Posts

Andrew DeFilippis Had a Role in the Prosecution of Gal Luft’s Co-Conspirator-1

/20 Comments/in , , , /by

James Comer plans to rely on Gal Luft’s testimony in his efforts to gin up conspiracy theories against Joe Biden, even in spite of the indictment against Luft DOJ obtained before James Comer started pursuing his conspiracy theories.

Andrew DeFilippis handled the classified evidence in the Patrick Ho case

Because of that, I want to flag a detail about the Patrick Ho case, the case out of which this one arose.

Ho is the person described as Co-Conspirator-1 in the Luft indictment.

Ho was sentenced on March 25, 2019 for bribing Chadian and Ugandan officials; the former scheme started in a suite in Trump Tower in 2014.

Through a connection, HO was introduced to Cheikh Gadio, the former Minister of Foreign Affairs of Senegal, who had a personal relationship with President Déby. HO and Gadio met at CEFC China’s suite at Trump World Tower in midtown Manhattan, where HO enlisted Gadio to assist CEFC China in obtaining access to President Déby.

Days after Ho was sentenced, the two lead prosecutors on that case, Catherine Ghosh and Daniel Richenthal, flew to Brussels to meet with Luft. As alleged in the indictment, Luft lied to those prosecutors and four FBI agents about both the arms deals and Chinese influence peddling for which he has since been charged.

64. On or about March 28, 2019, in the Southern District of New York, Belgium, and elsewhere outside of the jurisdiction of any particular State or district of the United States, GAL LUFT, the defendant, who is expected to be first brought to and arrested in the Southern District of New York, a matter within the jurisdiction of the executive branch of the Government of the United States, knowingly and willfully made a materially false, fictitious, and fraudulent statement and representation, to wit, LUFT falsely stated during an interview at the United States Embassy in Brussels, Belgium with federal law enforcement officers and prosecutors, in connection with an investigation being conducted in the Southern District of New York, that LUFT had not sought to engage in or profit from arms deals, and instead merely had been asked by an Israeli friend who dealt in arms to check arms prices so that the friend could use this information in bidding on deals, a request that LUFT said he fulfilled by having CC-1 check prices with CC-2 and then relay this information to LUFT–when in fact LUFT had actively worked to broker numerous illegal arms deals for profit involving multiple different countries, both in concert with CC-1 and directly himself, including as described in paragraphs Forty-Four through Fifty-Three above.

[snip]

84. On or about March 29, 2019, in the Southern District of New York, Belgium, and elsewhere outside of the jurisdiction of any particular State or district of the United States, GAL LUFT, defendant, who is expected to be first brought to and arrested in the Southern District of New York, in a matter within the jurisdiction of the executive branch the Government of the United States, knowingly and willfully made a materially false, fictitious, and fraudulent statement and representation, to wit, LUFT falsely stated during an interview at the United States Embassy in Brussels, Belgium with federal law enforcement officers and prosecutors, in connection with an investigation being conducted in the Southern District of New York, that LUFT had tried to prevent CEFC China from doing an oil deal with Iran, that LUFT had been excluded from CEFC China meetings with Iranians, and that LUFT did not know of any CEFC China dealings with Iran while he was affiliated with the company–when in fact, including as described above in paragraphs Sixty-Six through Eighty, LUFT personally attended at least one meeting between CEFC China and Iranians and assisted in setting up additional such meetings for the purpose of arranging deals for Iranian oil, and also worked to find a buyer of Iranian oil while concealing its origin.

Starting in early 2018, DeFilippis handled the classified evidence on the Ho case — both CIPA and a FISA order. He would have spent a great deal of time reviewing what the spooks had obtained on Ho and his associates, undoubtedly including Luft.

Andrew DeFilippis investigated John Kerry for a year

DeFilippis’ efforts on the Ho case took place in parallel with his efforts to gin up a criminal investigation against John Kerry. Here’s how Geoffrey Berman described being ordered to do that by Main Justice.

On May 9, the day after the second Trump tweet, the co-chiefs of SDNY’s national security unit, Ferrara and Graff, had a meeting at Main Justice with the head of the unit that oversees counterintelligence cases at DOJ, which is under the National Security Division.

He said that Main Justice was referring an investigation to us that concerned Kerry’s Iran-related conduct. The conduct that had annoyed the president was now a priority of the Department of Justice. The focus was to be on potential violations of the Logan Act.

[snip]

From the outset, I was skeptical that there was a case to be made. I knew enough about the Logan Act to have strong doubts. Politicians from both sides of the aisle have talked about it from time to time, suggesting that some opponent is in violation of it. It never goes anywhere.

But I figured if they bring us a possible case, we’ll do our best. We’ll look into it. We brought a prosecutor from the national security unit, Andrew DeFilippis, into the investigation.

Trump, meanwhile, kept on tweeting. “John Kerry had illegal meetings with the very hostile Iranian Regime, which can only serve to undercut our great work to the detriment of the American people,” he wrote that September. “He told them to wait out the Trump Administration! Was he registered under the Foreign Agents Registration Act? BAD!”

DeFilippis’ efforts extended into 2019, overlapping with the trial of Ho and the interview with Luft. National Security prosecutors at Main Justice kept pressuring SDNY to advance the investigation into Kerry, but first, Berman had DeFilippis research whether the Logan Act would be chargeable even if Kerry had committed it.

The next step would have been to conduct an inquiry into Kerry’s electronic communications, what’s known as a 2703(d) order. That would have produced the header information—the to, from, date, and subject fields—but not the contents. I decided that before moving forward, it made sense to evaluate whether we would ever have a viable, appropriate charge that matched up with Kerry’s alleged conduct.

At the risk of stating the obvious, under our system of law, pissing off the president is not a chargeable offense. I asked DeFilippis to conduct additional legal research into the Logan Act and other potentially applicable theories. “Look, we’re talking about going to the next step here,” I said.

“But before we do any further investigation, I want to know what the law is on the Logan Act. Let’s say we gather additional documents—I want to know, how is that helping us?”

I wanted to answer the question, even if these things happened, was it a crime? Let’s cut to the chase and find that out, because we’ve got plenty of other work to do and I don’t want us to just be spinning our wheels on this.

For the next several months, DeFilippis conducted extensive research into the Logan Act as well as statutes relating to possible criminal ethics violations by former senior government employees.

On April 22, 2019, Trump tweeted, “Iran is being given VERY BAD advice by @JohnKerry and people who helped him lead the U.S. into the very bad Iran Nuclear Deal. Big violation of Logan Act?”

The tweet was in the morning. That afternoon, Ferrara got a call from Main Justice. He was told that David Burns, the principal deputy assistant attorney general for national security, wanted to know why we were delaying. Why had we not proceeded with a 2703(d) order—the look into Kerry’s electronic communications?

The next day, Burns spoke to Ferrara, Graff, and DeFilippis and repeatedly pressed them about why they had not submitted the 2703(d) order. The team responded that additional analysis needed to be done before pursuing the order.

SDNY decided not to pursue the case against Kerry in fall of 2019.

We spent roughly a year exploring whether there was any basis to further investigate Kerry. Memos were written, revised, and thoroughly discussed.

Our deep dive into the Logan Act confirmed why no one has ever been successfully prosecuted under it in the more than 220 years it has been on the books: the law is not useful. It definitely does not prohibit a former US secretary of state from talking to a foreign official. We did not find that Kerry violated any ethics statutes or any laws having to do with the improper handling of classified material.

In September 2019, DeFilippis advised the National Security Division at Main Justice that we would not be pursuing the case further. He had earlier attempted to tell the specific NSD attorney assigned to the case of our decision, but he couldn’t connect because that attorney was engaged in another matter: the Craig trial.

Sometime after that, DeFilippis became the lead prosecutor on the Durham team, leading the prosecution of Michael Sussmann.

Andrew DeFilippis oversaw the most abusive parts of the John Durham prosecution

Over the course of the Michael Sussmann prosecution, DeFilippis and his prosecution team:

As noted above, Geoffrey Berman boasted that the investigation into Kerry didn’t leak. Even ignoring the inexplicably perfect concert between Alfa Bank’s efforts and Durham’s, it’s not clear the same can be said about the Durham investigation.

And it’s not just that DeFilippis routinely tried to introduce evidence that served his narrative rather than matched the facts. It’s that DeFilippis repeatedly — most notably in the alleged complaint that researchers working on a DARPA project would attempt to identify which Russians were interfering in the US election — proved more sympathetic of Russian efforts to help get Trump elected than to conduct an ethical prosecution.

Last August, shortly before Durham confessed the utter humiliation of his team at the hand of Sergei Millian, DeFilippis withdrew from the Durham team with almost no notice, left DOJ, and returned — in a Special Counsel role, not as Partner — to Sullivan & Cromwell.

These are just data points. There is no reason, yet, to believe that DeFilippis continues to unethically gin up conspiracy theories against Democrats.

But they are data points I thought worth collecting in one place.

In the End, the Leopards Who Launched the Durham Investigation Ate His Face

/61 Comments/in , /by

I’m visiting family, so my longer analysis of John Durham’s appearance before Congress will have to wait until the weekend. Here’s my live thread of the hearing.

The arc of the hearing should begin with Durham’s final answer (in response to an insane rant from Harriet Hageman, Liz Cheney’s replacement in Congress), in which Durham claimed that if people believed there is a two-tiered system of justice, the nation cannot stand.

Before he provided this answer, Adam Schiff, to whom many Democratic members deferred, had noted that in Durham’s comparison of Hillary’s treatment by the FBI with Trump’s in his report, Durham had completely ignored the way Jim Comey had tanked Hillary’s campaign, first in July and then again in October 2016. Durham had ignored, in his treatment, the most consequential events in the 2016 campaign, arguably the decisive set of events. (As I’ve noted, even CNN concluded that Durham’s actual evidence, as opposed to his conclusions, actually shows that even on other investigations, Hillary was treated worse than Trump.)

So Durham, after having been called out for ignoring the way the FBI may have decided the election against Hillary, nevertheless reiterated his false claim that he showed the FBI applying a two-tiered system of justice against Trump.

Then Durham said that if people believe his false claim, it will sink the nation. In his final answer, Durham effectively said that if people believe his false claim, it will sink democracy in the United States.

With that endpoint in mind, let’s review what happened leading up to it.

An important recurring theme from most Democrats is that Merrick Garland respected Durham’s independence. Democrats repeatedly got Durham to confirm that Garland had never interfered with Durham’s independence and even got him to endorse the independence of Special Counsels, generally. As I predicted, Durham’s testimony will undercut GOP efforts to interfere in Jack Smith’s ongoing investigations into Trump and some Republicans in Congress.

Democrats also repeatedly laid out how Durham had spent $6.5 million and found no new crime.

A really central moment came — in advance of a procedural vote to censure Schiff on the floor — where Schiff laid out that his prior claims about the Russian investigation all proved true. Both with Trump’s public call for Russia to find Hillary’s emails and Don Jr’s enthusiastic acceptance of an offer of dirt on Hillary, Trump invited Russia’s help. He got the help he asked for in the form of further hacking of Hillary. And Trump made use of it, by relying on the stolen emails over and over again.

At one point, Schiff said that if you don’t want to call Paul Manafort handing internal campaign information to a Russian spy “collusion,” then you could just call it Republicans cheating with the enemy.

In another exchange, Schiff laid out how George Papadopoulos’ prediction of help from Russia came true, in the form of the release of stolen emails via cut-outs. Durham (whose claim to be aware of Trump’s emails and public news coverage was selective throughout), claimed to have no awareness that the Russian operation released stolen emails via three different cut-outs — dcleaks, Guccifer 2.0, and WikiLeaks. He had no idea, about that, he claimed!

In short, the Durham hearing gave Schiff (and others, but especially Schiff) several opportunities to lay out just how damning the Mueller investigation results were, particularly as compared to Durham’s own flimsy outcome. Each time, Durham claimed ignorance of key details of the Mueller Report.

That said, Durham was under oath. Throughout the hearing, he stopped short of making claims that he had — while still a prosecutor with near-total immunity — made in his report. For example, Durham did not state, in the hearing, that Hillary had a plan to frame Donald Trump, as opposed to simply pointing out his very real Russian ties.  He even, in the hearing, acknowledged that Igor Danchenko did not hide his ties to Charles Dolan, when asked. MoJo is out claiming that Durham lied under oath, but the way Durham backed off key claims he made in his report is far more telling about his witting actions. The claims Durham did not repeat under oath are the ones deserving of further scrutiny.

Which brings us to the three MAGAt members of Congress who questioned Durham after a break for votes, too late for any Democrat to rebut Durham.

First, there was Hageman’s rant.

Then, Andy Biggs stated as fact that there were crimes Durham had not prosecuted, including immigration crimes by Igor Danchenko. Biggs also stated that, “the division in this country, I can trace back, it is the Steele dossier paid for by Hillary Clinton.” Of course, the Durham Report provided yet more evidence that the disinformation in the dossier came from Oleg Deripaska, so I guess Andy Biggs is congratulating Deripaska for the damage that he did to the country. And doubling down on that damage.

The most heated challenge to Durham, however, came from Matt Gaetz (again, after a half-hour break for votes; somehow Gaetz got two chances to question Durham). Gaetz demanded to know how Durham was unable to find Joseph Mifsud — the guy whose comments to Trump’s Coffee Boy started this whole investigation — for an interview, even after Durham patiently described that no US prosecutor can demand subpoena compliance for suspected Russian spies located overseas. Durham described that, as happened with former counterintelligence investigative subject Sergei Millian, Mifsud’s lawyer refused to disclose Mifsud’s location.

In response, Gaetz accused Durham of being part of a cover-up.

Durham was like the Washington Generals, Gaetz accused, paid to lose the game. Because Durham couldn’t find someone against whom the SSCI Report showed ties of Russian intelligence ties, Gaetz suggested that Durham had, from the start, planned to cover up a Deep State operation against Donald Trump.

This whole thing was an op. This wasn’t bumbling fumbling FBI that couldn’t get FISA straight. This was an op. It begs the question whether you were really trying to figure that out.

As he did in response to a parallel line of questioning from Cori Bush and even Jerry Nadler, Durham insisted on the good faith of his team. He talked about the four years he spent away from his family to conduct this investigation that made America less safe.

