed he was not representing any particular client in bringing the matter to the FBI’s attention.

Here’s what the text says:

Jim – it’s Michael Sussmann. I have something time-sensitive (and sensitive) I need to discuss. Do you have availibilty [sic] for a short meeting tomorrow? I’m coming on my own – not on behalf of a client or company – want to help the Bureau. Thanks.

[I’m unclear whether the misspelling of “availability” is Sussmann’s or Durham’s.]

The distinction between “representing” and “on behalf of” will be a core issue litigated in this trial (as I’ll lay out below), which makes Barrett’s sloppiness affirmatively misleading.

Second, Barrett serially accepts Durham’s framing — that the cybersecurity researchers who started identifying the Alfa Bank anomaly months before Rodney Joffe ever talked to Michael Sussmann were doing “campaign research.”

The two-week trial will delve into the murky world of campaign research, lawyers and the role the FBI played in that election, as Trump and Hillary Clinton vied for the presidency, and federal agents pursued very different investigations surrounding each of them.

[snip]

Prosecutors signaled this week that they plan to call a host of current and former law enforcement officials to describe how the FBI pursued the Alfa Bank accusations, and to paint Sussmann as part of a “joint venture” that included Joffe, Clinton’s campaign, research firm Fusion GPS and cybersecurity experts.

[snip]

Cooper, however, has limited how deeply Durham’s team may go into the particulars of any alleged joint venture among Democratic operatives, ruling that he will not allow “a time-consuming and largely unnecessary mini-trial to determine the existence and scope of an uncharged conspiracy to develop and disseminate the Alfa Bank data.”

Barrett does this in spite of the fact that Durham has repeatedly said the only evidence he has supporting his joint venture conspiracy theory (even assuming it were illegal) is billing records. While Barrett cites the gist of Cooper’s ruling excluding Durham’s unsubstantiated claims of a “joint venture,” he doesn’t quote Cooper noting that, “some evidence suggests that Fusion GPS employees had no connection to the gathering or compilation of the Alfa Bank data.” Effectively, an experienced DOJ reporter has fallen for Durham’s use of unsubstantiated materiality claims to frame a prosecution that didn’t charge the underlying conspiracy. That’s a real disservice to readers who don’t know the difference between uncharged materiality claims and a charged conspiracy.

So here’s my effort to explain to newbies what the trial is about. Durham has to prove that:

  • Michael Sussmann said what Durham claims Sussmann did to James Baker on September 19, 2016
  • What he said was a lie
  • The alleged lie was material to the functioning of the FBI

Durham has to prove that Sussmann said what Durham claims he did on September 19, 2016

From the start, Durham has been uncertain what lie Sussmann told. As Sussmann pointed out in a motion for a bill of particulars right from the get-go, at various points in the indictment, Durham claimed that Sussmann’s lie was:

  • “that he was not doing his work on the aforementioned allegations ‘for any client'” (one)
  • “that he was not acting on behalf of any client” (one, two)
  • that he was not “acting on behalf of any client conveying particular allegations concerning a Presidential candidate” (one)

That is, repeatedly in the indictment, Durham was conflating the “work” of chasing down the allegations (which is not at issue in this prosecution at all) with the meeting where Sussmann shared those allegations with the FBI. The last formulation is what Durham charged, but as we’ll see, unless Durham supersedes this indictment today, he may have problems with that formulation as well.

Almost six months after Durham charged Sussmann for lying about sharing allegations on September 19, he got rock-solid proof — a text from Sussmann to Baker that Durham only found because Sussmann kept asking Durham to go back and look for these records — that Sussmann said, he was “coming on my own – not on behalf of a client or company – want to help the Bureau,” on September 18.

That rock-solid proof actually presents two problems for Durham. First, it raises the possibility that, even if the jury decides this was a lie, Durham can only prove Sussmann said it on September 18, not September 19. But the text also suggests what Sussmann may have meant by “on behalf of:” who benefits. He was not seeking a benefit for a client, he was trying to benefit the FBI.

That interpretation is consistent with what Sussmann said under oath in 2017, and it is an interpretation that Durham did not test before he charged Sussmann.

I was sharing information, and I remember telling him at the outset that I was meeting with him specifically, because any information involving a political candidate, but particularly information of this sort involving potential relationship or activity with a foreign government was highly volatile and controversial. And I thought and I remember telling him that it would be a not-so-nice thing ~ I probably used a word more stronger than “not so nice” – to dump some information like this on a case agent and create some sort of a problem. And I was coming to him mostly because I wanted him to be able to decide whether or not to act or not to act, or to share or not to share, with information I was bringing him to insulate or protect the Bureau or — I don’t know. just thought he would know best what to do or not to do, including nothing at the time.

And if I could just go on, I know for my time as a prosecutor at the Department of Justice, there are guidelines about when you act on things and when close to an election you wait sort of until after the election. And I didn’t know what the appropriate thing was, but I didn’t want to put the Bureau or him in an uncomfortable situation by, as I said, going to a case agent or sort of dumping it in the wrong place. So I met with him briefly and

[snip]

so I told him this information, but didn’t want any follow-up, didn’t ~ in other words, I wasn’t looking for the FBI to do anything. I had no ask. I had no requests. And I remember saying, I’m not you don’t need to follow up with me. I just feel like I have left this in the right hands, and he said, yes. [my emphasis]

As has been explained over and over, Jim Baker’s testimony about what Sussmann said to him on September 19 (as opposed to what Sussmann texted him on September 18) has been all over the map:

Durham will argue that he got Baker’s testimony to match what he, Durham, claims to be sure is the truth by refreshing his memory with notes that Bill Priestap and Trisha Anderson took, the former when Baker told him about the meeting immediately afterwards and the latter in circumstances that are less clear.

The Priestap notes say four things:

  • Represent DNC, Clinton Foundation etc
  • Been approached by prominent cyber people
  • NYT, Wash Post, or WSJ on Friday
  • [Written slantways for reasons Priestap could not explain] said not doing this for any client

The Anderson notes say two things:

  • No specific client but group of cyber academics talked with him about research
  • Article this Friday, NYT/WPost [the notes fade out]

None of those notes say “on behalf of,” Anderson’s don’t address whether Sussmann offered up the claim or not, and Priestap seems to have written “not doing this for any client” after the fact, as if it wasn’t part of Baker’s initial telling.

None of those notes make it clear what part of the information Baker passed on came from the meeting itself and what part came from the text he had received the day before (and indeed, Priestap’s slantways note may suggest the detail about a client could have come later). Durham only has a refreshed memory of what Baker knew by September 19, not which parts he learned on September 18 and which he learned on September 19.

Literally six months after indicting Sussmann, Durham gave him different sets of notes recording how Andy McCabe explained the allegations to Dana Boente on March 6, 2017.

One set, from Tashina Gauhar’s notes, says this:

“Attorney” Brought to FBI on behalf of his client

Also advised others in media > NYT

Another set, from Mary McCord’s notes, says this:

First brought to FBI att by atty

[snip]

Attorney brought to Jim Baker + d/n say who client was. Said computer researchers saw the [activity?]. Said media orgs had the info, including NY Times.

These notes admittedly reflect what the FBI came to understand, possibly in the September 19 meeting, possibly hours after the September 19 meeting, possibly days, possibly months. But as McCord recorded it, the emphasis remained on the computer researchers and the NYT. That emphasis is important for materiality questions.

Durham has to prove what Sussmann said was a lie

Next, Durham has to prove that what Sussmann said was an intentional lie.

Probably, Durham will use the formulation Sussmann sent in his September 18 text, “I’m coming on my own – not on behalf of a client or company – want to help the Bureau,” since that’s the only thing he has real proof of. This is why Sussmann tried to nail down Durham on what “on behalf of” shortly after being charged. Because it could mean, “on the orders of,” “for a client I am retained by,” or “seeking some benefit or ask for.”

But Sussmann’s explanation, “want to help the Bureau,” tied as it is to some benefit for the FBI, presents new problems for Durham. As noted above, that’s precisely what Sussmann said in sworn testimony back in 2017, when he had no reason to believe there would ever be a special prosecutor checking his claims and at a time he no longer had that text to check. Sussmann framed it in terms of giving the FBI maximal flexibility during campaign season.

