Posts

John Durham’s Blind Man’s Bluff on DNS Visibility

/6 Comments/in , , /by

On September 16, 2021, John Durham indicted Michael Sussmann on a single count of lying to the FBI, just days before the statute of limitations for that crime expired. Durham accused Sussmann of lying to hide that he had a client or clients on whose behalf he was sharing allegations about DNS anomalies involving Trump Organization and Alfa Bank.

Durham adopts the “DNC fabrication” theory from agents who badly screwed up the original investigation

As I laid out here, the indictment adopted the “DNC fabrication” theory, the “fabrication” part of which was initially espoused in a hasty review by FBI Cyber agents Nate Batty and Scott Hellman by September 21, 2016, just two days after Sussmann shared a white paper describing anomalies involving Alfa Bank.

Durham adopted that theory in spite of proof, in their own summary, that the FBI agents had not closely reviewed the DNS logs included with the allegations, if they ever reviewed them at all. Durham adopted that theory in spite of irregularities in the chain of custody surrounding the handling of a Blue Thumb Drive that reportedly included DNS logs that were never reviewed. Durham adopted that theory in spite of the fact that Batty’s own Lync messages materially conflicted with a claim he made to Durham two years earlier: Batty claimed he had been refused information about the role of Sussmann in the allegations, when in fact his Lync messages showed he had been informed about Sussmann’s role from the start. Durham adopted that theory in spite of the fact that FBI started debunking parts of the “fabrication” story within hours of Batty and Hellman proposing it. Durham adopted that theory in spite of the fact that FBI’s own overt steps (during a pre-election period) and Alfa Bank’s curious lack of DNS logs made pursuing the allegations impossible.

That indictment was an insanely reckless thing for John Durham to do, building as it did on the investigative failures of Batty and Hellman, not to mention Batty’s own materially inconsistent claim.

Several things made that indictment even more reckless.

Durham fails to take basic investigative steps before indicting

First, in spite of the fact that Durham had already been investigating for 28 months by that point — Durham had already been investigating for six months longer than the entire Mueller investigation — there were a whole bunch of obvious investigative steps he had not yet taken. Between the indictment and the May 2022 trial, Durham would do the following:

Durham also revealed two other interviews he only conducted after charging Sussmann: one with someone identified as Listrak Employee-1 and other unidentified personnel on October 27, 2021 and another with the CEO and CTO of Cendyn on November 17, 2021. As described, their interviews pertained exclusively to email, not DNS, and Durham doesn’t appear to have asked Cendyn about the contacts via its Metron messaging product done for some other client with Alfa Bank in the same time period, nor about the contact that did exist between Cendyn and the affected Spectrum IP address. It also doesn’t mention that Listrak reported no emails to Alfa Bank, one of the Bank’s evolving explanations for the anomalies, and any mail to Spectrum was sent elsewhere.

In his report, Durham makes no mention of whether he interviewed anyone at Spectrum Health or Alfa Bank, though a DC judge would observe that it was almost like the Sussmann indictment and an Alfa Bank lawsuit, “were written by the same people in some way.” There were large gaps involved with both entities in the original investigation and it’s not clear Durham made any effort to close them.

Durham accused the FBI of skipping investigative steps on Crossfire Hurricane that might have discovered exculpatory evidence, but none of that comes close to the many investigative steps he had not yet pursued in the 28 months he had already been investigating before indicting Sussmann.

Durham’s indictment of Sussmann piled his own investigative failures on top of those by Batty and Hellman.

Durham discovers his DNC fabrication theory involves real data

More problematic than Durham’s investigative incompetence, though, the Special Counsel charged Michael Sussmann on September 16, 2021, in spite of the fact that a month earlier, by mid-August, 2021, Durham’s team learned that the data Rodney Joffe and others used to conduct their research was absolutely real. The nature of how this came about remains obscure, but in addition to debunking the most simplistic “DNC fabrication” theories, the discovery made it impossible for Durham to continue to rely on the expert his team had been using. The discovery that the data that Batty and Hellman had dismissed in just one day was real should have led Durham to reconsider everything about his case.

Instead, Durham barreled forward with his indictment.

Durham invites the guy who screwed up the investigation to be his expert

Instead of reassessing his case, Durham responded to losing his expert by proposing that Hellman serve as the replacement, even though by Hellman’s own admission he only knows the basics about DNS.

DeFilippis. How familiar or unfamiliar are you with what is known as DNS or Domain Name System data?

A. I know the basics about DNS.

[snip]

Berkowitz. And then, more recently, you met with Mr. DeFilippis and I think Johnny Algor, who is also at the table there, who’s an Assistant U.S. Attorney. Correct?

A. Yes.

Q. They wanted to talk to you about whether you might be able to act as an expert in this case about DNS data?

A. Correct.

Q. You said, while you had some superficial knowledge, you didn’t necessarily feel qualified to be an expert in this case, correct, on DNS data?

A. On DNS data, that’s correct.

Hellman was one of just two people, aside from John Durham himself, who had a stake in sustaining the “DNC fabrication” theory he had floated before closely reviewing the evidence. That Durham even considered making him his expert is a testament that Durham was interested in protecting his “DNC fabrication” theory, not interested in expertise, much less what the actual evidence said.

Durham includes two expert reviews unmoored from any prosecutorial decision

And that’s why Durham’s inclusion of two expert reviews of the allegations Sussmann shared with the government is of interest:

  • 1671 FBI Cyber Technical Operations Unit, Trump/Alfa/Spectrum/Yota Observations and Assessment (undated; unpaginated).
  • 1635 FBI Cyber Division Cyber Technical Analysis Unit, Technical Analysis Report (April 20, 2022) (hereinafter “FBI Technical Analysis Report”) (SCO _ 094755)

With one exception, Durham describes those reviews in a 13-page section of his report that purports to be about the ongoing efforts by Rodney Joffe and others to chase down the Alfa Bank anomalies and some unusual traffic probably reflecting the presence of Yota Phones in the US. The section itself has no place in a prosecutorial memo, because the only interaction with the government described in that section involved a Georgia Tech researcher refusing HPSCI’s request to help chase down these allegations. The rest involves Joffe continuing to chase this issue with his own data, which insofar as it demonstrates Joffe’s sustained concern about this, independent of any election, undermines pretty much all of Durham’s conspiracy theories. The declination decision regarding fraud — which Andrew DeFilippis used to claim that Joffe was still a subject of the investigation more than five years after the events in question, thereby keeping him off the stand in Sussmann’s trial — didn’t even mention Joffe.

But the description of these reviews in this section really doesn’t have a place where Durham put it, because along with the Cendyn and Listrak interviews, one of the reviews appears to have been last minute prep for the Sussmann trial and the other played a key role in an affirmatively misleading court filing that led Trump to make death threats against Sussmann.

These reviews in Durham’s report supported his last-ditch effort to cement the belief that Hillary framed Donald Trump. They’re here to prove, once and for all, that Sussmann was wrong.

Here’s how Durham introduces his efforts to redo the work Batty and Hellman and others botched so many years ago:

This subsection first describes what our investigation found with respect to the allegation that there was a covert communications channel between the Trump Organization and Alfa Bank. It includes the information we obtained from interviews of Listrak and Cendyn employees. It then turns to the allegation that there was an unusual Russian phone operating on the Trump Organization networks and in the Executive Office of the President. We tasked subject matter experts from the FBI’s Cyber Technical Analysis and Operations Section to evaluate both of these allegations.

But as with so much else in this report, they don’t do what they claim to. Durham ensured his experts sustained the blindness that Batty and Hellman willfully adopted so many years ago to avoid concluding that the allegations might be real.

As I noted here, the two reviews purport to review the Alfa Bank allegations — shared with both the FBI and (in updated form) the CIA — and the YotaPhone allegations shared with the CIA. In one place, Durham claims “the same FBI experts” did both reviews, though he attributes them to different groups. But that’s important because if they are the same experts, then they should know of both reviews.

Durham incites death threats because Joffe investigated Barack Obama

The YotaPhone review must have been done first because, as I noted above and show below, the analysis matches claims Durham made in a filing purporting to raise conflicts but mostly airing allegations for which the statute of limitations had just expired. Here’s how Durham describes the allegations in the report:

Specifically, Sussmann provided the CIA with an updated version of the Alfa Bank allegations and a new set of allegations that supposedly demonstrated that Trump or his associates were using, in the vicinity of the White House and other locations, one or more telephones from the Russian mobile telephone provider Yotaphone. The Office’s investigation revealed that these additional allegations relied, in part, on the DNS traffic data that Joffe and others had assembled pertaining to the Trump Tower, Trump’s New York City apartment building, the EOP,1558 and Spectrum Health. Sussmann provided data to the CIA that he said reflected suspicious DNS lookups by these entities of domains affiliated with Yotaphone.1559 Sussmann further stated that these lookups demonstrated that Trump or his associates were using a Yotaphone in the vicinity of the White House and other locations.1560

Durham’s description of these allegations relies on redacted sections of two trial exhibits (but not a related one that shows Sussmann was not hiding having a client). Because the section of these trial exhibits was redacted, it’s not clear whether Durham is representing how these CIA witnesses described Sussmann’s claims fairly. That’s important because — as we’ll see — Durham misrepresents the YotaPhone white paper.

As Durham described, Sussmann provided four documents and 6 data files to the CIA.

During the meeting, Sussmann provided two thumb drives and four paper documents that, according to Sussmann, supported the allegations. 1564

1564 The titles of the four documents were: (i) “Network Analysis of Yota-Related Resolution Events”; (ii) ·’YotaPhone CSV File Collected on December 11th, 2016″; (iii) “Summary of Trump Network Communications”; and (iv) “ONINT [sic] on Trump Network Communications.” The two thumb drives contained six Comma Separated Value (“.CSV”) files containing IP addresses, domain names and date/time stamps.

Unlike the Red and Blue Thumb Drive, Durham makes clear that his experts actually examined these thumb drives.

Here are three of the documents:

I understand the csv files include:

  • yota-eop
  • yota-cpwest
  • yota-spectrum
  • yota-trumporg
  • sipper
  • 2016-05-04_2017-01-15_Trump_server.csv

I’ll say more about them below.

Durham’s description of the analysis, titled, “Trump/Alfa/Spectrum/Yota Observations and Assessment,” generally obscures whether it is rebutting a claim (redacted in the trial exhibits) made by Sussmann (“the presentation”) or included in the white paper and data (“the above-quoted white papers about the Yotaphone allegations” and “Yotaphone-related materials”) provided, and he doesn’t repeat or address the Alfa Bank side of these observations (which have no tie to the YotaPhone claims).

But the technical analysis does not, at all, debunk the YotaPhone observations.

The FBI DNS experts with whom we worked also identified certain data and information that cast doubt upon several assertions, inferences, and allegations contained in (i) the above-quoted white papers about the Yotaphone allegations, and (ii) the presentation and Yotaphone-related materials that Sussmann provided to the CIA in 2017. In particular:

  • Data files obtained from Tech Company-2, a cyber-security research company, as part of the Office’s investigation reflect DNS queries run by Tech Company-2 personnel in 2016, 2017, or later reflect that Yotaphone lookups were far from rare in the United States, and were not unique to, or disproportionately prevalent on, Trump-related networks. Particularly, within the data produced by Tech Company-2, queries from the United States IP addresses accounted for approximately 46% of all yota.ru queries. Queries from Russia accounted for 20%, and queries from Trump-associated IP addresses accounted for less than 0.01 %.
  • Data files obtained from Tech Company-1, Tech Company-2, and University-1 reflect that Yotaphone-related lookups involving IP addresses assigned to the EOP began long before November or December 2016 and therefore seriously undermine the inference set forth in the white paper that such lookups likely reflected the presence of a Trump transition-team member who was using a Yotaphone in the EOP. In particular, this data reflects that approximately 371 such lookups involving Yotaphone domains and EOP IP addresses occurred prior to the 2016 election and, in at least one instance, as early as October 24, 2014. [bold and italics mine]

Compare that to the supposed debunking from the gratuitous conflicts filing that led to death threats.

The Indictment further details that on February 9, 2017, the defendant provided an updated set of allegations – including the Russian Bank-1 data and additional allegations relating to Trump – to a second agency of the U.S. government (“Agency-2”). The Government’s evidence at trial will establish that these additional allegations relied, in part, on the purported DNS traffic that Tech Executive-1 and others had assembled pertaining to Trump Tower, Donald Trump’s New York City apartment building, the EOP, and the aforementioned healthcare provider. In his meeting with Agency-2, the defendant provided data which he claimed reflected purportedly suspicious DNS lookups by these entities of internet protocol (“IP”) addresses affiliated with a Russian mobile phone provider (“Russian Phone Provider-1”). The defendant further claimed that these lookups demonstrated that Trump and/or his associates were using supposedly rare, Russian-made wireless phones in the vicinity of the White House and other locations. The Special Counsel’s Office has identified no support for these allegations. Indeed, more complete DNS data that the Special Counsel’s Office obtained from a company that assisted Tech Executive-1 in assembling these allegations reflects that such DNS lookups were far from rare in the United States. For example, the more complete data that Tech Executive-1 and his associates gathered – but did not provide to Agency-2 – reflected that between approximately 2014 and 2017, there were a total of more than 3 million lookups of Russian Phone-Provider-1 IP addresses that originated with U.S.-based IP addresses. Fewer than 1,000 of these lookups originated with IP addresses affiliated with Trump Tower. In addition, the more complete data assembled by Tech Executive-1 and his associates reflected that DNS lookups involving the EOP and Russian Phone Provider-1 began at least as early 2014 (i.e., during the Obama administration and years before Trump took office) – another fact which the allegations omitted. [bold mine]

The bolded narrative shows these are the same report. If 3 million is 46% of the total of around 6.521 million lookups globally, then 1,000 Trump-related queries would be .01% of the global total.

But it is an innumerate stat. I’m not the FBI, and definitely not a top FBI cyber expert. But even my humble little blog occasionally relies on William Ockham to explain things that should be bloody obvious to the Federal government, such as that 3 million DNS requests amount to one family’s worth of use.

Contra Durham, 3 million DNS requests for a related IP addresses over a four-year period means these requests are very rare.

For comparison purposes, my best estimate is that my family (7 users, 14 devices) generated roughly 2.9 million DNS requests just from checking our email during the same time frame. That’s not even counting DNS requests for normal web browsing.

If you’re going to make a federal case out of this, at least make some attempt to understand the topic.

Durham and his hand-picked experts in the FBI suggest that because, among the very rare number of global requests, almost half appear in the US, it means they aren’t rare. From that, Durham and his experts argue that the fact that Trump’s properties (and Spectrum and the Executive Office of the President) are part of this tiny club is not cause for concern.

They’re doing so even though among the domains included in the CSV tables is wimax-client-yota-ru, which shows up in Wordfence’s IOC lists for the GRU attack on the election. Durham and his FBI experts are arguing that it is not alarming that there would be several look-ups to such a domain in October 2016 from the Executive Office of the President, periodical look-ups to that domain from Trump Organization starting in August 2016, and persistent such look-ups from the suspect Spectrum IP address starting in November 2016.

And about those EOP look-ups. Durham claims, in the italicized language above, that there is an, “inference set forth in the white paper that such lookups likely reflected the presence of a Trump transition-team member who was using a Yotaphone in the EOP.” Sussmann may have said that. But it’s not in the white paper. In fact, there’s just one reference to the EOP in the white paper at all, and it’s not included in the speculative paragraph that there may be a tie between the Spectrum traffic and the Trump traffic.

Network traffic analysis strongly suggests communications between Russian networks and Trump Tower, associated Trump properties, with artifacts also present at EOP. Spectrum Health resolver IP 167.73.110.8 in Grand Rapids MI is also observed making similar queries.

The traffic data indicates: (a) There are Russian-made cellular devices on these networks, seldom seen elsewhere in the US; and (b) these networks appear to be at- tempting SIP-connections to Russian networks which very few IPs globally are seen trying to resolve.

It is possible that one or more devices is at times travelling between locations as there are sometimes gaps possibly correlated to newsworthy events such as New York NY to Grand Rapids MI, lifting of some sanctions on Russia, and the disappearance of the queries from New York in mid December and from Grand Rapids MI in mid January 2017.

In other words, as he did when he invented an allegation against Hillary that the Russians didn’t even make, he’s inventing an inference here, the kinds of inferences he tried to criminalize when Joffe did them. Further, he suggests that Sussmann and Joffe didn’t reveal that the lookups started before the election, even though the CSV data included shows lookups starting on October 2, 2016, which last I checked was before the election.

Durham, who admits in his report that these lookups inexplicably ended before Inauguration, nevertheless falsely insinuated in a court filing that Sussmann and Joffe had based their claims on lookups that post-date Trump’s inauguration. Durham is debunking Durham now! And that false claim from Durham led Trump to suggest that because Joffe found an IOC associated with the people who hacked the election within EOP, Sussmann should be put to death.

That’s one reason that it matters that this technical review is undated. Obviously, it’s crazy enough that an undated unpaginated report would show up in a report like this (I suspect it is intended to make the document hard to find).

But because it is undated and — it appears — Sussmann never got it, Durham doesn’t have to admit that he has included it in his report even after Sussmann pointed out that Durham’s inflammatory claims relied on getting the dates wrong himself.

For example, although the Special Counsel implies that in Mr. Sussmann’s February 9, 2017 meeting, he provided Agency-2 with EOP data from after Mr. Trump took office, the Special Counsel is well aware that the data provided to Agency-2 pertained only to the period of time before Mr. Trump took office, when Barack Obama was President.