I don’t doubt he believes his team engaged in a good faith investigation. As he said, sometimes confirmation bias can undermine even good faith actions.

The Durham investigation was kicked off in 2018 when a bunch of Tea Partiers like Gaetz gave Papadopoulos an opportunity to float conspiracy theories in the Congressional record. That’s literally what sent Durham and Barr on a junket together to Italy, the failed attempt to find Joseph Mifsud that Gaetz presents as proof that Durham was just part of a Deep State plot.

Durham ended his investigation with the leopards who kicked it off eating his face.

I’m not happy that more of Durham’s lies weren’t exposed at today’s hearing. The hearing could have been far more effective, as an effort to get to the truth.

But I can think of no more fitting way to end Durham’s four year effort to chase the conspiracy theories of George Papadopoulos than to have Matt Gaetz accuse him of being part of a Deep State op.

Durham set off in 2019 to chase down the conspiracy theories of people with close ties to Matt Gaetz. And Durham ended it by having Gaetz accuse Durham of the same things of which Durham accused others.

The leopard always eats your face.

Update: Fixed which Washington team intentionally loses rather than does so as the result of the right wing owner’s ineptitude.

Peter Strzok Claims He Spoke to John Durham about the Clinton Conspiracy Theory Document

/10 Comments/in , /by

In this post, I showed how John Durham fabricated a key aspect of his Clinton conspiracy theory — the claim that she planned to make false claims about Donald Trump. Durham invented the bit where Clinton had to make false claims about Trump. Made it up out of thin air.

Durham considered charging FBI agents because they didn’t respond to evidence that a Hillary advisor had been hacked by Russia as if it were proof of criminal intent by Hillary.

He did so in spite of the fact that he provided no proof that any of those FBI agents he considered charging had actually received the referral memo sharing that Russian intelligence.

In the section where Durham considers whether to charge some FBI agents for not doing more with the the Russian Hillary-and-Guccifer intelligence, he repeats his ploy of conflating the Hillary-and-Guccifer intelligence with the wider body of evidence to even deign to make a prosecutorial decision, though in this instance, he provides no reminder that the Hillary-and-Guccifer intelligence was just one of the things Brennan briefed to Obama, after five pages of other items.

The FBI thus failed to act on what should have been – when combined with other, incontrovertible facts – a clear warning sign that the FBI might then be the target of an effort to manipulate or influence the law enforcement process for political purposes during the 2016 presidential election. Indeed, CIA Director Brennan and other intelligence officials recognized the significance of the intelligence by expeditiously briefing it to the President, Vice President, the Director of National Intelligence, the Attorney General, the Director of the FBI, and other senior administration officials. 491

He lets the urgent import of an ongoing Russian hack to stand in for the import of this Hillary-and-Guccifer intelligence.

And that’s important, because Durham makes a prosecutorial decision about whether to charge FBI agents for how they responded to the intelligence that Russia claimed to have intercepted communications of Hillary personnel without proof that most of them ever read it.

As he describes, the top analytical people on the campaign learned of the claimed intercept of Hillary associates almost a month after CIA first obtained it.

On that date, an FBI cyber analyst (“Headquarters Analyst-2”) emailed a number of FBI employees, including Supervisory Intelligence Analyst Brian Auten and Section Chief Moffa, the most senior intelligence analysts on the Crossfire Hurricane team, to provide an update on Russian intelligence materials. 409 The email included a summary of the contents of the Clinton Plan intelligence. 410

There were in-person briefings for the top analytical people and the cyber people ten days later.

When interviewed by the Office, Auten recalled that on September 2, 2016 – approximately ten days after Headquarters Analyst-2’s email – the official responsible for overseeing the Fusion Cell briefed Auten, Moffa, and other FBI personnel at FBI Headquarters regarding the Clinton Plan intelligence. 411 Auten did not recall any FBI “operational” personnel (i.e., Crossfire Hurricane Agents) being present at the meeting. 412 The official verbally briefed the individuals regarding information that the CIA planned to send to the FBI in a written investigative referral, including the Clinton Plan intelligence information. 413

[snip]

Separate and apart from this meeting, FBI records reflect that by no later than that same date (September 2, 2016), then-FBI Assistant Director for Counterintelligence Bill Priestap was also aware of the specifics of the Clinton Plan intelligence as evidenced by his hand-written notes from an early morning meeting with Moffa, DAD Dina Corsi and Acting AD for Cyber Eric Sporre. 415

Durham describes the CIA writing a memo about what the fusion intelligence team had found — but he curiously never describes how or when it was sent.

Five days later, on September 7, 2016, the CIA completed its Referral Memo in response to an FBI request for relevant information reviewed by the Fusion Cell. 417

That’s important because Durham describes witness after witness describing that they had never seen it.

None of the FBI personnel who agreed to be interviewed could specifically recall receiving this Referral Memo.

[snip]

The Office showed portions of the Clinton Plan intelligence to a number of individuals who were actively involved in the Crossfire Hurricane investigation. Most advised they had never seen the intelligence before. For example, the original Supervisory Special Agent on the Crossfire Hurricane investigation, Supervisory Special Agent-1, reviewed the intelligence during one of his interviews with the Office. 428 After reading it, Supervisory Special Agent-I became visibly upset and emotional, left the interview room with his counsel, and subsequently returned to state emphatically that he had never been apprised of the Clinton Plan intelligence and had never seen the aforementioned Referral Memo. 42

[snip]

Former FBI General Counsel Baker also reviewed the Clinton Plan intelligence during one of his interviews with the Office. 431 Baker stated that he had neither seen nor heard of the Clinton Plan intelligence or the resulting Referral Memo prior to his interview with the Office.

In lieu of proof that it ever got sent, Durham reveals that Brian Auten might have hand-carried the memo to the team, but had no memory of doing so.

Auten stated that it was possible he hand-delivered this Referral Memo to the FBI, as he had done with numerous other referral memos,419 and noted that he typically shared referral memos with the rest of the Crossfire Hurricane investigative team, although he did not recall if he did so in this instance. 420

[snip]

[E]ven in spite of proof that Durham was coaching witnesses in these interviews, he still presented no affirmative evidence that the FBI investigators ever received the Fusion Cell memo. In the same way that all of Hillary’s people disclaimed any plan, the FBI investigators disclaimed having seen this memo.

To sum up: Durham considered charging FBI agents for not responding to evidence that Russians had hacked a Hillary advisor as if it was proof of Hillary’s devious attempt to frame Trump, even though he had no evidence those FBI agents ever saw that evidence.

In today’s hearing, Durham responded to a question from Jim Jordan about the memo — asking whether the memo was given to Jim Comey and Peter Strzok — by dodging on precisely that issue. Rather than saying, yes, Comey and Strzok got this referral, he said only that the memo had been addressed to Strzok.

Jordan: Was memo given to Comey and Strzok.
Durham: That’s who it was addressed to, yes.

That is, he affirmatively stopped short of claiming that Strzok received it.

That led to this exchange involving Strzok himself.

The significance of Strzok’s comment is twofold. First, he says he spoke to Durham about this topic.

I told Durham’s team I had no recollection of ever seeing the [referral]. Funny how he didn’t include that in his report.

That directly conflicts with a footnote in a section of Durham’s Report purporting to prove Peter Strzok’s political bias, in which Durham claimed that Strzok refused to talk about anything other than the Alfa Bank allegations.

139 Strzok was a Section Chief and later the Deputy Assistant Director in the FBI’s Counterintelligence Division. (For the positions held by those involved in the Crossfire Hurricane investigation, see the chart in the Redacted OIG Review at 81-82.) Strzok agreed to provide information to the Office concerning matters related to the FBI’s Alfa Bank investigation, but otherwise declined to be interviewed by the Office on matters related to his role in the Crossfire Hurricane investigation.

Durham has spent a good deal of time today making excuses for why he didn’t speak to Republicans’ biggest bogeymen, including Strzok. Yet it appears that Durham affirmatively misrepresented the extent to which Strzok spoke to him.

Then there’s the documentary detail Strzok raised: When he spoke to Durham, Durham didn’t have an FBI file copy of this memo. He was using a CIA or ODNI version of the document, not one from the FBI.

Either Durham didn’t look — or he never found — this file to be in FBI files.

Both Republicans and Democrats should be furious about this exchange — Republicans, because it suggests Durham is lying to them about whom he really did speak with, and Democrats, because it is yet more proof Durham invented a conspiracy theory out of a Russian intelligence report.

John Durham seems to be hiding the degree to which he left out interviews that debunked his own conspiracy theories. Including one with Peter Strzok.

A Guide to the False Claims John Durham Will Tell Congress

/37 Comments/in , , /by

I finally finished my last post on the Durham Report last week before heading off for a visit with family for a week. This post gathers them all together in one place.

John Durham’s investigation was a four year effort to flip the script: to make Hillary Clinton — the victim of a nation-state attack in 2016 — its villain.

Durham and his sponsor, Bill Barr, did so as part of a larger effort — one that also included Barr’s sabotage of both the release of the Mueller Report and the ongoing investigations into Trump’s people — to discredit the investigation started because Trump’s Coffee Boy bragged about learning of the Russian attack in advance, and he wasn’t the only one. The Rat-Fucker, too, got advance notice, the Rat-Fucker, too, bragged about Russia’s assistance to the campaign, though because the FBI didn’t investigate Guccifer 2.0 aggressively enough in real time, it took several years to unpack Roger Stone’s advance knowledge.

And so, in an attempt to negate the results of a very real and very productive investigation, Durham sought out targets via whom he could avenge that investigation into Trump. The investigation itself failed to Lock Her Up, to say nothing of jailing any of the men and women of “the Deep State” who believed that enthusiastic foreknowledge of a Russian attack on a presidential candidate was an important thing to investigate, right along with Emirati efforts to cultivate politicians of both parties, the improper handling of classified information, and suspected (but ultimately uncorroborated) corruption.

Durham tried, but failed, to criminalize efforts to keep the country safe from Russian influence operations. Likewise, he tried, but failed, to criminalize political speech, a political candidate’s effort to raise concerns about her opponent’s very real ties to the country that had targeted her. The two prosecutions Durham brought in an attempt to obtain evidence to support the conspiracy theory that animated his entire investigation — or, short of that, to lead the public to believe in his conspiracy theory, regardless of the evidence — ended in embarrassing acquittals, but not before devastating the livelihoods of his targets and others, many of whom had previously played valuable roles in keeping the US safe.

In a sane world, with a diligent press, that should have ended it. In a sane world, with a diligent press, this four year effort would be recognized as the weaponization of DOJ that Trump-whisperers imagine might only happen in the future, or that Republican supporters of fascism set up a committee to falsely claim happened, only to Republicans, in the past.

But that didn’t happen.

So here we are, six months after Durham’s second humiliating trial loss, that of Igor Danchenko, the one where Durham personally led the prosecution, and he finally released the required report on his investigation. By regulation the report is supposed to be just a record of his prosecutions and declinations. Rather than admit that there had been no there there to his conspiracy theory, Durham engaged in omissions and false claims to bolster his conspiracy theory.

Tomorrow, Republicans on the House Judiciary Committee will invite Durham to repeat his false claims.

Here’s a guide to some of the false claims he may make before Congress.

 

John Durham Lied about Who Told the False Stories

Eight Things Not Mentioned in the Durham Report

John Durham Committed the “Crime” of “Inferring” of Which He Accused Rodney Joffe

“Ridiculous:” Durham’s Failed Clinton Conspiracy Theory

John Durham Fabricated His Basis to Criminalize Oppo Research

John Durham’s Disinformation Problem

 

John Durham covered up what really happened with the Alfa Bank investigation

The Dishonest and Incompetent FBI Work John Durham Learned to Love

FBI Cyber Division’s Enduring Blue Pill Mystery

John Durham’s Blind Man’s Bluff on DNS Visibility

 

John Durham committed the prosecutorial errors he attacked when the FBI made them, but worse

Doo-Doo Process: John Durham Claims to Know Better than Anthony Trenga and Two Juries

John Durham, High Priest of the Cult of the Coffee Boy

 

The press hasn’t called out Durham even while they’ve identified his false claims

How Jonathan Swan Covered [Up] John Durham’s Corruption

How CNN Inculpated John Durham While Purportedly Exonerating Trump

Republicans Demanded Independence for John Durham and Got Robert Hur and Jack Smith in the Bargain

 

Bonus track!

Trophy Documents: The Entire Point Was to Make FBI Obedient

John Durham’s Disinformation Problem

/44 Comments/in , , /by

The only person about whose ties to Christopher Steele John Durham showed no curiosity was Oleg Deripaska.

The only person whose ties to the creator of the dossier that led the FBI to adopt false claims against Trump aides that Durham didn’t pursue was the guy, on whose behalf, Trump’s campaign regularly sent out internal polling data starting in May 2016, the guy, on whose behalf, Trump’s campaign manager briefed Russian agent Konstantin Kilimnik on the campaign’s plan to win swing states. The 2021 Treasury filing that stated, as fact, that Kilimnik is a, “known Russian Intelligence Services agent implementing influence operations on their behalf,” also stated, as fact, that in 2016, “Kilimnik provided the Russian Intelligence Services with sensitive information on polling and campaign strategy,” the very same polling data and campaign strategy he obtained from Trump’s campaign manager on Oleg Deripaska’s behalf. As I’ve laid out, John Durham never mentioned Kilimnik in his report, not once, to say nothing of how Kilimnik obtained internal polling data and a campaign strategy briefing and delivered it to Russian spies.

Everyone else who had the least little tie to Christopher Steele, Durham pursued relentlessly. He charged Igor Danchenko, even though the FBI used Danchenko to, “fish information from Mr. Steele about what Mr. Steele was up to,” as the former British spook pursued a second dossier against Trump in 2017. He charged Danchenko even though Danchenko neither wrote the dossier nor shared it (or even knew it was being shared) with the FBI. Durham not only charged Steele’s primary source, but he caused Danchenko to be burned as an FBI informant, even though Danchenko’s subsource network had reportedly proven incredibly valuable to the FBI. Durham even helped to ensure that the FBI would not pay a significant lump sum payment to Danchenko for his assistance after Republicans in Congress led to his exposure.