Importantly, Sussmann did take steps to help the Bureau, by (with Joffe’s assent), helping the FBI kill the story the NYT was close to publishing. Which is another thing Sussmann described when he testified under oath in 2017 and another thing Durham didn’t bother to investigate before indicting.

I just wanted to tell you about a phone call that I had with him 2 days after I met with him, just because I had forgotten it When I met with him, I shared with him this information, and I told him that there was also a news organization that has or had the information. And he called me 2 days later on my mobile phone and asked me for the name of the journalist or publication, because the Bureau was going to ask the public — was going to ask the journalist or the publication to hold their story and not publish it, and said that like it was urgent and the request came from the top of the Bureau. So anyway, it was, you know, a 5-minute, if that, phone conversation just for that purpose.

Along with the September 18 text showing Sussmann told Baker he wanted to help the FBI, there were several texts reflecting that when Baker asked Sussmann for the name of the outlet that was reporting on the Alfa Bank allegations, Sussmann told Baker he had to ask someone before sharing the name.

Those text messages include, among other things, texts indicating that Mr. Sussmann asked to meet with Mr. Baker in September 2016 not on behalf of a client but to help the Bureau; texts indicating that Mr. Sussmann told Mr. Baker he had to check with someone (i.e., his client) before giving him the name of the newspaper that was about to publish an article regarding the links between Alfa Bank and the Trump Organization; and other texts, including a copy of a tweet that then-President Trump posted regarding Mr. Sussmann.

Then, Sussmann and Baker spoke on the phone several times on September 21 and 22.

Mr. Sussmann and Mr. Baker also had several phone conversations over the course of that week, including on Wednesday, September 21 and on Thursday, September 22.

We’ll learn more details at the trial, but we know that Baker and Bill Priestap called the NYT and got them to kill the story.

One reason this is important is because — as Sussmann’s attorney noted in a recent hearing — this is the opposite of what Sussmann would have done if he was working on behalf of the campaign.

We expect there to be testimony from the campaign that, while they were interested in an article on this coming out, going to the FBI is something that was inconsistent with what they would have wanted before there was any press. And in fact, going to the FBI killed the press story, which was inconsistent with what the campaign would have wanted.

The decision to go to the FBI contravened Hillary’s best interest.

The other reason those exchanges are important is because, as Sussmann pointed out, the best explanation for how Andy McCabe (that “top of the Bureau” that decided to take steps to kill the story) came to learn that Sussmann did have a client was via those exchanges.

The FBI could not have come to that belief based on conversations they had with Mr. Sussmann after his phone calls with Mr. Baker the week of September 19, 2016, because the FBI chose not to interview Mr. Sussmann about the information he provided to Mr. Baker, and the FBI chose not to ask Mr. Sussmann about or interview the cyber experts whom Mr. Sussmann identified as the source of the information he shared with the FBI.

Indeed, that timeline may explain why Baker’s memories about this are so inconsistent: because what Sussmann told him on September 18, what he told him on September 19, and what he told him on September 21 have all blended into one.

In any case, though, the best evidence suggests the FBI probably learned Sussmann had a client within three days of the time Sussmann first brought the allegations to the FBI (because that was the last he spoke with the FBI). That undermines Durham’s claim that Sussmann was hiding some big conspiracy. Within days, he appears to have made it obvious he did have a client.

Durham has to prove the alleged lie was material to the functioning of the FBI

I’m not going to get too far into the work Durham will have to do to prove that Sussmann’s lie — if he can prove what Sussmann said, if he can prove Sussmann said it on September 19 and not September 18, and if he can prove it really was a lie — had the ability to affect the decisions the FBI could have made.

Sussmann has many ways to attack Durham’s materiality argument. He’ll do so by proving:

  • FBI knew he represented the Democrats (indeed, that’s what Priestap’s notes say)
  • FBI knew of his ties to Joffe
  • His characterization that this came from cybersecurity experts was true
  • After the Franklin Foer piece was published, a separate FBI Agent attempted to open an investigation (showing what would have happened if Sussmann had not shared the information and just let NYT publish)

If I were him, I would also point to all the evidence (including from the March 2017 notes) that what most mattered to the FBI was not whom his client was but that the NYT was going to publish this.

But, given the timeline laid out by Sussmann’s texts and calls with James Baker, I’d make one more point. All the evidence suggests that FBI knew he had a client by September 22 — probably by September 21.

The FBI Agents who will describe the steps they took will apparently describe making a second call to Cendyn on September 23.

That is, the timeline will show that FBI learned Sussmann had a client before they even spoke to Cendyn a second time.

If Sussmann’s client or clients mattered, the FBI learned about them so early in the process that it would not have affected the overall investigation.

Durham’s tactical retreat

I know a lot of people think Durham has a slam-dunk case with that September 18 text, but that’s simply not the case — though as always, you never know what a jury is going to decide.

But I think that Durham is already planning a tactical retreat.

As Sussmann noted in a recent filing summarizing conflicting views on jury instructions, Durham’s indictment describes Sussmann’s alleged lie this way:

[O]n or about September 19, 2016, the defendant stated to the General Counsel of the FBI that he was not acting on behalf of any client in conveying particular allegations concerning a Presidential candidate, when in truth, and in fact, and as the defendant knew well, he was acting on behalf of specific clients, namely, Tech Executive-1 and the Clinton Campaign.

Never mind that Durham characterized the allegations as pertaining to “a Presidential candidate,” which presents other problems for Durham, he has also accused Sussmann of lying about having two clients.

Mr. Sussmann proposes modifying the last sentence as follows, as indicated by underlining: Specifically, the Indictment alleges that, on or about September 19, 2016, Mr. Sussmann, did willfully and knowingly make a materially false, fictitious, and fraudulent statement or representation in a matter before the FBI, in violation of 18 U.S.C. § 1001(a)(2), namely, that Mr. Sussmann stated to the General Counsel of the FBI that he was not acting on behalf of any client in conveying particular allegations concerning Donald Trump, when, in fact, he was acting on behalf of specific clients, namely, Rodney Joffe and the Clinton Campaign.5 The government objects to the defense’s proposed modification since it will lead to confusion regarding charging in the conjunctive but only needing to prove in the disjunctive.

4 Authority: Indictment.

5 Authority: Indictment.

Durham’s language about “conjunctive” versus “disjunctive” will likely be the matter for heated debate next week. Particularly in the wake of Cooper’s decision that the materials from the researchers won’t come in as evidence, Durham seems to be preparing to prove only that Sussmann lied about representing Hillary, and not about Joffe. Sussmann, meanwhile, seems to believe that Durham will have to prove that his alleged lie was intended to hide both alleged clients.

The problem with Durham’s fall-back position is that if Sussmann really were representing Hillary at that FBI meeting, he wouldn’t have killed the NYT story that would have helped her campaign.

Update: Corrected date on Sussmann’s HPSCI interview, which was 2017.

Thirty Months after Disputing Michael Horowitz, Durham’s Team Suggests They’ve Never Looked at the Evidence

/32 Comments/in , , /by

In Michael Sussmann’s filing explaining that he couldn’t include highly exculpatory notes — written by Tashina Gaushar, Mary McCord, and Scott Schools — from a March 6, 2017 meeting in his motion in limine because John Durham had provided them to him too late to include, Sussmann claimed that the files were not among those for which Durham had gotten permission to provide late.

The Special Counsel neglects to mention that these handwritten notes were buried in nearly 22,000 pages of discovery that the Special Counsel produced approximately two weeks before motions in limine were due. Specifically, the Special Counsel produced the March 2017 Notes as part of a March 18, 2022 production. The Special Counsel included the March 2017 Notes in a sub-folder generically labeled “FBI declassified” and similarly labeled them only as “FBI/DOJ Declassified Documents” in his cover letter. See Letter from J. Durham to M. Bosworth and S. Berkowitz (Mar. 18, 2022). And although the Special Counsel indicated on a phone call of March 18, 2022 that some of the 22,000 pages were documents that made references to “client,” he did not specifically identify the March 2017 Notes or otherwise call to attention to this powerful exculpatory material in the way that Brady and its progeny requires.

[snip]

[T]he Special Counsel has also failed to explain why this powerful Brady material was produced years into their investigation, six months after Mr. Sussmann was indicted, and only weeks before trial.3

Sussmann was wrong.