After Sussmann and Joffe proved he was wrong, Durham dropped these claims. But then he resuscitated them for his report.

Durham blinds his expert so he can’t see any visibility

The second expert review Durham relied on, “FBI Cyber Division Cyber Technical Analysis Unit, Technical Analysis Report,” does have a date — April 20, 2022 — along with a Bates stamp showing that it was shared with Sussmann. The Cyber Technical Analysis Unit that wrote it is headed by David Martin, the guy who ultimately served as Durham’s expert witness at trial. After months of stalling, Durham first informed Sussmann that he would have an expert and Martin would be that expert on March 30, 2022, just weeks before trial.

Given that the Technical Analysis is dated three weeks after that, it seems exceedingly likely the Technical Analysis was a report done in preparation for Martin’s testimony.

As I noted in this post, this Technical Analysis focuses exclusively on the white paper Sussmann shared on September 19, 2016.

The citations to the Technical Analysis document in footnotes references just 13 pages of material, two pages of which is likely front matter, and one page describing the tasking Durham gave them.

Aside from the four pages of material that Durham doesn’t mention, there are really just two topics: addressing whether or not the Spectrum Health IP address was a Tor node, and using the answers obtained from Listrak (and possibly a broader set of logs than Alison Sands had available in 2016) to make an argument about the kind of visibility one needs to learn anything from DNS records.

These topics generally track Martin’s testimony as well (though Sussmann had opposed Martin’s comments on visibility, and given that it doesn’t appear in Martin’s Powerpoint from the trial, I’m not sure he was supposed to discuss it).

Now, Durham loves this technical analysis on Tor. He cited it first when he described how April Lorenzen was trying to figure out what the Spectrum IP address was in August 2016, and then quotes it again 30 pages later in his general technical discussion. The second time, he added an apostrophe-s which might be misread by the dim-witted people who are the audience of this propaganda to suggest that disproving that the Spectrum IP was a Tor node disproves the rest of the white paper, which it does not.

The FBI experts advised that historical TOR exit node data conclusively disproves this white paper allegation in its entirety and furthermore the construction of the TOR network makes the described arrangement impossible.

[snip]

The FBI experts who examined this issue for us stated that historical TOR exit node data conclusively disproves this white paper’s allegation in its entirety.

It’s really weird that Durham loves this analysis, because it would suggest that he didn’t learn that the Spectrum Health IP was not a Tor node until just weeks before trial — though that same judgement, that it was not a Tor node, is one of the main things the FBI got right when they first investigated this in 2016. There is almost nothing cited from this report that newbie counterintelligence agent Alison Sands hadn’t already laid out by October 5, 2016.

Durham’s fondness for this Tor node analysis is all the more hilarious because Durham tasked this expert review after the review of the files Sussmann shared with the CIA in February 2017. And neither of the files about the Alfa Bank anomaly that Sussmann turned over in 2017 (one, two) mention the Tor node. Researchers actually realized this was not a Tor node around the same time Sussmann originally shared the files. It was long gone, Durham knew it, yet that’s still the primary thing he relies on to claim he has debunked the allegations.

So Durham’s primary debunking of the white paper doesn’t address, at all, what was in the later documents. In fact, that was one effect of tasking the Cyber Technical Analysis Unit with reviewing just the stuff on the Red Thumb Drive: it gave some of FBI’s top experts a really easy way to debunk (part of) the white paper, albeit the only part that was entirely debunked in 2016.

It’s like congratulating yourself because the FBI’s top cyber experts managed to play tiddlywinks as well as a newbie counterintelligence agent did six years earlier during a rush investigation.

The second area of this technical review Durham cites that is still more telling. It purports to rely on information learned in Listrak email (not DNS) records to (effectively)  accuse Joffe and the others of cherrypicking the data.

In addition to investigating the actual ownership and control of the IP address, the Office tasked FBI cyber experts with analyzing the technical claims made in the white paper. 1650 This endeavor included their examination of the list of email addresses and send times for all emails sent from the Listrak email server from May through September 2016, which is the time period the white paper purportedly examined. 1651 The FBI experts also conducted a review of the historical TOR exit node data. 1652

The technical analysis done by the FBI experts revealed that the data provided by Sussmann to the FBI and used to support Joffe and the cyber researchers’ claim that a ‘”very unusual distribution of source IP addresses” was making queries for mail l.trump-email.com was incomplete. 1653 Specifically, the FBI experts determined that there had been a substantial amount of email traffic from the IP address that resulted in a significantly larger volume of DNS queries for the mail 1.trump-email.com domain than what Joffe, University-1 Researcher-2 and the cyber researchers reported in the white paper or included on the thumb drives accompanying it. 1654 The FBI experts reviewed all of the outbound email transmissions, including address and send time for all emails sent from the Listrak server from May through September 2016, and determined that there had been a total of 134,142 email messages sent between May and August 2016, with the majority sent on May 24 and June 23. 1655 The recipients included a wide range of commercial email services, including Google and Yahoo, as well as corporate email accounts for multiple corporations. 1656

Similarly, the FBI experts told us that the collection of passive DNS data used to support the claims made in the white paper was also significantly incomplete. 1657 They explained that, given the documented email transmissions from IP address 66.216.133.29 during the covered period, the representative sampling of passive DNS would have necessarily included a much larger volume and distribution of queries from source IP addresses across the internet. In light of this fact, they stated that the passive DNS data that Joffe and his cyber researchers compiled and that Sussmann passed onto the FBI was significantly incomplete, as it included no A-record (hostname to IP address) resolutions corresponding to the outgoing messages from the IP address. 1658 Without further information from those who compiled the white paper data, 1659 the FBI experts stated that it is impossible to determine whether the absence of additional A record resolutions is due to the visibility afforded by the passive DNS operator, the result of the specific queries that the compiling analyst used to query the dataset, or intentional filtering applied by the analyst after retrieval. 1660

1653 Our experts noted that the assertion of the white paper is not only that Alfa Bank and Spectrum Health servers had resolved, or looked up, the domain [mail-1.trump-email.com] during a period from May through September of 2016, but that their resolutions accounted for the vast majority of lookups for this domain. FBI Technical Analysis Report at 6.

1654 The USB drive that Sussman [sic] provided to the FBI on September 19, 2016, which was proffered as data supporting the claims in the white paper, contained 851 records of DNS resolutions for domains ending in trump-email.com. FBI Technical Analysis Report at 7.

I’ll leave it to William Ockham — who apparently is smarter than the entire FBI — to explain that by looking for emails sent out from an IP rather than DNS for a domain, the FBI was basically searching for all packages from one post office rather than stamps from one house that uses that post office (I’m still working on this analogy, but it’s a start). Plus, at least in real time, the newbie counterintelligence agent who figured out the Tor node information Durham claims to have only learned six years later, Alison Sands, kept complaining that Listrak didn’t provide the network logs they needed.

But as I pointed out here, not only does the FBI change its mind mid-sentence whether there was one thumb drive or two — a problem that has plagued FBI’s Cyber division for six years, apparently –but FBI doesn’t even claim to be looking at all the data that was submitted at trial. FBI’s experts only reviewed the exact same file that Scott Hellman emphasized was a portion of the data submitted; they didn’t review the larger set. They complain they only have 851 lines of data because they’re not reviewing the larger file, much less any csv records turned over on the Blue Thumb Drive, not because the logs didn’t exist.

Remember: these are supposed to be the same people who already reviewed the CIA material by February. And the equivalent of the white paper in those materials has a passage that addresses precisely the visibility of which FBI claims to be ignorant. And the Trump/Alfa csvs included on one of those thumb drives — 2016-05-04_2017-01-15_Trump_server — not only includes almost 25,000 lines of data, but it also shows the collection points. The FBI had a way, in hand, to get that visibility, but Durham told them to look away.

The only thing the FBI’s top experts offer to debunk, other than the Tor node claim that the FBI knew the researchers had dropped, was a complaint about visibility. But their complaints about visibility were entirely manufactured by the scope of the review Durham requested and possibly by the curious status of the Blue Thumb Drive, as well as (if Durham is telling the truth about these being the same experts) willful forgetting of a review they had done on related issues less than a year earlier.

Durham created this blindness. By ensuring all the experts remain blind to visibility, Durham ensured the review would conclude that the researchers didn’t have the visibility that, the FBI knew well, they had.

As I have described, way back in October 2016 — just days after Batty and Hellman did — I too thought that this was a set-up.

But I said that because (as I also noted) no one had seen the evidence. The FBI had the opportunity to look, but instead has spent the last six years deliberately blinding themselves so they can continue to claim it was a set-up.

Alfa Bank and Yotaphone Allegations

1.Factual background

a. Introduction

b. Sussmann’s attorney-client relationship with the Clinton campaign and Joffe

c. The Alfa Bank allegations

i. Actions by Sussmann, Perkins Coie, and Joffe to promote the allegation

ii. Actions by April Lorenzen and others and additional actions by Joffe

iii. Sussmann’s meeting with the FBI

d. The FBI’s Alfa Bank investigation

i. The Cyber Division’s review of the Alfa Bank allegations

ii. The opening of the FBI’s investigation

e. Actions by Fusion GPS to promote the Alfa Bank allegations

f. Actions by the Clinton campaign to promote the Alfa Bank allegations

g. Sussmann’s meeting with the CIA

h. Sussmann’s Congressional testimony

i. Perkins Coie’s statements to the media

j. Providing the Alfa Bank and Yotaphone allegations to Congress

k. Joffe’s company’s connections to the DNC and the Clinton campaign

l. Other post-election efforts to continue researching and disseminating the Alfa Bank and Yotaphone allegations

i. Continued efforts through Joffe-affiliated companies

ii. Efforts by Dan Jones and others

iii. Meetings by DARPA and Georgia Tech

iv. The relevant Trump Organization email domains and Yotaphone data

2. Prosecution decisions

The Dishonest and Incompetent FBI Work John Durham Learned to Love

/23 Comments/in , , /by

In the Durham Report’s telling of the FBI investigation into the Alfa Bank anomalies, it describes that the two cyber agents who conducted the first technical review of the allegations, Scott Hellman (Cyber Agent-1) and Nate Batty (Cyber Agent-2, the guy who appears to have misplaced the Blue Thumb Drive with all the data), congratulated themselves on the fact that they had both come to the same conclusion in spite of “their own very different political views.”

Cyber Agent-1 testified that both he and Cyber Agent-2 did not agree with the conclusion in the white paper and assessed that (i) the authors of the white paper ‘jumped to some conclusions that were not supported by the technical data,” (ii) the methodology was questionable, and (iii) the conclusions drawn did not “ring true at all.” 1479 In interviews with the Office, both Cyber Agent-1 and Cyber Agent-2 said that they were proud of their work because they had both come to the same conclusion despite their own very different political views. [my emphasis]

The interviews at which these men told this story are not cited (elsewhere in this passage, Durham relies on Hellman’s trial testimony rather than any of his interviews for the report, though according to trial testimony, he interviewed with Durham six times).

It’s an odd measure of investigative rigor, particularly in a report complaining that other FBI agents let bias infect their work.

It’s also a good place to start to describe the multiple layers of deceit in which Durham engages to avoid admitting that Batty and Hellman steered him wrong.

  • Durham adopted his “fabrication” theory from Hellman and Batty
  • The “fabrication” theory came with an understanding the DNC was involved
  • Hellman and Batty made materially contradictory comments about politics
  • Durham covered up Cyber’s clear errors
  • Durham’s made post-indictment efforts to sustain his false claims (this will be a follow-up because this got too long)

Durham adopted his “fabrication” theory from Hellman and Batty

As noted, Durham cites Hellman’s trial testimony, rather than those interviews he doesn’t cite, for his description of what Hellman and Batty concluded. At trial, immediately after the exchange cited, Durham lead prosecutor Andrew DeFilippis had Hellman walk through the written summary the two cyber guys wrote.

DeFilippis used that document to improperly cue Hellman, who was not qualified as an expert — someone who had, minutes earlier, admitted he knew only the basics of DNS — to express his opinion about the white paper, which I laid out here. Coming as it did after weeks of wrangling over Durham’s belated attempt to spring a different expert on Sussmann, the stunt unsurprisingly drew an objection.

But DeFilippis wasn’t working with the full summary. A redaction in the Hellman-Batty summary DeFilippis introduced as part of this exchange hid part of Hellman and Batty’s immediate response to the white paper. But a different version of the same document (introduced by the defense), reveals more about their initial conclusion to the anomalies: The otherwise redacted information reveals that Hellman and Batty floated the possibility that the researchers had fabricated the data by spoofing it themselves.

In conclusion, ECOU 1 suggests there is currently no cyber intrusion component in this case and that the report provided contains questionable methods and intentions. Based on the information provided, it also remains a possibility that the report was fabricated. If the domain maill.trump-email.com were discovered by researchers, a computer at Alfa Bank could be configured to conduct multiple DNS inquiries to create the appearance that a Russian bank is communicating exclusively with the domain maill.trump-email.com. Furthermore, it appears suspicious that the presumed suspicious activity began approximately three weeks prior to the stated start of the investigation conducted by the researcher. [emphasis, which marks otherwise redacted language, my own]

Hellman didn’t just share this opinion in the summary, which was sent out to others no later than September 21 at 4;46PMET (some of these time zones are in CDT, so an hour behind). It was the primary conclusion they shared with the Chicago-based agents conducting the actual investigation. As Curtis Heide’s Lync notes show (these are probably UTC, so morning ET), 8 minutes after Heide made a second request for the thumb drives, Batty and Hellman asked Heide to get on the phone. They spoke for five minutes, after which Heide texted Pientka to tell him that “we’re leaning towards this being a fake server not attributed to the trump organization.”

While Hellman was on the phone with Heide, Batty was texting Heide’s boss, Dan Wierzbicki, that, “we think it’s a setup. it smells like a setup.” Minutes after these two exchanges another Cyber guy shared with Joe Pientka Phil Todd’s opinion, described below, that this was a DNC set-up timed for the debate.

In other words, the premature Hellman and Batty opinion that this was a set-up tainted everything that followed in the investigation. And they shared it before anyone else looked at the evidence.

Notably, this opinion led the FBI to take overt acts during a pre-election period that prevented the FBI from conducting a robust investigation afterwards. At 4:22PM ET that same day, Alison Sands wrote from Chicago to New York explaining that this probably wasn’t actually a Trump domain. At 4:53PM ET, Sands wrote back to correct that: Miami FBI agents had taken overt investigative steps during an election season (though they used a ruse as to why they were asking), and learned that it was a legitimate email server. At 1:53PM the next day, Sands wrote back to note that Cendyn had responded to FBI’s overt investigative steps by updating their DNS tables, tainting the investigation and public reporting on it irreparably.

More importantly, the opinion Hellman and Batty formed — that this was a setup — influenced more than the initial investigation. It’s the entire organizing logic of the September 16, 2021 indictment against Michael Sussmann. Durham accused Sussmann of packaging all this up in a “narrative” fed by “purported” data provided by April Lorenzen, whom he called “Originator-1,” and then sharing it with the FBI. That’s why Durham needed it to be the case that Sussmann intentionally hid a tie to the DNC.

And because Durham adopted that hasty Hellman and Batty theory as his own, to the extent that Hellman and Batty made grave errors, Durham had to (and has to) cover those errors up.

The “fabrication” theory came with an understanding the DNC was involved

And that means covering up how politics — or at least a suspicion about politics — played a part.

Durham treated Batty and Hellman’s initial conclusions as reliable, he said, because, “they had both come to the same conclusion despite their own very different political views.”

That’s remarkable because Durham includes something in his report that he chose not to introduce at trial under oath: that Nate Batty told him in 2019 that he and Hellman had considered filing a whistleblower complaint against Jim Baker because FBI’s General Counsel refused to tell them where the tip came from.

Cyber Agent-2 told the Office that he and Cyber Agent-1 considered filing a whistleblower claim about Baker’s failure to provide the information but ultimately decided that they would not because the data provided was not formal evidence in a criminal proceeding. 1492

1492 OSC Report of Interview of Cyber Agent-2 on Sept. 16, 2019 at 2.

This is likely where the whole idea of charging someone for lying to the FBI about this evidence came from.

What Durham didn’t say in his report — but what the public record strongly suggests — is that one or both of these guys were affirmatively dishonest with him about how significantly politics played into this investigation. Three pieces of evidence submitted at trial show that Batty understood this tip to have come from the DNC and one of his colleagues treated it as a set-up by the DNC.

First, there’s the Lync text showing Batty was informed that Sussmann was in the evidentiary chain even before he picked up the thumb drives on September 20 (remember, these are probably UTC).

As this post makes clear, Batty learned that Sussmann was in the chain of custody before he picked up the thumb drives from Baker. He didn’t need Baker to tell him where they came from. He already knew.

Less than a day after being told Sussmann was in the evidentiary chain, Batty wrote Hellman, saying they had been asked to write “a brief summary of what we think about the DNC report,” and then conceded maybe they should look at the actual DNS logs before writing such a summary.

Then, the next morning at 8:09AM, one of the Cyber supervisors, Phil Todd, wrote an email claiming that “the DNC person” who dropped the thumb drives off planned to release the Trump – Alfa Bank tie prior to the Presidential debate that would be on October 4.

The DNC person that provided these thumb drives stated to Baker that he/she was going to release the information concerning the Trump server, and direct contact with the Russians through Alpha Bank in Moscow, to the press on Friday, 9/23/16, prior to the upcoming Trump / Clinton debate this weekend.