Durham’s report aired, at length, details of the earlier counterintelligence investigation into Danchenko; he didn’t include the reasons Danchenko’s handler found the allegations unreliable (indeed, an undated referral in his report suggests Durham retaliated against Danchenko’s handler Kevin Helson for providing those details at trial). Once again, Durham failed his own standards of including exculpatory information. Durham also falsely claimed that Danchenko never told the FBI that his source network knew of his tie to Steele. In reality, as I’ll return to below, in his first interview with the FBI, Dancehnko described that two of them did.

Durham also conducted the investigation into Charles Dolan he believed Robert Mueller’s team should have done in 2017. Durham obtained Dolan’s email, his work email, his phone records, and his Facebook records. Durham still found no proof that Dolan was the source for any of the Russia-related reports in the dossier. After not getting the answers he wanted in Dolan’s first interview, Durham made him a subject and had him review an email Dolan sent, passing on information he had read in public sources, with a report in the dossier, which Dolan conceded might have come from his email. But Dolan still testified that Danchenko never asked Dolan for information about Trump’s connection to Russia.

It wasn’t just Danchenko and Dolan, though. A key part of Durham’s conspiracy theory against Michael Sussmann depended on the fact that — shortly after Sussmann got the Alfa Bank anomaly independent of the Hillary campaign — Sussmann asked Steele about the bank during a meeting where Marc Elias asked Sussmann to help vet Steele. Durham tried to introduce Steele’s subsequent report on Alfa Bank based on that meeting, even though all the evidence shows that if the Brit did provide the report to the FBI, he did so on his own, and it’s not even clear that he himself did provide that particular report directly to his FBI handler.

Durham compelled Fusion’s tech expert Laura Seago to testify because a meeting and four emails she exchanged with Rodney Joffe were the one link between Joffe and the dossier. Seago testified that the Alfa Bank allegations were not a big part of the work she did on Trump-related issues.

Durham had Deborah Fine testify because, as one of the Hillary Campaign’s Deputy General Counsels, she was the only person associated with the campaign — aside from Marc Elias — who regularly met with Fusion GPS. Durham made her testify even though she knew nothing about research relating to Alfa Bank and didn’t remember any conversations about Trump and Russia. Instead, Fine testified, her interaction with Fusion pertained to lawsuits filed against Trump, his company, and his family that Fusion helped to research.

Durham used every method at his disposal — including getting Judge Christopher Cooper to override the Hillary campaign’s claim of privilege over some Fusion emails — to unpack any possible relationship that subjects of his investigation had with Christopher Steele.

Except Oleg Deripaska.

In fact, Durham did the opposite: he obscured the import of Deripaska’s ties to Steele.

In his report, Durham asserted, as fact, something that had only been implied before: Oleg Deripaska paid Steele in spring 2016 to collect information on Paul Manafort.

When interviewed by the FBI in September 2017, Steele stated that his initial entree into U.S. election-related material dealt with Paul Manafort’s connections to Russian and Ukrainian oligarchs. In particular, Steele told the FBI that Manafort owed significant money to these oligarchs and several other Russians. 890 At this time, Steele was working for a different client, Russian oligarch Oleg Deripaska, often referred to as “Putin’s Oligarch” in media reporting, on a separate litigation-related issue. 891

In the same way that Paul Singer initiated the open source research into Trump done by Fusion GPS before the Democrats took it over, Oleg Deripaska — the person on whose behalf Russian intelligence obtained inside dirt, via Konstantin Kilimnik, from Trump’s campaign — initiated the HUMINT collection on Trump’s team, lasting at least until April 18, 2016, even after the Russian attack on Hillary Clinton had already started.

Oleg Deripaska started the dossier project and only later did the Democrats pick it up, unwitting to the fact that it was started by a guy who was busy playing a key role in Russia’s influence operation targeting Hillary’s campaign.

It’s bad enough that Durham didn’t pursue the tie between the dossier and Russia’s later efforts to obtain inside dirt from Trump’s campaign.

But when he described the evidence that Russia likely learned of Steele’s work for the DNC by July 2016, before Steele did virtually all but one of the substantive reports on Trump, Durham did so in a section almost 100 pages earlier than his description of Deripaska’s ties to Steele, and by adopting the moniker the DOJ IG Report used for Deripaska, “Oligarch 1,” he hid that the source of that knowledge was Deripaska himself.

As the record now reflects, at the time of the opening of Crossfire Hurricane, the FBI did not possess any intelligence showing that anyone associated with the Trump campaign was in contact with Russian intelligence officers at any point during the campaign. 251 Moreover, the now more complete record of facts relevant to the opening of Crossfire Hurricane is illuminating. Indeed, at the time Crossfire Hurricane was opened, the FBI (albeit not the Crossfire Hurricane investigators) was in possession of some of the Steele Reports. However, even if the Crossfire Hurricane investigators were in possession of the Steele Reports earlier, they would not have been aware of the fact that the Russians were cognizant of Steele’s election-related reporting. The SSCI Russia Report notes that”[s]ensitive reporting from June 2017 indicated that a [person affiliated] to Russian Oligarch 1 was [possibly aware] of Steele’s election investigation as of early July 20 l 6.” 252 Indeed, “an early June 2017 USIC report indicated that two persons affiliated with [Russian Intelligence Services] were aware of Steele’s election investigation in early July 2016.”253 Put more pointedly, Russian intelligence knew of Steele’s election investigation for the Clinton campaign by no later than early July 2016. Thus, as discussed in Section IV.D. l .a.3, Steele’s sources may have been compromised by the Russians at a time prior to the creation of the Steele Reports and throughout the FBI’s Crossfire Hurricane investigation.

Steele’s source network may have been compromised before the project started, Durham charged. But Durham hid the evidence that if it was compromised, it was compromised by the guy on whose behalf Trump’s campaign manager shared campaign information with Russian intelligence.

In fact, the DOJ IG Report, finished in December 2019 and from which Durham adopted that moniker, Oligarch 1, strongly suggests that Deripaska himself and his “known Russian Intelligence Services agent implementing influence operations on their behalf” sidekick, Konstantin Kilimnik, were the source of any disinformation in the dossier.

Durham did not pursue that evidence, at all, in his report. As I said, he never once mentioned Kilimnik.

He ignored Deripaska’s likely role in disinformation in 2016, even though he focused repeatedly on disinformation in his report. He complained, for example, that the FBI didn’t unpack any potential disinformation in the dossier before using it in the Carter Page FISA applications.

The failure to identify the primary sub-source early in the investigation’s pursuit of FISA authority prevented the FBI from properly examining the possibility that some or much of the non-open source information contained in Steele’s reporting was Russian disinformation (that wittingly or unwittingly was passed along to Steele), or that the reporting was otherwise not credible.

He suggested Danchenko’s unresolved counterintelligence investigation — and not Oleg Deripaska — was the source of potential disinformation.

Our review found no indication that the Crossfire Hurricane investigators ever attempted to resolve the prior Danchenko espionage matter before opening him as a paid CHS. Moreover, our investigation found no indication that the Crossfire Hurricane investigators disclosed the existence of Danchenko’s unresolved counterintelligence investigation to the Department attorneys who were responsible for drafting the FISA renewal applications targeting Carter Page. As a result, the FISC was never advised of information that very well may have affected the FISC’s view of Steele’s primary sub-source’s (and Steele’s) reliability and trustworthiness. Equally important is the fact that in not resolving Danchenko’s status vis-a-vis the Russian intelligence services, it appears the FBI never gave appropriate consideration to the possibility that the intelligence Danchenko was providing to Steele -which, again, according to Danchenko himself, made up a significant majority of the information in the Steele Dossier reports – was, in whole or in part, Russian disinformation.

He falsely used one answer Danchenko gave in his first meeting with the FBI to suggest that might be a source of disinformation.

Danchenko’s uncharged false statements to the FBI reflecting the fact that he never informed friends, associates, and/or sources that he worked for Orbis or Steele and that “you [the FBI] are the first people he’s told.” In fact, the evidence revealed that Danchenko on multiple occasions communicated and emailed with, among others, Dolan regarding his work for Steele and Orbis, thus potentially opening the door to the receipt and dissemination of Russian disinformation;

The claim was grossly dishonest, because at the same meeting, Danchenko described that Olga Galkina knew he worked in business intelligence, and also revealed how he asked Orbis for help setting up another of his sources with language instruction in the UK. Danchenko told the FBI enough, from his first interview, that gave them reason to think his sources might know for whom he reported. But Durham accused Danchenko of lying about it anyway, because he needed to blame Danchenko, and not Deripaska, for any disinformation in the dossier.

Durham even complained that Peter Strzok had not considered whether the original Australian report about George Papadopoulos could be disinformation. Maybe it’s the Australians’ fault, Durham suggests, not Deripaska’s!

Durham looked for disinformation in every source but the one place where — even by early in his investigation — the FBI already suspected it, in the guy who kicked off the dossier project in 2016, before the Democrats even got to it.

Durham’s treatment of Deripaska’s suspected role in disinformation in 2016 is all the more astounding given how quickly Durham dismissed the possibility that the foundation of his own investigation was disinformation.

Durham built his entire project on a source that the intelligence community warned him might be a fabrication, the Russian intelligence report claiming that Hillary had a plan to hold Trump accountable for his ties to Russia. Durham dismissed that warning in two short paragraphs.

As was declassified and made public previously, the purported Clinton Plan intelligence was derived from insight that “U.S. intelligence agencies obtained into Russian intelligence analysis.” 394 Given the origins of the Clinton Plan intelligence as the product of a foreign adversary, the Office was cognizant of the statement that DNI Ratcliffe made to Senate Judiciary Chairman Lindsey Graham in a September 29, 2020 letter: “The [intelligence community] does not know the accuracy of this allegation or the extent to which the Russian intelligence analysis may reflect exaggeration or fabrication.” 395

Recognizing this uncertainty, the Office nevertheless endeavored to investigate the bases for, and credibility of, this intelligence in order to assess its accuracy and its potential implications for the broader matters within our purview.

Remember: Durham made this report the cornerstone of his investigation starting around February 2020, three months after the DOJ IG Report, in December 2019, publicly gave reason to believe that Deripaska had been feeding the dossier with disinformation starting at least by July 2016, the month of this purported Russian intelligence report. Durham made this report the cornerstone of his investigation in spite of his confirmation that Deripaska initiated the dossier project in March 2016 and continued it until weeks before the Democrats took it over.

And Durham made this report the cornerstone of his investigation by fabricating a claim that even the Russians didn’t make about Hillary: that she wanted to promote a false narrative about Trump, rather than demonstrate all the true and damning Russian ties Trump had that Fusion had already fed to Franklin Foer by early July 2016.

Hillary Clinton had no incentive to pay a lot of money for false information — and nor did anyone need to fabricate Trump’s ties to Russia. Paying for false information predictably could — and did, and hasn’t stopped doing in the interim seven years — backfire stupendously. Plus, as I have shown, paying for false information demonstrably led to complacency about the possibility that the material stolen in the earlier hack would be used later in the campaign.

Hillary Clinton had no incentive to pay for disinformation! And Durham utterly fabricated the claim that she did!

But Oleg Deripaska would have an incentive to pay for disinformation.

Not only did that false information in the dossier send the FBI looking at Carter Page as Paul Manafort’s liaison with Russia instead of Konstantin Kilimnik — who then waltzed into a cigar bar in New York to hear how Trump planned to win Pennsylvania. Not only did the false information in the dossier lead the FBI to spend valuable time vetting the dossier rather than pursuing the hundreds of real ties Trump had to Russia.

But the false information in the dossier — and the way that Trump, in the wake of a January 2017 Manafort meeting with another Deripaska associate, attacked the dossier as a way to discredit the larger Russian investigation —  undermined the investigation and ultimately did untold damage to the FBI.

The false information in the dossier has been one of the most singular sources of partisan antagonism in the United States ever since. It has ripped the country apart. One right wing influencer even blamed the dossier for the January 6 attack on the Capitol.

Hillary Clinton had no incentive to pay for that. But Oleg Deripaska did.

And rather than laying out Deripaska’s likely role in the disinformation in the dossier, the known disinformation behind claims about Trump, Durham simply invented a claim that after such time as Deripaska had kicked off the dossier project and the Democrats picked it up, after such time as Deripaska knew that Democrats were funding the dossier, Hillary decided to make up false claims about Trump.

Rather than honestly laying out the public evidence that Deripaska was playing a ruthless double game — using Steele to make Manafort legally and financially less secure while using Manafort’s insecurity to win his cooperation with the influence operation — Durham did the one thing that could continue the wild success of Deripaska’s disinformation project: Blame Hillary for the disinformation, rather than Deripaska himself.

I don’t know whether Durham wittingly decided he was going to play Oleg Deripaska’s flunkie from inside the federal government (to say nothing of Alfa Bank, with whose investigation Durham shared a script). But everything he did with his investigation, every misrepresentation he makes in his report, all the human carnage Durham has done since, simply continues the disinformation project Deripaska kicked off seven years ago.

And that’s why his singular lack of curiosity about Deripaska’s ties to Steele is so telling.

How Jonathan Swan Covered [Up] John Durham’s Corruption

/33 Comments/in , , /by

Something funny happened yesterday.

Full-time Trump-whisperer Maggie Haberman, Trump-whisperer Jonathan Swan, and DOJ reporter Charlie Savage wrote a story responding to Trump’s promise to appoint prosecutors to investigate Joe Biden and his family just like Biden’s own DOJ has done (which they note). They described that if Trump won a second term, he would “appoint an ally who would bring charges against his political enemies regardless of the facts,” then described how Jeffrey Clark and Russell Vought were already working on the plan.

Mr. Trump appeared to be promising his supporters that he would appoint an ally who would bring charges against his political enemies regardless of the facts.

[snip]

Mr. Clark and Mr. Vought are promoting a legal rationale that would fundamentally change the way presidents interact with the Justice Department. They argue that U.S. presidents should not keep federal law enforcement at arm’s length but instead should treat the Justice Department no differently than any other cabinet agency. They are condemning Mr. Biden and Democrats for what they claim is the politicization of the justice system, but at the same time pushing an intellectual framework that a future Republican president might use to justify directing individual law enforcement investigations.

They make no mention of the cases on which Bill Barr attempted to do just that — bring charges against Trump’s political enemies regardless of the facts: Greg Craig, Jim Comey, Andrew McCabe, John Kerry, among others (though Savage has covered them).