When Durham got an extension to his discovery deadlines, he got special permission to turn over (among other things) materials from DOJ IG at a later date.

DOJ Office of Inspector General Materials. On October 7, 2021, at the initiative of the Special Counsel’s Office, the prosecution team met with the DOJ Inspector General and other OIG personnel to discuss discoverable materials that may be in the OIG’s possession. The Special Counsel’s office subsequently submitted a formal written discovery request to the OIG on October 13, 2021, which requested, among other things, all documents, records, and information in the OIG’s possession regarding the defendant and/or the Russian Bank-1 allegations.

[I]n January 2022, the OIG informed the Special Counsel’s Office for the first time that it would be extremely burdensome, if not impossible, for the OIG to apply the search terms contained in the prosecution team’s October 13, 2021 discovery request to certain of the OIG’s holdings – namely, emails and other documents collected as part of the OIG’s investigation. The OIG therefore requested that the Special Counsel’s Office assist in searching these materials. The Government is attempting to resolve this technical issue as quickly as possible and will keep the defense (and the Court as appropriate) updated regarding its status.

In the pre-trial hearing on Monday, Andrew DeFilippis explained that the files came from DOJ IG (and therefore were subject to that later discovery deadline).

We located those statements in the notes in February or early March, when we received a huge production from the DOJ Inspector General’s office. As soon as we noticed that in the notes, we put them on very rapid declassification at the FBI and turned them over to the defense about a week later.

DeFilippis offered an unconvincing excuse for burying belatedly provided Brady material two layers deep in file folders without specific notice. He described the decision to flag the materials as an internal Government decision, which is an odd description unless Michael Horowitz’s office — or those involved in declassifying the records — forced the decision:

We then, speaking internally as the Government, decided it would be important to flag those notes for the defense. And so the day that we produced them, we got on a call. We wanted to be in a position to flag it in a way that we didn’t just put it in the end of a paragraph of a discovery letter. We flagged for the defense that we were going to be producing notes and that that included notes in which the word “client” appeared. And we told them that we thought that would be relevant to them.

[snip]

Let me just say that there was absolutely no effort by the Government to delay here or to hide these in a large production. That is precisely why we got on a phone call and flagged it for the defense.

It’s almost like DeFilippis was hoping this would get no notice.

I can understand why. I’ve described how astounding it was that Durham did not go looking for evidence from DOJ IG until — by Durham’s own telling — October 7, more than two weeks after indicting Sussmann (and likely not long enough before indicting Igor Danchenko to learn key details that undermine at least one charge against him).

But this late provision of exculpatory evidence means one of two things:

  • Durham has always had the files, but did such a poor job of looking for it in discovery he didn’t find it in his own files even as he started hunting Michael Sussmann
  • Durham never had these files

The latter is the more likely possibility, which, as a threshold matter, would mean Durham never reviewed key files that DOJ IG had used in high level witness interviews before disputing Michael Horowitz’ conclusion that the investigation was predicated appropriately. Durham is, literally, only reviewing key files three years into his investigation.

Along the way, he’s learning that conspiracy theories he has been chasing for months and years are false.

The revelation that Durham is discovering exculpatory information in DOJ IG’s files is as important to the efforts to blow up the Mike Flynn prosecution two years ago as it is to the Sussmann prosecution. That’s because the Jeffrey Jensen review of the Flynn prosecution and the Durham investigation were believed to be closely aligned. Indeed, I have shown that the handwritten notes from the FBI that Durham will rely on at trial show the same markers of unreliability that documents that were altered in the Flynn case had.

As I explained in this post, Jensen’s documents started with the Bates stamp used throughout the Flynn prosecution.

But after a period of time, they used a Bates stamp with a different typeface, albeit continuing the same series, suggesting someone else was doing the document sharing.

But if they’re drawing on the same source documents, Durham should at least know notes of that meeting exists. Jeffrey Jensen received and relied on at least one set of notes — Jim Crowell’s notes — from the March 6, 2017 meeting. Those notes, along with Tashina Gauhar’s notes of an earlier briefing and all those that got altered, also have the fat typeface.

The Tashina Gauhar notes turned over to Sussmann (and the others turned over) not only are based off a scan of her original notes and have no post-it notes on them, but they bear both Durham’s Bates stamp (SCO-074095), but also one that likely comes from DOJ IG (SCO-FBIPROD_021529).

All of which seems to suggest there was the same cherry-picking that went into the Durham investigation and the Jensen “review.” Neither reviewed — neither could have!! — what really happened. They reviewed selected records and then (in the Jensen review) altered those records to make false claims that the former President used in a debate attack.

I’ll come back to the issue of what appears in the notes Sussmann released that conflicts with the Flynn releases.

But I’m also interested that Durham is stalling on providing other notes from the meeting.

2 The defense has requested that the Special Counsel search for any additional records that may shed further light on the meeting and certain of those requests remain outstanding. To date, the Special Counsel has represented that the only additional notes from attendees at the meeting that he has identified do not reference whether or not Mr. Sussmann was acting on behalf of a client. The absence in those notes of any reference to whether Mr. Sussmann was acting on behalf of a client also raises questions regarding materiality of the charged conduct: if the on behalf of information were truly material to the FBI’s investigation, presumably all note takers would have written it down. [my emphasis]

Durham can’t be withholding notes because they don’t mention Sussmann having a client. That’s because Scott Schools’ notes mention that the Alfa Bank tip came from an attorney, but don’t mention that he was there on behalf of a client (Schools’ notes may have been included because they are the only ones of the three provided that attributed this discussion to Andy McCabe).

There are at least two other sets of notes from this meeting that are known or presumed to exist:

And there were at least three other people present at the meeting known to take notes:

  • Bill Priestap
  • Andy McCabe
  • Dana Boente

Importantly, in Durham’s objection to admitting these notes as evidence, he makes it clear that James Baker (inexcusably as a lawyer) did not take notes of this or any other meeting, but he does not say whether Priestap (or Trisha Anderson) took notes.

Moreover, the DOJ personnel who took the notes that the defendant may seek to offer were not present for the defendant’s 2016 meeting with the FBI General Counsel. And while the FBI General Counsel was present for the March 6, 2017 meeting, the Government has not located any notes that he took there.

If Priestap took notes, one copy should be in Durham’s possession, in the notebook of Priestap’s notes already on Durham’s exhibit list.

DOJ has been trying to prevent anyone from looking at Andy McCabe’s notes for some time.

But one thing that turning over the DOJ IG retained notes for the others will show is whether alterations in the Strzok, Priestap, and McCabe notes were made.

It’ll also make it easy to test why Jensen’s review redacted a date and added one — albeit the correct one — in the Jim Crowell notes.

 

That is, I wonder if Durhams’ reluctance to turn over those materials stems not from any facts about his own investigation, but from an awareness of the cherry-picking — and possibly worse — that having turned over the past one reveals.

Three posts on the altered documents from the Mike Flynn case

The Jeffrey Jensen “Investigation:” Post-It Notes and Other Irregularities (September 26, 2020)

Shorter DOJ: We Made Shit Up … Please Free Mike Flynn (October 27, 2020)

John Durham Has Unaltered Copies of the Documents that Got Altered in the Flynn Docket (December 3, 2020)

John Durham Is Likely to Supersede the Michael Sussmann Indictment

/67 Comments/in , /by

On Monday, both John Durham and Michael Sussmann submitted their motions in limine, which are filings to argue about what can be admitted at trial. They address a range of issues that I’ll cover in several posts:

Sussmann:

Durham wants to:

  • Admit witnesses’ contemporaneous notes of conversations with the FBI General Counsel
  • Admit emails referenced in the Indictment and other, similar emails (see this post)
  • Admit certain acts and statements (including the defendant’s February 2017 meeting with a government agency, his December 2017 Congressional testimony, and his former employer’s October 2018 statements to the media) as direct evidence or, alternatively, pursuant to Federal Rule of Evidence 404(b)
  • Exclude evidence and preclude argument concerning allegations of political bias on the part of the Special Counsel (addressed in this post)
  • Admit an October 31, 2016 tweet by the Clinton Campaign

I will link my discussions in serial fashion.

In his motions in limine submitted Monday, John Durham included a text Michael Sussmann sent to James Baker that he belatedly discovered on the Baker phone he never bothered to look for.