Sussmann obviously didn’t tell Baker his outreach to the press was timed for the debate. It’s something the Cyber guys made up and put into writing. But it shows that people in the Cyber division didn’t just make conclusions before investigating, but did so through that political lens, precisely the political lens Durham claimed that Sussmann thwarted by allegedly lying to Jim Baker.

And while there’s no evidence Batty shared the assumed tie between the tip and the DNC with the agents in Chicago, it’s important background to the way Hellman and Batty reached out to Heide and his boss to explain, in a way that would leave no written record, why they believed this was not a real server, an opinion that Heide would cite as one of four reasons he dismissed the allegations. Batty shared that opinion before sharing the substantive materials in the white paper with the Chicago agents.

These records should have led any sane prosecutor to conclude he had no case against Sussmann. These, along with at least two more exhibits (Bill Priestap’s notes and Ryan Gaynor’s briefing notes), show that numerous people in the FBI, including one of the guys who conducted the initial technical review of the anomalies, believed the white paper had a DNC tie. And at least some people at the FBI had concluded, absent evidence, that it was a political hit job.

How could Sussmann’s alleged lie be material if the initial conclusions about the anomaly presumed Sussmann was bringing the white paper for the DNC?

Hellman and Batty made materially contradictory comments about politics

As noted, Batty’s claim, made in a 2019 interview with Durham, seems to conflict with the record showing that he was informed of Sussmann’s involvement before he first obtained the thumb drives.

All the evidence that people in Cyber knew of and considered the role of the DNC in this tip — plus the way Durham measured Batty and Hellman’s reliability based on their partisanship — makes Hellman’s testimony at trial suspect, too. Hellman claimed, under oath, that he and Batty didn’t talk about whether these allegations had political origins in advance.

Q. And you and Special Agent Batty at least talked about whether this had political origins, didn’t you?

A. At that point I think the only thing that came up was just questioning the motive of somebody providing — like, who provided this report? I don’t recall any discussion about political motivations.

Q. Who would it have helped if the allegations were true?

A. It would have helped the opposing — it would have helped the democratic party.

Q. And that didn’t occur to you at all that that motivation might have been involved?

A. No.

This is one of several reasons I find it so curious that Durham didn’t cite the actual interviews in which Hellman and Batty talked about how they responded to the white paper by invoking politics: If Sussmann’s attorneys had received 302s reflecting they had, as Brady or even Jencks in Hellman’s case, you’d think they would have followed up on Hellman’s claim that politics didn’t come up by noting that he and Batty had both told Durham differently.

Hellman also claimed, under oath, that he never saw that text mentioning the DNC screencapped above, to which he responded by writing up a report, until 2020.

Q. All right. And then, with respect to Stranahan, he asks you and Nate to write a report about the — write a summary of the DNC report. Correct? That’s what it says?

A. That’s what it says in this chat, yes.

Q. And did you understand, sir, that the information had come from a DNC, meaning Democratic National Committee, source?

A. I did not understand that, no.

Q. Did you know what Nate Batty knew about it?

A. I don’t think he knew anything about it.

Q. Did you call up Tim and say, what a second. This is a DNC report? That’s political motivation.

A. No.

Q. Didn’t do anything or it didn’t occur to you?

A. The first time I saw this was two years ago when I was being interviewed by Mr. DeFilippis, and I don’t recall ever seeing it. I never had any recollection of this information coming from the DNC. I don’t remember DNC being a part of anything that we read or discussed.

Q. Okay. When you say, the first time you saw it was two years ago when you met with Mr. DeFilippis, that’s not accurate. Right? You saw it on September 21st, 2016. Correct?

A. It’s in there. I don’t have any memory of seeing it.

Later Berkowitz returned to the text. He asked Hellman how it could be that Batty could refer to the white paper from a lawyer who represented the DNC, in a text to Hellman, as the DNC report, without Hellman becoming aware that someone — his superior — was calling it a DNC report.

Q. And although you were surprised to see it today, it appears that at least somebody, such as Mr. Batty was aware and you were aware that somebody was calling this white paper a DNC report. Correct?

A. I was not aware that anybody was calling it a DNC report, and I don’t believe Mr. Batty knew that either.

Q. But you saw the link message. Right?

A. I did see the link message, yes.

Then Berkowitz asked Hellman how it could be that he would see a reference to a DNC report and not take from that it was a DNC report. Hellman responded by describing “the only explanation that … was discussed” — was that it was a typo.

Q. What’s your explanation for it?

A. I have no recollection of seeing that link message. And there is — have absolutely no belief that either me or Agent Batty knew where that data was coming from, let alone that it was coming from DNC. The only explanation that popped or was discussed was that it could have been a typo and somebody was trying to refer to DNS instead of DNC.

Q. So you think it was a typo?

A. I don’t know.

Q. When you said the only one suggesting it — isn’t it true that it was Mr. DeFilippis that suggested to you that it might have been a typo recently?

A. That’s correct.

Q. Okay. You didn’t think that at the time. Right?

A. I did not. I had never seen it or had any memory of seeing it ever before it was put in front of me.

That is, Hellman responded by explaining that Durham’s lead prosecutor Andrew DeFilippis, rather than asking whether the Lync text refreshed Hellman’s memory that he had been already been told this was a DNC report when he conducted the analysis, rather than recognizing that the evidence actually undermined his entire case, instead scripted an alternate explanation.

Just a typo.

And then Hellman repeated that script on the stand.

Under oath.

There are no declination decisions in Durham’s Report assessing how Hellman and Batty’s statements — in the 2019 interview and under oath on the stand — can be squared with the public record. Of course there aren’t declinations! When faced with documentary evidence that his disclaimer about awareness of a DNC role was suspect, Hellman simply parroted Durham’s own team.

But the fact that Durham didn’t even consider whether there was more evidence that Batty and Hellman lied to him than that Sussmann did is a testament to the fact that any misstatements they made would upend his entire project.

At trial, when Durham was desperate to claim that the five different exhibits that showed the FBI knew this report came from a DNC lawyer didn’t mean that the FBI had treated this as a DNC report, his star witness Scott Hellman said there was no discussion of politics when he and his boss assessed this report.

But in his report itself, Durham’s proof that their analysis was sound was that both FBI agents had told him (in interviews that he doesn’t cite) that they approached the report through a lens of politics.

Durham covered up Cyber’s clear errors

The fact that a supervisor in the Cyber Division concluded that this was a Democratic hit job timed to the debate makes Durham’s silence about Batty and Hellman’s clear errors all the more problematic.

I wrote them up in this post describing Hellman’s advice to newbie agent Alison Sands that, “any chance you get to work something like this that truly has 0 repercussions if you mess it up ….take those opportunities.”

The two most problematic clear errors bookend the otherwise redacted claim that they suspected this was a set up.

As that Lync text itself above makes clear: Hellman and Batty had already made conclusions about the white paper before he opened the thumb drive with the data that — Hellman later testified — is what made the two of them more qualified to assess this report than the counterintelligence agents who would later conduct the investigation. After having made a conclusion prior to reviewing the logs, Hellman and Batty claimed that the anomaly had only been going on for three weeks before the researchers started looking at it. That was probably a misreading of one of two histographs in the white paper. But it would have easily been debunked had they reviewed just the DNS logs provided, much less the data provided on the misplaced Blue Thumb Drive itself. There’s no way you make that error after having reviewed the DNS logs. Yet they did make that error, an error Durham never mentions in his report.

And Durham knows this claim is wrong, because the expert report he cites in his own report — which examined the smaller set of two logs included on the Red Thumb Drive — notes that the researchers included logs dating from May to September.

Durham repeats in his report, without correction, an even more serious error. Durham states, truthfully, that Batty and Hellman — two of the only FBI agents who investigated anything having to do with Russia in 2016 who haven’t subsequently been disciplined for their fuck-ups — claimed that there was no allegation of hacking in the white paper.

The report’s summary stated that they had “assess[ed] there is no CyD [Cyber Division] equity in this report and that the research conducted in the report reveals some questionable investigative steps taken and conclusions drawn.” 1477 The report acknowledged that there was no allegation of hacking and so there was no reason for the Cyber Division to investigate further.

But Durham doesn’t reveal that this claim — there was no allegation of hacking in the report — was false. Rather, he adopts it as his own.

As a footnote in the white paper Sussmann shared described, one reason the researchers offered that Spectrum might not have known it had this weird occurrence on its network (which the researchers incorrectly concluded was a Tor node) was because they had been hacked.

We discovered that Spectrum Health victim of a network intrusion. Therefore, Spectrum Health may not know what has a TOR exit node on is network. Alternatively. the De Vos family may have people at Spectrum who know here is a TOR node, i.e., TOR node could have been placed there with inside help.

“Network intrusion.” That’s a hack.

Outside researchers informed the FBI of an anomaly involving an IP address known to have been hacked. And yet the cyber guys concluded not just that this white paper was shit, but also that there was no Cyber Division equity — a hack — in it, and did so in just over a day.

The researchers were wrong about Tor, but they were right about the hack. When the FBI checked the Spectrum IP in question, they found that it had been compromised.

One reason this error is so problematic — aside from it discredits everything else Hellman and Batty did — is because it came as supervisors in the Cyber Division were trying to spin off this investigation because they had concluded, with no evidence, that it was a pre-debate set-up. Hellman and Batty concluded there was no hack not because of the evidence, but because they didn’t want to do this case.

John Durham congratulates these men because a Democrat and a Republican agreed about this white paper. But he doesn’t reveal that, in addition to getting several other key technical details wrong, they failed at their one job, to determine whether there was a hack involved. So instead of revealing that they failed in their one job in his report, Durham instead repeats their false claim, “The report acknowledged that there was no allegation of hacking,” and boasts because a Democrat and Republican ended up being badly, embarrassingly wrong together.

Now, as I noted, Durham covers up some of the other problems with this investigation.

The two most important are that the FBI violated the rule prohibiting overt investigative steps during the pre-election period, and perhaps partly because of that (as well as FBI’s failure to act immediately after Sussmann provided Eric Lichtblau’s name on September 22), by the time the FBI spoke to Alfa Bank, the potential suspect in this crime drama — the potential suspect which reached out to FBI rather than vice versa — Alfa had no log files left to review.

That’s the other big error the investigative team made, which Durham also covers up. The FBI didn’t understand that Mandiant’s judgement was useless until a March 2017 interview with Mandiant. Curtis Heide described at trial that he never — never!! — actually learned that the reassurances Alfa Bank had offered were based on a claim that a bank had no log files to review.

Q. And were you aware, while you were doing the investigation, that Mandiant, when it went to talk to AlfaBank to look into these allegations, did not have any historical data, that Alfa-Bank did not provide any historical data to Mandiant? Did you know that?

A. No

Here’s how Durham covered up that embarrassing failure in his report:

Mandiant provided the FBI with its findings, which too concluded that there was no evidence to support the allegations of a secret communications channel nor any evidence of direct communications between the Alfa Bank servers and Trump Organization servers.

In his report, Durham cites only an October 2016 302, not the March 2017 one where the FBI first learned how useless the Mandiant review would have been. Again, he makes absolutely no mention that a potential suspect in this story reached out to the FBI told the FBI that a potential crime scene had been wiped of digital fingerprints and did nothing.

Durham complains about other problems with the part of the investigation conducted by the counterintelligence agents — they made an error in their opening memo, for example.

But rather than bitching and moaning about the outright errors the FBI cyber agents committed during the investigation, like he did for every other FBI agent in his report (including the counterintelligence agents on the Alfa Bank investigation), Durham simply … covered those errors up. Repeated their false claims. Perpetuated the foundational error in the Alfa Bank anomaly investigation.

Durham couldn’t treat Hellman and Batty with the same ruthless contempt as he did all the other FBI agents he interviewed. That’s because the materially inconsistent claims and outright errors they made were all foundational to Durham’s project. Durham can’t admit that Hellman and Batty were among the most suspect and incompetent of every FBI agent involved. That’s because Durham built his entire case on the conclusion they drew before they even opened the thumb drives.

And that’s important for another reason: because of the investigative steps Durham took on DNS-related issues after he indicted Sussmann on September 16, 2021, and what they say about Durham’s efforts to manufacture claims to discredit the anomalies.

FBI Cyber Division’s Enduring Blue Pill Mystery

/23 Comments/in , , /by

I’m writing a post on the technical analysis John Durham included in his report purporting to debunk the white papers submitted via Michael Sussmann to, first, the FBI and, then, the CIA. But first I’m going to do something even more tedious: Try to track down FBI’s persistent blue pill problem — or rather, the FBI’s apparent failure to ever analyze one of two thumb drives Sussmann shared with Jim Baker in September 2016, the Blue one.

Last year, before Sussmann’s trial, Durham had FBI’s top technical people review what he claimed were the data Sussmann had shared. He cited those reports in his own report, claiming they debunk the white papers.

Here’s how they are described in footnotes.

  • 1635 FBI Cyber Division Cyber Technical Analysis Unit, Technical Analysis Report (April 20, 2022) (hereinafter “FBI Technical Analysis Report”) (SCO _ 094755)
  • 1671 FBI Cyber Technical Operations Unit, Trump/Alfa/Spectrum/Yota Observations and Assessment (undated; unpaginated).

Not only doesn’t the YotaPhone report have a date, but it doesn’t have a Bates stamp reflecting that it was shared with Sussmann. I’ll get into why that is interesting in my follow-up post.

Below is a summary of the materials Sussmann provided to both agencies. By description, the Technical Analysis Report only reviews the white paper and the smaller of two sets of text DNS logs included on the Red Thumb Drive. By description the Trump/Alfa/Spectrum/Yota Observations only review the Yota White Paper.

The data FBI’s technical people reviewed appear to be restricted to what is marked in blue.

They did review the actual thumb drives turned over to the CIA, because they found hidden data on one; there’s no indication they reviewed the thumb drives provided to the FBI.

In fact, it’s impossible that they reviewed the data included on the second thumb drive Sussmann shared, the Blue one.

That’s because the FBI analysis claims Sussmann only provided 851 resolutions, which is the 19-page collection of text files included on the Red Thumb Drive, not even the larger set.

Similarly, the FBI experts told us that the collection of passive DNS data used to support the claims made in the white paper was also significantly incomplete. 1657 They explained that, given the documented email transmissions from IP address 66.216.133.29 during the covered period, the representative sampling of passive DNS would have necessarily included a much larger volume and distribution of queries from source IP addresses across the internet. In light of this fact, they stated that the passive DNS data that Joffe and his cyber researchers compiled and that Sussmann passed onto the FBI was significantly incomplete, as it included no A-record (hostname to IP address) resolutions corresponding to the outgoing messages from the IP address. 1658 Without further information from those who compiled the white paper data, 1659 the FBI experts stated that it is impossible to determine whether the absence of additional A record resolutions is due to the visibility afforded by the passive DNS operator, the result of the specific queries that the compiling analyst used to query the dataset, or intentional filtering applied by the analyst after retrieval. 1660

1659 The data used for the white paper came from Joffe’s companies Packet Forensics and Tech Company-I. As noted above, Joffe declined to be interviewed by the Office, as did Tech Company-2 Executive-I. The 851 records of resolutions on the USB drive were an exact match for a file of resolutions sent from University-I Researcher-2 to University-I Researcher- I on July 29, 2016, which was referred to as “[first name of Tech Company-2 Executive-l]’s data.” Id. at 7.

1660 Id. [bold]

There’s no way they would have come to this conclusion if they had seen the Blue Thumb Drive, which had millions of logs on it.

In fact, it appears that the FBI never did review that Blue Thumb Drive when they were investigating the Alfa Bank anomaly.

They didn’t do so, it appears, because the Cyber Division Agents who first reviewed the allegations, Nate Batty and Scott Hellman, misplaced the Blue Thumb Drive for weeks.

That may not have been an accident.

Batty and Hellman’s initial review, which they completed in just over a day, was riddled with errors (as I laid out during the trial). Importantly, they could not have reviewed most of the DNS logs before writing their report, because they claimed, “the presumed suspicious activity began approximately three weeks prior to the stated start [July 28] of the investigation conducted by the researcher.”

Even the smaller set of log files included on the Red Thumb Drive showed the anomaly went back to May. A histograph included in the white paper shows the anomaly accelerating in June.

Had anyone ever reviewed the full dataset, the shoddiness of their initial analysis would have been even more clear.

Here’s how the FBI managed to conduct an investigation on two thumb drives without, it appears, ever looking at the second one.

As the chain of custody submitted at trial shows, Jim Baker accepted the thumb drives, then handed them off to Peter Strzok, who then handed them off to Acting Assistant Director of Cyber Eric Sporre, who at first put the thumb drives in his safe, then handed them over to Nate Batty.

Within hours (these logs are UTC), Batty and Hellman started mocking the white paper but also complaining about the “absurd quantity of data.”

Hellman, at least, admitted at trial that he only knows the basics about DNS.

The next day, Batty told Hellman that their supervisor wanted them to write a “brief summary” of what he calls “the DNC report.” Batty appears to have known of Sussmann from other cases and he was informed that Sussmann was in the chain of custody.

In spite of the clear record showing Batty was informed who provided the thumb drives, in 2019, he told Durham that he and Hellman — whose analysis was so shitty — had considered filing a whistleblower complaint because they weren’t told what the documentary record shows he was clearly informed. And Durham thought that was sufficiently credible to stick in his report.

Before writing an analysis of this report, Batty admitted, they should first “plug the thumb drives” in and look at the files before they wrote a summary.