The only mention of Barr’s unprecedented past success at politicizing DOJ includes an important error.

Under Mr. Barr, the Justice Department overruled career prosecutors’ recommendations on the length of a sentence for Mr. Trump’s longest-serving political adviser, Roger J. Stone Jr., and shut down a case against Mr. Trump’s first national security adviser, Michael Flynn, who had already pleaded guilty. Both cases stemmed from the Russia investigation.

Barr’s DOJ did not succeed at shutting down Mike Flynn’s prosecution, in which a sentencing memo, approved by Barr’s DOJ, had already been submitted by the time Barr commenced his efforts. Emmet Sullivan was still deciding whether to grant DOJ’s request to throw out Flynn’s guilty plea when Trump pardoned Flynn; and when Sullivan finally did dismiss the case, he reaffirmed Flynn’s guilty verdict.

NYT’s silence about how Trump really overturned Flynn’s conviction, a pardon, carries over generally. These journalists join Kaitlin Collins in warning of future Trump corruption without bothering to catalog or hold Trump accountable for his past unprecedented corruption, the pardons he used to reward those who lied about what really happened with Russia in 2016. That’s the opposite of accountability journalism, warning of future corruption while remaining silent about the similar corruption that already happened.

But the weirdest thing, coming as it does from a team including both Swan and Savage, is that NYT made no mention of the Durham investigation, in which a Special Counsel appointed under Trump literally did, “bring charges against [Trump’s] political enemies regardless of the facts.”

The silence from Savage is unfortunate given that he has done such important work laying out how that’s what Durham did.

Swan’s silence is more inexcusable.

That’s because — as I documented in real time — Swan was absolutely central in disseminating Durham’s unsubstantiated insinuation that a “Clinton/Dem operative” (Durham’s claim itself relied on exaggeration) was behind the pee tape.

Swan’s judgement, a neutral journalist not just magnifying and repeating Devlin Barrett’s shitty reporting on the Igor Danchenko indictment (Barrett said charges, plural, were tied to Charles Dolan and falsely claimed that Durham had alleged Dolan was the source for the dossier, “rather than well-connected Russians”), but adding his judgment that it “doesn’t get much worse,” went viral, accepted as fact.

I pointed that out, with a hot link to his earlier Tweet.

Swan responded. He ignored the clear factual error about Flynn and the point about pardons, but he conceded that his Tweet “is inaccurate.”

So he deleted it, with only this Tweet recording that he did so and no apology to the two innocent men, Charles Dolan and Igor Danchenko, he falsely accused and — with his viral tweet and his considerable credibility as a journalist — led others to falsely accuse, having done so because of the deliberately misleading way Durham had presented his charges against Danchenko.

Most curiously, Swan explained that he, “never covered Durham.”

It’s absolutely true that he never laid out how Durham, a Special Counsel Trump demanded and got, brought “charges against his political enemies regardless of the facts,” as Savage has. Swan never even, as Barrett did, reported on an indictment and misleadingly claimed uncharged allegations in it were charged conduct. Swan wasn’t the experienced DOJ reporter who first fell for Durham’s affirmatively misleading charging document, Barrett was.

But as a journalist, Swan disseminated Durham’s unsubstantiated, uncharged claims, exacerbated by Barrett’s shitty reporting, and people took his report as true. Swan played a key role in leading the public to believe that a prosecutor who charged Danchenko for making a literally true statement to the FBI about his contact with Dolan had instead found something so bad that, “it doesn’t get much worse.”

Perhaps his role was unwitting. But Swan played a key role in helping Durham to make and lead the public to believe in false claims, “regardless of the facts,” precisely the topic that Swan and his colleagues suggest is just a prospective threat from Trump.

And much of the public still believes Durham’s false claims, in (small) part because of Swan’s own actions.

John Durham is going to go before Congress next week and be asked to explain and repeat demonstrably false claims — outright fabrications, in some cases — that he made in his report. Durham will likely renew his claims, made in his report, that Michael Sussmann and Igor Danchenko lied, even though two juries told him that he made those accusations, “regardless of the facts.”

And Swan, who generously describes that, “the pee tape rumors didn’t bear out,” rather than that a prosecutor made the claim “regardless of the facts,” Swan, who believes the topic of prosecutors who make false claims “regardless of the facts” is a topic worth reporting, thinks that deleting evidence of his own role in disseminating such false claims is sufficient, even as Durham continues to do Trump’s bidding of making false claims in real time.

John Durham is precisely the threat that Haberman and Swan and Savage warned about prospectively, but Swan, having played a role in leading the public to believe Durham’s false claims “regardless of the facts,” thinks that merely deleting the evidence that that’s what Durham has done is sufficient.

If the threat of prosecutors charging Trump’s enemies “regardless of the facts” is worth reporting, than Durham’s ongoing corruption must be covered, not covered up.

Republicans Demanded Independence for John Durham and Got Robert Hur and Jack Smith in the Bargain

/70 Comments/in , , , , /by

Even before Trump’s Espionage Act indictment was made public, Trump was attempting to politicize his stolen documents prosecution by demanding — via a Truth Social post— a meeting with Merrick Garland, who is not overseeing the case. Virtually every journalist fell for Trump’s bait, reporting the demand without noting that Jack Smith is the prosecutor overseeing the investigation into Trump, not Merrick Garland.

Garland rightly refused the meeting.

Since then, paid propagandists have been chanting out “Joe Biden Merrick Garland Joe Biden Merrick Garland” talking points like wind-up toys, because repetition is how you get low-information Trump supporters and members of Congress to believe false claims.

This strand of propaganda has worked. The other day, WSJ’s Sadie Gurman, after reviewing how assiduously Merrick Garland remained out of the process, stated as fact that this is a political prosecution.

When a grand jury returned the first-ever federal indictment of a former president last week, Attorney General Merrick Garland made a point of suggesting he was nowhere near the team handling the case.

He strolled into Justice Department headquarters in downtown Washington with his deputy late Thursday afternoon amid intense speculation about charges against Donald Trump and told a Wall Street Journal reporter he had been out getting a Covid vaccine.

[snip]

In keeping with that philosophy, Garland kept details of the indictment and its timing secret from Biden, who said Friday, “I have not spoken to him at all, and I am not going to speak with him.”

The attorney general also declined to meet with Trump’s lawyers, who requested a sit-down in the days leading up to the indictment, leaving the gathering instead to Smith and other Justice Department officials.

[snip]

Yet Garland now presides over what may be the highest-profile political prosecution ever, which is certain to be a prominent factor in the 2024 election. [my emphasis]

Gurman also suggested that Garland somehow engaged in politics by letting Jack Smith unseal the indictment that was sealed to protect security, not to let Trump sow violence in a vacuum.

But Garland didn’t object to prosecutors asking a court to unseal the indictment on Friday, well before Trump’s Tuesday arraignment when it would normally be made public, a person familiar with the matter said.

Finally, Gurman immediately — and, possibly, falsely — suggested that Garland “faces a call” on whether DOJ should charge Hunter Biden.

Adding to the political overtones, Garland also faces a call on whether the Justice Department should file charges against Biden’s son, Hunter, who is under investigation related to his taxes and whether he made a false statement in connection with a gun purchase. Hunter Biden has said he acted legally and appropriately.

Garland only faces a call if he has to approve an indictment. If David Weiss chooses not to prosecute, Garland is not going to override the Trump-appointed US Attorney who has been retained to make this decision himself.

Since yesterday’s arraignment, the false claim that Joe Biden and Merrick Garland have pursued the prosecution of Biden’s rival has gotten crazier still, especially on Murdoch properties other than the one where Gurman invented a political prosecution where there is none. As Trump wailed about his plight at his club yesterday, for example, Fox’s chyron accused Biden of being a “wannabe dictator” because a process entirely insulated from Biden resulted in Trump’s arrest. (Natasha Korecki posted this screen cap.)

There’s something especially noxious about the degree to which actual journalists like Gurman are parroting this line (Jamison Fraser notes a similar example in polling coverage).

Donald Trump is being treated no differently than Biden himself, to say nothing of the targets of John Durham’s abusive four year investigation.

Consider how absurd it is that Trump, lashing out, promised to appoint “a real special ‘prosecutor'” to go after Biden and “the entire Biden crime family.”

The Biden Administration already did that, Bucko!!! It currently has two Trump appointed prosecutors, David Weiss and Robert Hur, conducting investigations into Biden’s son and Biden himself. You’re so inadequate you can’t even out-prosecute Biden than Biden himself is already doing!

Yet, in response to this tweet, almost no journalists noted that Joe Biden’s Administration already did that — retain or appoint two separate Trump-appointed prosecutors to investigate Biden himself.

And that’s a hint of what is affirmatively missing from the coverage of real journalists like Gurman.

It’s that Republicans, and Trump himself, have demanded what they’ve gotten with Merrick Garland’s distance from Jack Smith’s prosecution. Republicans, and Trump himself, have repeatedly demanded that Garland stay out of Weiss’ investigation. They even wailed that Biden was being treated specially after the discovery of classified documents at the Penn Biden Center, until it became clear a preliminary Special Counsel had been appointed within days, in Biden’s case, not months.

Most importantly, none of these Republicans wailing about Garland’s distance from the Jack Smith investigations (wailing because it demonstrates their claims that this is a political prosecution to be obvious bullshit) complained at all after John Durham used the independence Garland afforded him to engage in one after another instance of shocking prosecutorial abuse.

Republicans, and Trump himself, did not complain that Durham investigated for four years even though no crime predicated his investigation (a far worse abuse than Durham’s complaint that Crossfire Hurricane was opened as a Full rather than Preliminary investigation).

Republicans, and Trump himself, did not complain that Durham threatened witnesses and lawyers (and lawyers complained to Merrick Garland in real time; they didn’t wait until a target letter went out to try to excuse their own counterproductive legal advice).

Republicans, and Trump himself, did not complain that in both trials, first his lead prosecutor and then Durham himself, were caught scripting improbable or affirmatively misleading testimony from witnesses.

Republicans, and Trump himself, did not complain that Durham charged Michael Sussmann for coordinating with Hillary’s top staffers months before interviewing any of those staffers and discovering it wasn’t true.

Republicans, and Trump himself, did not complain that Durham charged Igor Danchenko relying, in significant part, on the rants Sergei Millian made on his Twitter feed, only to discover, months later, that Millian was unwilling to repeat the same claims at trial under oath.

Republicans, and Trump himself, did not complain that Durham prosecuted a man for making a literally true statement to the FBI.

Republicans, and Trump himself, did not complain when John Durham accused Sussmann and Danchenko anew of lying to the FBI after two juries told him he couldn’t prove that claim.

Republicans, and Trump himself, did not complain that John Durham fabricated a claim that even the Russians didn’t make against Hillary and used it as his excuse to continue his investigation for three more years.

Republicans, and Trump himself, did not complain when John Durham affirmatively misrepresented the YotaPhone white paper; instead, Trump used Durham’s misrepresentation to justify making death threats against Michael Sussmann.

Republicans, and Trump himself, knew how much independence Merrick Garland was giving Jack Smith, because Durham told them that he committed all that abuse and yet Garland let him continue unimpeded.

Finally, we want to thank you and your Office for permitting our inquiry to proceed independently and without interference as you assured the members of the Senate Judiciary Committee would be the case during your confirmation hearings to become Attorney General of the United States.

And long after it was clear that Garland had given Durham precisely the independence that Republicans, and Trump himself, had demanded, Trump is the one who forced the appointment of a Special Counsel by announcing his run six months ahead of his competitors. Trump took steps that led to someone completely independent investigating his suspected crimes, not Joe Biden, not Merrick Garland. And now he’s trying to pretend that he himself didn’t ensure someone independent would investigate his suspected crimes.

Jack Smith has been living by the rules Republicans demanded, and got, for John Durham.

I don’t expect Trump to care that Jack Smith has been operating under the same rules of independence that Garland gave Durham. Trump needs to claim this is political, to provide his boosters — and probably his own fragile ego — some explanation for this indictment other than that a grand jury of South Floridians determined there was probable cause he committed an unprecedented crime that made this country less safe. I expect Mike Davis to continue reeling out his knowingly false claims, Joe Biden Merrick Garland Joe Biden Merrick Garland. It’s what he is paid to do.

But journalists like Sadie Gurman should know better. Journalists like Sadie Gurman, after presenting proof that Jack Smith is operating with the same independence that John Durham did, owe their readers a description of what it means that this investigation has operated with independence. Journalists like Sadie Gurman should not be drawn in by attempts to delegitimize a prosecution only because Trump belatedly wants to change the rules he himself demanded.

Update: I’ve updated my stolen documents investigation resource page, with key documents, a bit of a timeline, all our posts on the case, plus other useful links (including to dockets of other 18 USC 793 cases).

John Durham’s Blind Man’s Bluff on DNS Visibility

/17 Comments/in , , /by

On September 16, 2021, John Durham indicted Michael Sussmann on a single count of lying to the FBI, just days before the statute of limitations for that crime expired. Durham accused Sussmann of lying to hide that he had a client or clients on whose behalf he was sharing allegations about DNS anomalies involving Trump Organization and Alfa Bank.

Durham adopts the “DNC fabrication” theory from agents who badly screwed up the original investigation

As I laid out here, the indictment adopted the “DNC fabrication” theory, the “fabrication” part of which was initially espoused in a hasty review by FBI Cyber agents Nate Batty and Scott Hellman by September 21, 2016, just two days after Sussmann shared a white paper describing anomalies involving Alfa Bank.

Durham adopted that theory in spite of proof, in their own summary, that the FBI agents had not closely reviewed the DNS logs included with the allegations, if they ever reviewed them at all. Durham adopted that theory in spite of irregularities in the chain of custody surrounding the handling of a Blue Thumb Drive that reportedly included DNS logs that were never reviewed. Durham adopted that theory in spite of the fact that Batty’s own Lync messages materially conflicted with a claim he made to Durham two years earlier: Batty claimed he had been refused information about the role of Sussmann in the allegations, when in fact his Lync messages showed he had been informed about Sussmann’s role from the start. Durham adopted that theory in spite of the fact that FBI started debunking parts of the “fabrication” story within hours of Batty and Hellman proposing it. Durham adopted that theory in spite of the fact that FBI’s own overt steps (during a pre-election period) and Alfa Bank’s curious lack of DNS logs made pursuing the allegations impossible.

