Posts

The US Government Formed a New Understanding of WikiLeaks after 2016

Julian Assange’s substantive extradition hearing starts today. (I’m collating a list of journalists covering it from the live feed.)

I view the proceeding with great ambivalence.

I definitely agree that some of the charges against him — there are two theories of publishing charges: conspiring by asking for specific files, including entire databases, and publishing the identities of informants — pose a threat to the press. That said, the Trump Administration has used one of the same theories it is using against Assange to threaten journalists even in the last week (and was, before his superseding indictment) with virtually no cries of alarm from those defending Assange. In addition, charging him for exposing the identities of US and Coalition sources is a well-established crime in the UK, the Official Secrets Act, and (because Coalition sources were included among those WikiLeaks is accused of exposing) could be charged if the extradition against him fails.

The CFAA charge against Assange — particularly as expanded in the latest superseding indictment — does not pose any unique threat to journalism. Indeed, Assange’s alleged co-conspirators in the bolstered CFAA charge were already prosecuted, on both sides of the Atlantic, so there’s no question that the underlying hacking is a viable charge. WikiLeaks supporters have pointed to the unreliability of Siggi and Sabu to question those charges. They’ve focused less on the immunity granted David House for his testimony, though at trial Assange’s lawyers would focus on that, too. They might argue, too, that the US government has spun this particular conspiracy well outside the bounds where participants had made common agreement (if they kept spinning, after all, FireDogLake might get swept up for Jane Hamsher’s ties to House and defense of Manning back in the day).  But those are complaints about the strength of the government case, not the appropriateness of extradition. I suspect the government case is far stronger than shown in the indictment, which currently relies only on publicly available evidence.

Assange’s defense will call a number of experts (Kevin Gosztola discusses them here), many though not all of whom will present important, valid points. They’ll raise important issues about the free speech implications of this case, the dangers of the Espionage Act, America’s atrocious standards of incarceration, and the EDVA venue; the latter three of these, however, are in no way unique to Assange (and venue for him in EDVA is uncontroversial, unlike it has been for others charged in a district where a jury is virtually guaranteed to include people tied to the national security world). They’ll raise evidentiary complaints to which the lawyer representing the US government will present counterarguments. They’ll talk a lot about the Collateral Murder video, which was not charged.

WikiLeaks’ supporters will also exploit the US government’s Mike Pompeo problem, in this case by misrepresenting a comment he bombastically made about the First Amendment when declaring WikiLeaks a non-state hostile actor in the wake of the Vault 7 release.

No, Julian Assange and his kind are not the slightest bit interested in improving civil liberties or enhancing personal freedom. They have pretended that America’s First Amendment freedoms shield them from justice. They may have believed that, but they are wrong.

[snip]

Third, we have to recognize that we can no longer allow Assange and his colleagues the latitude to use free speech values against us. To give them the space to crush us with misappropriated secrets is a perversion of what our great Constitution stands for. It ends now.

[snip]

DIRECTOR POMPEO: Yeah, First Amendment freedoms. What I was speaking to there was, as – was a little less constitutional law and a lot more of a philosophical understanding. Julian Assange has no First Amendment freedoms. He’s sitting in an embassy in London. He’s not a U.S. citizen. So I wasn’t speaking to our Constitution.

What I was speaking to is an understanding that these are not reporters don’t good work to try to keep you – the American government honest. These are people who are actively recruiting agents to steal American secrets with the sole intent of destroying the American way of life. That is fundamentally different than a First Amendment activity, as I understand them, and I think as most Americans understand them. So that’s what I was really getting to.

We’ve had administrations before that have been squeamish about going after these folks under some concept of this right-to-publish. No one has the right to actively engage in the threat of secrets from America with the intent to do harm to it.

This is not the first time the Trump Administration has had a Mike Pompeo problem when prosecuting WikiLeaks-related crimes, nor should it be the last. I believe Joshua Schulte’s attempts to call Pompeo forced the government to back off its claim that Schulte’s decision to leak to WikiLeaks — allegedly in April 2016 and so months before the future CIA Director was still celebrating WikiLeaks leaks of DNC files — was by itself proof of his intent to damage the US. That’s particularly true as Secretary of State Mike Pompeo torches the infrastructure of Human Rights in the world. While I, in no way, believe the Assange prosecution arises from any personal animus Pompeo has for Assange, Pompeo’s role in it and his clear retaliation against the ICC last week will be easy to use to delegitimize the Assange prosecution.

So WikiLeaks will have a lot of good points to present in the next several weeks.

But they’re also expected to tell a number of cynical lies, including with respect to pardon dangles in the US, lies that will detract from the otherwise very important principles they will raise.

I believe the prosecution of Julian Assange as charged poses a number of dangers to journalism.

But I also believe the government has evidence — some of which it may not want to share during extradition and some of which it may not ever share — that Assange is precisely what they say he is, someone with an entire intelligence infrastructure uniquely targeting the US. Of particular note (as I said regarding one of the new allegations in the CFAA charge), I know of multiple allegations, of mixed but in some cases impeccable credibility, that WikiLeaks has used its infrastructure to spy on protected entities — journalists, lawyers, former associates — going back years, long before UC Global allegedly ratcheted up the spying on Assange. The NYT doesn’t spy on its competitors to find out how they might undermine its unique role, and WikiLeaks itself says such spying on Assange is improper, so there’s no basis to claim that when WikiLeaks does it, it’s all good.

Still, even if Assange is the head of a non-state hostile intelligence agency, does that merit prosecution? While the US has sanctioned the heads of hostile state intelligence agencies, with a few notable exceptions, they don’t extend their jurisdiction overseas to prosecute them.

In addition, the allegations of involvement in Russia in all this are well-founded. The folks involved in the LulzSec chatrooms now incorporated into Assange’s CFAA charge acknowledge there were Russians there as well, though explain that the whole thing was so chaotic no one thought that much about it. Only those who aggressively ignore the public case afford WikiLeaks any deniability that it did Russia’s work in publishing the stolen Democratic files in 2016. The Joshua Schulte trial presented evidence he wanted to work with Russia too; while the evidence presented (almost incidentally, a point I hope to return to one day) at trial is quite ambiguous, I first learned about his willingness to work with Russia months before any such allegation made it into a court filing. In addition, I know of one much earlier instance where someone in WikiLeaks’ infrastructure had similar such interests. And that’s before all the allegations that WikiLeaks diverted files damaging to Russia over years.

All of those are my views about the ambivalence of this extradition proceeding, whatever those are worth as someone who has followed WikiLeaks closely from the beginning.

But there’s another point that has gotten virtually no attention, particularly not from WikiLeaks supporters who often make false claims about the investigation into WikiLeaks that conflict with this point. The government’s understanding of WikiLeaks changed after 2016, and so changed after the Obama Administration decided that prosecuting WikiLeaks posed “a New York Times problem.” The multi-volume Senate Intelligence Report talks about this repeatedly, though virtually all instances (such as this passage from Volume III) remain heavily redacted.

A different passage from the same volume, however, explicitly calls WikiLeaks a “coopted third party.”

Despite Moscow’s hist01y of leaking politically damaging information, and the increasingly significant publication of illicitly obtained information by coopted third parties, such as WikiLeaks, which historically had published information harmful to the United States. previous use of weaponized information alone was not sufficient for the administration to take immediate action on the DNC breach. The administration was not fully engaged until some key intelligence insights were provided by the IC, which shifted how the administration viewed the issue.

And, to the very limited extent you can trust the view of a prosecutor trying to coerce testimony from Jeremy Hammond, the people who will prosecute Assange if he’s extradited claim he’s a Russian spy.

This has important implications for the case against Assange, implications that his supporters make aggressive efforts to obscure. First, the surveillance of Assange almost certainly ratcheted up because of actions Assange took in 2016 and 2017, actions that aren’t protected by journalism. As a foreigner who negotiated the receipt of documents with a presumed Russian mouthpiece, Guccifer 2.0 — in what was surely theater played out on Twitter DMs — Assange and WikiLeaks made themselves targetable as foreign intelligence targets in an attempt to learn about the Russian attack on the US. Assange’s multiple efforts to offer Trump’s campaign a unique benefit — picked up in investigative collections targeting others — made Assange a criminal target in a foreign donation investigation, one Mueller declined to prosecute for First Amendment reasons (50 USC 30121 is cited in the single Mueller warrant admitted to be targeting WikiLeaks that has been publicly released). And because of some overt ongoing communications with Joshua Schulte over the course of the former CIA programmer’s prosecution, WikiLeaks’ communications would be collected incidentally off of collection targeting him as the primary suspect in the leak.

Thus, even before Pompeo declared WikiLeaks a non-state hostile actor, Assange had done things that made him targetable in a way that he hadn’t previously been. And burning down the CIA’s hacking capability behind thin claims of public interest and then continuing to communicate with the presumed source surely didn’t help matters.

And, according to multiple public, official government documents, that changed the US government’s understanding of what WikiLeaks is. Public documents make it clear that witnesses (including but not limited to David House) provided new testimony as the government came to this new understanding, even beyond the government’s ill-fated attempt to coerce more testimony out of Chelsea Manning and Hammond. I know of at least two non-public investigative steps the government took as well. On August 20, 2018 — two days before a prosecutor wrote a gag request in EDVA that mistakenly mentioned the sophistication of Assange and the publicity surrounding his case and eight months after Assange was first charged — a Mueller warrant targeting a Guccifer 2.0 email account described an ongoing investigation into whether WikiLeaks and others were conspiring and/or a Foreign Agent, which suggests a similar amount of activity targeting Assange directly in EDVA. The government conducted a great deal of investigation into Assange — predicated off of either activities that have nothing to do with journalism and/or the fact that there was one obvious source for what might be WikiLeaks most damaging publication — that has happened in recent years.

WikiLeaks supporters will cite something that former DOJ Director of Public Affairs, Matthew Miller, said  about how hard it is to distinguish what WikiLeaks does from what the New York Times does.

The problem the department has always had in investigating Julian Assange is there is no way to prosecute him for publishing information without the same theory being applied to journalists.

But Miller made that comment in 2013, before Assange did things that gave the US government reason, entirely independent of things journalists do, to investigate him and WikiLeaks more aggressively. And even in an Administration that might not be in power were it not for Assange’s actions, even after Trump and his associates considered rewarding Assange with a pardon for his help, that has led to a dramatically different understanding of what WikiLeaks is.

That belief — and the government’s still mostly secret evidence for it — does nothing to mitigate the risks of some of the charges against Assange, as currently charged. But it is a fact that should be considered in the debate.

Update: Fixed date of a Mueller warrant I discussed.

Update: Bridges will be posting all the arguments and statements. Thus far they include:

Treasury Threatens to Prosecute Reporters Trying to Reveal What Rod Rosenstein and Richard Burr Would Not

WikiLeaks supporters like to claim the May 2019 superseding indictment against Assange uniquely threatens journalism by treating routine journalistic activities — such as requesting sensitive information — as part of a conspiracy to leak.* That’s not entirely true.

As I’ve noted, well before Assange’s superseding indictment, in October 2018, DOJ charged Natalie Sours Edwards — one of several presumed sources for a series of BuzzFeed stories on Suspicious Activities Reports pertaining to those investigated for their ties to Russia — in such a way to treat Jason Leopold as a co-conspirator. Both the complaint justifying her arrest and the indictment include a conspiracy charge that describes how Edwards (and another unindicted co-conspirator) worked with Reporter-1, including one request pertaining to Prevezon captured on Signal.

c. As noted above, the October 2018 Article regarded, among other things, Prevezon and the Investment Company. As recently as September 2018, EDWARDS and Reporter-1 engaged in the following conversation, via the Encrypted Application, in relevant part:

EDWARDS: I am not getting any hits on [the CEO of the Investment Company] do you have any idea what the association is if I had more information i could search in different areas

Reporter-1: If not on his name it would be [the Investment Company]. That’s the only other one [The CEO] is associated with Prevezon Well not associated His company is [the Investment Company]

On January 13, Edwards pled guilty to one charge, the conspiracy one, though without any sign of cooperation.