The documentary evidence shows that these guys formed their initial conclusion about the white paper without ever reviewing the data first.

A day later, Curtis Heide texted from Chicago and asked them to upload the thumb drives, plural, so they could start looking at them.

They only uploaded one, the Red Thumb Drive.

That’s clear because when Kyle Steere documented what they had received on October 4, he described that his report is, “a brief summary of the contents of the USB drive,” singular. The contents match what were on the Red Thumb Drive.

Two hours and 16 minutes later, after uploading the Red Drive, Batty asked if he should send the actual thumb drives to Chicago.

48 minutes later, Batty asked Hellman if he had the Blue Thumb Drive.

The chain of custody shows that Batty didn’t send anything on September 22, when he and Hellman were panicking about the missing Blue Thumb Drive. Instead, he put something in storage on October 6, two weeks later. That he put them in storage makes no sense, because when he wrote an Electronic Communication explaining why he was sending the thumb drives to Chicago on October 11 (by that point, 19 days after saying they would send the thumb drives to Chicago that day), he claimed,

Due to case operational tempo, and the need to assess the data at ECOU-1 prior to referring the matter to the [Chicago] division the evidence was not charged into evidence (at the NVRA) until October 6, 2016.

Not a shred of evidence in the available record supports that claim and a great deal shows it to be false.

But he didn’t send the physical thumb drives until October 12, FedEx instead of internal BuMail.

By October 12, the FBI had decided there was nothing to these allegations.

Somewhere along the way, there was some confusion as to whether there was one or two thumb drives. At the time the case ID was added — the case was opened on September 23 — it seems to have been understood there was just one thumb drive.

Batty does seem to have sent two thumb drives, one Red and one Blue, to Chicago after that 20-day delay, though.

At trial on May 23, Alison Sands dramatically pulled two thumb drives — a Red Thumb Drive and a Blue Thumb Drive — out of the evidence envelope where she put them years earlier.

Q. Ms. Sands, I’m showing you what’s been marked for identification as Government’s Exhibit 1. Do you recognize that?

A. Yes.

Q. What is that?

A. This is the la envelope.

Q. Do you know what this envelope contains?

A. Yes, it contains the thumb drives. So I basically took them out of evidence and put it into this envelope.

[snip]

Q. Now, Ms. Sands, do you recall how many thumb drives there were?

A. Yes, there’s two.

Q. Do you recall if they had any particular colors?

A. One is blue and one is red.

On the stand, Sands also introduced Steere’s memo, the one that documented the contents of the Red Thumb Drive. In doing so, though, she falsely claimed (at least per the transcript) that the memo described both thumb drives.

Q. Do you recognize what Government’s 206 is?

A. Yes.

Q. What is that?

A. It is the EC documenting what information was on the thumb drives that were provided.

She also introduced the items included on the Red Thumb Drive, one after another, into evidence.

Except for the 19-page set of text files used for technical analysis.

When prosecutor Brittain Shaw got to that file in Steere’s memo, she tried to move it into evidence, but both Judge Cooper and Sussmann attorney Michael Bosworth noted it was already in evidence.

MS. SHAW: Could we go back to Government’s Exhibit 206, please? Moving down the list —

BY MS. SHAW:

Q. The second item, what is that?

A. It is data that was provided as alleged evidence of these DNS lookup tables.

Q. After number 2, is that the title that was given to the file or is that something you assigned?

A. I believe that’s something we assigned.

Q. Okay.

MS. SHAW: And if I could have Government’s Exhibit 208, please. If you’d just blow that up a little bit. Thank you.

BY MS. SHAW:

Q. And, Ms. Sands, do you recognize what that is?

A. Yes, these are the DNS lookups that I just described.

MS. SHAW: All right. I would move Government’s Exhibit 208 into evidence.

MR. BOSWORTH: It may be —-

THE COURT: I think it’s probably in.

MS. SHAW: All right.

It was already in.

Almost a week earlier, Scott Hellman introduced what he called “a portion” of the data included with the exhibit. It was the 19-page text file of DNS logs that reviewed in the Technical Analysis included on the Red Thumb Drive. He didn’t describe it as one stand-alone document included on the thumb drive. He seemed to imply this was a selection the FBI had made.

Q. And if I could show just to you on your screen what’s been marked Government Exhibit 208. And Agent Hellman, this is about an 18- or 19-page document. But you just see the first page here. Do you recognize this?

A. It appears to be a portion of the technical data that came along with the narrative.

MR. DeFILIPPIS: All right. Your Honor, the government offers Government Exhibit 208.

MR. BERKOWITZ: No objection.

THE COURT: So moved.

Q. And if we look at that first page there, Agent Hellman, what kind of data is this?

A. It appears to be — as far as I can tell, it looks to be — it’s log data. So it’s a log that shows a date and a time, a domain, and an IP address. And, I mean, that’s — just looking at this log, there’s not too much more from that.

Q. And do you understand this to be at least a part of the DNS data that was contained on the thumb drives that I think you testified about earlier?

All the while, he and DeFilippis referred to this as “a part” of the DNS data and referred to the thumb drives, plural.

And that, it appears, may be all the data anyone at the FBI ever analyzed.

Update: I erroneously said there were texts between Batty and Hellman that may have gotten deleted. I’ve corrected that error.

Update: I added details from the Lync files showing Batty provided a claim that conflicts with all public evidence about why he didn’t check the thumb drives into evidence until after the investigation was substantively done.

Update: I’ve updated the table to show what Sussmann shared. Particularly given FBI’s shoddy record-keeping and Durham’s obfuscation, it’s not clear on which drive GX209 was, nor is it clear whether there was a separate set of CSV DNS logs on the Blue Drive and if so how many logs they included.

John Durham Fabricated His Basis to Criminalize Oppo Research

/50 Comments/in , , /by

I’d like to talk about Durham’s treatment of what he calls the “Clinton Plan” in his report, an attempt to criminalize Hillary’s effort to hold Trump politically accountable for his coziness with Russia.

This part of the investigation was the core of Durham’s work. Charlie Savage noted that, after Durham found no evidence US intelligence targeted Trump by early 2020, he and Barr then turned to trying to blame Hillary for the FBI’s suspicions about Trump.

But by the spring of 2020, according to officials familiar with the inquiry, Mr. Durham’s effort to find intelligence abuses in the origins of the Russia investigation had come up empty.

Instead of wrapping up, Mr. Barr and Mr. Durham shifted to a different rationale, hunting for a basis to blame the Clinton campaign for suspicions surrounding myriad links Trump campaign associates had to Russia.

I’m going to variably refer to this as “Durham’s Clinton conspiracy theory,” because it’s what he imagines this might be: a criminal conspiracy to lie to the FBI, or “Russian intelligence,” which is what it is based on. Durham, however, names it the “Clinton Plan,” accepting as given that the Russian intelligence product he bases it on is truthful, even while admitting that the intelligence community believes it may not be. And as we’ll see, he omits part of the intelligence report to make it all about Hillary.

Durham’s Clinton conspiracy theory is the first mention of a potential crime in his description of the scope of his investigation (the first two bullets had significantly been covered by DOJ IG by the time Durham started his investigation and weren’t criminal at all).

Similarly, did the FBI properly consider other highly significant intelligence it received at virtually the same time as that used to predicate Crossfire Hurricane, but which related not to the Trump campaign, but rather to a purported Clinton campaign plan “to vilify Donald Trump by stirring up a scandal claiming interference by Russian security services,” which might have shed light on some of the Russia information the FBI was receiving from third parties, including the Steele Dossier, the Alfa Bank allegations and confidential human source (“CHS”) reporting? If not, were any provable federal crimes committed in failing to do so?

Only after that bullet does Durham list, in describing the scope of his criminal investigation, the possibility that people lied to the FBI, the only imagined crimes he discovered, and for which he got only acquittals.

The order of these bullets tracks the known timeline of the investigation, which I laid out here: Durham didn’t fully develop his now-debunked theory that Michael Sussmann and Igor Danchenko lied to the FBI and then — building off that theory — come to believe Clinton had conspired to lie to the FBI. Rather, he worked in the opposite direction, pursuing the Clinton conspiracy theory first, and only after Nora Dannehy thwarted Durham’s attempts to release an interim report focused on that conspiracy theory just before the 2020 election, did he do key interviews collecting much of his evidence in the Alfa Bank and Danchenko investigations. Worse still, in both investigations, he never took obvious steps (like checking Jim Baker’s iCloud, or interviewing the Clinton staffers Sussmann allegedly coordinated with, or interviewing Sergei Millian, to say nothing of interviewing George Papadopoulos, which he never did) until months after indicting the two men. Everything happened in reverse order than it should have if he were following the evidence.

The section describing his Clinton conspiracy theory makes up almost 18 pages of the report, about 5% of the total. Here’s a summary of that section:

While I won’t focus on it, note that about a third of this section consists of complaints about the Steele dossier and Fusion, some of which conflicts with his complaints about the Steele dossier elsewhere, some of which ignores evidence submitted at the Sussmann trial.

Even on its face, there are real problems with Durham’s Clinton conspiracy theory. As Phil Bump (one, two) and Dan Friedman already showed, Hillary’s concerns about Trump couldn’t have been the cause of the investigation into Trump. By the time (a Russian intelligence product claimed) that Hillary approved a plan to tie Trump to Russia on July 26, 2016, the events that would lead FBI to open an investigation were already in place. Here’s Friedman:

This isn’t just false. It would require time travel. Durham himself confirms that the FBI launched its investigation into Trump and Russia based on events that occurred months prior to Clinton’s alleged July 26 approval of the plan. In April 2016, George Papadopoulos, a foreign policy adviser to the Trump campaign, met with a professor with Kremlin ties, who informed him that Russia “had obtained ‘dirt’ on…Clinton in the form of thousands of emails,” as Robert Mueller’s final report noted.  A week later, according to Mueller, Papadopoulos “suggested to a representative of a foreign government that the Trump Campaign had received indications from the Russian government that it could assist the Campaign through the anonymous release” of damaging material. When hacked Democratic emails were indeed published—by WikiLeaks on July 22—this foreign diplomat alerted US officials about what Papadopoulos had said. The FBI quickly launched an official investigation into the Trump campaign’s Russia ties in response to that tip, Durham notes, while arguing they should have begun only a “preliminary investigation.”

It was the same Russian hack, not Hillary Clinton, that drove media attention, even before the documents were leaked to the public.

Ultimately, Durham hangs potential criminality (at least with respect to the FBI) on the Carter Page FISA applications, a suggestion that by not alerting the FISA Court that (Russia claimed) Hillary had this plan, the FBI was withholding what he calls “exculpatory” information. But in doing that, Durham conflates a Russian intelligence report making claims about Hillary with Hillary herself, something else Friedman rightly mocks.

To figure out how an American presidential campaign supposedly went about attacking a rival campaign, Durham relied on information US intelligence gathered on claims made by Russian intelligence agents about what they supposedly found by spying on Americans. That’s a pretty roundabout way to learn the kind of information you’d expect to see in “Playbook.” And this game of spy telephone was actually even longer than Durham details. According to the New York Times, US spies obtained their “insight” into Russian intelligence thinking from Dutch intelligence, which was spying on the Russians as the Russians spied on Americans. Durham seems to have found no other confirmation for his “Clinton Plan intelligence.” That’s reason enough for skepticism.

But there is a bigger problem. Russian security services did hack Clinton’s campaign to help Trump, according to the entire US intelligence community and the Senate Intelligence Committee. Yet Durham relies on those Russian spies for insight into how Clinton reacted to the hack. That is like the cops citing a bank robber who says the bank framed him.

Given how selective Durham is about how he treats Russian disinformation, this is a grave problem for his project, which I’ll return to.

But there are far more problems with Durham’s conspiracy theory.

Durham invents out of thin air that Hillary’s plan included false information

First, it’s not just that Durham focused his entire investigation on potential Russian disinformation with little worry about doing so.

At least per what is in the unclassified report, Durham added something to the Russian intelligence product: That Hillary had a plan to spread “false” information. Durham’s first paragraph explaining why the Russian intelligence claim about a Hillary plan is important claims:

First, the Clinton Plan intelligence itself and on its face arguably suggested that private actors affiliated with the Clinton campaign were seeking in 2016 to promote a false or exaggerated narrative to the public and to U.S. government agencies about Trump’s possible ties to Russia. [my emphasis]

Durham bases his entire pursuit of this piece of Russian intelligence on his judgment that the Russian intelligence “arguably suggested” Hillary’s people were going to pursue a “false or exaggerated” narrative to tie Trump to Russia. But the notion that this narrative would be — would have to be! — false is nowhere in any of the three formulations of the intelligence Durham describes in his unclassified report.

U.S Presidential candidate Hillary Clinton had approved a campaign plan to stir up a scandal against U.S. Presidential candidate Donald Trump by tying him to Putin and the Russians’ hacking of the Democratic National Committee.

[snip]

CIA Director Brennan subsequently briefed President Obama and other senior national security officials on the intelligence, including the “alleged approval by Hillary Clinton on July 26, 2016 of a proposal from one of her foreign policy advisors to vilify Donald Trump by stirring up a scandal claiming interference by Russian security services.”

[snip]

U.S. Presidential candidate Hillary Clinton’s approval of a plan concerning U.S. Presidential candidate Donald Trump and Russian hackers hampering U.S. elections as a means of distracting the public from her use of a private mail server.

Even the Russians were only claiming that Hillary would tie Trump to the hacking targeting her. The Russians didn’t claim Hillary would lie to do so. Yet Durham justifies this prong of investigation by adding something to the Russian intelligence that wasn’t in it: that tying Trump to Russia would “arguably” require false information.

That’s an utterly critical addition to what was actually contained in the Russian intelligence, because — as Durham noted in a footnote to this paragraph — oppo research is not itself illegal. It only becomes illegal if you intentionally lie to the government about it.

393 To be clear, the Office did not and does not view the potential existence of a political plan by one campaign to spread negative claims about its opponent as illegal or criminal in any respect. As prosecutors and the Court reminded the jury in the Sussmann trial, opposition research is commonplace in Washington, D.C. and elsewhere, is conducted by actors of all political parties, and is not a basis in and of itself for criminal liability. Rather, only if the evidence supported the latter of the two conditions described above-i.e., if there was an intent by the Clinton campaign or its personnel to knowingly provide false information to the government-would such conduct potentially support criminal charges.

Never mind that Durham never developed evidence that the Hillary campaign wanted or intended to privately share either the Steele dossier or the Alfa Bank allegations with the FBI. In fact, his report provides affirmative evidence that the Hillary campaign wanted nothing to do with the FBI, because it had already so damaged her campaign.

Without Durham’s invention — something that he made up out of thin air! — that Hillary planned to spread false information, Durham had no business spending three years investigating this. And remember, much of his investigation on Danchenko and the Alfa Bank allegations happened a year after he started pursuing his Clinton conspiracy theory, and two juries ultimately rejected his accusations that even the people who did share information with the FBI intentionally shared false information.

That’s one of many reasons why it matters that Durham so assiduously ignores all the evidence that Trump really was tied to Russia — that Mueller really did find hundreds of such ties, including a slew that Trump and his closest associates lied to the FBI to hide.

By the time Hillary allegedly approved this plan, on July 26, Trump had publicly hired a campaign manager with close ties to Russia, his foreign policy advisor had publicly made pro-Russian comments while speaking in Moscow, and he himself had publicly attacked NATO. The next day (and the day before the CIA discovered this), Trump publicly called for Russia to help him and publicly floated recognizing Russia’s annexation of Crimea. Even just on what was public, Hillary wouldn’t have had to invent anything.

But Russia knew about far more that wasn’t public. In January, Michael Cohen contacted the Kremlin to pursue a real estate deal in Moscow, involving both GRU and a sanctioned bank, something Trump would lie publicly about on July 27. In April, George Papadopoulos got an early warning of this operation. In May, Paul Manafort started sending polling data via Konstantin Kilimnik to Oleg Deripaska. In June, Trump’s failson accepted a meeting from the son of a Russian Oligarch promising dirt on Hillary. If you believe Rick Gates, Roger Stone claimed he was in contact with Guccifer 2.0 before the persona went public in June, and on July 25 (the day before the Russians claimed Hillary approved this purported plan), Manafort asked Stone to reach out to WikiLeaks and find out what else they had. The only one of these details that Russia didn’t definitely know was that Stone was pursuing WikiLeaks. By the time it wrote up that intelligence report, Russia was involved in all the rest of it.

And as I noted, Durham hid most of these non-public details. He hid the abundant evidence that Hillary wouldn’t have needed to make false claims, because the public and private reality all confirmed what Russia claimed Hillary was going to claim: that Trump had ties to Russia, ties he was hiding from voters.

Durham invents something that wasn’t in the Russian intelligence report he relies on, even while hiding abundant evidence that Hillary would have no reason to make stuff up, because there was so much public that was already damning.

Durham uses Hillary’s focus on true events as proof of his false claims

After inventing the claim that Russia said Hillary would rely on false information to tie Trump to the Russian operation, Durham points to Clinton’s focus on true things as evidence that Clinton really did have such a plan. In section vi, which Durham describes as, “Other evidence obtained by the office that appears to be relevant to an analysis of the Clinton Plan intelligence,” Durham uses several entirely true things that Hillary’s foreign policy advisors did, two of which precede the date when (the Russian intelligence report claims) Hillary approved a plan to focus on Trump, to try to prove that such a plan existed.