That indictment was an insanely reckless thing for John Durham to do, building as it did on the investigative failures of Batty and Hellman, not to mention Batty’s own materially inconsistent claim.

Several things made that indictment even more reckless.

Durham fails to take basic investigative steps before indicting

First, in spite of the fact that Durham had already been investigating for 28 months by that point — Durham had already been investigating for six months longer than the entire Mueller investigation — there were a whole bunch of obvious investigative steps he had not yet taken. Between the indictment and the May 2022 trial, Durham would do the following:

Durham also revealed two other interviews he only conducted after charging Sussmann: one with someone identified as Listrak Employee-1 and other unidentified personnel on October 27, 2021 and another with the CEO and CTO of Cendyn on November 17, 2021. As described, their interviews pertained exclusively to email, not DNS, and Durham doesn’t appear to have asked Cendyn about the contacts via its Metron messaging product done for some other client with Alfa Bank in the same time period, nor about the contact that did exist between Cendyn and the affected Spectrum IP address. It also doesn’t mention that Listrak reported no emails to Alfa Bank, one of the Bank’s evolving explanations for the anomalies, and any mail to Spectrum was sent elsewhere.

In his report, Durham makes no mention of whether he interviewed anyone at Spectrum Health or Alfa Bank, though a DC judge would observe that it was almost like the Sussmann indictment and an Alfa Bank lawsuit, “were written by the same people in some way.” There were large gaps involved with both entities in the original investigation and it’s not clear Durham made any effort to close them.

Durham accused the FBI of skipping investigative steps on Crossfire Hurricane that might have discovered exculpatory evidence, but none of that comes close to the many investigative steps he had not yet pursued in the 28 months he had already been investigating before indicting Sussmann.

Durham’s indictment of Sussmann piled his own investigative failures on top of those by Batty and Hellman.

Durham discovers his DNC fabrication theory involves real data

More problematic than Durham’s investigative incompetence, though, the Special Counsel charged Michael Sussmann on September 16, 2021, in spite of the fact that a month earlier, by mid-August, 2021, Durham’s team learned that the data Rodney Joffe and others used to conduct their research was absolutely real. The nature of how this came about remains obscure, but in addition to debunking the most simplistic “DNC fabrication” theories, the discovery made it impossible for Durham to continue to rely on the expert his team had been using. The discovery that the data that Batty and Hellman had dismissed in just one day was real should have led Durham to reconsider everything about his case.

Instead, Durham barreled forward with his indictment.

Durham invites the guy who screwed up the investigation to be his expert

Instead of reassessing his case, Durham responded to losing his expert by proposing that Hellman serve as the replacement, even though by Hellman’s own admission he only knows the basics about DNS.

DeFilippis. How familiar or unfamiliar are you with what is known as DNS or Domain Name System data?

A. I know the basics about DNS.

[snip]

Berkowitz. And then, more recently, you met with Mr. DeFilippis and I think Johnny Algor, who is also at the table there, who’s an Assistant U.S. Attorney. Correct?

A. Yes.

Q. They wanted to talk to you about whether you might be able to act as an expert in this case about DNS data?

A. Correct.

Q. You said, while you had some superficial knowledge, you didn’t necessarily feel qualified to be an expert in this case, correct, on DNS data?

A. On DNS data, that’s correct.

Hellman was one of just two people, aside from John Durham himself, who had a stake in sustaining the “DNC fabrication” theory he had floated before closely reviewing the evidence. That Durham even considered making him his expert is a testament that Durham was interested in protecting his “DNC fabrication” theory, not interested in expertise, much less what the actual evidence said.

Durham includes two expert reviews unmoored from any prosecutorial decision

And that’s why Durham’s inclusion of two expert reviews of the allegations Sussmann shared with the government is of interest:

  • 1671 FBI Cyber Technical Operations Unit, Trump/Alfa/Spectrum/Yota Observations and Assessment (undated; unpaginated).
  • 1635 FBI Cyber Division Cyber Technical Analysis Unit, Technical Analysis Report (April 20, 2022) (hereinafter “FBI Technical Analysis Report”) (SCO _ 094755)

With one exception, Durham describes those reviews in a 13-page section of his report that purports to be about the ongoing efforts by Rodney Joffe and others to chase down the Alfa Bank anomalies and some unusual traffic probably reflecting the presence of Yota Phones in the US. The section itself has no place in a prosecutorial memo, because the only interaction with the government described in that section involved a Georgia Tech researcher refusing HPSCI’s request to help chase down these allegations. The rest involves Joffe continuing to chase this issue with his own data, which insofar as it demonstrates Joffe’s sustained concern about this, independent of any election, undermines pretty much all of Durham’s conspiracy theories. The declination decision regarding fraud — which Andrew DeFilippis used to claim that Joffe was still a subject of the investigation more than five years after the events in question, thereby keeping him off the stand in Sussmann’s trial — didn’t even mention Joffe.

But the description of these reviews in this section really doesn’t have a place where Durham put it, because along with the Cendyn and Listrak interviews, one of the reviews appears to have been last minute prep for the Sussmann trial and the other played a key role in an affirmatively misleading court filing that led Trump to make death threats against Sussmann.

These reviews in Durham’s report supported his last-ditch effort to cement the belief that Hillary framed Donald Trump. They’re here to prove, once and for all, that Sussmann was wrong.

Here’s how Durham introduces his efforts to redo the work Batty and Hellman and others botched so many years ago:

This subsection first describes what our investigation found with respect to the allegation that there was a covert communications channel between the Trump Organization and Alfa Bank. It includes the information we obtained from interviews of Listrak and Cendyn employees. It then turns to the allegation that there was an unusual Russian phone operating on the Trump Organization networks and in the Executive Office of the President. We tasked subject matter experts from the FBI’s Cyber Technical Analysis and Operations Section to evaluate both of these allegations.

But as with so much else in this report, they don’t do what they claim to. Durham ensured his experts sustained the blindness that Batty and Hellman willfully adopted so many years ago to avoid concluding that the allegations might be real.

As I noted here, the two reviews purport to review the Alfa Bank allegations — shared with both the FBI and (in updated form) the CIA — and the YotaPhone allegations shared with the CIA. In one place, Durham claims “the same FBI experts” did both reviews, though he attributes them to different groups. But that’s important because if they are the same experts, then they should know of both reviews.

Durham incites death threats because Joffe investigated Barack Obama

The YotaPhone review must have been done first because, as I noted above and show below, the analysis matches claims Durham made in a filing purporting to raise conflicts but mostly airing allegations for which the statute of limitations had just expired. Here’s how Durham describes the allegations in the report:

Specifically, Sussmann provided the CIA with an updated version of the Alfa Bank allegations and a new set of allegations that supposedly demonstrated that Trump or his associates were using, in the vicinity of the White House and other locations, one or more telephones from the Russian mobile telephone provider Yotaphone. The Office’s investigation revealed that these additional allegations relied, in part, on the DNS traffic data that Joffe and others had assembled pertaining to the Trump Tower, Trump’s New York City apartment building, the EOP,1558 and Spectrum Health. Sussmann provided data to the CIA that he said reflected suspicious DNS lookups by these entities of domains affiliated with Yotaphone.1559 Sussmann further stated that these lookups demonstrated that Trump or his associates were using a Yotaphone in the vicinity of the White House and other locations.1560

Durham’s description of these allegations relies on redacted sections of two trial exhibits (but not a related one that shows Sussmann was not hiding having a client). Because the section of these trial exhibits was redacted, it’s not clear whether Durham is representing how these CIA witnesses described Sussmann’s claims fairly. That’s important because — as we’ll see — Durham misrepresents the YotaPhone white paper.

As Durham described, Sussmann provided four documents and 6 data files to the CIA.

During the meeting, Sussmann provided two thumb drives and four paper documents that, according to Sussmann, supported the allegations. 1564

1564 The titles of the four documents were: (i) “Network Analysis of Yota-Related Resolution Events”; (ii) ·’YotaPhone CSV File Collected on December 11th, 2016″; (iii) “Summary of Trump Network Communications”; and (iv) “ONINT [sic] on Trump Network Communications.” The two thumb drives contained six Comma Separated Value (“.CSV”) files containing IP addresses, domain names and date/time stamps.

Unlike the Red and Blue Thumb Drive, Durham makes clear that his experts actually examined these thumb drives.

Here are three of the documents:

I understand the csv files include:

  • yota-eop
  • yota-cpwest
  • yota-spectrum
  • yota-trumporg
  • sipper
  • 2016-05-04_2017-01-15_Trump_server.csv

I’ll say more about them below.

Durham’s description of the analysis, titled, “Trump/Alfa/Spectrum/Yota Observations and Assessment,” generally obscures whether it is rebutting a claim (redacted in the trial exhibits) made by Sussmann (“the presentation”) or included in the white paper and data (“the above-quoted white papers about the Yotaphone allegations” and “Yotaphone-related materials”) provided, and he doesn’t repeat or address the Alfa Bank side of these observations (which have no tie to the YotaPhone claims).

But the technical analysis does not, at all, debunk the YotaPhone observations.

The FBI DNS experts with whom we worked also identified certain data and information that cast doubt upon several assertions, inferences, and allegations contained in (i) the above-quoted white papers about the Yotaphone allegations, and (ii) the presentation and Yotaphone-related materials that Sussmann provided to the CIA in 2017. In particular:

  • Data files obtained from Tech Company-2, a cyber-security research company, as part of the Office’s investigation reflect DNS queries run by Tech Company-2 personnel in 2016, 2017, or later reflect that Yotaphone lookups were far from rare in the United States, and were not unique to, or disproportionately prevalent on, Trump-related networks. Particularly, within the data produced by Tech Company-2, queries from the United States IP addresses accounted for approximately 46% of all yota.ru queries. Queries from Russia accounted for 20%, and queries from Trump-associated IP addresses accounted for less than 0.01 %.
  • Data files obtained from Tech Company-1, Tech Company-2, and University-1 reflect that Yotaphone-related lookups involving IP addresses assigned to the EOP began long before November or December 2016 and therefore seriously undermine the inference set forth in the white paper that such lookups likely reflected the presence of a Trump transition-team member who was using a Yotaphone in the EOP. In particular, this data reflects that approximately 371 such lookups involving Yotaphone domains and EOP IP addresses occurred prior to the 2016 election and, in at least one instance, as early as October 24, 2014. [bold and italics mine]

Compare that to the supposed debunking from the gratuitous conflicts filing that led to death threats.

The Indictment further details that on February 9, 2017, the defendant provided an updated set of allegations – including the Russian Bank-1 data and additional allegations relating to Trump – to a second agency of the U.S. government (“Agency-2”). The Government’s evidence at trial will establish that these additional allegations relied, in part, on the purported DNS traffic that Tech Executive-1 and others had assembled pertaining to Trump Tower, Donald Trump’s New York City apartment building, the EOP, and the aforementioned healthcare provider. In his meeting with Agency-2, the defendant provided data which he claimed reflected purportedly suspicious DNS lookups by these entities of internet protocol (“IP”) addresses affiliated with a Russian mobile phone provider (“Russian Phone Provider-1”). The defendant further claimed that these lookups demonstrated that Trump and/or his associates were using supposedly rare, Russian-made wireless phones in the vicinity of the White House and other locations. The Special Counsel’s Office has identified no support for these allegations. Indeed, more complete DNS data that the Special Counsel’s Office obtained from a company that assisted Tech Executive-1 in assembling these allegations reflects that such DNS lookups were far from rare in the United States. For example, the more complete data that Tech Executive-1 and his associates gathered – but did not provide to Agency-2 – reflected that between approximately 2014 and 2017, there were a total of more than 3 million lookups of Russian Phone-Provider-1 IP addresses that originated with U.S.-based IP addresses. Fewer than 1,000 of these lookups originated with IP addresses affiliated with Trump Tower. In addition, the more complete data assembled by Tech Executive-1 and his associates reflected that DNS lookups involving the EOP and Russian Phone Provider-1 began at least as early 2014 (i.e., during the Obama administration and years before Trump took office) – another fact which the allegations omitted. [bold mine]

The bolded narrative shows these are the same report. If 3 million is 46% of the total of around 6.521 million lookups globally, then 1,000 Trump-related queries would be .01% of the global total.

But it is an innumerate stat. I’m not the FBI, and definitely not a top FBI cyber expert. But even my humble little blog occasionally relies on William Ockham to explain things that should be bloody obvious to the Federal government, such as that 3 million DNS requests amount to one family’s worth of use.

Contra Durham, 3 million DNS requests for a related IP addresses over a four-year period means these requests are very rare.

For comparison purposes, my best estimate is that my family (7 users, 14 devices) generated roughly 2.9 million DNS requests just from checking our email during the same time frame. That’s not even counting DNS requests for normal web browsing.

If you’re going to make a federal case out of this, at least make some attempt to understand the topic.

Durham and his hand-picked experts in the FBI suggest that because, among the very rare number of global requests, almost half appear in the US, it means they aren’t rare. From that, Durham and his experts argue that the fact that Trump’s properties (and Spectrum and the Executive Office of the President) are part of this tiny club is not cause for concern.

They’re doing so even though among the domains included in the CSV tables is wimax-client-yota-ru, which shows up in Wordfence’s IOC lists for the GRU attack on the election. Durham and his FBI experts are arguing that it is not alarming that there would be several look-ups to such a domain in October 2016 from the Executive Office of the President, periodical look-ups to that domain from Trump Organization starting in August 2016, and persistent such look-ups from the suspect Spectrum IP address starting in November 2016.

And about those EOP look-ups. Durham claims, in the italicized language above, that there is an, “inference set forth in the white paper that such lookups likely reflected the presence of a Trump transition-team member who was using a Yotaphone in the EOP.” Sussmann may have said that. But it’s not in the white paper. In fact, there’s just one reference to the EOP in the white paper at all, and it’s not included in the speculative paragraph that there may be a tie between the Spectrum traffic and the Trump traffic.

Network traffic analysis strongly suggests communications between Russian networks and Trump Tower, associated Trump properties, with artifacts also present at EOP. Spectrum Health resolver IP 167.73.110.8 in Grand Rapids MI is also observed making similar queries.