Jim – it’s Michael Sussmann. I have something time-sensitive (and sensitive) I need to discuss. Do you have availibilty for a short meeting tomorrow? I’m coming on my own – not on behalf of a client or company – want to help the Bureau. Thanks. (emphasis added).

The text seems really damning — and both Charlie Savage and the frothers have treated it as such.

But it creates one real problem and may not help as much as they assume.

That’s true, first of all, because Durham accused Michael Sussmann of lying to James Baker on September 19. He did not accuse him of lying on September 18. Every single witness Durham is relying on to prove this lie either doesn’t remember Baker relaying that Sussmann had claimed at the meeting not to be representing a client (as is the case for Bill Priestap and Trisha Anderson), or has given wildly conflicting testimony about it (as is the case for Baker). Durham can’t rule out that Sussmann did not repeat that claim at the meeting on September 19. And, indeed, that might explain why Baker’s testimony conflicted so wildly and also might explain why Priestap’s notes recording “said not doing this for any client” (note the apparent strike-out; h/t ML) appears to have been written after the fact.

Indeed the Priestap and Anderson notes Durham is fighting to rely on support an inference that the meeting emphasized the motive Sussmann said he had — to help the FBI. Both prominently focus on the upcoming NYT story, which is what Sussmann explained, in sworn testimony to HPSCI, he went to warn Baker about: that there would be an upcoming story that might be awkward for the FBI.

Q And when did that conversation occur on or about?

A Middle of September 2016.

Q And what did Mr. Baker advise you to do?

A Advise me to do?

Q Yeah. Or what was what did he – how did he respond to the information that you conveyed to him?

A He said thank you.

Q Did he offer any follow-on

A No.

Q engagements, or did he promise that he would pass it on?

A But to be clear, I told him I didn’t want any. I mean, I was sharing information, and I remember telling him at the outset that I was meeting with him specifically, because any information involving a political candidate, but particularly information of this sort involving potential relationship or activity with a foreign government was highly volatile and controversial. And I thought and I remember telling him that it would be a not-so-nice thing ~ I probably used a word more stronger than “not so nice” – to dump some information like this on a case agent and create some sort of a problem. And I was coming to him mostly because I wanted him to be able to decide whether or not to act or not to act, or to share or not to share, with information I was bringing him to insulate or protect the Bureau or — I don’t know. just thought he would know best what to do or not to do, including nothing at the time.

And if I could just go on, I know for my time as a prosecutor at the Department of Justice, there are guidelines about when you act on things and when close to an election you wait sort of until after the election. And I didn’t know what the appropriate thing was, but I didn’t want to put the Bureau or him in an uncomfortable situation by, as I said, going to a case agent or sort of dumping it in the wrong place. So I met with him briefly and

Q Did you meet — was it a personal meeting or a phone call?

A Personal meeting.

Q At the FBI?

A At the FBI. And if I could just continue to answer your question, and soI told him this information, but didn’t want any follow-up, didn’t ~ in other words, I wasn’t looking for the FBI to do anything. I had no ask. I had no requests. And I remember saying, I’m not you don’t need to follow up with me. I just feel like I have left this in the right hands, and he said, yes.

And FBI availed themselves of the help Sussmann offered, asking and getting him to share Eric Lichtblau’s name, thereby giving the FBI an opportunity to kill the story that Sussmann had directly seeded.

Q The conversations you had with the journalists, the ~

A Oh, excuse me. I did not recall a sort of minor conversation that I had with Mr. Baker, which I don’t think it was necessarily related to the question you ‘asked me, but I just wanted to tell you about a phone call that I had with him 2 days after I met with him, just because I had forgotten it When I met with him, I shared with him this information, and I told him that there was also a news organization that has or had the information. And he called me 2 days later on my mobile phone and asked me for the name of the journalist or publication, because the Bureau was going to ask the public — was going to ask the journalist or the publication to hold their story and not publish it, and said that like it was urgent and the request came from the top of the Bureau. So anyway, it was, you know, a 5-minute, if that, phone conversation just for that purpose.

Q Thats good to know. Was that information the same information that you talked to Mr. Baker about?

A Yes

Q Okay. So the FBI then — so, at some point, the FBI was very concerned about that actually appearing in the New York Times. Is that correct?

A Yes, yes. My understanding is they —

Q Did he explain why they were so concerned?

A No. He just didn’t want — just didn’t want it to be revealed publicly.

All the discussions about materiality should include the decision that FBI made: not just to open an investigation or not, but also to intervene and kill a damaging story about Trump.

This is one reason that April Lorenzen’s largely independent efforts to push this story (which Durham treats as part of the same conspiracy) are important. Because Sussmann’s efforts actually had the opposite effect of what Durham claims he wanted, a big story to sway the election.

Durham has an easy fix to his first problem though: He can simply supersede the indictment.

If I were him, especially if I were as much of a douchebag as he has been, I’d wait until after Christopher Cooper rules on the motions in limine to supersede, tailoring the charges that Durham will have to prove to those decisions.

Indeed, that may be one reason Sussmann cheekily submitted a redlined indictment as it would appear without all Durham’s conspiracy theorizing: to get Cooper to rule in on what a reasonable indictment would look like.

In any case, because that text creates temporal problems with the most compelling evidence that Durham has, I expect he’ll supersede the indictment before trial.

Update: Charlie Savage noted to me, persuasively, that the statute of limitation has expired on charging Sussmann with lying on September 18. I still would not be surprised if Durham attempted to fix this error by superseding, perhaps by adopting “on or about” language. But if Durham can’t include September 18 in his indictment, he may have a real problem.

Update: A reader notes that Durham’s filing claims that U.K. Person-1 — Christopher Steele — is referred to in the indictment.

For example, in the summer of 2016, the defendant met in Law Firm-1’s offices with the author of a now well-known dossier regarding Trump (referred to in the Indictment as “U.K. Person-1”) and personnel from the U.S. Investigative Firm.

He’s not in the known Sussmann indictment, as Sussmann notes in his counterpart filing.

The Special Counsel also indicated during a telephone conference on March 11, 2022 that he intends to introduce evidence and argument pertaining to reports and information that Christopher Steele separately provided to the FBI—i.e., the so-called “Steele Dossier.” Not only that, but the Special Counsel also produced witness statements for Mr. Steele pursuant to 18 U.S.C. § 3500, presumably because the Special Counsel seeks to call Mr. Steele as a witness at trial. However, the Indictment contains no reference to Mr. Steele or the inflammatory Steele Dossier. The Indictment similarly contains no allegations—nor is there any evidence of—Mr. Sussmann’s knowledge, awareness, or involvement in any of Mr. Steele’s efforts to provide information to the government.

I wonder if Durham asked to file the conspiracy charges he’s been pursuing between March 18 and March 23, but was denied, after which he filed his delayed 404(b) notice pertaining to Steele and Joffe.

The Guy Investigating the Claimed Politicized Hiring of a Special Counsel Insists that the Hiring of a Special Counsel Cannot Be Political

/16 Comments/in , , /by

On Monday, both John Durham and Michael Sussmann submitted their motions in limine, which are filings to argue about what can be admitted at trial. They address a range of issues that I’ll cover in several posts:

Sussmann:

Durham wants to:

  • Admit witnesses’ contemporaneous notes of conversations with the FBI General Counsel
  • Admit emails referenced in the Indictment and other, similar emails (see this post)
  • Admit certain acts and statements (including the defendant’s February 2017 meeting with a government agency, his December 2017 Congressional testimony, and his former employer’s October 2018 statements to the media) as direct evidence or, alternatively, pursuant to Federal Rule of Evidence 404(b)
  • Exclude evidence and preclude argument concerning allegations of political bias on the part of the Special Counsel (addressed in this post)
  • Admit an October 31, 2016 tweet by the Clinton Campaign

I will link my discussions in serial fashion.

Here’s how John Durham moved to exclude any evidence that his team was ordered to produce results in time for the 2020 election, bullied witnesses, or treated Hillary Clinton as a more dangerous adversary than Russia.