In fact, Edwards is not the only case charged like this. While he was charged after Assange’s superseding indictment, Henry Frese, a DIA analyst who leaked reports on China to some NBC reporters, was not just charged in a similar conspiracy charge, but was wiretapped to collect evidence implicating the reporters. Because he cooperated, there’s little to prevent Trump’s DOJ from charging the journalists after the election except Trump’s well-established support for an adversarial press.

The way in which DOJ charged Edwards has become newly critical given an announcement Treasury made yesterday, in the wake of reports about how Donald Trump was never investigated for his financial vulnerability to Russia. The unit of Treasury that collects and analyzes Suspicious Activity Reports released a statement threatening “various media outlets” who were planning to publish stories on SARs.

The Financial Crimes Enforcement Network (FinCEN) is aware that various media outlets intend to publish a series of articles based on unlawfully disclosed Suspicious Activity Reports (SARs), as well as other sensitive government documents, from several years ago.  As FinCEN has stated previously, the unauthorized disclosure of SARs is a crime that can impact the national security of the United States, compromise law enforcement investigations, and threaten the safety and security of the institutions and individuals who file such reports.  FinCEN has referred this matter to the U.S. Department of Justice and the U.S. Department of the Treasury’s Office of Inspector General.

BuzzFeed has always treated their source for the Treasury story as a whistleblower, reporting not just a dispute over access to reports for intelligence reports, but also on the damning Russian information that got ignored.

As Edwards has moved closer to sentencing, she developed irreconcilable differences with her original attorneys over what she called a coerced guilty plea. And documents filed in the case provide some explanation why.

While the substance of her appeal is not entirely clear, it’s clear that she claimed legal access to certain documents — presumably SARs — as a whistleblower.

In the appellants “official capacity” as a government employee from 2015-Jan 2020 and as a whistleblower from 2015 to current, the specific documents were used during the Congressional Request Inquires & Letters from 2015-2018, the Office of Special Counsel’s investigations from 2017-2020 and the appellants legal access to the exculpatory material from 2018 to current per 31 C.F.R. § 103 “official disclosures responsive to a request from an appropriate Congressional committee or subcommittees; and prosecutorial disclosures mandated by statute or the Constitution, in connection with the statement of a government witness to be called at trial, the impeachment of a government witness, or as material exculpatory of a criminal defendant.1

As a government employee I could disclose any information in a SAR (including information in supporting documentation) to anyone, up to and including the person who is the subject of the SAR, so long as the disclosure was “necessary to fulfill the official duties of such officer or employee”2 which I did as a whistleblower and as an employee; however, once I medically resigned, 31 C.F.R. § 103 provided the legal exculpatory material as a whistleblower, administrative appellate and criminal defendant to disclose the information in court proceedings. Furthermore, the appellant was adhering to the courts upholding that disclosures must be specific and detailed, not vague allegations of wrongdoing regarding broad or imprecise matters. Linder v. Department of Justice, 122 M.S.P.R. 14, 14 (2014); Keefer v. Department of Agriculture, 82 M.S.P.R. 687, 10 (1999); Padilla v. Department of the Air Force, 55 M.S.P.R. 540, 543– 44 (1992).

After she tried to use the documents in her appeal of a whistleblower complaint, the Treasury Department Inspector General shared them with the prosecutors in her case, who in turn cited them in her presentencing report.

The agency has argued throughout the appellant no longer is an employee of the agency, the pro se appellant agrees. The agency Inspector General should not have been notified of the administrative proceedings of the court because the appellant is not an employee of the agency. There is no statue or policy that gives the agency the right to notify the agency IG of the “procedural motion” prior “to notify the other party”. Regulation 5 C.F.R. § 1201.55(a) does not state “notify Inspector General” rather it does state “to notify the other party”. The pro se appellant argues notifying the Inspector General prior to “the other party” is a violation of the pro se appellants fifth amendment.

[snip]

[T]he agency/agency IG notified the appellants criminal prosecutors of the disclosures in the IRA case. As explained above, the disclosures are permissible per 31 C.F.R. § 103. Due to the agency/agency IG notification to the government prosecutors, the prosecution requested increased sentencing in the sentencing report for the appellant/defendant thus violating the defendants fifth amendment in the criminal proceeding.

Edwards further claimed that the government withheld her original complaint to coerce her to plead guilty.

The Federal Judge found merit and significant concerns in the “letter and substantial documentation” the whistleblower defendant/appellant provided to the court concerning violation of fifth amendment, conflict of interests pertaining to the prosecution/counsel, coercion of the plea deal, criminal referral submitted against agency IG, the letter defendant sent to Attorney General Sessions and Special Counsel Mueller, etc., all elements withheld from the Federal court by both the prosecution and defense counsel.

Edwards has been assigned a new attorney (who may have convinced her not to submit this complaint as part of sentencing), and her sentencing has been pushed out to October.

There’s no way to assess the validity of her complaint or even her representation of what happened with the judge in her case, Gregory Woods. What her complaint shows, however, is that there’s a packet of information she sent to Mueller and Sessions (possibly implicating and/or also sent to Congress), summarizing some reports she believes got ignored.

If those reports show what Rod Rosenstein and Richard Burr worked so hard not to investigate, it might explain why Treasury is threatening legal consequences for reporting on them. And given how DOJ already structured this prosecution, they might well be threatening to treat reporting on the President’s vulnerabilities as a conspiracy to leak SARs protected by statute.


*WikiLeaks supporters also cite the risk of Assange being subjected to US Espionage Act prosecution. While that risk is real, in his case, the most dangerous charges (for leaking the names of US and Coalition informants) would likely be far easier to prosecute under the UK’s Official Secrets Act, which still could happen if he’s not extradited. The actions described in his indictment are arguably more explicitly criminalized in the UK than the US, even if their sentences are not as draconian.

It’s Not the Four Year Old Counterintelligence Investigation intro Trump We Need to Be Most Worried About — It’s the Ones Bill Barr May Have Killed

The other day, Mike Schmidt advertised a book by claiming that FBI never did any kind of counterintelligence investigation of Trump in parallel with the Mueller investigation. On Twitter, Andrew Weissmann debunked a key part (though not all) of that claim.

The aftermath has led to ongoing debates about what really happened. My guess is that Schmidt’s sources did not have visibility on the full scope of the Mueller investigation, and he didn’t read the Mueller Report, which would have helped him realize that. And while credible reports say Mueller didn’t investigate Trump’s historical financial ties to Russia (while I’ve read neither book yet, the excerpts of Jeff Toobin’s book adhere more closely to the public record than Schmidt’s), the public record also suggests Mueller obtained Trump-related records that most people don’t realize he obtained.

I reiterate that it is far more troubling that a co-equal branch of government — the one with impeachment power — chose not to pursue the same questions about Trump’s financial vulnerabilities to Russia. If you want to express outrage that no one has investigated whether Trump is beholden to Russia, focus some of it on Richard Burr, who suggested Trump’s financial vulnerability to Russia was irrelevant to a report specifically focused on counterintelligence threats.

Still, there’s something still more urgent, one that is getting lost in the debate about what happened three or four years ago.

There were, as of at least April, at least one and probably several investigations implicating counterintelligence tied to Trump, through his top associates. But they tie to the same cases that Billy Barr has undermined in systematic and unprecedented fashion in recent months. It is a far more pressing question whether Barr has undermined counterintelligence investigations implicating Trump’s ties to Russia by ensuring those who lied to protect him during the Mueller investigation face no consequences than what Rod Rosenstein did forty months ago.

Consider Mike Flynn. The most newsworthy thing Robert Mueller said — under oath — over the course of two congressional hearings is that “many elements of the FBI” were looking into the counterintelligence risks created by Mike Flynn’s lies about his communications with Russia.

KRISHNAMOORTHI: Since it was outside the purview of your investigation your report did not address how Flynn’s false statements could pose a national security risk because the Russians knew the falsity of those statements, right?

MUELLER: I cannot get in to that, mainly because there are many elements of the FBI that are looking at different aspects of that issue.

KRISHNAMOORTHI: Currently?

MUELLER: Currently.

As part of Mueller’s analysis about whether Trump fired Jim Comey to stop the investigation into Flynn, he weighed whether the Flynn investigation implicated Trump personally. But he found — largely because Flynn and KT McFarland, after first telling similar lies to investigators, later professed no memory that Trump was in the loop regarding Flynn’s efforts to undercut sanctions with Sergey Kislyak, and Steve Bannon repeated a White House script saying he wasn’t — that the evidence was inconclusive.

As part of our investigation, we examined whether the President had a personal stake in the outcome of an investigation into Flynn-for example, whether the President was aware of Flynn’s communications with Kislyak close in time to when they occurred, such that the President knew that Flynn had lied to senior White House officials and that those lies had been passed on to the public. Some evidence suggests that the President knew about the existence and content of Flynn’s calls when they occurred, but the evidence is inconclusive and could not be relied upon to establish the President’s knowledge.

[snip]

But McFarland did not recall providing the President-Elect with Flynn’s read-out of his calls with Kislyak, and Flynn does not have a specific recollection of telling the President-Elect directly about the calls. Bannon also said he did not recall hearing about the calls from Flynn. And in February 2017, the President asked Flynn what was discussed on the calls and whether he had lied to the Vice President, suggesting that he did not already know. Our investigation accordingly did not produce evidence that established that the President knew about Flynn’s discussions of sanctions before the Department of Justice notified the White House of those discussions in late January 2017.

We’ve since seen transcripts that show Mike Flynn telling Sergey Kislyak in real time that Trump was aware of the communications between the two (and John Ratcliffe is withholding at least one transcript of a call between the men).

FLYNN: and, you know, we are not going to agree on everything, you know that, but, but I think that we have a lot of things in common. A lot. And we have to figure out how, how to achieve those things, you know and, and be smart about it and, uh, uh, keep the temperature down globally, as well as not just, you know, here, here in the United States and also over in, in Russia.

KISLYAK: yeah.

FLYNN: But globally l want to keep the temperature down and we can do this ifwe are smart about it.

KISLYAK: You’re absolutely right.

FLYNN: I haven’t gotten, I haven’t gotten a, uh, confirmation on the, on the, uh, secure VTC yet, but the, but the boss is aware and so please convey that. [my emphasis]

Certainly, Russia would have reason to believe that Flynn’s efforts to undermine sanctions were directed by Trump.

In January, a sentencing memo that was delayed so it could be approved by the entire chain of command at DOJ, explained why all this was significant.

Any effort to undermine the recently imposed sanctions, which were enacted to punish the Russian government for interfering in the 2016 election, could have been evidence of links or coordination between the Trump Campaign and Russia. Accordingly, determining the extent of the defendant’s actions, why the defendant took such actions, and at whose direction he took those actions, were critical to the FBI’s counterintelligence investigation.

[snip]

It was material to the FBI’s counterintelligence investigation to know the full extent of the defendant’s communications with the Russian Ambassador, and why he lied to the FBI about those communications.

Flynn’s forgetfulness about whether Trump ordered him to undermine sanctions went to the core question of whether Trump worked with Russia in their efforts to throw him the election.