The traffic data indicates: (a) There are Russian-made cellular devices on these networks, seldom seen elsewhere in the US; and (b) these networks appear to be at- tempting SIP-connections to Russian networks which very few IPs globally are seen trying to resolve.

It is possible that one or more devices is at times travelling between locations as there are sometimes gaps possibly correlated to newsworthy events such as New York NY to Grand Rapids MI, lifting of some sanctions on Russia, and the disappearance of the queries from New York in mid December and from Grand Rapids MI in mid January 2017.

In other words, as he did when he invented an allegation against Hillary that the Russians didn’t even make, he’s inventing an inference here, the kinds of inferences he tried to criminalize when Joffe did them. Further, he suggests that Sussmann and Joffe didn’t reveal that the lookups started before the election, even though the CSV data included shows lookups starting on October 2, 2016, which last I checked was before the election.

Durham, who admits in his report that these lookups inexplicably ended before Inauguration, nevertheless falsely insinuated in a court filing that Sussmann and Joffe had based their claims on lookups that post-date Trump’s inauguration. Durham is debunking Durham now! And that false claim from Durham led Trump to suggest that because Joffe found an IOC associated with the people who hacked the election within EOP, Sussmann should be put to death.

That’s one reason that it matters that this technical review is undated. Obviously, it’s crazy enough that an undated unpaginated report would show up in a report like this (I suspect it is intended to make the document hard to find).

But because it is undated and — it appears — Sussmann never got it, Durham doesn’t have to admit that he has included it in his report even after Sussmann pointed out that Durham’s inflammatory claims relied on getting the dates wrong himself.

For example, although the Special Counsel implies that in Mr. Sussmann’s February 9, 2017 meeting, he provided Agency-2 with EOP data from after Mr. Trump took office, the Special Counsel is well aware that the data provided to Agency-2 pertained only to the period of time before Mr. Trump took office, when Barack Obama was President.

After Sussmann and Joffe proved he was wrong, Durham dropped these claims. But then he resuscitated them for his report.

Durham blinds his expert so he can’t see any visibility

The second expert review Durham relied on, “FBI Cyber Division Cyber Technical Analysis Unit, Technical Analysis Report,” does have a date — April 20, 2022 — along with a Bates stamp showing that it was shared with Sussmann. The Cyber Technical Analysis Unit that wrote it is headed by David Martin, the guy who ultimately served as Durham’s expert witness at trial. After months of stalling, Durham first informed Sussmann that he would have an expert and Martin would be that expert on March 30, 2022, just weeks before trial.

Given that the Technical Analysis is dated three weeks after that, it seems exceedingly likely the Technical Analysis was a report done in preparation for Martin’s testimony.

As I noted in this post, this Technical Analysis focuses exclusively on the white paper Sussmann shared on September 19, 2016.

The citations to the Technical Analysis document in footnotes references just 13 pages of material, two pages of which is likely front matter, and one page describing the tasking Durham gave them.

Aside from the four pages of material that Durham doesn’t mention, there are really just two topics: addressing whether or not the Spectrum Health IP address was a Tor node, and using the answers obtained from Listrak (and possibly a broader set of logs than Alison Sands had available in 2016) to make an argument about the kind of visibility one needs to learn anything from DNS records.

These topics generally track Martin’s testimony as well (though Sussmann had opposed Martin’s comments on visibility, and given that it doesn’t appear in Martin’s Powerpoint from the trial, I’m not sure he was supposed to discuss it).

Now, Durham loves this technical analysis on Tor. He cited it first when he described how April Lorenzen was trying to figure out what the Spectrum IP address was in August 2016, and then quotes it again 30 pages later in his general technical discussion. The second time, he added an apostrophe-s which might be misread by the dim-witted people who are the audience of this propaganda to suggest that disproving that the Spectrum IP was a Tor node disproves the rest of the white paper, which it does not.

The FBI experts advised that historical TOR exit node data conclusively disproves this white paper allegation in its entirety and furthermore the construction of the TOR network makes the described arrangement impossible.

[snip]

The FBI experts who examined this issue for us stated that historical TOR exit node data conclusively disproves this white paper’s allegation in its entirety.

It’s really weird that Durham loves this analysis, because it would suggest that he didn’t learn that the Spectrum Health IP was not a Tor node until just weeks before trial — though that same judgement, that it was not a Tor node, is one of the main things the FBI got right when they first investigated this in 2016. There is almost nothing cited from this report that newbie counterintelligence agent Alison Sands hadn’t already laid out by October 5, 2016.

Durham’s fondness for this Tor node analysis is all the more hilarious because Durham tasked this expert review after the review of the files Sussmann shared with the CIA in February 2017. And neither of the files about the Alfa Bank anomaly that Sussmann turned over in 2017 (one, two) mention the Tor node. Researchers actually realized this was not a Tor node around the same time Sussmann originally shared the files. It was long gone, Durham knew it, yet that’s still the primary thing he relies on to claim he has debunked the allegations.

So Durham’s primary debunking of the white paper doesn’t address, at all, what was in the later documents. In fact, that was one effect of tasking the Cyber Technical Analysis Unit with reviewing just the stuff on the Red Thumb Drive: it gave some of FBI’s top experts a really easy way to debunk (part of) the white paper, albeit the only part that was entirely debunked in 2016.

It’s like congratulating yourself because the FBI’s top cyber experts managed to play tiddlywinks as well as a newbie counterintelligence agent did six years earlier during a rush investigation.

The second area of this technical review Durham cites that is still more telling. It purports to rely on information learned in Listrak email (not DNS) records to (effectively)  accuse Joffe and the others of cherrypicking the data.

In addition to investigating the actual ownership and control of the IP address, the Office tasked FBI cyber experts with analyzing the technical claims made in the white paper. 1650 This endeavor included their examination of the list of email addresses and send times for all emails sent from the Listrak email server from May through September 2016, which is the time period the white paper purportedly examined. 1651 The FBI experts also conducted a review of the historical TOR exit node data. 1652

The technical analysis done by the FBI experts revealed that the data provided by Sussmann to the FBI and used to support Joffe and the cyber researchers’ claim that a ‘”very unusual distribution of source IP addresses” was making queries for mail l.trump-email.com was incomplete. 1653 Specifically, the FBI experts determined that there had been a substantial amount of email traffic from the IP address that resulted in a significantly larger volume of DNS queries for the mail 1.trump-email.com domain than what Joffe, University-1 Researcher-2 and the cyber researchers reported in the white paper or included on the thumb drives accompanying it. 1654 The FBI experts reviewed all of the outbound email transmissions, including address and send time for all emails sent from the Listrak server from May through September 2016, and determined that there had been a total of 134,142 email messages sent between May and August 2016, with the majority sent on May 24 and June 23. 1655 The recipients included a wide range of commercial email services, including Google and Yahoo, as well as corporate email accounts for multiple corporations. 1656

Similarly, the FBI experts told us that the collection of passive DNS data used to support the claims made in the white paper was also significantly incomplete. 1657 They explained that, given the documented email transmissions from IP address 66.216.133.29 during the covered period, the representative sampling of passive DNS would have necessarily included a much larger volume and distribution of queries from source IP addresses across the internet. In light of this fact, they stated that the passive DNS data that Joffe and his cyber researchers compiled and that Sussmann passed onto the FBI was significantly incomplete, as it included no A-record (hostname to IP address) resolutions corresponding to the outgoing messages from the IP address. 1658 Without further information from those who compiled the white paper data, 1659 the FBI experts stated that it is impossible to determine whether the absence of additional A record resolutions is due to the visibility afforded by the passive DNS operator, the result of the specific queries that the compiling analyst used to query the dataset, or intentional filtering applied by the analyst after retrieval. 1660

1653 Our experts noted that the assertion of the white paper is not only that Alfa Bank and Spectrum Health servers had resolved, or looked up, the domain [mail-1.trump-email.com] during a period from May through September of 2016, but that their resolutions accounted for the vast majority of lookups for this domain. FBI Technical Analysis Report at 6.

1654 The USB drive that Sussman [sic] provided to the FBI on September 19, 2016, which was proffered as data supporting the claims in the white paper, contained 851 records of DNS resolutions for domains ending in trump-email.com. FBI Technical Analysis Report at 7.

I’ll leave it to William Ockham — who apparently is smarter than the entire FBI — to explain that by looking for emails sent out from an IP rather than DNS for a domain, the FBI was basically searching for all packages from one post office rather than stamps from one house that uses that post office (I’m still working on this analogy, but it’s a start). Plus, at least in real time, the newbie counterintelligence agent who figured out the Tor node information Durham claims to have only learned six years later, Alison Sands, kept complaining that Listrak didn’t provide the network logs they needed.

But as I pointed out here, not only does the FBI change its mind mid-sentence whether there was one thumb drive or two — a problem that has plagued FBI’s Cyber division for six years, apparently –but FBI doesn’t even claim to be looking at all the data that was submitted at trial. FBI’s experts only reviewed the exact same file that Scott Hellman emphasized was a portion of the data submitted; they didn’t review the larger set. They complain they only have 851 lines of data because they’re not reviewing the larger file, much less any csv records turned over on the Blue Thumb Drive, not because the logs didn’t exist.

Remember: these are supposed to be the same people who already reviewed the CIA material by February. And the equivalent of the white paper in those materials has a passage that addresses precisely the visibility of which FBI claims to be ignorant. And the Trump/Alfa csvs included on one of those thumb drives — 2016-05-04_2017-01-15_Trump_server — not only includes almost 25,000 lines of data, but it also shows the collection points. The FBI had a way, in hand, to get that visibility, but Durham told them to look away.

The only thing the FBI’s top experts offer to debunk, other than the Tor node claim that the FBI knew the researchers had dropped, was a complaint about visibility. But their complaints about visibility were entirely manufactured by the scope of the review Durham requested and possibly by the curious status of the Blue Thumb Drive, as well as (if Durham is telling the truth about these being the same experts) willful forgetting of a review they had done on related issues less than a year earlier.

Durham created this blindness. By ensuring all the experts remain blind to visibility, Durham ensured the review would conclude that the researchers didn’t have the visibility that, the FBI knew well, they had.

As I have described, way back in October 2016 — just days after Batty and Hellman did — I too thought that this was a set-up.

But I said that because (as I also noted) no one had seen the evidence. The FBI had the opportunity to look, but instead has spent the last six years deliberately blinding themselves so they can continue to claim it was a set-up.

Update: From pre-trial motions, here are two of the CIA summaries in which Sussmann’s claims about the YotaPhone allegations remain unredacted (one, two). They do tie the presence of the YotaPhone in EOP to Trump. But they also make it clear that the phone couldn’t have been Trump, because it didn’t always move with him, meaning these could easily have been (and still could be) someone attempting to compromise Trump.

Alfa Bank and Yotaphone Allegations

1.Factual background

a. Introduction

b. Sussmann’s attorney-client relationship with the Clinton campaign and Joffe

c. The Alfa Bank allegations

i. Actions by Sussmann, Perkins Coie, and Joffe to promote the allegation

ii. Actions by April Lorenzen and others and additional actions by Joffe

iii. Sussmann’s meeting with the FBI

d. The FBI’s Alfa Bank investigation

i. The Cyber Division’s review of the Alfa Bank allegations

ii. The opening of the FBI’s investigation

e. Actions by Fusion GPS to promote the Alfa Bank allegations

f. Actions by the Clinton campaign to promote the Alfa Bank allegations

g. Sussmann’s meeting with the CIA

h. Sussmann’s Congressional testimony

i. Perkins Coie’s statements to the media

j. Providing the Alfa Bank and Yotaphone allegations to Congress

k. Joffe’s company’s connections to the DNC and the Clinton campaign

l. Other post-election efforts to continue researching and disseminating the Alfa Bank and Yotaphone allegations

i. Continued efforts through Joffe-affiliated companies

ii. Efforts by Dan Jones and others

iii. Meetings by DARPA and Georgia Tech

iv. The relevant Trump Organization email domains and Yotaphone data

2. Prosecution decisions

The Dishonest and Incompetent FBI Work John Durham Learned to Love

/23 Comments/in , , /by

In the Durham Report’s telling of the FBI investigation into the Alfa Bank anomalies, it describes that the two cyber agents who conducted the first technical review of the allegations, Scott Hellman (Cyber Agent-1) and Nate Batty (Cyber Agent-2, the guy who appears to have misplaced the Blue Thumb Drive with all the data), congratulated themselves on the fact that they had both come to the same conclusion in spite of “their own very different political views.”

Cyber Agent-1 testified that both he and Cyber Agent-2 did not agree with the conclusion in the white paper and assessed that (i) the authors of the white paper ‘jumped to some conclusions that were not supported by the technical data,” (ii) the methodology was questionable, and (iii) the conclusions drawn did not “ring true at all.” 1479 In interviews with the Office, both Cyber Agent-1 and Cyber Agent-2 said that they were proud of their work because they had both come to the same conclusion despite their own very different political views. [my emphasis]

The interviews at which these men told this story are not cited (elsewhere in this passage, Durham relies on Hellman’s trial testimony rather than any of his interviews for the report, though according to trial testimony, he interviewed with Durham six times).

It’s an odd measure of investigative rigor, particularly in a report complaining that other FBI agents let bias infect their work.

It’s also a good place to start to describe the multiple layers of deceit in which Durham engages to avoid admitting that Batty and Hellman steered him wrong.

  • Durham adopted his “fabrication” theory from Hellman and Batty
  • The “fabrication” theory came with an understanding the DNC was involved
  • Hellman and Batty made materially contradictory comments about politics
  • Durham covered up Cyber’s clear errors
  • Durham’s made post-indictment efforts to sustain his false claims (this will be a follow-up because this got too long)

Durham adopted his “fabrication” theory from Hellman and Batty

As noted, Durham cites Hellman’s trial testimony, rather than those interviews he doesn’t cite, for his description of what Hellman and Batty concluded. At trial, immediately after the exchange cited, Durham lead prosecutor Andrew DeFilippis had Hellman walk through the written summary the two cyber guys wrote.

DeFilippis used that document to improperly cue Hellman, who was not qualified as an expert — someone who had, minutes earlier, admitted he knew only the basics of DNS — to express his opinion about the white paper, which I laid out here. Coming as it did after weeks of wrangling over Durham’s belated attempt to spring a different expert on Sussmann, the stunt unsurprisingly drew an objection.