The Government expects that defense counsel may seek to present evidence at trial and make arguments that depict the Special Counsel as politically motived or biased based on his appointment by the prior administration. Notwithstanding the patently untrue nature of those allegations, such matters are irrelevant to this case and would create a substantial danger of unfair prejudice, confusion, and delay. In particular, the government seeks to preclude the defendant from introducing any evidence or making any argument concerning the circumstances surrounding the appointment of the Special Counsel and alleged political bias on the part of the Special Counsel’s Office. Indeed, the defendant has foreshadowed some of these arguments in correspondence with the Special Counsel and others, and their assertions lack any valid basis.

Only relevant evidence is admissible at trial. Fed. R. Evid. 402. The definition of relevance is inclusive, see Fed. R. Evid. 401(a), but depends on the possibility of establishing a fact that “is of consequence in determining the action,” Fed. R. Evid. 401(b). Evidence is therefore relevant only if it logically relates to matters that are at issue in the case. E.g., United States v. O’Neal, 844 F. 3d 271, 278 (D.C. Cir. 2016); see Sprint/United Management Co. v. Mendelsohn, 552 U.S. 379, 387 (2008). The party seeking to introduce evidence bears the burden of establishing relevancy. Dowling v. United States, 493 U.S. 342, 351 n.3 (1990).

Here, the defendant is charged with making a false statement to the FBI General Counsel in violation of 18 U.S.C. § 1001. A jury will have to decide only whether the defendant knowingly and willfully made a materially false statement to the FBI General Counsel. Nothing more, nothing less. Baseless political allegations are irrelevant to the crime charged. See, e.g., United States v. Regan, 103 F. 3d 1072, 1082 (2d Cir. 1997) (claims of Government misconduct are “ultimately separate from the issue of [a defendant’s] factual guilt”); United States v. Washington, 705 F. 2d 489, 495 (D.C. Cir. 1983) (similar). Evidence or argument concerning these issues should therefore be excluded. See Fed. R. Evid. 402; see, e.g., O’Neal, 844 F,3d at 278; United States v. Stone, 19 CR 18 (D.D.C. Sept. 26, 2019) ECF Minute Order (granting the government’s motion in limine to exclude evidence or argument regarding alleged misconduct in the government’s investigation or prosecution of Roger Stone).

The only purpose in advancing these arguments would be to stir the pot of political polarization, garner public attention, and, most inappropriately, confuse jurors or encourage jury nullification. Put bluntly, the defense wishes to make the Special Counsel out to be a political actor when, in fact, nothing could be further from the truth.11 Injecting politics into the trial proceedings is in no way relevant and completely unjustified. See United States v. Gorham, 523 F. 2d 1088, 1097-1098 (D.C. Cir. 1975) (upholding trial court’s decision to preclude evidence relevant only to jury nullification); see also United States v. Rushin, 844 F. 3d 933, 942 (11th Cir. 2016) (same); United States v. Castro, 411 Fed. App’x 415, 420 (2d Cir. 2011) (same); United States v. Funches, 135 F.3d 1405, 1408-1409 (11th Cir. 1998) (same); United States v. Cropp, 127 F.3d 354, 358-359 (4th Cir. 1997). With respect to concerns about jury nullification, this Circuit has opined:

[Defendant’s] argument is tantamount to the assertion that traditional principles concerning the admissibility of evidence should be disregarded, and that extraneous factors should be introduced at trial to become part of the jury’s deliberations. Of course a jury can render a verdict at odds with the evidence and the law in a given case, but it undermines the very basis of our legal system when it does so. The right to equal justice under law inures to the public as well as to individual parties to specific litigation, and that right is debased when juries at their caprice ignore the dictates of established precedent and procedure.

Gorham, 523 F.2d at 1098. Even if evidence related to the defendant’s anticipated allegations had “marginal relevance” to this case (which it does not), the “likely (and presumably intended) effect” would be “to shift the focus away from the relevant evidence of [the defendant’s] wrongdoing” to matters that are, at most, “tangentially related.” United States v. Malpeso, 115 F. 3d 155, 163 (2d Cir. 1997) (upholding exclusion of evidence of alleged misconduct by FBI agent). For the foregoing reasons, the defendant should not be permitted to introduce evidence or make arguments to the jury about the circumstances surrounding the appointment of the Special Counsel and alleged political bias on the part of the Special Counsel.

11 By point of fact, the Special Counsel has been appointed by both Democratic and Republican appointed Attorneys General to conduct investigations of highly-sensitive matters, including Attorneys General Janet Reno, Michael Mukasey, Eric Holder, Jeff Sessions and William Barr. [my emphasis]

Durham stuck the section between an extended section arguing that Judge Christopher Cooper should treat the interlinked investigations — by those working for the Hillary campaign and those, working independently of the campaign, who believed Donald Trump presented a grave risk to national security — into Trump’s ties to Russia as a unified conspiracy and another section asking that Clinton Campaign tweets magnifying the Alfa Bank allegations be admitted, even though the argument to include them is closely related.

Even ignoring how Durham pitches this issue, the placement of this argument — smack dab in the middle of an effort to treat protected political speech he admits is not criminal like a criminal conspiracy — seems like a deliberate joke. All the more so coming from prosecutors who, with their conflicts motion,

stir[red] the pot of political polarization, garner[ed] public attention, and, most inappropriately, confuse[d potential] jurors

It’s pure projection, presented in the middle of just that kind of deliberately polarizing argument. From the moment the Durham team — which relied heavily on an FBI Agent who reportedly sent pro-Trump texts on his FBI phone — tried to enhance Kevin Clinesmith’s punishment for altering documents because he sent anti-Trump texts on his FBI phone, Durham has criminalized opposition to Trump.

And Durham himself made his hiring an issue by claiming that the guy who misrepresented his conflicts motion by using it to suggest that Sussmann and Rodney Joffe should be executed, Donald Trump, is a mere third party and not the guy who made him a US Attorney.

But it’s also misleading, for multiple reasons.

The initial bias in question pertains to covering up for Russia, not helping Republicans

Sussmann’s likely complaints at trial have little to do with the fact that Durham was appointed by a Republican. Rather, a key complaint will likely have to do with the fact that Durham was appointed as part of a sustained campaign to misrepresent the entire set of events leading up to the appointment of his predecessor as Special Counsel, Robert Mueller, by a guy who auditioned for the job of Attorney General based on his claims — reflecting his warped Fox News understanding of the investigation — that the confirmed outcome of that investigation was false.

You cannot separate Durham’s appointment from Billy Barr’s primary goal in returning as Attorney General to undermine the evidence of improper Trump ties to Russia. You cannot separate Durham’s appointment, in the same days as Mueller acquired key evidence in two investigations (the Egyptian bank donation and Roger Stone) that Barr subsequently shut down, from Barr’s attempt to undermine the past and ongoing investigation. You cannot separate Durham’s appointment from what several other DC District judges (Reggie Walton, Emmet Sullivan, and Amy Berman Jackson — the latter, twice) have said was Barr’s improper tampering in the Russian investigation.

That is, Durham was appointed to cover-up Trump’s confirmed relationship with Russia, not to attack Democrats. But in order to cover up for Russia, Durham will, and has, attacked the Democrats who were first victimized by Russia for viewing Russia as a threat (though I believe that Republicans were victimized, too).

That bias has exhibited in the following ways, among others:

  • Treating concern about Trump’s solicitation of further hacks by Russia and his confirmed ties to Russian money laundering as a partisan issue, and not a national security issue (something Durham continues with this filing)
  • Treatment, in the Danchenko case, of Charles Dolan’s involvement in the most accurate report in the Steele dossier as more damning that the likely involvement of Dmitri Peskov in the most inflammatory reports that paralleled the secret communications with Dmitry Peskov that Trump and Michael Cohen lied to cover up
  • Insinuations from Andrew DeFilippis to Manos Antonakakis that it was inappropriate for DARPA to ask researchers to investigate ongoing Russian hacks during an election
  • A prosecutorial decision that risks making sensitive FISA information available to Russia that will, at the same time, signal that the FBI won’t protect informants against Russia

There are other indications that Durham has taken probable Russian disinformation that implicates Roger Stone as instead reliable evidence against Hillary.

Durham’s investigation into an investigation during an election was a key prop during an investigation

Another thing Durham may be trying to stave off is Sussmann calling Nora Dannehy as a witness to explain why she quit the investigation just before the election. Even assuming Durham could spin concerns about pressure to bring charges before an election, that pressure again goes to Billy Barr’s project.