And that sentencing memo was the moment when Billy Barr threw two different lawyers — one a lifetime associate of his — into the project of creating a false excuse to undermine the prosecution of Flynn. More recently, Acting Solicitor General Jeffrey Wall told the DC Circuit that Barr had secret reasons for overturning the prosecution.

The Attorney General of course sees this in a context of non-public information from other investigations.

[snip]

I just want to make clear that it may be possible that the Attorney General had before him information that he was not able to share with the court and so what we put in front of the court were the reasons that we could, but it may not be the whole picture available to the Executive Branch.

[snip]

It’s just we gave three reasons; one of them was that the interests of justice were not longer served, in the Attorney General’s judgment, by the prosecution. The Attorney General made that decision, or that judgment, on the basis of lots of information, some of it is public and fleshed out in the motion, some of it is not.

This secret reason is why, Wall suggested, it would cause irreparable harm for DOJ to have to show up before Judge Emmet Sullivan and explain why DOJ blew up the prosecution.

Then there’s Roger Stone. Stone very loudly claimed (improbably) that he could have avoided prison had he not lied to protect Donald Trump. And Trump rewarded him for it, commuting his sentence to ensure he didn’t spend a day in prison.

But at least as of April, an investigation into whether Stone was part of a conspiracy with Russia and/or was a Russian agent — implicating 18 USC 951, not just FARA — was ongoing. Among the things Stone was involved in that Trump refused to answer Mueller questions about was a pardon for Julian Assange, one Stone started pursuing at least as early as November 15. While no sentencing memo has explained this (as it did with Mike Flynn), whether Trump and Stone used promises of a pardon to get Assange to optimize the WikiLeaks releases goes to the core question of whether there was a quid pro quo as part of 2016.

Finally, there’s Paul Manafort, whose close associates, the SSCI Report makes clear, were part of GRU and appear to have had a role in the hack-and-leak. After securing a cooperation deal, Manafort changed his story, and then shared details of what Mueller’s team knew with the President.

Yet, even with Manafort’s ties to the effort to steal our election, the Attorney General used COVID relief to ensure that Manafort would escape prison.

While it’s not clear whether John Ratcliffe, Barr, or the IC made the decision, the redaction process of the SSCI report denied voters the ability to know how closely tied Trump’s campaign manager is with the people who helped steal the election. What we do know is the effort Manafort started continues in Trump’s efforts to extort Ukraine and spew Russian disinformation.

For all three of the Trump associates where we know Barr intervened (there’s good reason to suspect he intervened in an Erik Prince prosecution, too), those people implicate Trump directly in counterintelligence investigations that were, fairly recently, ongoing.

Whether or not there was a counterintelligence investigation implicating Trump on May 20, 2017, after Rod Rosenstein scoped the Mueller investigation, we know counterintelligence investigations have implicated him since. What we don’t know is whether, in an effort to help Trump get reelected, his fixer Billy Barr squelched those, too.

Update: In an appearance for his book, Schmidt said he considered writing it (in 2020) about just the first 26 days of his presidency. It’s a telling comment given that his description of what happened with counterintelligence doesn’t accord with what the Mueller Report itself said happened around 500 days into Trump’s presidency.

“These Actions Have Targeted Not Only against Russia, But Also Against the President Elect”

Given the news that Donald Trump is considering pardoning Edward Snowden, there has been a lot of discussion about why Trump would do this.

It’s actually not a deviation from past actions. Just seven days after the election, Trump’s rat-fucker started working on a pardon for Julian Assange, something that Trump offered a very circumscribed answer to Mueller about. He continued to entertain such proposals, and even ordered then CIA Director Mike Pompeo to consider a theory purporting to undermine the Russian attribution of the hack, one understood to be tied to an Assange pardon.

And on March 15, 2017, Trump shared information with Tucker Carlson that would have tipped off Joshua Schulte that the FBI considered him the culprit behind the Vault 7 leaks. While Trump shared that information hours before the FBI searched Schulte’s residence and seized his passports (including a diplomatic passport he never returned to CIA), there’s no evidence that information was made public before the FBI confronted Schulte that night. Had it, though, Trump’s comments might have led Schulte to accelerate a trip to Mexico he already had scheduled. John Solomon would even go on to blame Jim Comey for not pardoning Assange in advance of the Vault 7 releases.

So Trump has repeatedly undermined the prosecution of people who released large amounts of intelligence community secrets. Snowden would just be part of a pattern.

There’s some complaint that Trump opponents — including Adam Schiff — have suggested Trump would do this (dramatically altering his prior stance) because of Putin.

In fact, Russia has deliberately encouraged Trump to believe Russia and Trump were on the same side, opposed to the US intelligence community, since weeks before he was even inaugurated.

When, on December 31, 2016, Sergey Kislyak called Mike Flynn to tell him that his intervention to undermine sanctions on Russia for interfering in the 2016 election had succeeded in persuading Putin to take no action, Kislyak told Flynn that Russia considered the sanctions — for a hostile attack on this country!!! — to be an attack targeting not just Russia, but Trump himself.

KISLYAK: Uh, you know I have a small message to pass to you from Moscow and uh, probably you have heard about the decision taken by Moscow about action and counter-action.

FLYNN: yeah, yeah well I appreciate it, you know, on our phone call the other day, you know, I, I, appreciate the steps that uh your president has taken. I think that it is was wise.

KISLYAK: I, I just wanted to tell you that our conversation was also taken into account in Moscow and …

FLYNN: Good

KISLYAK: Your proposal that we need to act with cold heads~ uh, is exactly what is uh, invested in the decision.

FLYNN: Good

KISLYAK: And I just wanted to tell you that we found that these actions have targeted not only against Russia, but also against the president elect.

FLYNN: yeah, yeah.

“Yeah, yeah,” Trump’s weak-kneed National Security Advisor with 30 years intelligence experience said in reply.

We don’t need to speculate about whether Russia has encouraged Trump to view Russia as an ally against a hostile American Intelligence Community. We have proof. And even Mike Flynn, with a victim complex only a fraction as Yuge as Trump’s own, simply nodded along.

I mean, if Trump does pardon Snowden, by all means he should accept it — it likely would save his life.

But if you believe Trump is considering this out of any belief in whistleblowing or transparency — or even opposition to the surveillance that has ratcheted up and gotten less accountable under his Administration — you’re simply deceiving yourself.

And, yes, there is concrete evidence that Russia has cultivated Trump’s antagonism against the IC — well before Trump’s own actions led the FBI investigate him personally — so much that he might pardon Snowden to harm them.

DOJ Claims Some Ongoing Investigation Mueller Report Redactions Pertain to the the Assange Prosecution

DOJ just filed their answers to Judge Reggie Walton’s questions in the EPIC/BuzzFeed FOIA for the Mueller Report. While those are entirely sealed, a new declaration from Vanessa Brinkmann is available, albeit in heavily redacted form.

One thing that’s not redacted, however, is the list of pending prosecutions pertaining to which information remains redacted. One of those is US v. Assange.

Information that is withheld pursuant to (b)(7)(A) and included in Exhibit A pertains to a number of pending law enforcement proceedings, including [US v. Internet] Research Agency LLC (Case No. 1:18-cr-32 (D.D.C.)), United States v. Khusyaynova (Case No. 1:18-mj-464 (E.D. Va.)), United States v. Netyksho (Case No. 1:18-cr-215 (D.D.C.)), United States v. Morenets (Case No. 2:18-cr-00263 (W.D. Pa.)), United States v. Assange (Case No. 1:18-cr-00111-CMH (E.D. Va.)), United States v. Kilimnik (Case No. 1:17-cr-201-3 (D.D.C.)), or ongoing law enforcement investigations conducted by the Department and the FBI.1

The first two of these are prosecutions of Yevgeniy Prigozhin’s trolls, the third and fourth are GRU hackers (the second of those is the WADA hack).

Regarding Assange, it’s possible that this is as simple as a description of how the FBI accessed communications coming into or going out of the Ecuadorian Embassy (one example of this is footnote 262). Or it could mean redacted sections on charging decisions implicate not just Roger Stone, but also Assange. The Stone warrants released earlier this spring described an ongoing 951 (foreign agent)/conspiracy investigation that also necessitated ongoing redactions.

Seven pages of the filing (out of 17) pertain to ongoing investigations, almost all of them entirely redacted.

The Growing WikiLeaks Conspiracy [Indictment]

I want to revisit the superseding Julian Assange indictment with a view to unpacking how the conspiracy charges work in it. Alexa O’Brien and Dell Cameron — both experts on some of the acts described in the indictment — have written really useful pieces on the indictment that don’t, however, fully account for the way DOJ built the charges around two conspiracy charges, one a conspiracy to obtain and disclose national defense information (18 USC 793(g)) and one a conspiracy to commit computer intrusions (18 USC 371). While commenters are right to argue that the Espionage Act related charges risk criminalizing journalism, the CFAA conspiracy charge — particularly as expanded in this superseding indictment — does nothing unusual in charging the conspiracy.

As background to what the government has to do to prove a conspiracy, see this Elizabeth de la Vega thread from 2018. As she notes,

  • A conspiracy needs not succeed
  • Co-conspirators don’t have to explicitly agree
  • Conspiracies can have more than one object
  • But all co-conspirators have to agree on one object of the conspiracy
  • Co-conspirators can use multiple means to carry out the conspiracy
  • Co-conspirators don’t have to know what all the other conspirators are doing
  • Once someone is found to have knowingly joined a conspiracy, he is responsible for all acts of other co-conspirators
  • Statements of any co-conspirator made to further the conspiracy may be introduced into evidence against any other co-conspirator
  • Overt acts taken in furtherance of a conspiracy need not be illegal

Conspiracy charges are a powerful way for the government to charge groups of people (and also a way to charge crimes without showing all the evidence for them). But that’s true whenever it is used, not just against Assange. So if this associative kind of guilt bothers you (often with justification), your problem is with the law and precedents, not with the treatment of Assange.

For the moment, there are two key takeaways from de la Vega’s list: to prove Assange guilty of conspiring to hack various victims, the government only needs to show that he entered into an agreement to break US law and took overt acts to advance that conspiracy.

Here’s how the government presented the elements of this very same hacking conspiracy in Jeremy Hammond’s change of plea hearing (though Assange is charged with conspiring to violate four different CFAA charges, so the conspiracy is larger than what Hammond pled guilty to).

The crime of conspiracy, which is what he’s charged with, the elements are that there existed an agreement or implicit understanding between two or more people to violate a law of the United States, that the defendant knowingly and willingly joined that agreement, and that any one member of the conspiracy committed at least one overt act in the Southern District of New York. And the object of the conspiracy here is computer hacking to obtain information in violation of 18 U.S.C. 1030(a)(2)(A).

The elements of that offense are that, without authorization, members of the conspiracy agreed to intentionally access a computer, that they obtained information  from a protected computer, and that the value of the information obtained was greater than $5,000.

With regard to venue, I believe that defendant said that, I believe he did say that information was intentionally uploaded to a server located in the Southern District of New York.

The venue for Assange is different — EDVA rather than SDNY. The venue would be uncontroversial in any case, given that the Chelsea Manning-related leaks tie to the Pentagon and so EDVA. That said, when the US government extradites someone from overseas, they get venue wherever the person first enters the US (which is why EDNY, where JFK is located, has a lot of interesting precedents tied to foreigners violating US law). The indictment against Assange notes repeatedly that Assange “will be first brought to the Eastern District of Virginia,” so they plan on obtaining venue in EDVA, with all its harsh precedents on the Espionage Act, by landing him there if and when they get him, on top of the venue they’d already get via the leaks themselves.