The section is punctuated with one after another Hillary staffer, and Hillary herself, saying that no such plan existed, but in spite of that, Durham spins three pieces of documentary evidence to claim it supports his conspiracy theory. The documentary evidence cited starts with a July 27 letter-writing effort to condemn Trump’s attacks on NATO.

We are writing to enlist your support for the attached public statement. Both of us are Hillary Clinton supporters and advisors but hope that this statement could be signed by a bipartisan group[.] Donald Trump’s repeated denigration of the NATO Alliance, his refusal to support our Article 5 obligations to our European allies and his kid glove treatment of Russia and Vladimir Putin are among the most reckless statements made by a Presidential candidate in memory.

This letter wasn’t even oppo research: It was mainstream opinion about a true fact about Trump.

Durham’s focus on this is exactly analogous to GOP efforts to attack a completely true letter former spooks wrote expressing their opinion that the Hunter Biden laptop looked like a Russian information operation, which Republican Congressmen have falsely depicted as a claim about disinformation. It’s even worse though, because Durham points to the mere expression of an opinion as evidence of criminal intent. True (and solidly within mainstream) opinion equals false and criminal in Durham’s book.

Then Durham turns to a Hillary staffer’s early July effort to follow-up on Franklin Foer’s July 4, 2016 review of Trump’s very real Russian ties. The article itself is really inconvenient for Durham’s narrative, because it summarizes all the absolutely true reasons (in addition to the ones I listed above) why Trump’s Russian ties were suspect, including an accurate description of why Carter Page’s fawning praise for Russia was so alarming. The article effectively proves this was a press concern before Hillary allegedly approved a plan to make it one. Given Foer’s later ties to Fusion, this entirely accurate article likely also relies on Fusion research, but Durham puts it in this section rather than the 5-page Fusion subsection, perhaps to hide that Fusion’s open source research largely held up. Perhaps because this Foer article itself undermines Durham’s narrative in various ways, Durham claimed this follow-up pertained to this June 2020 Foer article rather than the one written in July 2016, which would require an even more time travel than what Friedman described. Did Durham read the real article here and realize how badly it undermined all his claims about Fusion and Hillary and so cite one written four years later?

Insanely, however, Durham claims that this July 5 attempted follow-up, “provide[s] some support for the notion that the Clinton campaign was engaged in an effort or plan in late July 2016 to encourage scrutiny of Trump’s potential ties to Russia.” Durham cites a Clinton staffer’s focus on Trump’s true ties to Russia as proof Hillary approved — three weeks later — a plan to invent such ties. Again, true equals false.

Perhaps the craziest of all, buried deep in his report, Durham claims that Hillary’s staffers’ interest in finding out whether the FBI was actually investigating the crime committed against her — without any tie to Trump — is proof that Hillary had a plan targeting Trump.

In addition, on July 25, 2016, Foreign Policy Advisor-1 had the following text message exchange with Foreign Policy Advisor-2:

[Foreign Policy Advisor-2]: Can you see if [Special Assistant to the President and National Security Council member] will tell you if there is a formal fbi or other investigation into the hack?

[Foreign Policy Advisor-1]: [She] won’t say anything more to me. Sorry. Told me [she] went as far as [she] could.

[Foreign Policy Advisor-2]: Ok. Do you have others who might?

[Foreign Policy Advisor-1]: Has [Individual-2] tried [her]? Curious if [she] would react differently to [Individual-2]? can also try OVP [Office of the Vice President]. They might say more.

[Foreign Policy Advisor-2]: I don’t know if he has but can ask. Would also be good to try ovp, and anyone in IC [intelligence community]

[Foreign Policy Advisor-1]: Left messages for OVP but politico just sent me a push notification stating that they are indeed investigating.

[Foreign Policy Advisor-2]: Fbi just put our [sic] statement. Thx454

Remember: Durham accuses the FBI of confirmation bias, but here he uses a victim’s attempt to find out whether the crime committed against her was being investigated as evidence that, instead, she was victimizing Trump.

More problematic for Durham’s conspiracy theory, emails the Special Counsel only sought out in response to Sussmann’s discovery requests show that Sussmann knew of the investigation (because he was helping the FBI conduct it), proving that he had no ties with the people Durham imagined were behind this conspiracy theory.

In fact, FBI’s Assistant Director would concede to Sussmann that he should have consulted with the campaign before making such a public statement.

First let me apologize for any perceived or actual disconnect on this matter. I agree fully that when making statements to the media and others, we need to be in lock step with victims and partners. In this case, it appears we were not.

The FBI admitted it fucked up by not being more forthcoming about the status of the investigation. But Durham takes an effort to learn about whether there even was an investigation and claims it is evidence that victim may have committed a crime. This is the digital equivalent of slut-shaming, criminally investigating Hillary because she was hacked.

Durham’s report takes true stuff, some of it unrelated to Trump and other parts of it before the purported plan, as evidence that Hillary wanted to make false claims. And remember, these true details that Durham adopts to support his invented claim that Hillary was pursuing a false narrative are things Durham relies on to justify adopting a Russian intelligence product as the backbone of his investigation.

Given how shoddy this stuff is, I can only imagine what additional stuff he pointed to in his classified summary.

What Durham calls “Clinton Plan” is actually the Hillary-and-Guccifer intelligence

Time for a detour about Guccifer 2.0.

Remember how Durham omitted, without an ellipsis, damning information about Sam Clovis?

He similarly omitted two redacted lines in his presentation of the CIA referral of the Russian intelligence about Hillary and Guccifer 2.0. Here’s what it looks like in his report, with Durham’s omission marked:

Here’s what the original looks like, with the redaction Durham omitted marked.

I don’t know what is behind the redaction. Given what Durham did with the Clovis information, it probably doesn’t help his narrative. And given that Durham barely mentions Roger Stone and definitely doesn’t mention the rat-fucker’s suspected advance discussions with Guccifer 2.0, and given that his lead prosecutor criticized DARPA investigators for trying to identify Guccifer 2.0, the redaction is suspect. At the very least though, he should be referring to this not as “Clinton Plan intelligence,” but as “Hillary-and-Guccifer intelligence,” because that’s how it got packaged up for the FBI.

And if he treated this as Hillary-and-Guccifer intelligence, Durham might consider why the FBI didn’t begin to look at Roger Stone’s ties to Guccifer until almost a year after opening Crossfire Hurricane — but that would provide proof that the FBI wasn’t aggressive enough in their investigation of Trump, not that they were too aggressive.

Durham conflates reporting on Russia’s attack on the US with intelligence about Hillary

Durham’s failure to note the two-line redaction about Guccifer 2.0 matters because of something else he does.

First, note that this intelligence, if true, seems to reflect the collection by Russian spy agencies of recent communications between Hillary’s close associates (which would be explained in the second redaction). So if the intelligence were true, it would reflect a Presidential candidate’s associates being wiretapped by foreign spies. But Durham isn’t interested in that part of it. He’s interested in the content that Russia allegedly intercepted, not the the claimed intercept itself.

Key to Durham’s claim that the content of what Russia claimed to have intercepted from Hillary associates, rather than the claimed interception itself, is important is that John Brennan briefed it, the content, “expeditiously” to President Obama. But throughout this section, Durham plays word games to suggest a larger collection of intelligence is the same thing as the intelligence pertaining to Hillary(-and-Guccifer). As you read this section, imagine how it would read if instead of “Clinton Plan,” it read, “the intercept of Hillary’s associates.”

The Intelligence Community received the Clinton Plan intelligence in late July 2016. 397 The official who initially received the information immediately recognized its importance including its relevance to the U.S. presidential election- and acted quickly to make CIA leadership aware of it. 398

[snip]

Immediately after communicating with the President, Comey, and DNI Clapper to discuss relevant intelligence, Director Brennan and other agency officials took steps to ensure that dissemination of intelligence related to Russia’s election interference efforts, including the Clinton Plan intelligence, would be limited to protect sensitive information and prevent leaks.404

[snip]

On August 3, 2016, within days of receiving the Clinton Plan intelligence, Director Brennan met with the President, Vice President and other senior Administration officials, including but not limited to the Attorney General (who participated remotely) and the FBI Director, in the White House Situation Room to discuss Russian election interference efforts. 406 According to Brennan’s handwritten notes and his recollections from the meeting, he briefed on relevant intelligence known to date on Russian election interference, including the Clinton Plan intelligence. 407 Specifically, Director Brennan’s declassified handwritten notes reflect that he briefed the meeting’s participants regarding the “alleged approval by Hillary Clinton on 26 July of a proposal from one of her [campaign] advisors to vilify Donald Trump by stirring up a scandal claiming interference by the Russian security services.”408

[snip]

In late September 2016, high-ranking U.S. national security officials, including Comey and Clapper, received an intelligence product on Russian interference in the 2016 presidential election that included the Clinton Plan intelligence. 421

[snip]

CIA Director Brennan and other intelligence officials recognized the significance of the intelligence by expeditiously briefing it to the President, Vice President, the Director of National Intelligence, the Attorney General, the Director of the FBI, and other senior administration officials. 491 [my emphasis]

Virtually all these references are to the wider body of intelligence the CIA was collecting on Russia’s targeting of Hillary, and the one that’s not — the reference to the discovery of the intelligence — almost certainly refers to the intelligence shared by the Dutch. Nevertheless, Durham uses the urgency of the intelligence about an ongoing attack to claim the importance of the Hillary-and-Guccifer intelligence.

The Hillary stuff — and whatever reference to Guccifer it included — was just one piece of intelligence among a bunch of intelligence. It probably wasn’t considered all that important a part of that intelligence, because it only appears on pages 5 and 6 of the notes taken from Brennan’s briefing of the intelligence.

In fact, Durham’s description of Brennan’s interview suggests that Brennan didn’t even consider this to be a piece of intelligence about Hillary. Indeed, he thought the intelligence was about Russia hacking Hillary, not Hillary making a plan to talk about being hacked by Russia.

When interviewed, Brennan generally recalled reviewing the materials but stated he did not recall focusing specifically on its assertions regarding the Clinton campaign’s purported plan. 400 Brennan recalled instead focusing on Russia’s role in hacking the DNC. 401

On July 28, 2016, Director Brennan met with President Obama and other White House personnel, during which Brennan and the President discussed intelligence relevant to the 2016 presidential election as well as the potential creation of an inter-agency Fusion Cell to synthesize and analyze intelligence about Russian malign influence on the 2016 presidential election. 402

Brennan’s impression that this intelligence was about Russia’s hack of the DNC would make sense if it were treated as a piece of intelligence about Russia intercepting communications of Hillary’s associates.

Durham’s conflation of the Hillary-and-Guccifer-specific intelligence with the wider body of intelligence continues as he describes how it got shared with the FBI. Again, imagine how this passage would read if you replaced “Clinton Plan” with “intercept of Hillary’s associates.”

It appears, however, that this occurred no later than August 22, 2016. On that date, an FBI cyber analyst (“Headquarters Analyst-2”) emailed a number of FBI employees, including Supervisory Intelligence Analyst Brian Auten and Section Chief Moffa, the most senior intelligence analysts on the Crossfire Hurricane team, to provide an update on Russian intelligence materials. 409 The email included a summary of the contents of the Clinton Plan intelligence. 410 The Office did not identify any replies or follow-up actions taken by FBI personnel as a result of this email.

When interviewed by the Office, Auten recalled that on September 2, 2016 – approximately ten days after Headquarters Analyst-2’s email – the official responsible for overseeing the Fusion Cell briefed Auten, Moffa, and other FBI personnel at FBI Headquarters regarding the Clinton Plan intelligence. 411

[snip]

FBI records reflect that by no later than that same date (September 2, 2016), then-FBI Assistant Director for Counterintelligence Bill Priestap was also aware of the specifics of the Clinton Plan intelligence as evidenced by his hand-written notes from an early morning meeting with Moffa, DAD Dina Corsi and Acting AD for Cyber Eric Sporre. 415

He falsely suggests that the entirety of an investigative referral memo regarded,

“U.S. Presidential candidate Hillary Clinton’s approval of a plan concerning U.S. Presidential candidate Donald Trump and Russian hackers hampering U.S. elections as a means of distracting the public from her use of a private mail server.”

In fact, the memo in which this intelligence got formally packaged up for the FBI included three things, paragraph a, paragraph b, and paragraph c (though the Hillary-and-Guccifer intelligence was first), with the introduction that these were simply “examples of information the CROSSFIRE HURRICANE fusion cell has gleaned to date,” not that they were particularly important examples. Nevertheless, Durham pretends the Hillary-and-Guccifer intelligence was the entirety of the memo.

There’s no reason to believe any of these briefings were about the Hillary-and-Guccifer intelligence specifically. Durham pretends there was a buzz among the intelligence agencies about Hillary, when in reality there was a buzz about Russia hacking Hillary that he presents as if it were primarily about Hillary.

Durham failed to coach witnesses into claiming they had received the FBI memo

In the section where Durham considers whether to charge some FBI agents for not doing more with the the Russian Hillary-and-Guccifer intelligence, he repeats his ploy of conflating the Hillary-and-Guccifer intelligence with the wider body of evidence to even deign to make a prosecutorial decision, though in this instance, he provides no reminder that the Hillary-and-Guccifer intelligence was just one of the things Brennan briefed to Obama, after five pages of other items.

The FBI thus failed to act on what should have been – when combined with other, incontrovertible facts – a clear warning sign that the FBI might then be the target of an effort to manipulate or influence the law enforcement process for political purposes during the 2016 presidential election. Indeed, CIA Director Brennan and other intelligence officials recognized the significance of the intelligence by expeditiously briefing it to the President, Vice President, the Director of National Intelligence, the Attorney General, the Director of the FBI, and other senior administration officials. 491

He lets the urgent import of an ongoing Russian hack to stand in for the import of this Hillary-and-Guccifer intelligence.

And that’s important, because Durham makes a prosecutorial decision about whether to charge FBI agents for how they responded to the intelligence that Russia claimed to have intercepted communications of Hillary personnel without proof that most of them ever read it.

As he describes, the top analytical people on the campaign learned of the claimed intercept of Hillary associates almost a month after CIA first obtained it.

On that date, an FBI cyber analyst (“Headquarters Analyst-2”) emailed a number of FBI employees, including Supervisory Intelligence Analyst Brian Auten and Section Chief Moffa, the most senior intelligence analysts on the Crossfire Hurricane team, to provide an update on Russian intelligence materials. 409 The email included a summary of the contents of the Clinton Plan intelligence. 410

There were in-person briefings for the top analytical people and the cyber people ten days later.

When interviewed by the Office, Auten recalled that on September 2, 2016 – approximately ten days after Headquarters Analyst-2’s email – the official responsible for overseeing the Fusion Cell briefed Auten, Moffa, and other FBI personnel at FBI Headquarters regarding the Clinton Plan intelligence. 411 Auten did not recall any FBI “operational” personnel (i.e., Crossfire Hurricane Agents) being present at the meeting. 412 The official verbally briefed the individuals regarding information that the CIA planned to send to the FBI in a written investigative referral, including the Clinton Plan intelligence information. 413

[snip]

Separate and apart from this meeting, FBI records reflect that by no later than that same date (September 2, 2016), then-FBI Assistant Director for Counterintelligence Bill Priestap was also aware of the specifics of the Clinton Plan intelligence as evidenced by his hand-written notes from an early morning meeting with Moffa, DAD Dina Corsi and Acting AD for Cyber Eric Sporre. 415

Durham describes the CIA writing a memo about what the fusion intelligence team had found — but he curiously never describes how or when it was sent.

Five days later, on September 7, 2016, the CIA completed its Referral Memo in response to an FBI request for relevant information reviewed by the Fusion Cell. 417

That’s important because Durham describes witness after witness describing that they had never seen it.

None of the FBI personnel who agreed to be interviewed could specifically recall receiving this Referral Memo.

[snip]

The Office showed portions of the Clinton Plan intelligence to a number of individuals who were actively involved in the Crossfire Hurricane investigation. Most advised they had never seen the intelligence before. For example, the original Supervisory Special Agent on the Crossfire Hurricane investigation, Supervisory Special Agent-1, reviewed the intelligence during one of his interviews with the Office. 428 After reading it, Supervisory Special Agent-I became visibly upset and emotional, left the interview room with his counsel, and subsequently returned to state emphatically that he had never been apprised of the Clinton Plan intelligence and had never seen the aforementioned Referral Memo. 42

[snip]

Former FBI General Counsel Baker also reviewed the Clinton Plan intelligence during one of his interviews with the Office. 431 Baker stated that he had neither seen nor heard of the Clinton Plan intelligence or the resulting Referral Memo prior to his interview with the Office.

In lieu of proof that it ever got sent, Durham reveals that Brian Auten might have hand-carried the memo to the team, but had no memory of doing so.

Auten stated that it was possible he hand-delivered this Referral Memo to the FBI, as he had done with numerous other referral memos,419 and noted that he typically shared referral memos with the rest of the Crossfire Hurricane investigative team, although he did not recall if he did so in this instance. 420

Note that two of the interviews on which this passage relies — a June 18, 2020 interview of Jim Baker and a July 26, 2021 interview of Auten — were shown to be highly problematic at trial.

In the former case, Durham called Baker back a week after an earlier interview; it’s the interview where Baker’s memory started changing fairly dramatically, under coaching from Durham, to coincide with the story Durham needed to have told to support his conspiracy theory.

Q. Did Mr. DeFilippis or Mr. Durham ask you to go back and think harder about certain things?

A. I don’t remember that.

Q. Well, do you remember when you met with them on June 18th of 2020? Do you remember generally that date?

A. I’ll take your word for it. I don’t remember that date specifically.

[snip]

Q. And at that meeting for the first time, you told them, After thinking about it further, you recalled being briefed at some point on an unrecalled date about the investigation involving the intrusion of the DNC computers and possibly learning at that briefing that Sussmann, who you knew from previous contacts, was representing the DNC on that matter.