When Durham didn’t bring charges, some of the same documents Durham was reviewing got shared with Jeffrey Jensen, whose team then altered several of them, at least one of them misleadingly, to present a false narrative about Trump’s opponent’s role in the investigation. Suspected fraudster Sidney Powell seems to have shared that false narrative with Donald Trump, who then used it in a packaged attack in the first debate.

This is one of the reasons why Durham’s submission of Bill Priestap’s notes in such a way as to obscure whether those notes have some of the same indices of unreliability as the altered filings in the Mike Flynn case matters.

In other words, Durham is claiming that scrutinizing the same kind of questions that Durham himself has been scrutinizing for years is improper.

The bullying

I find it interesting that Durham claims that, “the defendant has foreshadowed some of these arguments in correspondence with the Special Counsel and others,” without citing any. That’s because the only thing in the record is that Sussmann asked for evidence of Durham bullying witnesses to alter their testimony — in response to which Durham provided communications with April Lorenzen’s attorneys.

On December 10, 2021, the defense requested, among other things, all of the prosecution team’s communications with counsel for witnesses or subjects in this investigation, including, “any records reflecting any consideration, concern, or threats from your office relating to those individuals’ or their counsels’ conduct. . . and all formal or informal complaints received by you or others” about the conduct of the Special Counsel’s Office.” Although communications with other counsel are rarely discoverable, especially this far in advance of trial, the Government expects to produce certain materials responsive to this request later this week. The Government notes that it is doing so despite the fact that certain counsel persistently have targeted prosecutors and investigators on the Special Counsel’s team with baseless and polemical attacks that unfairly malign and mischaracterize the conduct of this investigation. For example, certain counsel have falsely accused the Special Counsel’s Office of leaking information to the media and have mischaracterized efforts to warn witnesses of the consequences of false testimony or false statements as “threats” or “intimidation.”

And this set of filings reveals that Durham is still trying to force Rodney Joffe to testify against Sussmann, even though Joffe says his testimony will actually help Sussmann.

In other words, this may be a bid by Durham to prevent evidence of prosecutorial misconduct under the guise of maintaining a monopoly on the right to politicize the case.

Normally, arguments like this have great merit and are upheld.

But by making the argument, Durham is effectively arguing that the entire premise of his own investigation — an inquiry into imagined biases behind an investigation and later appointment of a Special Counsel — is illegitimate.

As we’ll see, what Judge Christopher Cooper is left with is nothing more than competing claims of conspiracy.

John Durham Is Hiding Evidence of Altered Notes

/29 Comments/in , , /by

On Monday, both John Durham and Michael Sussmann submitted their motions in limine, which are filings to argue about what can be admitted at trial. They address a range of issues that I’ll cover in several posts:

Sussmann:

Durham wants to:

  • Admit witnesses’ contemporaneous notes of conversations with the FBI General Counsel
  • Admit emails referenced in the Indictment and other, similar emails (see this post)
  • Admit certain acts and statements (including the defendant’s February 2017 meeting with a government agency, his December 2017 Congressional testimony, and his former employer’s October 2018 statements to the media) as direct evidence or, alternatively, pursuant to Federal Rule of Evidence 404(b)
  • Exclude evidence and preclude argument concerning allegations of political bias on the part of the Special Counsel (addressed in this post)
  • Admit an October 31, 2016 tweet by the Clinton Campaign

I will link my discussions in serial fashion.

In John Durham’s bid to introduce notes from Bill Priestap and Trisha Anderson, he presented a color scan of Anderson’s notes [red annotation added]:

But he presented a black and white scan of Priestap’s notes [red annotation added]:

That’s important for two reasons. First, because blue sticky tabs were implicated in altered documents submitted in the Mike Flynn case. There was a blue sticky tab on another page of Priestap notes submitted in Flynn’s case.

There were what appear to be blue and red stickies visible on the original version of some Peter Strzok notes submitted in that case.

When the government ultimately confessed to adding dates (affirmatively misleading, in at least one case) to both that set of Strzok notes …

And some Andrew McCabe notes …

… The government claimed that the date added to some Andrew McCabe notes was added via a blue sticky — what sounds like the same sticky we saw in the Priestap notes.

In response to the Court and counsel’s questions, the government has learned that, during the review of the Strzok notes, FBI agents assigned to the EDMO review placed a single yellow sticky note on each page of the Strzok notes with estimated dates (the notes themselves are undated). Those two sticky notes were inadvertently not removed when the notes were scanned by FBI Headquarters, before they were forwarded to our office for production. The government has also confirmed with Mr. Goelman and can represent that the content of the notes was not otherwise altered.

Similarly, the government has learned that, at some point during the review of the McCabe notes, someone placed a blue “flag” with clear adhesive to the McCabe notes with an estimated date (the notes themselves are also undated). Again, the flag was inadvertently not removed when the notes were scanned by FBI Headquarters, before they were forwarded to our office for production. Again, the content of the notes was not otherwise altered. [my emphasis]

If that’s right, then whoever altered the McCabe notes altered them with the same kind of blue sticky note that appears on the Priestap notes that Durham wants to submit at trial.

Whether that date was added via blue sticky note has never been publicly tested. Rather than submitting unaltered versions of McCabe’s notes in the Flynn docket, DOJ — metadata suggests that Jocelyn Ballantine did this — simply digitally removed the date and a footer, effectively submitting a realtered exhibit in place of an altered one. So one cannot rule out that that date was written right onto the notes themselves. McCabe was being specifically prevented by DOJ from reviewing his original notes in the period, not even to prepare for Senate Judiciary Committee testimony, so he hasn’t been able to test that either.

That, by itself, suggests some of the alterations that were an issue in the Flynn docket were altered before they were shared with Jeffrey Jensen.

But that’s all the more interesting given a detail that Michael Sussmann included in his bid to exclude these notes. In Priestap’s grand jury testimony in this case, he testified he didn’t know why he wrote the “no specific client” comment on a slant, or why those notes were, “perhaps darker or thicker than some of the other notes.”

The Indictment characterizes the Priestap Notes as a contemporaneous record of Mr. Priestap’s conversation with Mr. Baker. See id. But beyond offering that they “looked like his writing and organizational style,” Mem. of Special Counsel’s June 2, 2021 Interview of E.W. Priestap, SCO-3500U-018701, at -01, Mr. Priestap said he “[doesn’t] remember why [he] wrote them down and who gave [him] the information,” E.W. Priestap’s June 3, 2021 Grand Jury Test., SCO-3500U-018746, at -98. Not only that, but Mr. Priestap “[does] not recall actually writing these notes,” id. at SCO-3500U-018815, nor can he confirm that the notes actually reflect any conversation he had with Mr. Baker, as opposed to a conversation he had with someone else, id. Indeed, Mr. Priestap “advised he did not remember Baker conveying to him the information about Sussmann,” Mem. of Special Counsel’s June 2, 2021 Interview of E.W. Priestap at SCO-3500U 018702, and was “not certain whether th[e] conversation reflected in the notes . . . was with Mr. Baker or maybe with someone else,” E.W. Priestap’s June 3, 2021 Grand Jury Test. at SCO3500U-018815. Mr. Priestap also has “[n]o idea” why the phrase “said not doing this for any client”—written diagonally to the side of the main body of the notes—was written at all, and could offer no explanation for why those words were “perhaps darker or thicker than some of the other notes.” Id. at SCO-3500U-018816.

The date in the January 24, 2017 Priestap notes is even more irregular — at cross-direction from his other notes on the page, and with uneven ink — and I have always wondered whether that date was added too.

And lo and behold, the Anderson notes also appear to have a sticky note right by the date (as annotated), albeit apparently a red one, though some of the tags on the Strzok notes were of a similar color. She also found aspects of her notes surprising.