But DeFilippis wasn’t working with the full summary. A redaction in the Hellman-Batty summary DeFilippis introduced as part of this exchange hid part of Hellman and Batty’s immediate response to the white paper. But a different version of the same document (introduced by the defense), reveals more about their initial conclusion to the anomalies: The otherwise redacted information reveals that Hellman and Batty floated the possibility that the researchers had fabricated the data by spoofing it themselves.

In conclusion, ECOU 1 suggests there is currently no cyber intrusion component in this case and that the report provided contains questionable methods and intentions. Based on the information provided, it also remains a possibility that the report was fabricated. If the domain maill.trump-email.com were discovered by researchers, a computer at Alfa Bank could be configured to conduct multiple DNS inquiries to create the appearance that a Russian bank is communicating exclusively with the domain maill.trump-email.com. Furthermore, it appears suspicious that the presumed suspicious activity began approximately three weeks prior to the stated start of the investigation conducted by the researcher. [emphasis, which marks otherwise redacted language, my own]

Hellman didn’t just share this opinion in the summary, which was sent out to others no later than September 21 at 4;46PMET (some of these time zones are in CDT, so an hour behind). It was the primary conclusion they shared with the Chicago-based agents conducting the actual investigation. As Curtis Heide’s Lync notes show (these are probably UTC, so morning ET), 8 minutes after Heide made a second request for the thumb drives, Batty and Hellman asked Heide to get on the phone. They spoke for five minutes, after which Heide texted Pientka to tell him that “we’re leaning towards this being a fake server not attributed to the trump organization.”

While Hellman was on the phone with Heide, Batty was texting Heide’s boss, Dan Wierzbicki, that, “we think it’s a setup. it smells like a setup.” Minutes after these two exchanges another Cyber guy shared with Joe Pientka Phil Todd’s opinion, described below, that this was a DNC set-up timed for the debate.

In other words, the premature Hellman and Batty opinion that this was a set-up tainted everything that followed in the investigation. And they shared it before anyone else looked at the evidence.

Notably, this opinion led the FBI to take overt acts during a pre-election period that prevented the FBI from conducting a robust investigation afterwards. At 4:22PM ET that same day, Alison Sands wrote from Chicago to New York explaining that this probably wasn’t actually a Trump domain. At 4:53PM ET, Sands wrote back to correct that: Miami FBI agents had taken overt investigative steps during an election season (though they used a ruse as to why they were asking), and learned that it was a legitimate email server. At 1:53PM the next day, Sands wrote back to note that Cendyn had responded to FBI’s overt investigative steps by updating their DNS tables, tainting the investigation and public reporting on it irreparably.

More importantly, the opinion Hellman and Batty formed — that this was a setup — influenced more than the initial investigation. It’s the entire organizing logic of the September 16, 2021 indictment against Michael Sussmann. Durham accused Sussmann of packaging all this up in a “narrative” fed by “purported” data provided by April Lorenzen, whom he called “Originator-1,” and then sharing it with the FBI. That’s why Durham needed it to be the case that Sussmann intentionally hid a tie to the DNC.

And because Durham adopted that hasty Hellman and Batty theory as his own, to the extent that Hellman and Batty made grave errors, Durham had to (and has to) cover those errors up.

The “fabrication” theory came with an understanding the DNC was involved

And that means covering up how politics — or at least a suspicion about politics — played a part.

Durham treated Batty and Hellman’s initial conclusions as reliable, he said, because, “they had both come to the same conclusion despite their own very different political views.”

That’s remarkable because Durham includes something in his report that he chose not to introduce at trial under oath: that Nate Batty told him in 2019 that he and Hellman had considered filing a whistleblower complaint against Jim Baker because FBI’s General Counsel refused to tell them where the tip came from.

Cyber Agent-2 told the Office that he and Cyber Agent-1 considered filing a whistleblower claim about Baker’s failure to provide the information but ultimately decided that they would not because the data provided was not formal evidence in a criminal proceeding. 1492

1492 OSC Report of Interview of Cyber Agent-2 on Sept. 16, 2019 at 2.

This is likely where the whole idea of charging someone for lying to the FBI about this evidence came from.

What Durham didn’t say in his report — but what the public record strongly suggests — is that one or both of these guys were affirmatively dishonest with him about how significantly politics played into this investigation. Three pieces of evidence submitted at trial show that Batty understood this tip to have come from the DNC and one of his colleagues treated it as a set-up by the DNC.

First, there’s the Lync text showing Batty was informed that Sussmann was in the evidentiary chain even before he picked up the thumb drives on September 20 (remember, these are probably UTC).

As this post makes clear, Batty learned that Sussmann was in the chain of custody before he picked up the thumb drives from Baker. He didn’t need Baker to tell him where they came from. He already knew.

Less than a day after being told Sussmann was in the evidentiary chain, Batty wrote Hellman, saying they had been asked to write “a brief summary of what we think about the DNC report,” and then conceded maybe they should look at the actual DNS logs before writing such a summary.

Then, the next morning at 8:09AM, one of the Cyber supervisors, Phil Todd, wrote an email claiming that “the DNC person” who dropped the thumb drives off planned to release the Trump – Alfa Bank tie prior to the Presidential debate that would be on October 4.

The DNC person that provided these thumb drives stated to Baker that he/she was going to release the information concerning the Trump server, and direct contact with the Russians through Alpha Bank in Moscow, to the press on Friday, 9/23/16, prior to the upcoming Trump / Clinton debate this weekend.

Sussmann obviously didn’t tell Baker his outreach to the press was timed for the debate. It’s something the Cyber guys made up and put into writing. But it shows that people in the Cyber division didn’t just make conclusions before investigating, but did so through that political lens, precisely the political lens Durham claimed that Sussmann thwarted by allegedly lying to Jim Baker.

And while there’s no evidence Batty shared the assumed tie between the tip and the DNC with the agents in Chicago, it’s important background to the way Hellman and Batty reached out to Heide and his boss to explain, in a way that would leave no written record, why they believed this was not a real server, an opinion that Heide would cite as one of four reasons he dismissed the allegations. Batty shared that opinion before sharing the substantive materials in the white paper with the Chicago agents.

These records should have led any sane prosecutor to conclude he had no case against Sussmann. These, along with at least two more exhibits (Bill Priestap’s notes and Ryan Gaynor’s briefing notes), show that numerous people in the FBI, including one of the guys who conducted the initial technical review of the anomalies, believed the white paper had a DNC tie. And at least some people at the FBI had concluded, absent evidence, that it was a political hit job.

How could Sussmann’s alleged lie be material if the initial conclusions about the anomaly presumed Sussmann was bringing the white paper for the DNC?

Hellman and Batty made materially contradictory comments about politics

As noted, Batty’s claim, made in a 2019 interview with Durham, seems to conflict with the record showing that he was informed of Sussmann’s involvement before he first obtained the thumb drives.

All the evidence that people in Cyber knew of and considered the role of the DNC in this tip — plus the way Durham measured Batty and Hellman’s reliability based on their partisanship — makes Hellman’s testimony at trial suspect, too. Hellman claimed, under oath, that he and Batty didn’t talk about whether these allegations had political origins in advance.

Q. And you and Special Agent Batty at least talked about whether this had political origins, didn’t you?

A. At that point I think the only thing that came up was just questioning the motive of somebody providing — like, who provided this report? I don’t recall any discussion about political motivations.

Q. Who would it have helped if the allegations were true?

A. It would have helped the opposing — it would have helped the democratic party.

Q. And that didn’t occur to you at all that that motivation might have been involved?

A. No.

This is one of several reasons I find it so curious that Durham didn’t cite the actual interviews in which Hellman and Batty talked about how they responded to the white paper by invoking politics: If Sussmann’s attorneys had received 302s reflecting they had, as Brady or even Jencks in Hellman’s case, you’d think they would have followed up on Hellman’s claim that politics didn’t come up by noting that he and Batty had both told Durham differently.

Hellman also claimed, under oath, that he never saw that text mentioning the DNC screencapped above, to which he responded by writing up a report, until 2020.

Q. All right. And then, with respect to Stranahan, he asks you and Nate to write a report about the — write a summary of the DNC report. Correct? That’s what it says?

A. That’s what it says in this chat, yes.

Q. And did you understand, sir, that the information had come from a DNC, meaning Democratic National Committee, source?

A. I did not understand that, no.

Q. Did you know what Nate Batty knew about it?

A. I don’t think he knew anything about it.

Q. Did you call up Tim and say, what a second. This is a DNC report? That’s political motivation.

A. No.

Q. Didn’t do anything or it didn’t occur to you?

A. The first time I saw this was two years ago when I was being interviewed by Mr. DeFilippis, and I don’t recall ever seeing it. I never had any recollection of this information coming from the DNC. I don’t remember DNC being a part of anything that we read or discussed.

Q. Okay. When you say, the first time you saw it was two years ago when you met with Mr. DeFilippis, that’s not accurate. Right? You saw it on September 21st, 2016. Correct?

A. It’s in there. I don’t have any memory of seeing it.

Later Berkowitz returned to the text. He asked Hellman how it could be that Batty could refer to the white paper from a lawyer who represented the DNC, in a text to Hellman, as the DNC report, without Hellman becoming aware that someone — his superior — was calling it a DNC report.

Q. And although you were surprised to see it today, it appears that at least somebody, such as Mr. Batty was aware and you were aware that somebody was calling this white paper a DNC report. Correct?

A. I was not aware that anybody was calling it a DNC report, and I don’t believe Mr. Batty knew that either.

Q. But you saw the link message. Right?

A. I did see the link message, yes.

Then Berkowitz asked Hellman how it could be that he would see a reference to a DNC report and not take from that it was a DNC report. Hellman responded by describing “the only explanation that … was discussed” — was that it was a typo.

Q. What’s your explanation for it?

A. I have no recollection of seeing that link message. And there is — have absolutely no belief that either me or Agent Batty knew where that data was coming from, let alone that it was coming from DNC. The only explanation that popped or was discussed was that it could have been a typo and somebody was trying to refer to DNS instead of DNC.

Q. So you think it was a typo?

A. I don’t know.

Q. When you said the only one suggesting it — isn’t it true that it was Mr. DeFilippis that suggested to you that it might have been a typo recently?

A. That’s correct.

Q. Okay. You didn’t think that at the time. Right?

A. I did not. I had never seen it or had any memory of seeing it ever before it was put in front of me.

That is, Hellman responded by explaining that Durham’s lead prosecutor Andrew DeFilippis, rather than asking whether the Lync text refreshed Hellman’s memory that he had been already been told this was a DNC report when he conducted the analysis, rather than recognizing that the evidence actually undermined his entire case, instead scripted an alternate explanation.

Just a typo.

And then Hellman repeated that script on the stand.

Under oath.

There are no declination decisions in Durham’s Report assessing how Hellman and Batty’s statements — in the 2019 interview and under oath on the stand — can be squared with the public record. Of course there aren’t declinations! When faced with documentary evidence that his disclaimer about awareness of a DNC role was suspect, Hellman simply parroted Durham’s own team.

But the fact that Durham didn’t even consider whether there was more evidence that Batty and Hellman lied to him than that Sussmann did is a testament to the fact that any misstatements they made would upend his entire project.

At trial, when Durham was desperate to claim that the five different exhibits that showed the FBI knew this report came from a DNC lawyer didn’t mean that the FBI had treated this as a DNC report, his star witness Scott Hellman said there was no discussion of politics when he and his boss assessed this report.

But in his report itself, Durham’s proof that their analysis was sound was that both FBI agents had told him (in interviews that he doesn’t cite) that they approached the report through a lens of politics.

Durham covered up Cyber’s clear errors

The fact that a supervisor in the Cyber Division concluded that this was a Democratic hit job timed to the debate makes Durham’s silence about Batty and Hellman’s clear errors all the more problematic.

I wrote them up in this post describing Hellman’s advice to newbie agent Alison Sands that, “any chance you get to work something like this that truly has 0 repercussions if you mess it up ….take those opportunities.”

The two most problematic clear errors bookend the otherwise redacted claim that they suspected this was a set up.

As that Lync text itself above makes clear: Hellman and Batty had already made conclusions about the white paper before he opened the thumb drive with the data that — Hellman later testified — is what made the two of them more qualified to assess this report than the counterintelligence agents who would later conduct the investigation. After having made a conclusion prior to reviewing the logs, Hellman and Batty claimed that the anomaly had only been going on for three weeks before the researchers started looking at it. That was probably a misreading of one of two histographs in the white paper. But it would have easily been debunked had they reviewed just the DNS logs provided, much less the data provided on the misplaced Blue Thumb Drive itself. There’s no way you make that error after having reviewed the DNS logs. Yet they did make that error, an error Durham never mentions in his report.

And Durham knows this claim is wrong, because the expert report he cites in his own report — which examined the smaller set of two logs included on the Red Thumb Drive — notes that the researchers included logs dating from May to September.

Durham repeats in his report, without correction, an even more serious error. Durham states, truthfully, that Batty and Hellman — two of the only FBI agents who investigated anything having to do with Russia in 2016 who haven’t subsequently been disciplined for their fuck-ups — claimed that there was no allegation of hacking in the white paper.

The report’s summary stated that they had “assess[ed] there is no CyD [Cyber Division] equity in this report and that the research conducted in the report reveals some questionable investigative steps taken and conclusions drawn.” 1477 The report acknowledged that there was no allegation of hacking and so there was no reason for the Cyber Division to investigate further.

But Durham doesn’t reveal that this claim — there was no allegation of hacking in the report — was false. Rather, he adopts it as his own.

As a footnote in the white paper Sussmann shared described, one reason the researchers offered that Spectrum might not have known it had this weird occurrence on its network (which the researchers incorrectly concluded was a Tor node) was because they had been hacked.

We discovered that Spectrum Health victim of a network intrusion. Therefore, Spectrum Health may not know what has a TOR exit node on is network. Alternatively. the De Vos family may have people at Spectrum who know here is a TOR node, i.e., TOR node could have been placed there with inside help.

“Network intrusion.” That’s a hack.

Outside researchers informed the FBI of an anomaly involving an IP address known to have been hacked. And yet the cyber guys concluded not just that this white paper was shit, but also that there was no Cyber Division equity — a hack — in it, and did so in just over a day.