Thus, so long as the government can prove that Assange entered into an agreement with co-conspirators to commit illegal hacks, then the government will have plenty of evidence to prove that the conspiracy happened, not least because co-conspirators Chelsea Manning, Jeremy Hammond, and Sabu pled guilty to them. Sigurdur Thordarsson (Siggi) is another key co-conspirator; the reason the government refers to him as “Teenager,” is to signal he was part of the conspiracy while explaining whey he wasn’t prosecuted for it (because he was a minor). The government also refers to Daniel Domscheit-Berg (WLA-2), Jake Appelbaum (WLA-3), and Sarah Harrison (WLA-4) in a way that treats them as co-conspirators; it’s unclear whether that numbering system starts at 2 because it treats Assange as WLA-1 or whether there’s some unnamed conspirator who will be added in the future.

The indictment alleges Assange entered into an agreement to commit CFAA in a number of ways:

  • Agreeing to help Manning crack a password on the same day Manning said the Gitmo detainee briefs were “all [she] really have got left” and Assange said, “curious eyes never run dry in my experience” (¶¶18-21)
  • Asking Siggi to hack Iceland (¶36)
  • Asking David House to decrypt a file stolen from Iceland before going on to hire him (¶44)
  • Agreeing that Siggi should meet with Gnosis, which included getting Laurelei and Kayla to agree to hack for WikiLeaks (¶¶48-49)
  • Publicly stating a link with LulzSec in June 2011 (¶62)
  • Validating Siggi’s outreach to Topiary, in which Siggi said, “WikiLeaks cannot publicly be taking down websites, but we might give a suggestion of something or something similar, if that’s acceptable to LulzSec” (¶¶63-64)
  • Cooperating with Jeremy Hammond, as reflected in Hammond’s statements to Sabu (¶70)
  • Providing Hammond a script to search the emails hacked from Stratfor (¶72)
  • Responding to a Sabu request for targets first by saying they could not do that “for the obvious legal reasons” but then suggesting a target (¶73)
  • Providing Sabu a script for searching emails (¶75)

The reason (one reason, anyway, I suspect there are a bunch more) that — as Cameron notes — the indictment doesn’t describe the earlier parts of the Stratfor hack is because they don’t matter at all to proving Assange was part of the conspiracy. The indictment provides evidence Assange agreed to enter into a conspiracy with LulzSec long before the hack and further evidence he remained actively involved as Hammond tried to exploit it.

Cameron’s piece is inconsistent, as well, when it attributes the hack to Hyrriiya but then claims that Sabu initiated the crime. Neither ultimately matters in the Assange conspiracy indictment, because — to the extent that Hyrriiya’s letter taking credit can be believed without corroboration — he laid out the basis for a conspiracy in the letter in any case, and he, too, would be a member of the conspiracy and that letter, if it could be validated, would be admissible.

As de la Vega described, once someone joins a conspiracy, that person becomes implicated in the acts of all the others in the conspiracy, whether or not one knows about those other acts. Assange agreed to enter into a conspiracy before and after the actual hack of Stratfor, so he’s on the hook for it.

Finally, given that the contemporaneous statements of all the co-conspirators would be admissible, concerns about the credibility of Siggi or any lack of cooperation from Manning and Hammond are less serious than they might otherwise be.

That principle of conspiracies — that once someone joins the conspiracy he is on the hook for everything else — is why (as O’Brien notes), the Espionage abetting charges all take place after the March 8 agreement to help hack a password. Before that, DOJ might be thinking, Assange might be playing a typical role of a publisher, publishing classified information provided to him, but after that, they seem to be arguing, he was part of the crime. An awful lot hangs on that agreement to crack a password (remember, a conspiracy doesn’t need to be successful to be charged), which is the main thing that distinguishes the Manning-related charges from journalism. But the government may be planning to tie WikiLeaks’ targeting of Iceland — which was not charged as a Manning-related crime but which involves conspiring to hack materials related to materials that Manning provided — with the Espionage charges.

As I’ve repeatedly argued, though, this dual structure — one conspiracy to hack, and another to steal National Defense Information from the US — sets up the Vault 7 leak perfectly, the charge that for some reason WikiLeaks associates want no tie to. The government will show, among other things, that even after WikiLeaks published the Vault 7 files, WikiLeaks published Joshua Schulte’s blogs, in which he attempted to provide details of the skills he deployed at CIA. The government will likewise show that Schulte, in attempting, from prison, to convince others to leak, fits into their theory that WikiLeaks was recruiting others to leak.

That’s one of many reasons why I expect Vault 7 to eventually be added to this indictment. Thus far, the government has obtained two indictments just as statutes of limitation might toll on the overt acts (the first being the agreement to crack a password, and the second to be the recruiting efforts five years ago). So I wouldn’t be surprised if, in April of next year, the government supersedes this again to include Vault 7, including some of the same charges (such as exposing the identities of covert officers) we already see in this indictment.

The real question, however, is if the government includes Russians as co-conspirators in a future superseding indictment. There were Russians in the chat rooms behind the Stratfor hack. And the existing conspiracy to hack charge is the same charge (though with slightly different counts) as two of the charges against the GRU officers who hacked the Democrats in 2016. Plus, there are repeated references in the Schulte trial about outreach to Russia (these references are quite ambiguous, but I hope to explain why that might be in the nearish future); I had heard about that outreach before it was publicly disclosed.

When the government made its last ditch attempt to get Hammond to testify before the grand jury, according to Hammond’s account, they twice claimed to Hammond that Assange was a Russian spy. And when he asked why Assange wasn’t charged in the 2016 hack-and-leak, the prosecutor appears to have suggested the extradition would take a long time, which might mean they could add those charges in a superseding indictment.

If the government eventually argues that Russians were part of this conspiracy from very early on, then the charges will look very different if and when Assange gets extradited.

The Government Argues that Edward Snowden Is a Recruiting Tool

As I noted in my post on the superseding indictment against Julian Assange, the government stretched the timeline of the Conspiracy to Hack count to 2015 by describing how WikiLeaks helped Edward Snowden flee to Russia. DOJ seems to be conceiving of WikiLeaks’ role in helping Snowden as part of a continuing conspiracy designed to recruit more leakers.

Let me make clear from the onset: I am not endorsing this view, I am observing where I believe DOJ not only intends to head with this, but has already headed with it.

Using Snowden as a recruitment tool

After laying out how Chelsea Manning obtained and leaked files that were listed in the WikiLeaks Most Wanted list (the Iraq Rules of Engagement and Gitmo files, explicitly, and large databases more generally; here’s one version of the list as entered into evidence at Manning’s trial), then describing Assange’s links to LulzSec, the superseding Assange indictment lays out WikiLeaks’ overt post-leak ties and claimed ties to Edward Snowden.

83. In June 2013, media outlets reported that Edward J. Snowden had leaked numerous documents taken from the NSA and was located in Hong Kong. Later that month, an arrest warrant was issued in the United States District Court for the Eastern District of Virginia, for the arrest of Snowden, on charges involving the theft of information from the United States government.

84. To encourage leakers and hackers to provide stolen materials to WikiLeaks in the future, ASSANGE and others at WikiLeaks openly displayed their attempts to assist Snowden in evading arrest.

85. In June 2013, a WikiLeaks association [Sarah Harrison, described as WLA-4 in the indictment] traveled with Snowden from Hong Kong to Moscow.

86. On December 31, 2013, at the annual conference of the Chaos Computer Club (“CCC”) in Germany, ASSANGE, [Jacob Appelbaum] and [Harrison] gave a presentation titled “Sysadmins of the World, Unite! A Call to Resistance.” On its website, the CCC promoted the presentation by writing, “[t]here has never been a higher demand for a politically-engaged hackerdom” and that ASSANGE and [Appelbaum] would “discuss what needs to be done if we re going to win.” ASSANGE told the audience that “the famous leaks that WikiLeaks has done or the recent Edward Snowden revelations” showed that “it was possible now for even a single system administrator to … not merely wreck[] or disabl[e] [organizations] … but rather shift[] information from an information apartheid system … into the knowledge commons.” ASSANGE exhorted the audience to join the CIA in order to steal and provide information to WikiLeaks, stating, “I’m not saying doing join the CIA; no, go and join the CIA. Go in there, go into the ballpark and get the ball and bring it out.”

87. At the same presentation, in responding to the audience’s question as to what they could do, [Appelbaum] said “Edward Snowden did not save himself. … Specifically for source protection [Harrison] took actions to protect [Snowden] … [i]f we can succeed in saving Edward Snowden’s life and to keep him free, then the next Edward Snowden will have that to look forward to. And if look also to what has happened to Chelsea Manning, we see additionally that Snowden has clearly learned….”

The following section describes how, “ASSANGE and WikiLeaks Continue to Recruit,” including two more paragraphs about the Most Wanted Leaks:

89. On May 15, 2015, WikiLeaks tweeted a request for nominations for the 2015 “Most Wanted Leaks” list, and as an example, linked to one of the posts of a “Most Wanted Leaks” list from 2009 that remained on WikiLeaks’s website.

[snip]

92. In June 2015, to continue to encourage individuals to hack into computers and/or illegaly obtain and disclose classified information to WikiLeaks, WikiLeaks maintained on its website a list of “The Most Wanted Leaks of 2009,” which stated that documents or materials nominated to the list must “[b]e likely to have political, diplomatic, ethical or historical impact on release … and be plausibly obtainable to a well-motivated insider or outsider,” and must be “described in enough detail so that … a visiting outsider not already familiar with the material or its subject matter may be able to quickly locate it, and will be motivated to do so.”

Effectively, Snowden is included in this indictment not because the government is alleging any ties between Snowden and WikiLeaks in advance of his leaks (Snowden’s own book lays out reasons to think there was more contact between him and Appelbaum than is publicly known, but the superseding Assange indictment makes no mention of any contacts before Snowden’s first publications), but because WikiLeaks used their success at helping Snowden to flee as a recruiting pitch.

Snowden admits Harrison got involved to optimize his fate

This is something that Snowden lays out in his book. First, he addresses insinuations that Assange only helped Snowden out of selfish reasons.

People have long ascribed selfish motives to Assange’s desire to give me aid, but I believe he was genuinely invested in one thing above all—helping me evade capture. That doing so involved tweaking the US government was just a bonus for him, an ancillary benefit, not the goal. It’s true that Assange can be self-interested and vain, moody, and even bullying—after a sharp disagreement just a month after our first, text-based conversation, I never communicated with him again—but he also sincerely conceives of himself as a fighter in a historic battle for the public’s right to know, a battle he will do anything to win. It’s for this reason that I regard it as too reductive to interpret his assistance as merely an instance of scheming or self-promotion. More important to him, I believe, was the opportunity to establish a counterexample to the case of the organization’s most famous source, US Army Private Chelsea Manning, whose thirty-five-year prison sentence was historically unprecedented and a monstrous deterrent to whistleblowers everywhere. Though I never was, and never would be, a source for Assange, my situation gave him a chance to right a wrong. There was nothing he could have done to save Manning, but he seemed, through Sarah, determined to do everything he could to save me.

This passage is written to suggest Snowden believed these things at the time, describing what “seemed” to be true at the time. But it’s impossible to separate it from Appelbaum’s explicit comparison of Manning and Snowden at CCC in December 2013.

Snowden then describes what he thinks Harrison’s motive was.

By her own account, she was motivated to support me out of loyalty to her conscience more than to the ideological demands of her employer. Certainly her politics seemed shaped less by Assange’s feral opposition to central power than by her own conviction that too much of what passed for contemporary journalism served government interests rather than challenged them.

Again, this is written to suggest Snowden believed it at the time, though it’s likely what he has come to believe since.