Ms. Anderson’s notes (the “Anderson Notes”) include, on top, “Deputies Mtg. 9/19/16,” and then, after a redaction and under a second heading reading “9/19[/]16,” go on to state: “Sussman[n] Mtg w/ Baker” and “No specific client but group of cyber academics talked w/ him abt research,” followed by the phrase, “article this Friday – NYT/WaPo/WSJ.” Anderson Notes at SCO-3500U-000018. The relevant sentence fragment contains no subject revealing who had “[n]o specific client,” nor any other context for that phrase. Ms. Anderson, who was first asked about these notes by the Special Counsel over five years after they were written, has no meaningful memory of the notes or their context: she has only a “vague recollection” of discussing this topic with Mr. Baker and cannot “recall specifics.” Mem. of Special Counsel’s Jan. 5, 2022 Interview of T. Anderson, SCO-3500U-000087, at -88, -96. When shown the notes, Ms. Anderson stated that she had been “surprised” to learn about the “no specific client” phrase, and she “d[id] not now recall hearing from Baker his use” of that phrase; she could only assume that she got that phrase from Mr. Baker “because her notes reflect[ed] it.” Id. at -88.

Durham has only provided a partial scan of theses notes, hiding that the date, 9/19/16, appears earlier on the page, describing a different kind of meeting. That’s consistent with what the added date and the redaction on the McCabe notes did: It served to suggest that McCabe briefed the Flynn case to SSCI the day after Jim Comey was fired. Here, the September 19 date that appears next to the sticky is necessary for Durham’s case to claim that Anderson took these notes the same day of the meeting and not some time after that.

But why would Anderson date her notes twice?

According to a discovery filing in this case, Sussmann has reviewed redacted versions of the originals of the Priestap notes, which were still in the notebook Priestap took them in.

On October 13, 2021, the defense requested, among other things, to inspect the original notes that a former FBI Assistant Director of Counterintelligence took reflecting the defendant’s alleged false statement. The original notes were contained in a hard-bound notebook located at FBI Headquarters and contained extremely sensitive and highly classified information on a variety of topics and unrelated investigative matters. The Government immediately agreed to make the original notebook available to the defense in redacted form, and the defense conducted its review of the notebook on October 20, 2021.

But to test why all these notes have post-it notes on them and why the dates are so unreliable (and affirmatively misleading, in the case of the alteration in the January 5, 2017 Strzok notes), Sussmann would need to review all the notes together, probably with the assistance of the original authors.

It’s still not clear who altered the notes submitted in the Flynn docket, the extent of those alterations, or why the government is submitting exhibits with investigative stickies on them as evidence at trial. DOJ’s filing in the Flynn case blamed the misleading date on the Strzok notes on an FBI agent associated with the Jeffrey Jensen investigation (which would suggest that alteration post-dated Durham’s access to it), but it did not say who altered the McCabe notes.

But by showing that the blue sticky notes existed in Durham’s copy of the exhibits, Durham makes it clear some of the alterations exhibited in the Flynn docket happened before he shared the documents with Jensen’s investigation, if that’s how the notes got shared around.

The misleading date added to the Strzok notes ultimately was part of a packaged Trump attack on Joe Biden at the first debate, one that Sidney Powell, who has since been sanctioned for making fraudulent claims in an attempt to keep Trump in office, appears to have had a part in.

President Donald J. Trump: (01:02:22)
We’ve caught them all. We’ve got it all on tape. We’ve caught them all. And by the way, you gave the idea for the Logan Act against General Flynn. You better take a look at that, because we caught you in a sense, and President Obama was sitting in the office.

Given that even Chuck Grassley recognized the alteration added to the Strzok notes was incorrect, it’s hard to believe that was an innocent mistake.

And yet, 18 months later, DOJ is still trying to submit notes with all these investigative sticky notes as exhibits, without explaining why or how they appeared there.

And Durham’s choice to present the Priestap notes — with what appear to be the same blue sticky as appeared on his earlier notes, as well was the the blue sticky described to have been used to alter the McCabe notes — in black-and-white suggests he may know that’s a problem.

John Durham Says Election-Hack Victims Should Wait Until After the Election to Report Tips

/46 Comments/in , , , /by

Even as Russia assaults a peaceful democracy (which invasion, in a separate filing, Durham calls, “recent world events in Ukraine”), John Durham suggests that a political campaign victimized by Russia should expect to wait until after the election before the FBI opens an investigation into a cybersecurity anomaly potentially implicating her opponent.

Durham even asserts that such a cybersecurity anomaly is not a cybersecurity matter, but instead a political one.

Almost six years after Trump’s request, “Russia are you listening,” was met with a renewed Russian attack on Hillary Clinton, John Durham continues to treat Hillary’s attempts to run a campaign while being attacked as a greater threat than that nation-state attack by Russia.

Durham’s latest contortions come in a response to Micheal Sussmann’s motion to dismiss the indictment.

Sussmann argued that the alleged lie he told (motions to dismiss must accept the alleged facts as true), could not have affected the single decision facing the FBI when he shared information about a DNS anomaly: whether to open an investigation or not.

Following the Supreme Court’s clear instruction in Gaudin, in order to assess the materiality of the false statement that Mr. Sussmann is alleged to have made, this Court must ask what statement he is alleged to have made to the FBI; what decision the FBI was trying to make; and whether the false statement could have influenced that decision. Here, even accepting all the allegations in the Indictment as true—and the evidence would prove otherwise—the only decision the FBI was trying to make was the decision whether or not to commence an investigation into the allegations of suspicious internet data involving the Trump Organization and Russian Bank-1. Ample precedent—and the Special Counsel’s own allegations in this case—make clear that Mr. Sussmann’s purported false statement did not influence, and was not capable of influencing, that decision.

Predictably and reasonably, Durham’s response cited the precedent that leaves it up to juries to determine whether something is material or not.

In any event, the defendant’s arguments on the materiality of his statement are also premature. The Supreme Court in Gaudin held that materiality is an essential element of Section 1001 that must be resolved by a jury.

As I noted back in October, “Prosecutors will argue that materiality is a matter for the jury to decide.”

Prosecutors also noted what I did: a long list of precedents about materiality that Sussmann cited in his motion are all post-trial challenges to materiality, not pretrial motions to dismiss.

The defendant cites to multiple cases where the Supreme Court and Circuit Courts have held that the false statements and misrepresentations at issue were immaterial as a matter of law. See Def. Mot. at 7-10. But critically, all of those cases involved post-conviction appeals or motions to vacate the conviction after the Government presented its case at trial. Accordingly, none of these cases support the defendant’s requested relief here – that is, that the court dismiss the Indictment before trial because it fails to sufficiently allege that the defendant’s false statement is material. What the cases do show is that courts have routinely declined to usurp the jury’s role in making the determination on whether a false statement is material.

For those two reasons, Sussmann’s motion to dismiss is unlikely to succeed, and should instead be viewed as an opening bid to frame his defense and establish issues for appeal.

Those two arguments are all Durham really needed to respond to Sussmann’s motion to dismiss. Instead of leaving it with responsible lawyering, however, Durham instead launches into an illogical attempt to criminalize tip reporting.

Take his attempt to dismiss Rodney Joffe’s real cybersecurity expertise. In the three months since he charged Sussmann, Durham belatedly (at Sussmann’s request) discovered how closely Joffe had worked with the FBI on other investigations. As Sussmann scoffed in an earlier filing, “The notion that the FBI would have been more skeptical of the information had it known of Tech Executive-1’s involvement is, in a word, preposterous.” Now that Durham has discovered the close ties between Joffe and the FBI, he claimed that that history of reliability was itself something the FBI needed to know.

Namely, as the defendant’s motion reveals (Def. Mot. at 18-19, fn. 8), Tech Executive-1 had a history of providing assistance to the FBI on cyber security matters, but decided in this instance to provide politically-charged allegations anonymously through the defendant and a law firm that was then-counsel to the Clinton Campaign. Given Tech Executive-1’s history of assistance to law enforcement, it would be material for the FBI to learn of the defendant’s lawyer-client relationship with Tech Executive-1 so that they could evaluate Tech Executive-1’s motivations. As an initial step, the FBI might have sought to interview Tech Executive-1. And that, in turn, might have revealed further information about Tech Executive-1’s coordination with individuals tied to the Clinton Campaign, his access to vast amounts of sensitive and/or proprietary internet data, and his tasking of cyber researchers working on a pending federal cybersecurity contract.

Durham’s claim that “learning” how much data Joffe had access to (which is something the FBI undoubtedly knew — it is surely the reason why FBI partnered with him, because the volume of data Neustar had made their observations more useful) would make them more skeptical of the DNS tip is nonsensical. In fact, elsewhere (in tracking all the YotaPhone requests in the US over a three year period), Durham treated it as presumptively reliable.