Do you remember that that was the meeting where you said, “After further thought, Mr. Sussmann was representing the DNC at least on the hack?”

A. Again, I don’t remember that it was at that particular meeting, but I remember at some point acknowledging that.

Sussmann attorney Sean Berkowitz got Baker to admit that at the meeting, Durham only showed Baker the notes that matched the story the Special Counsel needed to be told, not those that utterly contradicted the story (and were consistent with a bunch of other evidence that at least four people at the FBI believed that Sussmann was there on behalf of the Democrats).

Q. Now, the government did not show you other people’s notes in that June of 2021 time period, correct?

A. At that point in time I don’t think they showed me anybody else’s notes.

[snip]

MR. BERKOWITZ: And if you could blow up, “The attorney brought to” — Page 2, I believe. Page 6.

A. I’m sorry, these are the notes we looked at yesterday.

Q. Right. These are the notes — just to be clear for everybody — March 6th of 2017. Did the FBI or anybody from Special Counsel Durham’s team show you these notes in an attempt to refresh your recollection of what happened in your interactions with Mr. Sussmann in 2016?

A. No.

The interview with Auten is similar.

As Danchenko attorney Danny Onorato laid out at trial, before Auten’s July 26, 2021 interview, Durham told Auten he was being criminally investigated.

Q Does July 26 of 2021 sound fair?

A Yes, it does.

Q Okay. And when you met with them for the first time after you were meeting with people for 25 or 30 hours, did your status change from a witness to a subject of an investigation?

A Yes, it did.

Q Okay. And in your work for the FBI, has anyone ever told you that you are a subject of a criminal inquiry?

A No.

Q Was that scary?

A Yes.

In addition to showing that at trial, Durham coached Auten into making an inaccurate statement about how Danchenko claimed Millian had called him, Onorato also showed — as Berkowitz had months earlier — that Durham had withheld documents that undermined Durham’s story and corroborated Danchenko’s during these earlier witness interviews.

In other words, both these interviews were shown at trial to have reflected coaching of witnesses to tell the story Durham wanted told, not the story reflected by the evidence. (Unsurprisingly, Durham never cites the trial testimony that disproves his claims in his report, yet another thing he accused the FBI of doing that he himself did.)

And even in spite of proof that Durham was coaching witnesses in these interviews, he still presented no affirmative evidence that the FBI investigators ever received the Fusion Cell memo. In the same way that all of Hillary’s people disclaimed any plan, the FBI investigators disclaimed having seen this memo.

Yet in spite of having no evidence that these people ever saw this memo, Durham compares how they responded to the Steele dossier with how they didn’t respond to this memo, and then generously decides not to charge anyone for doing nothing in response to a memo he has no proof they ever saw.

That’s how his conspiracy theory ended, after four years of trying to create evidence to support it, with him making an extended declination decision about a document he has no proof the FBI ever saw. His prosecutorial decision weighs whether the FBI “intentionally furthered” a Clinton plan to “frame” Trump with improper ties to Russia, as if he had presented proof there was such a plan.

The aforementioned facts reflect a rather startling and inexplicable failure to adequately consider and incorporate the Clinton Plan intelligence into the FBI’ s investigative decision-making in the Crossfire Hurricane investigation. Indeed, had the FBI opened the Crossfire Hurricane investigation as an assessment and, in turn, gathered and analyzed data in concert with the information from the Clinton Plan intelligence, it is likely that the information received would have been examined, at a minimum, with a more critical eye. A more deliberative examination would have increased the likelihood of alternative analytical hypotheses and reduced the risk of reputational damage both to the targets of the investigation as well as, ultimately, to the FBI.

The FBI thus failed to act on what should have been -when combined with other, incontrovertible facts – a clear warning sign that the FBI might then be the target of an effort to manipulate or influence the law enforcement process for political purposes during the 2016 presidential election. Indeed, CIA Director Brennan and other intelligence officials recognized the significance of the intelligence by expeditiously briefing it to the President, Vice President, the Director ofNational Intelligence, the Attorney General, the Director of the FBI, and other senior administration officials. 491 Whether or not the Clinton Plan intelligence was based on reliable or unreliable information, or was ultimately true or false, it should have prompted FBI personnel to immediately undertake an analysis of the information and to act with far greater care and caution when receiving, analyzing, and relying upon materials of partisan origins, such as the Steele Reports and the Alfa Bank allegations. The FBI also should have disseminated the Clinton Plan intelligence more widely among those responsible for the Crossfire Hurricane investigation so that they could effectively incorporate it into their analysis and decision-making, and their representations to the OI attorneys and, ultimately, the FISC. 492

[snip]

Although the evidence we collected revealed a troubling disregard for the Clinton Plan intelligence and potential confirmation bias in favor of continued investigative scrutiny of Trump and his associates, it did not yield evidence sufficient to prove beyond a reasonable doubt that any FBI or CIA officials494 intentionally furthered a Clinton campaign plan to frame or falsely accuse Trump of improper ties to Russia.

Again, to get to the point where Durham is making a prosecutorial decision about whether the FBI helped Hillary frame Trump, Durham has,

  • Relied on proof that Hillary pointed to the true things that were damning enough
  • Presented affirmative evidence that Hillary wouldn’t have approved of sharing the Alfa Bank anomaly with the FBI
  • Been told, by two juries, that he couldn’t prove that anyone actually lied to the FBI
  • Presented no evidence that the FBI investigators saw this memo

And yet virtually every Republican claims that this is what the Durham Report did conclude, that Hillary did have such a plan.

He made it up.

For the more than three years, John Durham criminally investigated whether Hillary framed Donald Trump. And that entire investigation is based on a premise that even he describes was only “arguably suggested” by the evidence on which he builds it.

In fact, Durham fabricated that entire part of it. He made up, out of thin air, his claim that a Russian intelligence report “suggested” Hillary was going to make false claims about Donald Trump rather than simply repeating all the true things that were damning enough.

The entire Durham Report was built on this fabrication, a fabrication he used to claim that Hillary was framing someone, instead of doing so himself.

Update: Durham himself submitted this email thread between Fusion and Foer showing that Fusion was heavily involved in Foer’s article and that their focus on Carter Page significantly preceded Page’s July speech in Russia.

Doo-Doo Process: John Durham Claims to Know Better than Anthony Trenga and Two Juries

/40 Comments/in , , /by

There’s something grotesque and unethical about John Durham’s conduct that has gotten little attention.

After getting his ass handed to him by two juries and one judge, in his report, Durham nevertheless repeated the allegations against Michael Sussmann and Igor Danchenko on which they have been acquitted. While in one discussion of his prosecutorial decisions, Durham described these as “allegations,” in his executive summary and elsewhere, he stated, as fact, that both men had made false or fabricated statements. Worse still, in his efforts to sustain his false statements allegations, Durham himself makes claims that were rebutted or undermined by the trial records.

John Durham lies about press contacts to cover up his failure to investigate exculpatory information

As a reminder, the researchers who found the Alfa Bank anomaly found it organically, and out of a suspicion — later validated by at least three Mueller prosecutions (Paul Manafort, Michael Cohen, and Alex Van der Zwaan) — that Trump and his associates were lying about their ties to Russia, Rodney Joffe shared the Alfa Bank anomaly with Michael Sussmann.

Sussmann definitely packaged up the allegations and asked Fusion GPS what they knew about Alfa Bank. He definitely billed that packaging-up process to Hillary. The campaign definitely approved sharing that information with the NYT.

But then, without the consent of the campaign, Sussmann blew their big story, by sharing the allegations with the FBI.

Sussmann claimed that he did so because, as a former cybersecurity prosecutor, he knew that if DOJ were going to have a chance to investigate these allegations, they would need to do so, covertly, before the allegations went public. He claimed to have done so because he had been in the position where a big allegation broke before law enforcement had an opportunity to investigate. As proof to support this claim, Sussmann noted — and over the course of months, forced Durham to collect the heretofore ignored evidence proving — that he helped the FBI kill the NYT story the campaign had approved, in the process making it clear that he had to ask someone (Joffe’s) consent to do so.

Because the FBI used overt means to investigate these allegations — a violation of DOJ pre-election guidelines that Durham doesn’t mention in his screed about the FBI — a seeming response to NYT’s efforts which was actually a response to the FBI bigfooting helped to fuel the story. The record shows, and Durham’s most aggressive prosecutor conceded at closing arguments, that the FBI fucked up this investigation in other ways, yet more FBI shortcomings that Durham doesn’t mention in his screed.

After the election, at a time when Sussmann no longer worked for Hillary, Joffe asked him to try to get the CIA to look at these anomalies. Before that meeting, Sussmann told one of his CIA interlocutors that he did have a client (something Sussmann also told to Congress), but described that his client wanted anonymity because of concerns about Russian retaliation. In the meeting where he passed off his thumb drives, he said he was not representing a client.

Those are the competing signals on which Durham obtained a criminal indictment and did so before having consulted significant swaths of directly relevant evidence: a question about how Sussmann intended those words, “represent” and “on behalf of,” a problem with the indictment that Sussmann identified immediately.

Here’s how Durham presented the Sussmann charges in the Executive Summary (all bold in this post my own).

The Office also investigated the actions of Perkins Coie attorney Michael Sussmann and others in connection with Sussmann’s provision of data and “white papers” to FBI General Counsel James Baker purporting to show that there existed a covert communications channel between the Trump Organization and a Russia-based bank called Alfa Bank. As set forth in Section IV.E.1.c.iii, in doing so he represented to Baker by text message and in person that he was acting on his own and was not representing any client or company in providing the information to the FBI. Our investigation showed that, in point of fact, these representations to Baker were false in that Sussmann was representing the Clinton campaign (as evidenced by, among other things, his law firm’s billing records and internal communications). 42 In addition, Sussmann was representing a second client, a technology executive named Rodney Joffe (as evidenced by various written communications, Sussmann’s subsequent congressional testimony, and other records).

Cyber experts from the FBI examined the materials given to Baker and concluded that they did not establish what Sussmann claimed they showed. At a later time, Sussmann made a separate presentation regarding the Alfa Bank allegations to another U.S. government agency and it too concluded that the materials did not show what Sussmann claimed. In connection with that second presentation, Sussmann made a similar false statement to that agency, claiming that he was not providing the information on behalf of any client.

[snip]

As explained in Section IV.E. l .c.i, the evidence collected by the Office also demonstrated that, prior to providing the unfounded Alfa bank claims to the FBI, Sussmann and Fusion GPS (the Clinton campaign’s opposition research firm) had provided the same information to various news organizations and were pressing reporters to write articles about the alleged secret communications channel. Moreover, during his September 2016 meeting at the FBI, Sussmann told Baker that an unnamed news outlet was in possession of the information and would soon publish a story about it. The disclosure of the media’s involvement caused the FBI to contact the news outlet whose name was eventually provided by Sussmann in the hope of delaying any public reporting on the subject. In doing so it confirmed for the New York Times that the FBI was looking into the matter. On October 31, 2016, less than two weeks before the election, the New York Times and others published articles on the Alfa Bank matter and the Clinton campaign issued tweets and public statements on the allegations of a secret channel of communications being used by the Trump Organization and a Russian bank – allegations that had been provided to the media and the FBI by Fusion GPS and Sussmann, both of whom were working for the Clinton campaign. [my emphasis; link]

And here’s how Durham presented his prosecutorial decision.

Accordingly, Sussmann’s conduct supports the inference that his representations to both the FBI and the CIA that he was not there on behalf of a client reflect attempts to conceal the role of certain clients, namely the Clinton campaign and Joffe, in Sussmann’s work. Such evidence also further supports the inference that Sussmann’s false statements to two different agencies were not a mistake or misunderstanding but, rather, a deliberate effort to conceal the involvement of specific clients in his delivery of data and documents to the FBI and CIA. [link]

[snip]

First, and as noted above, we identified certain statements that Sussmann made to the FBI and the CIA that the investigation revealed were false. Given the seriousness of the false statement and its effect on the FBI’s investigation, a federal Grand Jury found probable cause to believe that Sussmann had lied to the FBI and charged him with making a false statement to the Bureau, in violation of 18 U.S.C. § 1001. 1675 Ultimately, after a two-week trial, a jury acquitted Sussmann of the false statement charge.

We also considered whether any criminal actions were taken by other persons or entities in furtherance of Sussmann’s false statement to the FBI. The evidence gathered in the investigation did not establish that any such actions were taken. [link]

As noted above, just in these two passages Durham repeats, five times, that Sussmann made false statements, even though he never charged Sussmann with making false statements to the CIA and even though a jury found Sussmann not guilty of making false statements to the FBI (Durham also misrepresents that the billing evidence presented at trial, which didn’t show Sussmann billing Hillary for the meeting with Baker). This is a gross assault on due process, to accuse a man anew of the charges for which he has already been acquitted.

Durham claims, in explaining why he charged this flimsy case, that the [alleged] “false statement” was serious and had what he insinuates was a major effect on the FBI investigation. Remember: When Durham made this prosecutorial decision, he still had never bothered to check two Jim Baker phones in DOJ IG possession (one of which he had learned about years earlier), texts in Baker’s iCloud account that complicated his case, and documents in DOJ IG’s possession showing that the FBI understood — whether true or not — that the Alfa Bank allegation came from the DNC. Indeed, Durham obscures that while those Baker texts did show that Sussmann had conveyed such a claim by text, those belatedly discovered texts undermined Durham’s case at trial that Sussmann had repeated the claim in person (without providing any clarity about how Sussmann meant “on behalf of”). And one possible explanation for the acquittal is that the jury found that Sussmann didn’t repeat his claim that he was representing no client at the face-to-face meeting with Baker. Certainly, the record showed that whatever memory Baker had of that meeting had been selectively reconstructed with Durham’s help to match the story he needed to sustain a certain narrative, one that didn’t line up with the documentary evidence.

And evidence presented at trial completely undermined the claim that this was a material false claim, the reason Durham made the claim about seriousness in the first place. Sussmann’s attorneys showed that only the threat of prosecution altered FBI Agent Ryan Gaynor’s memory — backed by his contemporaneous notes — that, in fact, he always understood that the allegation came from a DNC attorney. Durham’s star FBI witness admitted on cross-examination that he developed his belief that a reference to the DNC in his colleague’s Lync texts was just a typo after prosecutor Andrew DeFilippis coached him on that point. There were other Lync texts recording a belief that the tip had come from the DNC. Several people at the FBI conducted this investigation as if they understood it to be an investigation of a DNC tip, which likely contributed to the errors the FBI made in their investigation. Durham claims the opposite.

Durham seems to hang his claim about seriousness on his own two inferences — one on top of another — that Sussmann had to have been deliberately hiding something, even though evidence presented at trial, most notably that Sussmann offered up information about having a client with both the FBI and CIA, undermined those inferences. As noted, Durham found April Lorenzen’s inferences as a private citizen to be potentially criminal, but he puts the weight of DOJ behind inferences that proved less robust than Lorenzen’s own.

Particularly given the fact that Durham only belatedly, months after indicting Sussmann, discovered evidence corroborating Sussmann’s explanation for reaching out to Baker — that he helped the FBI kill the NYT story the campaign very much wanted published — the Special Counsel’s misrepresentation of the timeline of press contacts is particularly dishonest. In response to an Eric Lichtblau email asking for more details about Russian hacking, Sussmann provided the tip. Durham’s claim that Sussmann “eventually provided” Lichtblau’s name falsely suggests it took more than a few days to make this happen. After that, Sussmann didn’t push the Alfa Bank story until it got published via other channels. For its part, Fusion was pushing this story weeks later, after April Lorenzen’s separately posted data had renewed questions about it. This muddled timeline repeats the outlandish claim Durham prosecutor Brittain Shaw made in opening arguments that an article most Democrats view as profoundly damaging was precisely the October Surprise Hillary wanted. But in this final report, it’s wildly dishonest spin to cover up the fact that Durham didn’t learn a key detail — that Sussmann helped kill the NYT story — until after charging him.

All the more so because telling the truth about Sussmann’s willingness to help the FBI kill the story suggests Sussmann’s version of the story is far more credible than Durham’s.

How Durham avoids admitting he charged a “literally true” statement as false

If you read nothing more than John Durham’s Executive Summary, you would never learn that John Durham falsely led the press to believe that Danchenko attributed the pee tape allegation to someone with distant ties to Hillary rather than the two Russians who admitted they went out drinking with Danchenko during the period in question. More importantly, you would never learn that Durham created that false pee tape panic out of what Judge Anthony Trenga ruled was a literally true statement.

This section of the Executive Summary, which doesn’t mention any prosecutorial decision regarding Dolan, is completely divorced from the prosecutorial decision it pertains to.

During the relevant time period, Danchenko maintained a relationship with Charles Dolan, a Virginia-based public relations professional who had previously held multiple positions and roles in the Democratic National Committee (“DNC”) and the Democratic Party. In his role as a public relations professional, Dolan focused much of his career interacting with Eurasian clients, with a particular focus on Russia. As described in Section IV.D. l.d.ii, Dolan previously conducted business with the Russian Federation and maintained relationships with several key Russian government officials, including Dimitry Peskov, the powerful Press Secretary of the Russian Presidential Administration. A number of these Russian government officials with whom Dolan maintained a relationship – and was in contact with at the time Danchenko was collecting information for Steele – would later appear in the Dossier.