Then Snowden describes believing, at that time, that Harrison might ask for something in exchange for her help — some endorsement of WikiLeaks or something.

As we hurtled to the airport, as we checked in, as we cleared passport control for the first of what should have been three flights, I kept waiting for her to ask me for something—anything, even just for me to make a statement on Assange’s, or the organization’s, behalf. But she never did, although she did cheerfully share her opinion that I was a fool for trusting media conglomerates to fairly guard the gate between the public and the truth. For that instance of straight talk, and for many others, I’ll always admire Sarah’s honesty.

Finally, though, Snowden describes — once the plane entered into Chinese airspace and so narratively at a time when there was no escaping whatever fate WikiLeaks had helped him pursue — asking Harrison why she was helping. He describes that she provided a version of the story that WikiLeaks would offer that December in Germany: WikiLeaks needed to be able to provide a better outcome than the one that Manning suffered.

It was only once we’d entered Chinese airspace that I realized I wouldn’t be able to get any rest until I asked Sarah this question explicitly: “Why are you helping me?” She flattened out her voice, as if trying to tamp down her passions, and told me that she wanted me to have a better outcome. She never said better than what outcome or whose, and I could only take that answer as a sign of her discretion and respect.

Whatever has been filtered through time and (novelist-assisted) narrative, Snowden effectively says the same thing the superseding indictment does: Assange and Harrison went to great lengths to help Snowden get out of Hong Kong to make it easier to encourage others to leak or hack documents to share with WikiLeaks. I wouldn’t be surprised if these excerpts from Snowden’s book show up in any Assange trial, if it ever happens.

Snowden’s own attempt to optimize outcomes

Curiously, Snowden did not say anything in his book about his own efforts to optimize his outcome, which is probably the most interesting new information in Bart Gellman’s new book, Dark Mirror (the book is a useful summary of some of the most important Snowden disclosures and a chilling description of how aggressively he and Askhan Soltani were targeted by foreign governments as they were reporting the stories). WaPo included the incident in an excerpt, though the excerpt below is from the book.

Early on in the process, Snowden had asked Gellman to publish the first PRISM document with a key, without specifying what key it was. When WaPo’s editors asked why Gellman’s source wanted them to publish a key, Gellman finally asked.

After meeting with the Post editors, I remembered that I could do an elementary check of the signature on my own. The result was disappointing. I was slow to grasp what it implied.

gpg –verify PRISM.pptx.sig PRISM.pptx

gpg: Signature made Mon May 20 14:31:57 2013 EDT

using RSA key ID ⬛⬛⬛⬛⬛⬛⬛⬛

gpg: Good signature from “Verax”

Now I knew that Snowden, using his Verax alter ego, had signed the PowerPoint file himself. If I published the signature, all it would prove to a tech-savvy few was that a pseudonymous source had vouched for his own leak. What good would that do anyone?

In the Saturday night email, Snowden spelled it out. He had chosen to risk his freedom, he wrote, but he was not resigned to life in prison or worse. He preferred to set an example for “an entire class of potential whistleblowers” who might follow his lead. Ordinary citizens would not take impossible risks. They had to have some hope for a happy ending.

To effect this, I intend to apply for asylum (preferably somewhere with strong Internet and press freedoms, e.g. Iceland, though the strength of the reaction will determine how choosy I can be). Given how tightly the U.S. surveils diplomatic outposts (I should know, I used to work in our U.N. spying shop), I cannot risk this until you have already gone to press, as it would immediately tip our hand. It would also be futile without proof of my claims—they’d have me committed—and I have no desire to provide raw source material to a foreign government. Post publication, the source document and cryptographic signature will allow me to immediately substantiate both the truth of my claim and the danger I am in without having to give anything up. . . . Give me the bottom line: when do you expect to go to print?

Alarm gave way to vertigo. I forced myself to reread the passage slowly. Snowden planned to seek the protection of a foreign government. He would canvass diplomatic posts on an island under Chinese sovereign control. He might not have very good choices. The signature’s purpose, its only purpose, was to help him through the gates.

How could I have missed this? Poitras and I did not need the signature to know who sent us the PRISM file. Snowden wanted to prove his role in the story to someone else. That thought had never occurred to me. Confidential sources, in my experience, did not implicate themselves—irrevocably, mathematically—in a classified leak. As soon as Snowden laid it out, the strategic logic was obvious. If we did as he asked, Snowden could demonstrate that our copy of the NSA document came from him. His plea for asylum would assert a “well-founded fear of being persecuted” for an act of political dissent. The U.S. government would maintain that Snowden’s actions were criminal, not political. Under international law each nation could make that judgment for itself. The fulcrum of Snowden’s entire plan was the signature file, a few hundred characters of cryptographic text, about the length of this paragraph. And I was the one he expected to place it online for his use.

Gellman, Poitras, and the Post recognized this would make them complicit in Snowden’s flight and go beyond any journalistic role.

After some advice from WaPo’s lawyers, Gellman made it clear to Snowden he could not publish the key (and would not have, in any case, because the slide deck included information on legitimate targets he and the WaPo had no intent of publishing).

We hated the replies we sent to Snowden on May 26. We had lawyered up and it showed. “You were clear with me and I want to be equally clear with you,” I wrote. “There are a number of unwarranted assumptions in your email. My intentions and objectives are purely journalistic, and I will not tie them or time them to any other goal.” I was working hard and intended to publish, but “I cannot give you the bottom line you want.”

This led Snowden to withdraw his offer of exclusivity which — as Gellman tells the story — is what led Snowden to renew his efforts to work with Glenn Greenwald. The aftermath of that decision led to a very interesting spat between Gellman and Greenwald — to read that, you should buy the book.

To be clear, I don’t blame Snowden for planning his first releases in such a way as to optimize the chances he wouldn’t spend the rest of his life in prison. But his silence on the topic in his own account, even while he adopted the WikiLeaks line about their goal of optimizing his outcome, raises questions about any link between Harrison’s plans and Snowden’s.

The government is using Snowden as inspiration in other cases

The superseding Assange indictment is the first place I know of where the government has specifically argued that WikiLeaks’ assistance to Snowden amounted to part of a criminal conspiracy (though it is totally unsurprising and I argued that it was clear the government was going there based on what they had argued in the Joshua Schulte case).

But it’s not the first place they have argued a tie between Snowden as inspiration and further leaks.

The indictment for Daniel Everette Hale, the guy accused of sharing documents on the drone program with Jeremy Scahill, makes it clear how Hale’s relationship with Scahill blossomed just as the Snowden leaks were coming out (and this detail makes it clear he’s the one referred to in Citizenfour as another source coming forward).

15. On or about June 9, 2013, the Reporter sent HALE an email with a link to an article about Edward Snowden in an online publication. That same day. Hale texted a friend that the previous night he had been hanging out with journalists who were focused on his story. Hale wrote that the evening’s events might provide him with “life long connections with people who publish work like this.”

Hale launched a fairly aggressive (and if it weren’t in EDVA, potentially an interesting) challenge to the Espionage Act charges against him. It included (but was not limited to) a Constitutional motion to dismiss as well as a motion to dismiss for selective prosecution. After his first motions, however, both the government’s response and Hale’s reply on selective prosecution were (and remain, nine months later) sealed.

But Hale’s reply on the Constitutional motion to dismiss was not sealed. In it, he makes reference to what remains sealed in the selective prosecution filings. That reference makes it clear that the government described searching for leakers who had been inspired “by a specific individual” who — given the mention of Snowden in Hale’s indictment — has to be Snowden.

Moreover, as argued in more detail in Defendant’s Reply in support of his Motion to Dismiss for Selective or Vindictive Prosecution (filed provisionally as classified), it appears that arbitrary enforcement – one of the risks of a vague criminal prohibition – is exactly what occurred here. Specifically, the FBI repeatedly characterized its investigation in this case as an attempt to identify leakers who had been “inspired” by a specific individual – one whose activity was designed to criticize the government by shedding light on perceived illegalities on the part of the Intelligence Community. In approximately the same timeframe, other leakers reportedly divulged classified information to make the government look good – by, for example, unlawfully divulging classified information about the search for Osama Bin Laden to the makers of the film Zero Dark Thirty, resulting in two separate Inspector General investigations.3 Yet the investigation in this case was not described as a search for leakers generally, or as a search for leakers who tried to glorify the work of the Intelligence Community. Rather, it was described as a search for those who disclosed classified information because they had been “inspired” to divulge improprieties in the intelligence community.

Hale argued, then, that the only reason he got prosecuted after some delay was because the FBI had a theory about Snowden’s role in inspiring further leaks.

Judge Liam O’Grady denied both those motions (and most of Hale’s other motions), though without further reference to Snowden as an inspiration. But I’m fairly sure this is not the only case where they’re making this argument.

The Superseding Assange Indictment Tidies Up CFAA Charges

Yesterday, the government released a second superseding indictment against Julian Assange. The EDVA press release explains that no new counts were added, but the language describing the computer hacking conspiracy was expanded.

The new indictment does not add additional counts to the prior 18-count superseding indictment returned against Assange in May 2019. It does, however, broaden the scope of the conspiracy surrounding alleged computer intrusions with which Assange was previously charged. According to the charging document, Assange and others at WikiLeaks recruited and agreed with hackers to commit computer intrusions to benefit WikiLeaks.

It is true the description of the hacking charge has been dramatically expanded, incorporating a bunch of hacks that WikiLeaks was associated with.

But there are a few details of the charges that changed as well. The CFAA charge has actually been reworked, focused on four different kinds of hacks:

  • Accessing a computer and exceeding access to obtain information classified Secret
  • Accessing a computer and exceeding access to obtain information from protected computers at a department or agency of the United States committed in furtherance of criminal acts
  • Knowingly transmitting code that can cause damage,
    • Greater than $5000
    • Used by an entity of the US in furtherance of the administration of justice, national defense, and national security
    • Affecting more than 10 or more protected computers in a given year
  • Intentionally accessing protecting computers without authorization to recklessly cause damage,
    • Greater than $5000
    • Used by an entity of the US in furtherance of the administration of justice, national defense, and national security
    • Affecting more than 10 or more protected computers in a given year

This is a grab bag of hacking charges, and it could easily cover (and I expect one day it will cover) actions not described in this indictment. While adding this grab bag of charges, the indictment takes out a specific reference to the Espionage Act, probably to ensure at least one charge against Assange can in no way be claimed to be a political crime. It also takes out 18 U.S.C. § 641, possibly because the thinking of its applicability to leaking classified information has gotten more controversial.

The indictment also changes the dates on several of the counts. The timeline on the three counts addressing leaking of informants’ identities (something that is criminalized in the UK in ways it is not here, but also the counts that most aggressively charge Assange for the publication of information) now extends to April 2019. The timeline on the hacking charges extends (for reasons I’ll explain below), to 2015. And the overall timeline of Assange’s behavior extends back to 2007, a date that post-dates the earliest WikiLeaks activity and so raises interesting questions about what actions it was chosen to include.