Plus, Durham made no mention here of one of a number of the other things he belatedly learned: that the September 2016 tip Sussmann shared with FBI General Counsel James Baker was not the only one Joffe had shared via Sussmann anonymously. He shared a tip anonymously during this same time period with DOJ IG. Durham has no way of knowing, either, whether those two were the only ones, but his revised theory of materiality depends on an anonymous tip like this one being unique.

Similarly, Durham struggled to explain (including by citing an inapt precedent) why the FBI would need to be told that Sussmann represented Hillary when, in notes of Baker’s retelling of the meeting, Bill Priestap wrote that Sussmann represented the DNC and Clinton Foundation.

As he did with Joffe, Durham tried to flip Sussmann’s expertise, arguing that the former prosecutor’s recognized qualification as a cybersecurity expert, something that would help him assess whether DNS data were anomalous or not, is precisely why the Perkins Coie lawyer needed to disclose he was working for Hillary.

In an effort to downplay the materiality of this false statement, the defendant asserts that the FBI General Counsel was aware that the defendant represented the DNC. See Def. Mot at 18. But the Government expects that evidence at trial will establish that the FBI General Counsel was aware that the defendant represented the DNC on cybersecurity matters arising from the Russian government’s hack of its emails, not that he provided political advice or was participating in the Clinton Campaign’s opposition research efforts. Indeed, the defendant held himself out to the public as an experienced national security and cybersecurity lawyer, not an election lawyer or political consultant. Accordingly, when the defendant disclaimed any client relationships at his meeting with the FBI General Counsel, this served to lull the General Counsel into the mistaken, yet highly material belief that the defendant lacked political motivations for his work.

There are many crazy assumptions built into this statement: that, had Sussmann identified Hillary as his client, it would have required him to reveal her motives as political rather than security-related to the FBI, breaching privilege; that reporting an anomaly potentially involving Trump after Trump had begged Russia to further hack Hillary would not be a sound decision from a cybersecurity standpoint; that researching the context of an anomaly, such as Alfa Bank’s ties to Putin, is not part of cybersecurity. Effectively, Durham has unilaterally decided that pursuing this anomaly was a political act, with no basis in law or fact.

Which is how Durham espoused the claim that the FBI, facing an unprecedented attack by Russia on American elections in 2016, might have delayed investigation of a part of it that might have implicated one of the contestants.

The defendant’s false statement to the FBI General Counsel was plainly material because it misled the General Counsel about, among other things, the critical fact that the defendant was disseminating highly explosive allegations about a then-Presidential candidate on behalf of two specific clients, one of which was the opposing Presidential campaign. The defendant’s efforts to mislead the FBI in this manner during the height of a Presidential election season plainly could have influenced the FBI’s decision-making in any number of ways. The defendant’s core argument to the contrary rests on the flawed premise that the FBI’s only relevant decision was binary in nature, i.e., whether or not to initiate an investigation. But defendant’s assertion in this regard conveniently ignores the factual and practical realities of how the FBI initiates and conducts investigations. For example, the Government expects that evidence at trial will prove that the FBI could have taken any number of steps prior to opening what it terms a “full investigation,” including, but not limited to, conducting an “assessment,” opening a “preliminary investigation,” delaying a decision until after the election, or declining to investigate the matter altogether.

[snip]

Moreover, the Department of Justice and the FBI maintain stringent guidelines on dealing with matters that bear on U.S. elections. Given the temporal proximity to the 2016 U.S. presidential election, the FBI also might have taken any number of different steps in initiating, delaying, or declining the initiation of this matter had it known at the time that the defendant was providing information on behalf of the Clinton Campaign and a technology executive at a private company.

[snip]

And the evidence will show that it would have been all the more material here because the defendant was providing this information on behalf of the Clinton Campaign less than two months prior to a hotly contested U.S. presidential election. [my emphasis]

The first paragraph here is really telling, given Durham’s public complaint that the Crossfire Hurricane team should have opened the investigation as a preliminary investigation, not a full investigation (the investigation into Mike Flynn, specifically, wasn’t opened as a full investigation, but none of the techniques used would have otherwise been unavailable, not least because there was already a full investigation opened on Carter Page). This is an argument Durham may reprise in his report: That it was unreasonable for Hillary Clinton to ask the FBI to inquire into Trump’s campaign after he publicly asked a foreign country for help (even ignoring the tip from Australia).

Durham seems to think Hillary should have had no assistance from law enforcement when her opponent publicly asked Russia to hack her some more if people close to her found more reason to be concerned. He even mocked Sussmann as too powerful to choose to use anonymity.

[W]hile the defendant’s motion seeks to equate the defendant with a “jilted ex-wife [who] would think twice about reporting her ex-husband’s extensive gun-smuggling operation,” this comparison is absurd. Def. Mot. at 24

Far from finding himself in the vulnerable position of an ordinary person whose speech is likely to be chilled, the defendant – a sophisticated and well-connected lawyer – chose to bring politically-charged allegations to the FBI’s chief legal officer at the height of an election season.”

This also betrays pure insanity. The anomaly involving Trump could always have reflected disloyal insiders compromising the candidate, as could the YotaPhones potentially in use in Trump headquarters. In fact, Page did compromise Trump when he went to Russia in December 2016 and tell Russians there that he was representing Trump on matters pertaining to Ukraine, just as Mike Flynn did by selling his access to Trump to Turkey, just as Tom Barrack is accused of doing with the Emirates. The reason why Sussmann was providing this information less than two months before an election is because cybersecurity researchers had gone looking because there was an ongoing multi-faceted cybersecurity attack, one that continued right through the election, one that could have victimized Trump as well as Hillary.

Which brings me to the one point Sussmann made that Durham completely ignored. In his response, Durham’s response uses the word “purported” to describe the DNS allegations from Sussmann five times:

  1. The defendant provided the FBI General Counsel with purported data and “white papers” that allegedly demonstrated a covert communications channel between the Trump Organization and a Russia-based bank
  2. the purported data and white papers
  3. the purported DNS traffic that Tech Executive-1 and others had assembled
  4. the defendant provided data which he claimed reflected purportedly suspicious DNS lookups by these entities of internet protocol (“IP”) addresses affiliated with a Russian mobile phone provider (“Russian Phone Provider-1”)
  5. examine the origins of the purported data

What Durham did not do is ever address this point from Sussmann:

Indeed, the defense is aware of no case in which an individual has provided a tip to the government and has been charged with making any false statement other than providing a false tip. But that is exactly what has happened here.

In the fall of 2016, Michael Sussmann, a prominent national security lawyer, voluntarily met with the Federal Bureau of Investigation (“FBI”) to pass along information that raised national security concerns. He met with the FBI, in other words, to provide a tip. There is no allegation in the Indictment that the tip he provided was false. And there is no allegation that he believed that the tip he provided was false. Rather, Mr. Sussmann has been charged with making a false statement about an entirely ancillary matter—about who his client may have been when he met with the FBI—which is a fact that even the Special Counsel’s own Indictment fails to allege had any effect on the FBI’s decision to open an investigation.

[snip]

Again, nowhere in the Indictment is there an allegation that the information Mr. Sussmann provided was false. Nowhere is there an allegation that Mr. Sussmann knew—or should have known—that the information was false. And nowhere is there an allegation that the FBI would not have opened an investigation absent Mr. Sussmann’s purported false statement.

I could fund an entire Special Counsel investigation if I had $5 for every time in this prosecution Durham has used the word “purported.” For almost six months, his entire prosecution has been premised on this anomaly not being “real,” meaning unexplained traffic that might represent something serious.

And yet he has not charged that (though he seems to have bullied April Lorenzen, perhaps because he needs her to be something other than she was). Instead, he just keeps doing the work for which actual evidence is normally required by repeating the word “purported” over and over.

This motion to dismiss will likely fail, because juries get to decide what is material. But contrary to Durham’s claims, unless and until he can prove that Sussmann, Jofffe, and Lorenzen didn’t believe this was a real anomaly worth investigating given all the other attacks that, Sussmann especially, knew were ongoing, then he really will be prosecuting someone for reporting a valid national security concern.