In the summer and fall of 2016, at the time Danchenko was collecting information for Steele, Dolan traveled to Moscow, as did Danchenko, in connection with a business conference. As discussed in Section IV.D. l .d.iii, the business conference was held at the Ritz Carlton Moscow, which, according to the Steele Reports, was allegedly the site of salacious sexual conduct on the part of Trump. Danchenko would later inform the FBI that he learned of these allegations through Ritz Carlton staff members. Our investigation, however, revealed that it was Dolan, not Danchenko, who actually interacted with the hotel staff identified in the Steele Reports, so between the two, Dolan appears the more likely source of the allegations.

As discussed in Section IV.D. l .d.vi, our investigation also uncovered that Dolan was the definitive source for at least one allegation in the Steele Reports. This allegation, contained in Steele Report 2016/105, concerned the circumstances surrounding the resignation of Paul Manafort from the Trump campaign. When interviewed by the Office, Dolan admitted that he fabricated the allegation about Manafort that appeared in the Steele Report. Our investigation also revealed that, in some instances, Dolan independently received other information strikingly similar to allegations that would later appear in the Steele Reports. Nevertheless, when interviewed by the FBI, Danchenko denied that Dolan was a source for any information in the Steele Reports. [link]

When Durham gets around to describing his decision to charge Igor Danchenko in the Executive Summary, he makes no mention that one of those charges pertained to Dolan. Likewise, he makes no mention that Trenga threw out that charge before sending it to a jury.

Perhaps the most damning allegation in the Steele Dossier reports was Company Report 2016/95, which Steele attributed to “Source E,” one of Danchenko’s supposed sub-sources. This report, portions of which were included in each of the four Page FISA applications, contributed to the public narrative of Trump’s conspiring and colluding with Russian officials. As discussed in Section IV.D. l.f, Danchenko’s alleged source for the information (Source E) was an individual by the name of Sergei Millian who was the president of the Russian-American Chamber of Commerce in New York City and a public Trump supporter. The evidence uncovered by the Office showed that Danchenko never spoke with Sergei Millian and simply fabricated the allegations that he attributed to Millian.

When interviewed by Crossfire Hurricane investigators in late January 2017, Danchenko said that Source E in Report 2016/95 sounded as though it was Sergei Millian. As discussed in Section IV.D.1.f.i, Danchenko stated that he never actually met Millian. Instead, he said that in late-July 2016 he received an anonymous call from a person who did not identify himself, but who spoke with a Russian accent. Danchenko further explained that he thought it might have been Millian – someone Danchenko previously had emailed twice and received no response – after watching a YouTube video of Millian speaking. Thus, as detailed in Section IV.D. l .f.i, the total support for the Source E information contained in Steele Report 2016/95 is a purported anonymous call from someone Danchenko had never met or spoken to but who he believed might be Sergei Millian – a Trump supporter – based on his listening to a YouTube video of Millian. Unfortunately, the investigation revealed that, instead of taking even basic steps, such as securing telephone call records for either Danchenko or Millian to investigate Danchenko’ s hard-to-believe story about Millian, the Crossfire Hurricane investigators appear to have chosen to ignore this and other red flags concerning Danchenko’s credibility, as well as Steele’s.41

41 As noted in Section IV.D.2.f, a federal grand jury in the Eastern District of Virginia returned a five-count indictment against Danchenko charging him with making false statements. A trial jury, however, found that the evidence was not sufficient to prove his guilt beyond a reasonable doubt. See United States v. Igor Danchenko, 21-CR-245 (E.D. Va.). [link]

That’s what you’d learn from the Executive Summary.

It’s only in the body of his report where Durham reveals the Dolan-related charge and Judge Trenga’s finding that the statement he charged as a false statement was literally true. I’d like to congratulate Durham for here describing the false statements claims as “allegations” made by a grand jury, as distinct from the re-accusation of false statements made against Sussmann or his claim that Danchenko “fabricated the allegations” attributed to Millian. But even there he misrepresents the charges.

In November 2021, a grand jury sitting in the Eastern District of Virginia returned an indictment (“Indictment”) charging Igor Danchenko with five counts of making false statements to the FBI. The false statements, which were made during Danchenko’s time as an FBI CHS, related to his role as Steele’s primary sub-source for the Reports.

First, the Indictment alleged that Danchenko stated falsely that he had never communicated with Charles Dolan about any allegations contained in the Steele Reports. As discussed above, the documentary evidence clearly showed that Dolan was the source for at least one allegation in the Steele Reports. Specifically, that information concerned Manafort’s resignation as Trump’s campaign manager, an allegation Dolan told Danchenko that he sourced from a “GOP friend” but that he told our investigators was something he made up. 1384 The allegations regarding Dolan formed the basis of Count One of the Indictment.

Second, the Indictment alleged that Danchenko falsely stated that, in or about late July 2016, he received an anonymous phone call from an individual whom Danchenko believed to be Sergei Millian. Danchenko also falsely stated that, during this phone call, (i) the person he believed to be Millian informed him, in part, about information that the Steele Reports later described as demonstrating a well-developed “conspiracy of cooperation” between the Trump campaign and Russian officials, and (ii) Danchenko and Millian agreed to meet in New York. The available evidence was sufficient to prove beyond a reasonable doubt that Danchenko fabricated these facts regarding Millian. The allegations regarding Millian formed the bases for Counts Two through Five of the Indictment.

Following a one-week trial, and before the case went to the jury, the Court dismissed Count One of the Indictment pursuant to Federal Rule of Criminal Procedure 29. The Court held that Danchenko’s statement to the FBI regarding Dolan, i.e., that he [Danchenko] never “talked to [Dolan] about anything that showed up in the dossier” was “literally true” because, in fact, the information about Manafort was exchanged over email rather than in an actual verbal conversation. The Court denied Danchenko’s Rule 29 motion to dismiss related to the remaining counts of the Indictment. Following two days of deliberations, the jury concluded that the case had not been proven beyond a reasonable doubt.

In determining whether to bring criminal charges against Danchenko, the Office expected to be able to introduce additional evidence against Danchenko that supported the charged crimes. Thus, prior to trial, the Office moved in limine to introduce certain evidence as direct evidence of the charged crimes. Alternatively, the Office moved to admit the evidence as “other act” evidence pursuant to Federal Rule of Evidence 404(b) to prove Danchenko’ s motive, intent, plan and absence of mistake or accident. In particular, the Office sought permission to introduce evidence of:

(1) Danchenko’ s uncharged false statements to the FBI regarding his purported receipt of information reflecting Trump’s alleged salacious sexual activity at the Ritz Carlton Hotel in Moscow. In particular, the Office planned to call as a witness the German-national general manager of the Ritz Carlton, identified in the Steele Report 2016/080 as “Source E.” The Office expected the general manager would testify that he (i) had no recollection of speaking with Danchenko in June 2016 or at any time, (ii) had no knowledge of the allegations set forth in the Steele Report before their appearance in the media, and (iii) never discussed such allegations with Danchenko or any staff member at the hotel;

(2) Danchenko’s uncharged false statements to the FBI reflecting the fact that he never informed friends, associates, and/or sources that he worked for Orbis or Steele and that “you [the FBI] are the first people he’s told.” In fact, the evidence revealed that Danchenko on multiple occasions communicated and emailed with, among others, Dolan regarding his work for Steele and Orbis, thus potentially opening the door to the receipt and dissemination of Russian disinformation; and

(3) Danchenko’s email to a former employer in which Danchenko advised the employer, when necessary, to fabricate sources of information. Specifically, on February 24, 2016, just months before Danchenko began collecting information for the Steele Reports, the employer asked Danchenko to review a report that the employer’s company had prepared. Danchenko emailed the employer with certain recommendations to improve the report. One of those recommendations was the following:

Emphasize sources. Make them bold of CAPITALISED [sic]. The more sources the better. If you lack them, use oneself as a source ([Location redacted]-Washington-based businessman” or whatever) to save the situation and make it look a bit better. 1385

Danchenko’s advice that he attach multiple sources to information and obscure one’s own role as a source for information was consistent with Danchenko’s alleged false statements in which he denied or fabricated the roles of sources in the Steele Reports.

The Court ruled, however, that the evidence described above was inadmissible at trial. The prosecution was forced to then proceed without the benefit of what it believed in good faith was powerful, admissible evidence under Rule 404(6) of the Federal Rules of Evidence.

In reality, the question Danchenko answered about Dolan was an attempt to learn whether Dolan could have been a direct source to Steele, not to Danchenko. And Danchenko didn’t entirely deny talking to Dolan about such issues. He said they talked about “related issues perhaps but no, no, no, nothing specific.” One of the FBI Agents who tried to open an investigation into Dolan relied on the statements Danchenko did make, so it’s not like anything Danchenko said impeded that investigation.

Meanwhile, Durham’s description of the acquitted false statements against Millian conflates, as he repeatedly did during the prosecution, what Danchenko told the FBI he told Christopher Steele, and what showed up in the dossier, which Danchenko had no hand in writing. Danchenko said that some of the allegations in the dossier didn’t come from him — including the claim of conspiracy (and lots of FBI Agents have been disciplined because they didn’t pass on this detail to the FISA Court). What Danchenko told the FBI was that the caller had said there was an exchange of information with the Kremlin (which, in fact, Mueller’s investigation proved, there already had been!), but that there was, “nothing bad about it,” all of which (as Danchenko’s team made clear at trial) is utterly consistent with other things Millian was saying at the time. The alleged lie Danchenko told is that he believed at the time (in July 2016) that the caller was Millian. Also, Durham claims that Danchenko said he made plans to meet in New York; he doesn’t note that Danchenko said those were tentative plans. In other words, Durham here misrepresents what Danchenko actually said! Durham is the fabricator here, not Danchenko.

Having grossly overstated what the charge against Danchenko was, Durham claims that, “The available evidence was sufficient to prove beyond a reasonable doubt that Danchenko fabricated these facts regarding Millian.”

That’s why we have juries, buddy! No, there was not. Nuh uh.

For some reason, Durham feels the need to explain why he got his ass handed to him even though, he’s sure, he had enough evidence in hand to charge Danchenko.  He blames Judge Trenga’s exclusion of three pieces of evidence about uncharged conduct (here’s my post on that ruling and here’s Trenga’s order). Among the three pieces of evidence he claims he relied on when making a prosecutorial decision in November 2021 is an interview with the former General Manager of the Ritz that only happened in August 2022 (the indictment relies on Dolan and one of Dolan’s colleagues for that claim, not the Manager himself). At least as described, Durham would have needed a time machine for the GM’s testimony to have factored in his prosecutorial decision.

Plus, the claim that those three pieces of evidence — none of which directly pertain to Millian! — were what Durham relied on to make a prosecutorial decision in November 2021 conflicts with what his team said in a filing last September. Back then, they said certain emails from Millian were the most probative proof against Danchenko.

The July 2020 emails between Millian and Zlodorev also bear circumstantial guarantees of trustworthiness. Again, in July 2020, Millian had no motive to lie to Zlodorev.

Third, whether the statements relate to a material fact. The Government submits that this factor is not in dispute.

Fourth, whether the statements are the most probative evidence on the point. Millian’s emails written contemporaneous to the events at issue are undoubtedly the most probative evidence to support the fact that Millian had never met or spoken with the defendant.

Trenga decided those emails were inadmissible hearsay.

Durham probably points to three other pieces of evidence — one obtained nine months after the indictment and all unrelated to Millian — because to admit that his case relied on inadmissible hearsay would require Durham to admit something still more embarrassing. Those hearsay emails from Millian were only the most probative evidence because Durham insanely charged Danchenko relying on what Millian had said on his Twitter account.

Only three months after indicting Danchenko on November 3, 2021 did Durham get around to interviewing Millian.

1085 OSC Report of Interview of Sergei Millian on Feb. 5, 2022 at 1.

His team did that interview remotely; Durham didn’t even have direct proof that Millian was in Dubai when he did that interview.

The Government has conducted a virtual interview of Millian. Based on representations from counsel, the Government believes that Millian was located in Dubai at the time of the interview.

[snip]

The Government has also been in contact with Millian’s counsel about the possibility of his testimony at trial. Nonetheless, despite its best efforts, the Government’s attempts to secure Millian’s voluntary testimony have been unsuccessful. Moreover, counsel for Millian would not accept service of a trial subpoena and advised that he does not know Millian’s address in order to effect service abroad.

[snip]

In the case of a U.S. national residing in a foreign country, 28 U.S.C. § 1783 allows for the service of a subpoena on a U.S. national residing abroad. Here, the Government has made substantial and repeated efforts to secure Millian’s voluntary testimony. When those efforts failed, the Government attempted to serve a subpoena on Millian’s counsel who advised that he was not authorized to accept service on behalf of Mr. Millian. The Government, not being aware of Millian’s exact location or address, asked counsel to provide Millian’s address so that service of a subpoena could be effectuated pursuant to 28 U.S.C. § 1783. Counsel stated that he does not know Millian’s address. In any event, even if the Government had been able to locate Millian, it appears unlikely that Millian would comply with the subpoena and travel to the United States to testify.

And a week after that interview, Durham accused Millian (though he didn’t name him) of “misrepresent[ing] facts” when he claimed “they” were spying on the White House on the very same Twitter account on which Durham relied to obtain the indictment.

One day later, Millian’s Twitter account revealed that Millian told the Trump White House who was “working against them” long before it was publicly known (Durham made no mention of these Tweets when he tried to claim that emails Millian sent in 2020 could be considered reliable).

In other words, abundant evidence suggests that Durham indicted Danchenko without doing the most basic step first, testing Millian’s reliability. By the time he got to trial, Millian — who like Danchenko, had been the subject of a counterintelligence investigation, and who unlike Danchenko had been frolicking in St. Petersburg during 2016 with Oleg Deripaska, someone who had a key role in Russia’s interference in 2016 — proved more than unreliable.

Durham makes no mention of that truly humiliating prosecutorial misstep, an embarrassment set in motion when he decided to indict a man based on claims made on Twitter, in his entire Report.

And yet not only does Durham refuse to state clearly, in his description of the prosecutorial decision, that Danchenko was acquitted of the charges against him, in his Executive Summary he falsely claims that he has proven Danchenko fabricated the claim. Worse still, Durham complains about investigative steps the Crossfire Hurricane investigators appear to have taken (which are different from the Mueller ones, who obtained abundant records about Millian’s communications), but he himself focused exclusively on disproving a telephony call between the two men, in spite of evidence (including of the contacts setting up a meeting between Millian and George Papadopoulos in precisely the same period) that any such call would have happened over the Internet.

Durham does this while making it clear that one reason he charged the Millian counts is because the allegation attributed to Millian, “contributed to the public narrative of Trump’s conspiring and colluding with Russian officials.” That’s only a crime if someone lied to the FBI about it, and Durham didn’t prove his case that Danchenko did.

It should not be left to me, almost a week after this report got released, to point out something grotesque. Durham is still claiming that these men lied, even though two juries told him he didn’t have the evidence to prove that case. That’s not just a grave abuse of Michael Sussmann and Igor Dancheko’s due process, but it exhibits profound disrespect to the service of the jurors.

After both his acquittals, Durham issued a statement claiming, “we respect the jury’s decision and thank them for their service.” And then he wrote a 300-page report telling them he knew better.

John Durham Committed the “Crime” of “Inferring” of Which He Accused Rodney Joffe

/17 Comments/in , /by

I’d like to look at 13 instances in which the word, “inference” appears in the Durham Report.

Almost half come in Durham’s discussion of Rodney Joffe’s work on the Alfa Bank anomalies. Durham states as fact that Joffe “tasked” a number of people to “mine … data to establish ‘an inference’ … tying then-candidate Trump to Russia.”

With respect to the Alfa Bank materials, our investigation established that Joffe had tasked a number of computer technology researchers who worked for companies he was affiliated with, and who had access to certain internet records, to mine the internet data to establish “an inference” and “narrative” tying then-candidate Trump to Russia.

[snip]

In particular, in late July and early August, Joffe commenced a project in coordination with Sussmann and Perkins Coie to support an “inference” and “narrative” tying Trump to Russia. For example, records show that on three days in August 2016, Joffe had meetings or conference calls with Sussmann and Elias. 1401 At about the same time, Joffe began tasking his own employees and associates to mine and assemble internet data that would support such an inference or narrative. 1402

[snip]

Regarding this whole project, my opinion is that from DNS all we could gain even in the best case is an *inference*. I have not the slightest doubt that illegal money and relationships exist between pro-Russian and pro-Trump, meaning actual people very close to Trump if not himself, [meaning actual people very close to Trump if not himself. And by Putin’s traditional style, people Putin controls, but not himself. He controls the oligarchs and they control massive fortunes and cross nearly all major industries in a vast number of countries.]

But even if we found what Rodney asks us to find in DNS we don’t see the money flow, and we don’t see the content of some message saying “send me the money here” etc.

I could fill out a sales form on two websites, faking the other company’s email address in each form, and cause them to appear to communicate with each other in DNS (And other ways I can think of and I feel sure [University-1 Researcher-2] can think of[.])

IF Rodney can take the *inference* we gain through this team exercise … and cause someone to apply more use.fit! tools of more useful observation or study or questioning … then work to develop even an inference may be worthwhile.

That is how I understood the task. Because Rodney didn’t tell me more context or specific things. What [Cyber Researcher- 1] has been digging up is going to wind up being significant. It’s just not the case that you can rest assured that Hil[l]ary’s opposition research and whatever professional govts and investigative journalists are also digging … they just don’t all come up with the same things or interpret them the same way. But if you find any benefit in what [he] has done or is doing, you need to say so, to encourage [him]. Because we are both killing ourselves here, every day for weeks.