As to the 2015 date, the indictment gets there by discussing WikiLeaks’ role in helping Edward Snowden flee China and the ways WikiLeaks used Snowden’s case to encourage other leakers and hackers. It describes:

  • Sarah Harrison’s trip to Hong Kong in June 2013
  • The presentation Harrison, Jake Appelbaum, and Assange gave in December 2013 encouraging potential leakers to, “go and join the CIA. Go in there, go into the ballpark and get the ball and bring it out,” and claiming that, “Edward Snowden did not save himself … Harrison took actions to protect him”
  • A conference on May 6, 2014 when Harrison recruited others to obtain classified or stolen information to share with WikiLeaks
  • A May 15, 2015 Most Wanted Leaks pitch that linked back to the 2009 list that Chelsea Manning partly responded to
  • Comments Assange made on May 25, 2015 claiming to have created distractions to facilitate Snowden’s flight
  • Appelbaum and Harrison’s efforts to recruit more leakers at a June 18, 2015 event
  • The continued advertisement for Most Wanted Leaks until at least June 2015, still linking back to the 2009 file

I’ll explain in a follow-up where this is going. Obviously, though, the government could easily supersede this indictment to add later leakers, most notably but in no way limited to Joshua Schulte, who first started moving towards leaking all of CIA’s hacking tools to WikiLeaks in 2015.

I argued, in December, that the government appeared to be moving towards a continuing conspiracy charge, one that later hackers and leakers (as well as Appelbaum and Harrison) could easily be added to. Doing so as they’ve done here would in no way violate UK’s extradition rules. And fleshing out the CFAA charge makes this airtight from an extradition standpoint; some of the crimes alleged involving Anonymous have already been successfully prosecuted in the UK.

This doesn’t mitigate the harm of the strictly publishing counts. But it does allege Assange’s personal involvement in a number of hacks and leaks that others — both in the US and UK — have already been prosecuted for, making the basic extradition question much less risky for the US.

Update: I think this allegation in the new indictment is important:

In September 2010, ASSANGE directed [Siggi] to hack into the computer of an individual former associated with WikiLeaks and delete chat logs containing statements of ASSANGE. When Teenager asked how that could be done, ASSANGE wrote that the former WikiLeaks associate could “be fooled into downloading a trojan,” referring to malicious software, and then asked Teenager what operating system the former-WikiLeaks associate used.

I’ve heard allegations from the entire period of WikiLeaks’ prominence of Assange asking to spy on one or another partner or former partner, including protected entities. One relatively recent allegation I know of targeted a former WikiLeaks associate in 2016, after a break on election-related issues. I have no idea whether these allegations are credible (and I know of none who would involve law enforcement). But allegations that Assange considered — or did — spy on his allies undercuts his claim to being a journalist as much as anything else he does. It also raises questions about what WikiLeaks did with the unpublished Vault 7 files.

Update: Dell Cameron, who is the expert on the Stratfor hack, lays out some apparently big holes in the parts of the indictment that pertain to that.

Prosecutors Have Discovered the Joshua Schulte Is a Hack-and-Leak Case, Not a Personnel Dispute

While I’ve been buried in the Mike Flynn beat, on Monday, there was a status hearing in the Joshua Schulte case.

There were three main news items in the hearing.

First, prosecutors revealed unsurprisingly that they’re going retry Schulte. More interesting, they said they planned to supersede the indictment against Schulte, alleging the same charges, but providing more information on them. They cited the notes from jurors, which made it crystal clear that the jurors were confused by the forensic testimony and how the charges related to that testimony. What the limits of Schulte’s legal access were seemed to be particularly confusing (something that is not sufficiently clear in the law anyway). At the time of both the initial Espionage indictment and the superseding one, the CIA was still trying to keep secret specifically what had been stolen when and how, but now that that’s public. I expect the superseding indictment to explain more clearly what was stolen and how Schulte allegedly exceeded his legal accesses to do that.

In discussions around that superseding indictment, prosecutor David Denton said something to the effect that grand juries are only available in emergencies. As far as the public record goes, however, grand juries aren’t available at all, so Denton’s disclosure was news. That only matters in the Schulte case insofar as he’s going to refuse most Speedy Trial exclusions (meaning prosecutors may be forced to find some way to start a new trial before COVID lockdowns end). But it’s an interesting admission more generally.

Finally, prosecutors said they didn’t think the retrial will take as long as his initial trial. In my summary of why the prosecution was in a remarkably weak position as the last trial went to the jury, I described how prosecutors had made it look like the Vault 7 breach was just a really nasty personnel dispute to which burning the CIA’s hacking abilities to the ground was just a side dispute.

Add that to the pace of the trial, which feels like a nasty employment dispute to which the massive breach of the CIA’s hacking tools became just a side-dispute. That’s often true of CIA trials — it certainly was for Jeffrey Sterling. But the long parade of CIA witnesses — Schulte’s buddy, two other colleagues, his boss, his boss’s boss, his boss’s boss’s boss, her boss, and then yet another boss, plus a CIA SysAdmin and a security guy — all describing a series of disputes escalating from a nerf gun fight to WikiLeaks burning the CIA’s hacking capabilities to the ground refocused the trial onto whether Schulte’s complaints had merit and not on what the forensic evidence showed.

And Sabrina Shroff did a superb job of defending not the forensic case (indeed, defense expert Steve Bellovin did not take the stand to float any of the alternate theories that Schulte has been offering for two years, and in so doing will leave Shroff to claim Michael could have accessed the backup without prosecutors having gotten him to admit that wouldn’t have worked), but instead arguing that her client was maligned by the entire CIA. The boss, the boss’s boss, the boss’s boss’s boss, the boss’s boss’s boss’s boss, and then the senior-most boss are all lined up against Schulte for being an asshole. She even defused utterly damning notes about working with Russia (which I’ll return to). From the transcripts, it seemed like Shroff rattled a good many government witnesses, too, and a number of them (one of the FBI agents and the classification expert, especially) seemed to come off as unresponsive as a result.

I expect prosecutors will shorten the trial by limiting this testimony to just the four or so people who have first-hand knowledge of Schulte’s actions (and in the retrial, the government won’t have to backpedal as they try to fix their late disclosure that Schulte’s buddy Michael had been put on paid leave by the CIA). If so, that should make it easier for prosecutors to focus on why the circumstantial forensic evidence strongly supports Schulte’s involvement.

All that said, prosecutors also seemed to be fighting jury nullification in Schulte’s trial, with at least two jurors who were determined to acquit Schulte no matter what other jurors said. That may be a WikiLeaks thing (one that would be far less likely to happen if this were tried in EDVA, which is why Julian Assange says he can’t get a fair trial in EDVA). But it also may be the case that CIA’s hacking department doesn’t make a very sympathetic hacking victim.

The Roger Stone Prosecution Was One Step in an Ongoing Investigation

I’ve spent the last few days going through the warrants released the other day in detail. This post attempts to summarize what they show about the Stone investigation.

First, understand the scope of this release. According to a filing the government submitted a year ago, they considered the media request to apply to, “warrants to search Stone’s property and facilities [and] other warrants that were executed as part of the same line of investigation” obtained under both Rule 41 and Stored Communication Act.  It does not include warrants from other lines of investigation that happened to yield information on Stone. That said, there is good reason to believe there are either filings that were entirely withheld, or that DOJ’s interpretation of what constitutes the “same line of investigation” is fluid.

In his order to release the files, Judge Christopher Cooper said that the individual redactions hide, “the private information of non-parties, financial information, and non-public information concerning other pending criminal investigations.” In the hearing on the release, the media coalition suggested that people who had testified at Stone’s trial should not be protected under the guise of privacy, and that seems to have been the standard adopted on redactions of names. In general, then, this post assumes that the redaction of names (such as Ted Malloch) protects the privacy of people who did not testify at trial, but the redaction of entire paragraphs (such as 7 paragraphs of boilerplate describing why Malloch was suspected to be involved) was done to protect ongoing investigations. In the list of warrants below, I’ve marked with an asterisk those that — either because they weren’t for Stone’s property or because they didn’t yield evidence relevant to the the obstruction charges he was prosecuted for — were not provided to Stone in discovery; I’ve based that on the list in this order (see footnote 2).

This investigation may well have started as a box-checking exercise, effectively checking whether John Podesta’s allegations that Roger Stone had learned of the hack targeting Hillary’s campaign manager ahead of time. It appears that Mueller’s team slowly came to believe that Roger Stone had gotten advance notice — and possibly advanced possession — of the Podesta email drop. Along the way, it ruled out one after another theory of how he did so.

Two of the most fascinating applications — one pertaining to an Israeli contact and another regarding someone apparently introduced to Stone by Charles Ortel — seem to have fully (the Israeli lead) or partly (the Ortel one) fizzled. (I base that on whether communications described in the affidavits continue to show up in later applications and whether entire paragraphs remain redacted.)

But the government still seems to believe that Stone worked with Corsi and Malloch on these issues. The government is obviously still trying to figure out whether the rat-fuckers and hoaxsters managed to optimize the release of the Podesta emails on October 7, 2016 to drown out the Access Hollywood drop. Mueller’s uncertainty on this point is something explained in redacted sections of the Mueller Report.

Along the way, Mueller developed two side prongs to the investigation: an examination of how Stone used social media to advertise WikiLeaks documents (it’s likely that investigation came to include ads that may have replicated themes being pushed by Russia and may have involved improper collaboration with the campaign), and the obstruction and witness tampering investigation Stone was prosecuted for.

More interesting still, in fall 2018, Mueller’s team started pursuing several leads (including the Ortel one), most of which — if the rule that entirely redacted paragraphs reflect ongoing investigation — continue to be investigated. Indeed, it appears that the prosecution of Stone for obstruction served partly as a means to initiate a prosecution against him, possibly entice him to flip against Trump or others, but perhaps mainly to obtain Stone’s devices in an attempt to get texts from 2016 to 2017 he had deleted, as well as the content of the encrypted communications he had sent using those devices. That is, the search, arrest, and prosecution of Stone appears to have been just one step in an ongoing investigation, an investigation that may be targeting others (including Julian Assange).

Identify the Malloch and Corsi connection (May 2017 to July 2018)

From May (when Mueller’s team first obtained subscriber records on Stone’s Twitter account) until November 2017, the investigation may have been little more than an effort to assess the spat between Stone and John Podesta over Stone’s August 21, 2016 “time in the barrel tweet.” After the team obtained Stone’s Twitter accounts, they moved to obtain the email accounts on which he conducted conversations started on Twitter. In November, Mueller got a warrant for his own team to access Julian Assange’s Twitter accounts (though the government surely already had obtained that). By December, Stone’s email accounts would have led Mueller’s team to believe that Ted Malloch, who was in London, could have been the back channel Stone kept bragging about, and so got his Gmail account. Mueller gagged Google to prevent Malloch from learning that. As a result, Malloch was presumably surprised when he arrived at Logan airport in March and was searched — a search conducted to obtain his phones, partly in an attempt to get to his UK-hosted email.

After Steven Bannon was interviewed in February 2018, Mueller’s team used that to obtain Stone’s Apple account; while not indicated anywhere in these applications, that’s where they would discover Stone and Michael Caputo had responded to a Russian offering dirt on Hillary.

In July, Mueller’s team obtained Jerome Corsi’s email and Apple accounts (there’s no record of them obtaining his Gmail account, but Corsi’s description of Mueller’s knowledge of his August 2016 searches suggests they got it). These affidavits begin to include a 7-page redaction that may indicate ongoing investigation into whether Stone or Corsi optimized the October 7 Podesta email release.

In this phase, the crimes being investigated expanded from just hacking to conspiracy to aiding and abetting. When Mueller got the Assange warrant, he added the illegal  foreign contribution charge (one he declined to prosecute in a long redacted passage of the Mueller Report).

Collect materials on Stone’s overt social media campaigns (August 2018)

On May 18, 2018, Mueller’s team interviewed John Kakanis, who had worked on tech issues for Stone during the election. Afterwards, Mueller’s team obtained a series of warrants to collect the social media campaigns Stone had conducted on issues related to the Russian hack-and-leak. Those warrants included one for several Facebook accounts, a Gmail and Twitter account Stone used for such issues, and a Facebook and Gmail account under the Brazilian name Falo Memo Tio. Stone apparently did not receive the Facebook Falo Memo Tio account, and that warrant included a gag.