The researchers were wrong about Tor, but they were right about the hack. When the FBI checked the Spectrum IP in question, they found that it had been compromised.

One reason this error is so problematic — aside from it discredits everything else Hellman and Batty did — is because it came as supervisors in the Cyber Division were trying to spin off this investigation because they had concluded, with no evidence, that it was a pre-debate set-up. Hellman and Batty concluded there was no hack not because of the evidence, but because they didn’t want to do this case.

John Durham congratulates these men because a Democrat and a Republican agreed about this white paper. But he doesn’t reveal that, in addition to getting several other key technical details wrong, they failed at their one job, to determine whether there was a hack involved. So instead of revealing that they failed in their one job in his report, Durham instead repeats their false claim, “The report acknowledged that there was no allegation of hacking,” and boasts because a Democrat and Republican ended up being badly, embarrassingly wrong together.

Now, as I noted, Durham covers up some of the other problems with this investigation.

The two most important are that the FBI violated the rule prohibiting overt investigative steps during the pre-election period, and perhaps partly because of that (as well as FBI’s failure to act immediately after Sussmann provided Eric Lichtblau’s name on September 22), by the time the FBI spoke to Alfa Bank, the potential suspect in this crime drama — the potential suspect which reached out to FBI rather than vice versa — Alfa had no log files left to review.

That’s the other big error the investigative team made, which Durham also covers up. The FBI didn’t understand that Mandiant’s judgement was useless until a March 2017 interview with Mandiant. Curtis Heide described at trial that he never — never!! — actually learned that the reassurances Alfa Bank had offered were based on a claim that a bank had no log files to review.

Q. And were you aware, while you were doing the investigation, that Mandiant, when it went to talk to AlfaBank to look into these allegations, did not have any historical data, that Alfa-Bank did not provide any historical data to Mandiant? Did you know that?

A. No

Here’s how Durham covered up that embarrassing failure in his report:

Mandiant provided the FBI with its findings, which too concluded that there was no evidence to support the allegations of a secret communications channel nor any evidence of direct communications between the Alfa Bank servers and Trump Organization servers.

In his report, Durham cites only an October 2016 302, not the March 2017 one where the FBI first learned how useless the Mandiant review would have been. Again, he makes absolutely no mention that a potential suspect in this story reached out to the FBI told the FBI that a potential crime scene had been wiped of digital fingerprints and did nothing.

Durham complains about other problems with the part of the investigation conducted by the counterintelligence agents — they made an error in their opening memo, for example.

But rather than bitching and moaning about the outright errors the FBI cyber agents committed during the investigation, like he did for every other FBI agent in his report (including the counterintelligence agents on the Alfa Bank investigation), Durham simply … covered those errors up. Repeated their false claims. Perpetuated the foundational error in the Alfa Bank anomaly investigation.

Durham couldn’t treat Hellman and Batty with the same ruthless contempt as he did all the other FBI agents he interviewed. That’s because the materially inconsistent claims and outright errors they made were all foundational to Durham’s project. Durham can’t admit that Hellman and Batty were among the most suspect and incompetent of every FBI agent involved. That’s because Durham built his entire case on the conclusion they drew before they even opened the thumb drives.

And that’s important for another reason: because of the investigative steps Durham took on DNS-related issues after he indicted Sussmann on September 16, 2021, and what they say about Durham’s efforts to manufacture claims to discredit the anomalies.

FBI Cyber Division’s Enduring Blue Pill Mystery

/23 Comments/in , , /by

I’m writing a post on the technical analysis John Durham included in his report purporting to debunk the white papers submitted via Michael Sussmann to, first, the FBI and, then, the CIA. But first I’m going to do something even more tedious: Try to track down FBI’s persistent blue pill problem — or rather, the FBI’s apparent failure to ever analyze one of two thumb drives Sussmann shared with Jim Baker in September 2016, the Blue one.

Last year, before Sussmann’s trial, Durham had FBI’s top technical people review what he claimed were the data Sussmann had shared. He cited those reports in his own report, claiming they debunk the white papers.

Here’s how they are described in footnotes.

  • 1635 FBI Cyber Division Cyber Technical Analysis Unit, Technical Analysis Report (April 20, 2022) (hereinafter “FBI Technical Analysis Report”) (SCO _ 094755)
  • 1671 FBI Cyber Technical Operations Unit, Trump/Alfa/Spectrum/Yota Observations and Assessment (undated; unpaginated).

Not only doesn’t the YotaPhone report have a date, but it doesn’t have a Bates stamp reflecting that it was shared with Sussmann. I’ll get into why that is interesting in my follow-up post.

Below is a summary of the materials Sussmann provided to both agencies. By description, the Technical Analysis Report only reviews the white paper and the smaller of two sets of text DNS logs included on the Red Thumb Drive. By description the Trump/Alfa/Spectrum/Yota Observations only review the Yota White Paper.

The data FBI’s technical people reviewed appear to be restricted to what is marked in blue.

They did review the actual thumb drives turned over to the CIA, because they found hidden data on one; there’s no indication they reviewed the thumb drives provided to the FBI.

In fact, it’s impossible that they reviewed the data included on the second thumb drive Sussmann shared, the Blue one.

That’s because the FBI analysis claims Sussmann only provided 851 resolutions, which is the 19-page collection of text files included on the Red Thumb Drive, not even the larger set.

Similarly, the FBI experts told us that the collection of passive DNS data used to support the claims made in the white paper was also significantly incomplete. 1657 They explained that, given the documented email transmissions from IP address 66.216.133.29 during the covered period, the representative sampling of passive DNS would have necessarily included a much larger volume and distribution of queries from source IP addresses across the internet. In light of this fact, they stated that the passive DNS data that Joffe and his cyber researchers compiled and that Sussmann passed onto the FBI was significantly incomplete, as it included no A-record (hostname to IP address) resolutions corresponding to the outgoing messages from the IP address. 1658 Without further information from those who compiled the white paper data, 1659 the FBI experts stated that it is impossible to determine whether the absence of additional A record resolutions is due to the visibility afforded by the passive DNS operator, the result of the specific queries that the compiling analyst used to query the dataset, or intentional filtering applied by the analyst after retrieval. 1660

1659 The data used for the white paper came from Joffe’s companies Packet Forensics and Tech Company-I. As noted above, Joffe declined to be interviewed by the Office, as did Tech Company-2 Executive-I. The 851 records of resolutions on the USB drive were an exact match for a file of resolutions sent from University-I Researcher-2 to University-I Researcher- I on July 29, 2016, which was referred to as “[first name of Tech Company-2 Executive-l]’s data.” Id. at 7.

1660 Id. [bold]

There’s no way they would have come to this conclusion if they had seen the Blue Thumb Drive, which had millions of logs on it.

In fact, it appears that the FBI never did review that Blue Thumb Drive when they were investigating the Alfa Bank anomaly.

They didn’t do so, it appears, because the Cyber Division Agents who first reviewed the allegations, Nate Batty and Scott Hellman, misplaced the Blue Thumb Drive for weeks.

That may not have been an accident.

Batty and Hellman’s initial review, which they completed in just over a day, was riddled with errors (as I laid out during the trial). Importantly, they could not have reviewed most of the DNS logs before writing their report, because they claimed, “the presumed suspicious activity began approximately three weeks prior to the stated start [July 28] of the investigation conducted by the researcher.”

Even the smaller set of log files included on the Red Thumb Drive showed the anomaly went back to May. A histograph included in the white paper shows the anomaly accelerating in June.

Had anyone ever reviewed the full dataset, the shoddiness of their initial analysis would have been even more clear.

Here’s how the FBI managed to conduct an investigation on two thumb drives without, it appears, ever looking at the second one.

As the chain of custody submitted at trial shows, Jim Baker accepted the thumb drives, then handed them off to Peter Strzok, who then handed them off to Acting Assistant Director of Cyber Eric Sporre, who at first put the thumb drives in his safe, then handed them over to Nate Batty.

Within hours (these logs are UTC), Batty and Hellman started mocking the white paper but also complaining about the “absurd quantity of data.”

Hellman, at least, admitted at trial that he only knows the basics about DNS.

The next day, Batty told Hellman that their supervisor wanted them to write a “brief summary” of what he calls “the DNC report.” Batty appears to have known of Sussmann from other cases and he was informed that Sussmann was in the chain of custody.

In spite of the clear record showing Batty was informed who provided the thumb drives, in 2019, he told Durham that he and Hellman — whose analysis was so shitty — had considered filing a whistleblower complaint because they weren’t told what the documentary record shows he was clearly informed. And Durham thought that was sufficiently credible to stick in his report.

Before writing an analysis of this report, Batty admitted, they should first “plug the thumb drives” in and look at the files before they wrote a summary.

The documentary evidence shows that these guys formed their initial conclusion about the white paper without ever reviewing the data first.

A day later, Curtis Heide texted from Chicago and asked them to upload the thumb drives, plural, so they could start looking at them.

They only uploaded one, the Red Thumb Drive.

That’s clear because when Kyle Steere documented what they had received on October 4, he described that his report is, “a brief summary of the contents of the USB drive,” singular. The contents match what were on the Red Thumb Drive.

Two hours and 16 minutes later, after uploading the Red Drive, Batty asked if he should send the actual thumb drives to Chicago.

48 minutes later, Batty asked Hellman if he had the Blue Thumb Drive.

The chain of custody shows that Batty didn’t send anything on September 22, when he and Hellman were panicking about the missing Blue Thumb Drive. Instead, he put something in storage on October 6, two weeks later. That he put them in storage makes no sense, because when he wrote an Electronic Communication explaining why he was sending the thumb drives to Chicago on October 11 (by that point, 19 days after saying they would send the thumb drives to Chicago that day), he claimed,

Due to case operational tempo, and the need to assess the data at ECOU-1 prior to referring the matter to the [Chicago] division the evidence was not charged into evidence (at the NVRA) until October 6, 2016.

Not a shred of evidence in the available record supports that claim and a great deal shows it to be false.

But he didn’t send the physical thumb drives until October 12, FedEx instead of internal BuMail.

By October 12, the FBI had decided there was nothing to these allegations.

Somewhere along the way, there was some confusion as to whether there was one or two thumb drives. At the time the case ID was added — the case was opened on September 23 — it seems to have been understood there was just one thumb drive.

Batty does seem to have sent two thumb drives, one Red and one Blue, to Chicago after that 20-day delay, though.

At trial on May 23, Alison Sands dramatically pulled two thumb drives — a Red Thumb Drive and a Blue Thumb Drive — out of the evidence envelope where she put them years earlier.

Q. Ms. Sands, I’m showing you what’s been marked for identification as Government’s Exhibit 1. Do you recognize that?

A. Yes.

Q. What is that?

A. This is the la envelope.

Q. Do you know what this envelope contains?

A. Yes, it contains the thumb drives. So I basically took them out of evidence and put it into this envelope.

[snip]

Q. Now, Ms. Sands, do you recall how many thumb drives there were?

A. Yes, there’s two.

Q. Do you recall if they had any particular colors?

A. One is blue and one is red.

On the stand, Sands also introduced Steere’s memo, the one that documented the contents of the Red Thumb Drive. In doing so, though, she falsely claimed (at least per the transcript) that the memo described both thumb drives.

Q. Do you recognize what Government’s 206 is?

A. Yes.

Q. What is that?

A. It is the EC documenting what information was on the thumb drives that were provided.

She also introduced the items included on the Red Thumb Drive, one after another, into evidence.

Except for the 19-page set of text files used for technical analysis.

When prosecutor Brittain Shaw got to that file in Steere’s memo, she tried to move it into evidence, but both Judge Cooper and Sussmann attorney Michael Bosworth noted it was already in evidence.

MS. SHAW: Could we go back to Government’s Exhibit 206, please? Moving down the list —

BY MS. SHAW:

Q. The second item, what is that?

A. It is data that was provided as alleged evidence of these DNS lookup tables.

Q. After number 2, is that the title that was given to the file or is that something you assigned?

A. I believe that’s something we assigned.

Q. Okay.

MS. SHAW: And if I could have Government’s Exhibit 208, please. If you’d just blow that up a little bit. Thank you.

BY MS. SHAW:

Q. And, Ms. Sands, do you recognize what that is?

A. Yes, these are the DNS lookups that I just described.

MS. SHAW: All right. I would move Government’s Exhibit 208 into evidence.

MR. BOSWORTH: It may be —-

THE COURT: I think it’s probably in.

MS. SHAW: All right.

It was already in.

Almost a week earlier, Scott Hellman introduced what he called “a portion” of the data included with the exhibit. It was the 19-page text file of DNS logs that reviewed in the Technical Analysis included on the Red Thumb Drive. He didn’t describe it as one stand-alone document included on the thumb drive. He seemed to imply this was a selection the FBI had made.

Q. And if I could show just to you on your screen what’s been marked Government Exhibit 208. And Agent Hellman, this is about an 18- or 19-page document. But you just see the first page here. Do you recognize this?

A. It appears to be a portion of the technical data that came along with the narrative.

MR. DeFILIPPIS: All right. Your Honor, the government offers Government Exhibit 208.

MR. BERKOWITZ: No objection.

THE COURT: So moved.

Q. And if we look at that first page there, Agent Hellman, what kind of data is this?

A. It appears to be — as far as I can tell, it looks to be — it’s log data. So it’s a log that shows a date and a time, a domain, and an IP address. And, I mean, that’s — just looking at this log, there’s not too much more from that.

Q. And do you understand this to be at least a part of the DNS data that was contained on the thumb drives that I think you testified about earlier?

All the while, he and DeFilippis referred to this as “a part” of the DNS data and referred to the thumb drives, plural.

And that, it appears, may be all the data anyone at the FBI ever analyzed.

Update: I erroneously said there were texts between Batty and Hellman that may have gotten deleted. I’ve corrected that error.

Update: I added details from the Lync files showing Batty provided a claim that conflicts with all public evidence about why he didn’t check the thumb drives into evidence until after the investigation was substantively done.

Update: I’ve updated the table to show what Sussmann shared. Particularly given FBI’s shoddy record-keeping and Durham’s obfuscation, it’s not clear on which drive GX209 was, nor is it clear whether there was a separate set of CSV DNS logs on the Blue Drive and if so how many logs they included.