Track Stone’s efforts to obstruct the investigation (August 2018)

As Mueller’s team started interviewing people loyal to Stone, they became aware that Stone was communicating with witnesses. In May, Mueller obtained a pen register on Stone’s email accounts, allowing them to track with whom Stone was communicating. An August 3, 2018 warrant describes how investigators used those toll records to track such communications:

  • In the wake of Michael Caputo’s interview, he and Stone communicated via his Hotmail account (this would have been obvious from the story Stone seeded with the WaPo not long after)
  • After FBI Agents approached Andrew Miller, Stone emailed him via Gmail at least 10 times and a over a hundred times after he started challenging his subpoena
  • Stone emailed both Corsi and Credico in May 2018
  • Stone hired a private investigator to conduct a background investigation into someone who had done IT work for him during the campaign and research where he could serve Credico with legal process; in a June 2018 interview, the PI told investigators he and Stone primarily communicated via iPhone text messages

This affidavit included a section (¶¶64-77), based off texts with Credico stored in Stone’s iCloud account and texts published by the media, describing Stone’s threats to Credico.

In response to Stone’s overt efforts to thwart the investigation, Mueller obtained new warrants on Stone’s Hotmail, Gmail, and Apple accounts, which would yield a great deal of evidence for the obstruction and witness tampering charges against Stone. From this point forward, those charges would be included on warrants targeting Stone. In addition, from that point forward, the government appears to have sought to obtain Stone’s communications with those whose testimony he was obstructing (though the names of others besides Credico are redacted).

Starting with the next warrant, affidavits would include a section (¶¶87-89) comparing what Stone had told the House Intelligence Committee with what his own communication records showed, language that would form the backbone for the obstruction indictment.

Investigate the spooky stuff (May to August 2018)

There’s a number of things in these warrants that are difficult to assess. They didn’t show up in Stone’s trial, and it’s unclear whether they were leads that fizzled or reflect far more damning evidence. For example, the Israeli source who kept trying (and ultimately succeeded, once) to use Stone to get a meeting with Donald Trump doesn’t appear to have amounted to much, at least not with respect to the WikiLeaks releases.

A far more intriguing detail is the FBI claim — that lacks details that would be necessary to assess its accuracy — that Stone was searching for details of the Russian operation before those details were made public. The FBI made that claim twice. First, in a July 28, 2018 affidavit, they described that someone conducted searches on dcleaks and “guccifer june” using IP addresses that might be Stone, starting on May 17, 2016. The suggestion is that Stone may have had advance notice of those parts of the Russian operation. But some journalists learned of dcleaks after it got launched in early June and before it got more attention later in the summer. And the original Guccifer, Marcel Lazar, signed a plea agreement in late May 2016. Given Lazar’s claim to have hacked a Hillary server, it’s not unreasonable to think Stone would be researching him. A later warrant discusses someone — who again could be Stone — searching on Guccifer the day that the site would go up, but before it was public.

During the course of its investigation, the FBI has identified a series of searches that appear to relate to the persona Guccifer 2.0, which predate the public unveiling of that persona. In particular, on or about June 15, 2016 (prior to the publication of the Guccifer 2.0 WordPress blog), records from Google show that searches were conducted for the terms “guccifer” and “guccifer june,” from an IP address within the range 107. 77 .216.0/24.

The same rebuttal may be made — that this was about Marcel Lazar and not Guccifer 2.0. But evidence submitted at the trial suggests that Stone started anticipating the June 2016 dump on June 13, not June 15, making the claim more credible.

That July 28 warrant also describes several accounts that look like the FBI suspect Stone of sophisticated operational security. These include:

  • A Gmail account created on July 28, 2016 (right in the thick of Stone’s effort to find out what WikiLeaks had coming next) and used until July 5, 2017
  • A Gmail account created on October 26, 2016 and used until August 8, 2017
  • A Gmail account created on June 27, 2016 and used in conjunction with Craigslist to communicate

The latter effort may suggest some serious OpSec, a way for Stone to communicate publicly without using his own comms.

Finally, there are matching Gmail and Facebook accounts the government obtained warrants for on August 28, 2018. These were old accounts with the Brazilian name Falo Memo Tio. It appears the government was interested in activity on this account from the last four days before the election. They obtained a gag for the Facebook warrant.

Seal warrants investigating an Agent of Foreign Power (August to September 2018)

The government tried to obtain proof that it was Stone doing those searches on Guccifer — as well as evidence about whom he may have met with in early August 2016 when he told Sam Nunberg he had dined with Assange — by obtaining his cell site location for June 14 through November 15 of that year.

Minutes after FBI Agent Andrew Mitchell (who had been the primary affiant on Stone warrants starting in May 2018) obtained that cell site warrant, FBI Agent Patrick Myers obtained a warrant for a mail.com account that Guccifer 2.0 had created on July 23, 2016 and used until October 18, 2016 (the account kept receiving traffic until February 2017). There are several remarkable things about this warrant. While FBI Agents in San Francisco obtained a warrant for it in August 2016, and someone — possibly Mueller’s team — obtained the headers from the account in September 2017, the government had never before obtained a full warrant on the account for the entire span of its activity. So Myers, seven weeks after Mueller released an indictment against the GRU, obtained that information in hopes it would provide more information about how the Guccifer persona had shared files.

The other FBI Agents investigating Stone, to the extent they described such things, were located in either Washington Field Office or FBI Headquarters in DC. Myers, however, was stationed in Pittsburgh, where the investigation into GRU had been moved (they were also working on an indictment for GRU’s hacking of WADA).

Myers’ involvement with Stone extended beyond this curious warrant for Guccifer 2.0’s account. Over the course of the next month, he obtained warrants for:

  1. Stone’s Liquid Web server storing old communications
  2. A Twitter account obtained for redacted reasons
  3. Multiple Twitter accounts obtained for redacted reasons
  4. Multiple Facebook and Instagram accounts obtained for redacted reasons
  5. Multiple Microsoft and Skype accounts obtained for redacted reasons
  6. Multiple Google accounts obtained for redacted reasons
  7. A Twitter account for someone, probably referred by Charles Ortel, whose name ends in R and who traveled back and forth from the UK who Stone suggested, in October 2016, was his intermediary
  8. Multiple Google accounts obtained for redacted reasons

All those warrants, as well as the Guccifer 2.0 account one, included a gag. One of those gag requests — for a warrant for some Twitter accounts — explains,

It does not appear that Stone is currently aware of the full nature and scope of the ongoing FBI investigation. Disclosure of this warrant to Stone could lead him to destroy evidence or notify others who may delete information relevant to the investigation.

Almost all of the warrants (not the R Apple one or the last Google one, though the R Apple one lists perjury) list FARA and 18 USC 951 (Agent of a Foreign Power) as crimes under investigation somewhere in the warrant, though often only in the gag request. To be clear, that doesn’t mean the FBI was investigating Stone as an Agent of a Foreign Power. The Guccifer 2.0 gag says FBI “is investigating WikiLeaks and others” for the listed crimes.

And those gags say the complexity of the investigation means it may extend more than a year from late September 2018. That is, in September 2018, the government took steps in an investigation they expected to last until around the time that Stone would eventually be tried, in November 2019.

Use the obstruction charges to seize Stone’s phones (January to February 2019)

The existence of those mystery warrants, none of which were provided to Stone in discovery and all but the R Apple one which appear to be ongoing, puts what happened in January 2019 in a very different light. At a time when Bill Barr promised to shut down the Mueller investigation as soon as he was confirmed yet while Mueller was still pursuing Andrew Miller’s testimony, the government obtained warrants to search Stone’s two homes, his office, and three devices seized in those searches (the affiants for those warrants had filed for earlier warrants in the investigation).

Unlike all the other warrants, those 2019 warrants listed only the obstruction, false statements, and witness tampering charges against Stone, largely tracking the indictment against him.

Those warrants emphasize the government’s interest in obtaining texts that might be accessed only via a forensic search of Stone’s phone, including texts sent via Apple, but also Signal, Wickr, and WhatsApp texts, as well as ProtonMail emails.

Which is to say, in the context of the warrants released this week, the prosecution of Roger Stone appears to be just one step in a far more serious investigation, one that may well be ongoing.


The warrants

August 7, 2017: Stone’s Twitter Accounts

This warrant only lists CFAA as the suspected crime, and doesn’t allege that Stone was the suspect in it. It also relies on Stone’s own public comments about DMing with Guccifer 2.0 rather than materials already obtained from the account, just the first of an insane number of instances where Stone’s comments to the press formed the basis for probable cause.

September 11, 2017: Stone’s Hotmail Account

When people DMed Stone, he’d refer them to this Hotmail account for further discussion. This affidavit incorporates DMs to Assange (including the June 10, 2017 one discussing a pardon) obtained with the August 7 warrant. It also describes investigating information to be used in the Republican primary. This warrant extended the timeframe of the Stone investigation back to January 1, 2015.

October 17, 2017: Stone’s Gmail

This warrant builds on emails between Corsi and Stone about getting the WikiLeaks releases — including Stone’s “get to Assange” one — to establish the probable cause to get Stone’s Gmail account. Because Corsi would sometimes discuss Podesta related business via both Stone’s Hotmail and Gmail accounts, Mueller’s team was able to get Stone’s Gmail account. This warrant makes it clear the investigation focused on Corsi and Stone’s evolving attacks against John Podesta (which I’ve covered in real time from early on) from the beginning. It also includes a detail about Malloch — that he made a reference in January 2017 about phishing Podesta — that almost certainly remains in the redacted sections pertaining to Malloch.

*November 6, 2017: WikiLeaks and Assange’s Twitter Accounts

This affidavit uses Assange’s DMs with Stone — including another one about a pardon and migration from the WikiLeaks to the Assange account– as well as his sharing of a password with Don Jr to get Mueller his own copy of the WikiLeaks and Assange Twitter accounts, which the government surely already had. The affidavit includes new details on initial communications between Guccifer 2.0 and WikiLeaks, some of which I laid out here. One detail that’s critical is WikiLeaks asked Guccifer 2.0 for Clinton Foundation documents from early on, meaning WikiLeaks and Trump’s people agreed about what they considered the best possible dirt.

*December 19, 2017: Ted Malloch’s Gmail

In addition to extra details about campaign communications (both between Stone and the campaign, and with Malloch and the campaign), this includes details of Turkish dirt Malloch was offering. It reveals that Stone got RNC credentials for Malloch (where, evidence suggests, Stone had meetings where upcoming releases may have been discussed). In addition, because Stone’s order to Corsi to reach out to Malloch is so important, this affidavit has previously unknown details about those days. The affidavit describes Malloch writing Stone on November 13, 2016 while with Jerome Corsi, a detail that may get redacted in subsequent affidavits.

This warrant included a gag on the provider.

This is the first application that introduces Stone, Corsi, and Malloch at the beginning of each affidavit, a practice that would generally continue (though some of these changes reflect different FBI agents writing the affidavit).

March 14, 2018: Two Apple Accounts used by Stone

In February, Steve Bannon was interviewed for two long days. He was asked questions and shared texts with Stone. This application uses some of what he testified about to justify getting Stone’s Apple accounts. Stone had his iCloud account set to full backup, but later warrants would make clear that he had deleted some of his texts from 2016 and 2017. Stone would later blame Sam Nunberg for revealing that he had claimed to have “dined” with Julian Assange while visiting Los Angeles in early August 2016, but this application began to incorporate that email into boilerplate application language (a footnote on what Nunberg told investigators about this is redacted in later warrants).

This application added wire fraud to Stone’s potential charges; it’s not at all clear why.

*March 27, 2018: Malloch’s person and his baggage

This warrant allowed the FBI to search Malloch as he landed in Logan airport. It incorporated details from Malloch’s Gmail obtained in December and was at least in part an effort to get to his UK-based email.

*May 4, 2018: Mystery Israeli Gmail

Over the course of the year, an Israeli exploited a seeming pre-existing relationship with Jerome Corsi to get close to Stone and through him to Trump. The person appeared to offer Stone dirt to save Trump (this story provides some background on potential players). Stone seems to have been reluctant to meet at multiple times, as when he said, in May 2016, “I am uncomfortable meeting without Jerry,” claimed, in June, “to have been poisoned,” in July, came down “with a nasty cold and too ill to travel,” followed later with, “I have pneumonia and may be hospitalized later today,” claimed, “Matters complicated” in August. When, in early November, they tried again, the Israeli deferred claiming, “HAVING a TIA. Early Stroke. … Blury Virson.” These exchanges never show up in later filings, so it’s quite likely Mueller determined they were nothing (or at least, that Stone and Corsi had done nothing wrong) after obtaining the emails. Alternately, a redaction in the affidavit may suggest the Israeli in question got referred and some kind of investigation is ongoing. This warrant included a gag on the provider.

*July 12, 2018: Jerome Corsi’s CSC Holdings, Windstream, and Apple accounts (second version)

This adds language about Russian hacking after the initial compromise (including the September hack of the AWS server). It includes 7 paragraphs of language from after the election that is redacted, possibly because it remains under investigation. This Stone filing describes four of those paragraphs as pertaining to Corsi taking credit for optimizing the Podesta release and Malloch introducing Corsi to Assange after the election (see this post). Some of the redactions (probably the Malloch introduction) repeats the “phishing Podesta” quip. This warrant included a gag on the provider. It limited the scope of the warrant to June 15 through November 10, 2016 and included only CFAA and conspiracy in the crimes being investigated.

July 27, 2018: Roger Stone’s OpSec emails

This warrant obtains the search histories for 3 Gmail accounts Roger Stone set up, possibly for OpSec purposes. They include:

  • Target Account 1 created on July 28, 2016 and used until July 5, 2017
  • Target Account 2 created on October 26, 2016 and used until August 8, 2017
  • Swash Buckler Account created on June 27, 2016 and used to communicate via Craigslist ads

Between May 17, 2016 and June 15, 2016, the affidavit suggests, Stone may have conducted Google searches for DCLeaks and Guccifer (which could be 1 or 2) prior to the publication of the Guccifer 2.0 blog. The FBI connected them to Stone via the IP addresses he used to access Twitter and Facebook, something they would continue to investigate. The affidavit also reveals that Stone deleted the search history for a different Google account between January 18 and July 23, 2016.

August 2, 2018: Roger Stone marketing Facebook accounts

This warrant gets three of Stone’s Facebook accounts, two of which include advertisements pertaining to WikiLeaks or Russia (the description of the third is redacted). Stone used this warrant when signaling to his co-conspirators what was in his warrants, so redacted details are available here. The biggest redaction for an ongoing investigation pertains to whether Corsi and Stone affected the release of the Podesta emails and Malloch offering to set Corsi up with Assange after the election.

August 3, 2018: Renewed warrants for Apple, Hotmail, and Gmail

Partly because the way Stone worked the press and aired the threats he had made against Randy Credico, it became clear he was tampering or comparing notes with witnesses (also including Jerome Corsi, Michael Caputo, and Andrew Miller, as well as one other witness that Stone hired a private investigator to investigate). That gave Mueller the excuse to get new warrants on Stone’s main email and text accounts to get those conversations. This request expanded the focus to include Credico and others (the names of the others are redacted but are likely those with whom Stone was trying to tamper). This warrant also adds obstruction and witness tampering to the crimes being investigated.

August 8: Warrants for a Gmail and Twitter account Stone used for social media campaigns (Twitter)

On May 18, 2018, Mueller’s team interviewed John Kakanis about work he did for Stone during the campaign. He described how Stone conducted social media campaigns — including materials relating to WikiLeaks and the Russian investigation — which both of these accounts played a role in.

August 20, 2018: Warrant for Stone’s cell site information from June 15 to November 15, 2016

Citing the searches probably made by Stone for Guccifer and dcleaks information before those accounts were made public, the government obtained cell site information for the period from the day that the Guccifer 2.0 account first started to a day the week after the election. The affidavit also explained wanting to know if Stone was with the Trump campaign at various times and where he was in Los Angeles when he told Sam Nunberg he had dined with Assange. Note, this affidavit suggests Stone did a Google search on “Guccifer” on June 15, 2016 before the site went up.

*August 20, 2018: Warrant for Guccifer 2.0’s second email account

The same day the government got a warrant to find out where Stone had been when during the election, they got a renewed warrant for one of the email accounts associated with the Guccifer 2.0 site. They had previously gotten everything from that email account in “approximately” August 2016, and then gotten headers for any emails sent in “approximately” September 2017. Getting the full content would give it additional details on any activity with the account between the original warrant — August 2016 — and the final login on October 18, 2016, as well as any email traffic subsequent to that. The stated purpose for obtaining this information was to “assist in identifying additional means by which Guccifer 2.0 shared stolen documents with WikiLeaks and others.” Patrick Myers, an FBI agent located in Pittsburgh (and therefore presumably someone more closely involved in the GRU investigation) obtained this warrant. This warrant included a gag on the provider. Parts of this warrant invoke 18 USC 951 — agent of a foreign power charges — in addition to the other crimes under investigation.

*August 28, 2018: Warrant for Stone’s Falo Memo Tio Facebook account

August 28, 2018: Warrant for Stone’s Falo Memo Gmail account

This incorporates details about Stone’s Facebook accounts used to push the hack-and-leak, found in the earlier August Facebook warrants. It seeks to obtain an old Stone Facebook account that got advertising traffic right before the election. These were Stone-specific warrants that was not turned over in discovery, suggesting it returned nothing pertaining to his prosecution. The Facebook warrant, but not the Gmail one, included a gag on the provider; it also was not included in the warrants provided to Stone in discovery.

August 28, 2018: Warrant for Stone’s [email protected] account

This email account–and the fact that he had been using it to tell his cover story about WikiLeaks–showed up in his Gmail account.

*September 24, 2018: Warrant for Stone’s Liquid Web server

This was a server Stone used to encrypt and back up his data in case the government seized his computers. It was not provided to Stone in discovery so may not have revealed any interesting information. This is the first of these affidavits written by Patrick Myers, an FBI agent located in Pittsburgh.

*September 26, 2018: Mystery Twitter Account

*September 27, 2018: Mystery Facebook and Instagram Accounts

*September 27, 2018: Mystery Microsoft include Skype

*September 27, 2018: Mystery Google

On September 26 and 27, Mueller’s team obtained a bunch of new warrants. All were obtained by Myers, the Pittsburgh FBI agent. All included gags on the provider. Most entirely redact the description of why the FBI needed the accounts, suggesting these investigations are ongoing. They also invoke 951 and FARA in the sealing request.

*September 27, 2018: Mystery Twitter Accounts 2

Like the other warrants obtained on September 27, the explanation for targeting these Twitter accounts is sealed. Like them, Myers obtained the warrant. Like those, it includes a request for sealing that lists 18 USC 951 — acting as an unregistered foreign agent — and FARA. Unlike the other warrants from that day, the justification for sealing this one explains that “It does not appear that Stone is fully aware of the full scope of the ongoing FBI investigation.”

*September 27, 2018: Mystery Apple ends in R

Then there’s another odd September 27 warrant application. Like the other warrants obtained on September 27, Myers wrote the affidavit for this one, and it included a gag. Unlike the others, however, the explanation for targeting this account is not entirely redacted. The affidavit explains that,

  • On August 17, 2016, someone (Charles Ortel?) introduced Stone and R
  • Between that introduction and November 3, 2016, Stone and R were in contact 60 times
  • On October 7, R and Stone spoke during the time between when WaPo alerted him to the Access Hollywood Video and the time it dropped
  • On October 10, R and Stone probably met for pizza on the Upper East Side
  • On October 12, Stone claimed that he had met his intermediary, who traveled back and forth to London, on October 10

The list of information targeted includes an additional name, probably that of Charles Ortel.

*October 5, 2018: Mystery Multiple Googles

Like the September 27 warrants, the explanation for targeting these accounts remains entirely redacted. Like them, the affidavit was written by Myers and sealed under a Kyle Freeny request. Unlike those, however, this one does not list 951 and FARA in the request to seal. This affidavit also does not include the contacts with “R” in the narrative about October 7, suggesting that lead may have fizzled.

January 24, 2019: Stone’s NY property

January 24, 2019: Stone’s FL property

January 24, 2019: Stone’s FL office

February 13, 2019: Three of Stone’s devices

The warrants for the searches in conjunction with Stone’s arrest on January 24 are fairly similar (one agent wrote the one in NY, another did the two in FL), except for the descriptions of the premises, facilitated by how much media Stone has done at these locations.

The affidavits themselves largely track the indictment, though showing where the government had sourced the evidence that ultimately got introduced at evidence at trial. The affidavits add people named in the indictment — Rick Gates, Steve Bannon, and Erik Prince (whose description is redacted) — premised on the import of proving that Stone had lied about telling these people about his purported link to WikiLeaks. As compared to the earlier warrants, these affidavits have a closer focus on the release (and reliance, exclusively, on the Crowdstrike and GRU indictment attribution, which is something Stone litigated and which I may return to).

These warrants make it clear that one of the things the government was doing was searching Stone’s homes for all his electronic devices in hopes of getting texts from 2016 to 2017 he deleted and his encrypted communications, which include:

  • WhatsApp, downloaded on October 5, 2016 to talk to Erik Prince
  • Signal and ProtonMail downloaded on August 18, 2016; Stone used Signal to talk to Margaret Kunstler
  • Wickr downloaded on August 5, 2017

Update: One detail I forgot to add about the 2019 search warrants: They explain that Stone responded to a grand jury subpoena in November 2018 asking for the texts he had with Credico, after he told the press — specifically, Chuck Ross, for a credulous story that spun Stone’s like — that his attorney had them. It’s one of the most hilarious ways that Stone’s blathering to the press hurt him.

Update: One more detail about the 2019 search warrants. The FBI was specifically looking for a “file booklet” recording a meeting Stone had with Trump at Trump Tower during the 2016 election.

60. On or about May 8, 2018, a law enforcement interview of [redacted] was conducted. [redacted] was an employee of Stone’s from approximately June 2016 through approximately December 2016 and resided in Stone’s previous New York apartment for a period of time. [redacted] provided information technology support for Stone but was not formally trained to do so. [redacted] was aware that Stone communicated with Trump during the 2016 presidential campaign, and afterward, both in person and by telephone. [redacted] provided information about a meeting at Trump Tower between Trump and Stone during the time [redacted] worked for him, to which Stone carried a “file booklet” with him. Stone told [redacted] the file booklet was important and no one should touch it. [redacted] also said Stone maintained the file booklet in his closet.

61. On or about December 3,2018, law enforcement conducted an interview of an individual (“Person 2”) who previously had a professional relationship with a reporter who provided Person 2 with information about Stone. The reporter relayed to Person 2 that in or around January and February 2016, Stone and Trump were in constant communication and that Stone kept contemporaneous notes of the conversations. Stone’s purpose in keeping notes was to later provide a “post mortem of what went wrong.”