[I’m on the verge of something interesting with hosts that talk to the list of Trump dirty advisor domain resources, and hosts that talk to [Russian Bank1]-* domains. Take even my start on this and you have Tehran and a set of Russian banks they talk to. I absolutely do not assume that money is passing thru Tehran to Trump. It’s just one of many *inferences* I’m looking at.

SAME IRANIAN IP THAT TALKS TO SOME TRUMP ADVISORS, also talks to:

[list of domains redacted]

(Capitals don’t mean SUPER SIGNIFICANT it was just a heading.)

Many of the IPs we have to work with are quite MIXED in purpose, meaning that a lot of work is needed to WINNOW down and then you will still only be left in most cases with an *inference* not a certainty.]

Trump/ advisor domains I’ve been using. These include ALL from Rodney’s PDF [the Trump Associates List] plus more from [Cyber Researcher-1]‘s work[:

Trump/ advisor domains I’ve been using. These include ALL from [Tech Executive-1’s] PDF [the Trump Associate’s List] plus more from [name redacted, probably also Cyber Researcher-1]’s work: [list of domains redacted] [RUSSIAN BANK-1] DOMAINS [list of domains redacted] More needs to be added to both lists.]1438 

The word “inference” here comes not from Joffe, but from April Lorenzen, who wrote the large block quote here, to which I’ve added — in the italicized brackets — language from the Durham motion to get it admitted at trial. Even without the Lorenzen language Durham excludes, his deceit is clear, because someone that Durham has never included in his feverish conspiracy theories — Cyber Researcher-1 — is described as doing his or her own work. With Lorenzen’s language included, Durham’s deceit is still more obvious, given how Lorenzen talks about forming her own inference. Not to mention the fact that (as I noted here), many of Lorenzen’s inferences — starting with the fact that Trump’s campaign manager was laundering money from Russia through Cyprus and that he had a tie with Alfa Bank founder’s son-in-law or that Trump was hiding business ties with Russia — turned out to be 100% correct.

But Durham’s deceit goes even further, because the effort to review DNS data for signs of Russian hacking started, organically, in June, not in July in response to Joffe.

Durham’s misrepresentation of the relationship between the various researchers is particularly rich given that a technical review he had done months after indicting Sussmann revealed that the data Sussmann shared with the FBI was referred to as Lorenzen’s data, not Joffe’s.

The 851 records of resolutions on the USB drive were an exact match for a file of resolutions sent from University-1 Researcher-2 to University-I Researcher- 1 on July 29, 2016, which was referred to as “[first name of Tech Company-2 Executive-l]’s data.”

As it happens, three more of the appearances of the word “inference” in the Durham Report come from the technical review.

The FBI DNS experts with whom we worked also identified certain data and information that cast doubt upon several assertions, inferences, and allegations contained in (i) the above-quoted white papers about the Yotaphone allegations, and (ii) the presentation and Yotaphone-related materials that Sussmann provided to the CIA in 2017.

[snip]

Data files obtained from Tech Company-I, Tech Company-2, and University-I reflect that Yotaphone-related lookups involving IP addresses assigned to the EOP began long before November or December 2016 and therefore seriously undermine the inference set forth in the white paper that such lookups likely reflected the presence of a Trump transition-team member who was using a Yotaphone in the EOP.

[snip]

In sum, as a result of our investigation, the FBI experts advised us that actual data and information on YotaPhone resolution requests directly undermined or refuted several conclusions and inferences included in the Yotaphone white paper. 1674

But that technical review only treats claims made about Yotaphone, not the Alfa Bank allegations, as “inferences.”

I’ll return to the way that Durham presents this technical review at some later time. It doesn’t help Durham in the way he thinks it does.

The point being, though, is that Durham claimed that Joffe was directing people to make inferences about Alfa Bank. He investigated private citizens who made such inferences as a crime.

Which is why I find it telling that the remaining three uses of the word “inference” in the Durham report are his own.

For example, Durham infers, first, that Sussmann’s statements that he was not at the FBI or CIA on behalf of any client is proof he was hiding who his client(s) were, and from that inference, he in turn infers that Sussmann was deliberately trying to hide Clinton and Joffe.

Accordingly, Sussmann’s conduct supports the inference that his representations to both the FBI and the CIA that he was not there on behalf of a client reflect attempts to conceal the role of certain clients, namely the Clinton campaign and Joffe, in Sussmann’s work. Such evidence also further supports the inference that Sussmann’s false statements to two different agencies were not a mistake or misunderstanding but, rather, a deliberate effort to conceal the involvement of specific clients in his delivery of data and documents to the FBI and CIA.

Both these inferences are nonsense — not least because Clinton no longer was a client of Sussmann’s when he went to the CIA in 2017 and both in the process of setting up the CIA meeting and helping the FBI to kill the NYT Alfa Bank story, Sussmann revealed that he did have a client he was working with.

Durham simply refuses to consider the possibility that DNS experts can see anomalous traffic and view it with alarm. And he grossly misrepresents the evidence regarding whether Sussmann pushed the Alfa Bank story after helping the FBI to kill it, probably because that evidence strongly supports Sussmann’s claimed motive: to give the FBI a chance to investigate before the public story alerted those behind the anomaly.

The final use of the word inference in the report is even more egregious.

As discussed above, Fusion GPS approached Steele in May 2016. Prior to his retention, Glenn Simpson met with Steele at Heathrow Airport in London and pitched Steele on the opposition research project. 1100 Approximately one week later, Danchenko contacted RIA Novosti journalists seeking Millian’s contact information. 1101 The timing of Danchenko’s request to RIA Novosti on the heels of Steele’s meeting with Simpson in London strongly supports the inference that Fusion GPS directed Steele to pursue Millian. 1102 Indeed, by the time of Steele’s meeting with Simpson, Nellie Ohr had already identified Millian’s alleged connections to Trump.

As with Carter Page (and Felix Sater, the focus on whom Durham continually downplayed over the course of this investigation), it didn’t take a research firm to identify Millian’s ties to Trump. Especially not with Millian bragging of those ties. Indeed, elsewhere Durham suggests Ohr learned of Millian from the RIA Novosti interviews he did in April. RIA Novosti was just as accessible to Danchenko as it was to Ohr.

But once you’ve traced the interest in Millian back to a Nellie Ohr report completed on April 22, 2016, then you’re tracking the research started no later than November 2015 under Paul Singer. You’re blaming Hillary for a project she took over from a right wing billionaire. You’re also tracking research that turned out to be reliable and accurate.

Again, these kinds of inferences are the stuff that Durham tried to criminalize when Lorenzen, a private citizen, made them.

But he nevertheless included them in a declination report provided to the Attorney General.

“Ridiculous:” Durham’s Failed Clinton Conspiracy Theory

/43 Comments/in , /by

I put together a very rough list of the interviews that John Durham included in his Report and a table showing the organization of his report.

I’d like to describe what appears to have happened with the investigation. Remember a few things about this list: It won’t include everything. Even just among witnesses who testified at trial, Durham was known to have done initial interviews, then threatened them with prosecution, in an often successful attempt to shade their testimony (see this post for an example). With others, Durham is being affirmatively misleading by stating that people who did appear before the grand jury were unwilling to be interviewed.

This list is just a list of interviews that actually support his narrative.

2019: Manufacturing a new origin story

As noted, most of the junkets that Durham and Barr did in the first year of the investigation don’t appear. The only overseas investigative steps noted in 2019 include the Legal Attaché personnel in London and the two Australian sources, Alexander Downer and Erika Thompson (described as Australian Diplomat-1), behind the original tip on George Papadopoulos. Durham did two separate interviews with the Australians, done on the same day, months before the DOJ IG Report determined the investigation was properly predicated.

Durham relies heavily on Downer, instead of Thompson, and claims to have discovered a conflict in their two accounts.

The Australian account reflects that two meetings of a casual nature took place with Papadopoulos. 215 These meetings were documented by Downer on May 11, 2016 and by Australian Diplomat-I later in the month. 216 Both diplomats advised that prior to the Spring of 2016, Papadopoulos was unknown to them. 217 Notably, the information in Paragraph Five does not include any mention of the hacking ofthe DNC, the Russians being in possession of emails, or the public release of any emails. In addition, when interviewed by the Office, Downer stated that he would have characterized the statements made by Papadopoulos differently than Australian Diplomat-1 did in Paragraph 5. According to Downer, Papadopoulos made no mention of Clinton emails, dirt or any specific approach by the Russian government to the Trump campaign team with an offer or suggestion of providing assistance. Rather, Downer’s recollection was that Papadopoulos simply stated “the Russians have information” and that was all. 218

As recounted to the FBI on August 2, 2016, by Australian Diplomat-1, the substance of Paragraph Five was written in a “purposely vague” way. 219 This was done because Papadopoulos left a number of things unexplained and “did not say he had direct contact with the Russians.” 220 The impression Papadopoulos made on the Australian diplomats was wide ranging. On the one hand, he “had an inflated sense of self,” was “insecure,” and was “trying to impress.” 221 On the other hand, he was “a nice guy,” was “not negative,” and “did not name drop.” 222

Downer noted that he

was impressed Papadopoulos acknowledged his lack of expertise and felt the response was uncommon for someone of Papadopoulos’ age, political experience and for someone thrust into the spotlight overnight. Many people in a similar position would represent themselves differently and [Downer] would have sniffed them out. If [Downer] believed Papadopoulos was a fraud [he] would not have recorded and reported on the meeting [he] had with Papadopoulos. 223

Downer also said that he “did not get the sense Papadopoulos was the middle-man to coordinate with the Russians.” 224 The Australian diplomats would later inform the FBI, and subsequently the Office, that the impetus for passing the Paragraph Five information in late-July was the public release by WikiLeaks ( on July 22, 2016) of email communications that had been hacked from the DNC servers. 225

215 We note there is an inconsistency in the statements given by Australian Diplomat-1 and former-High Commissioner Downer to the Crossfire Hurricane interviewers in August 2016 and what they told the Office when interviewed in October 2019. Australian Diplomat-1 and Downer were interviewed together in August 2016, and, according to the FD-302 prepared afterward by Supervisory Special Agent- 1, Papadopoulos made the statements about the Russians during the May 6, 2016 introductory meeting when he met only with Australian Diplomat-1. When the two diplomats were interviewed separately by the Office in October 2019, investigators were advised that Papadopoulos made the statements in front of both Australian Diplomat-1 and Downer during the second meeting on May 10, 2016.

216 The meetings with Papadopoulos took place on May 6 and 10, 2016. Australia 302 at 1- 2. The Australian diplomats documented the meetings in two cables dated May 11 and May 16, 2016; OSC Report of Interview ofAlexander Downer on Oct. 9, 2019 at 2; OSC Report of Interview ofAustralian Diplomat-1 on Oct. 9, 2019 at 3.

217 OSC Report of Interview of Alexander Downer on Oct. 09, 2019 at 1; OSC Report of Interview of Australian Diplomat-I on Oct. 09, 2019 at 1-2.

218 OSC Report of Interview of Alexander Downer on Oct. 09, 2019 at 2 (and related field notes); Downer also is reported to have stated in an interview that in talking with Papadopoulos there was “no suggestion that there was collusion between Donald Trump or Donald Trump’s campaign and the Russians.” Brooke Singman, Diplomat Who Helped Launch Russia Probe Speaks Out, Defends Role, Fox News (May 10, 2019), https://www.foxnews.com/politics/forrner-ausralian-diplomat-alexander-downer-defendswork-pushes-back-on-claim-he-tried-to-trap-papadopoulos. 219 Australia 302 at 2.

There’s no conflict.

Papadopoulos appears to have told the story about advance notice of Russia’s help to Thompson twice, once on May 6 and again, with Downer present, on May 10. She explains that not everything Papadopoulos said made it into her report. It’s likely Papadopoulos said more at the first meeting (I believe the record reflects that he drank more at the first meeting).

But by relying on Downer instead of Thompson, Durham claims that there was less to the tip than Thompson appears to have taken from it.

Having manufactured an alternate story about the initial predication, it’s no wonder Durham pushed Michael Horowitz not to say the investigation was fully predicated.

Durham also appears to have investigated why it took so long for the Steele reports to make their way from New York to DC. This is a fairly remarkable and sustained part of his report, because Durham is basically complaining that the pee tape report wasn’t immediately taken seriously.

Finally, from the very first year, Durham started doing investigations into the treatment of the Clinton Foundation investigation. As I have noted, his report leaves out really important details of that investigation: that agents who exhibited every bit as much bias as Durham finds in Peter Strzok, Lisa Page, or Kevin Clinesmith were running a key informant on the investigation, something no one has alleged happened with investigations into Trump’s associates.

That silence is all the more important given how Durham compares the predication of the Crossfire Hurricane investigation with that of Clinton Foundation, which relied in significant part on the Steve Bannon-linked Clinton Cash book which was every bit as shoddy as the Christopher Steele dossier, with a much more aggressive bias.

Once again, the investigative actions taken by FBI Headquarters in the Foundation matters contrast with those taken in Crossfire Hurricane. As an initial matter, the NYFO and WFO investigations appear to have been opened as preliminary investigations due to the political sensitivity and their reliance on unvetted hearsay information (the Clinton Cash book) and CHS reporting. 388 By contrast, the Crossfire Hurricane investigation was immediately opened as a full investigation despite the fact that it was similarly predicated on unvetted hearsay information. Furthermore, while the Department appears to have had legitimate concerns about the Foundation investigation occurring so close to a presidential election, it does not appear that similar concerns were expressed by the Department or FBI regarding the Crossfire Hurricane investigation. Indeed, in short order after opening the Crossfire Hurricane file and its four subfiles, the FBI was having one of its long-time CHSs meet not with just one Trump campaign associate, but meet and record conversations with three such insiders. And a little more than a month after opening the Crossfire Hurricane file on Page, a “senior U.S. law enforcement official” was publicly reported as confirming for Michael Isikoff and Yahoo! News that the FBI had Page on its radar screen. 389

Durham says two Australians who had no stake in the election (and who likely didn’t want to create a row with a major political candidate) have the same credibility as a long term political hoaxster paid by Trump’s ultimate campaign manager.

And in making this comparison, Durham doesn’t consider the urgency of the ongoing Russian attack on democracy (something that he generally ignores throughout the report). The underlying crime behind the Papadopoulos tip was potential (and real, in the case of both Paul Manafort and Roger Stone) ongoing involvement in Russia’s efforts to interfere in the election.

2020: Laying the ground work for the Clinton conspiracy

Early in 2020, Barr made Durham a Special Counsel, giving him authority to use a grand jury.

The very next day, he met with Jim Baker.

In cross-examination at the Sussmann trial, Baker lawyer Sean Berkowitz situated this meeting and another, in June 2020, when Baker’s story about the Sussmann meeting was still radically different than the one he told at trial, in terms of a leak investigation into Baker that had just closed. Baker had recently been criminally investigated by Durham, he knew that Durham would come after him again on the Russian investigation, and that February 2020 meeting was the first after the close of the leak investigation.

Q. So you know what it’s like to be under criminal investigation. Right?

A. Yes.

Q. You know what it’s like to be under criminal investigation by this man?

A. Yes.

Q. That’s Mr. Durham?

A. Yes.

Q. In fact, sir, in March of 2017 Mr. Durham was appointed by the Department of Justice to conduct a criminal investigation of the unauthorized disclosure of classified information to a reporter. Correct?

A. I don’t remember exactly when he was appointed, but that’s roughly correct based on my recollection of the timeframe.

Q. And you were a subject of that investigation?

A. I was never told that I was a subject.

Q. Is it fair to say that your lawyer refused to let you answer questions before Congress because you were under investigation?

A. He did object to certain questions — certain questions — because I was under investigation. That’s correct.

Q. Under criminal investigation. Right?

A. It was a criminal investigation was my understanding, yes.

Q. And you refused to answer those questions on the gounds that it might incriminate you?

A. I refused to answer those questions on advice of counsel, and it was a voluntary interview so I could refuse to answer any questions that I didn’t want to answer.

Q. And the investigation took place between 2017 and 2018. correct:

A. Say that again.

Q. The investigation took place between 2017 and 2019. correct?

A. I think it was not closed until 2020 by the Department.

[snip]

Q. And you, sir, were aware that Mr. Baker was — I mean, Mr. Durham was reappointed as special counsel, correct, in or around 2019?

A. For this matter?

Q. Yes.

A. Yes.

Q. And when that happened, you were concerned, were you not?

A. Concerned about what?

Q. That Mr. Durham might come and investigate you more?

A. I wasn’t concerned about it. I expected it.

[snip]

Q. It’s the first time you saw him after you were the subject of the criminal investigation by him?

A. Again, I was never told that I was a subject.

Q. Was that the first time?

A. Yeah, I think that was the first time.

In June 2020, Baker’s story started to evolve until ultimately, he testified, claiming 100% certainty about a story that had changed at least four times, to precisely the story Durham would want him to.

Most of the early 2020 interviews relied on by Durham in his report pertain to two topics: His reinvestigation of how the Clinton Foundation investigation proceeded, and his pursuit of a claim that Hillary framed Donald Trump (marked as “Russian intelligence” in the timeline).

Starting in June 2020, Durham appears to have started focusing on Igor Danchenko, burning him as a source, reviewing the long-dormant counterintelligence investigation into him, and focusing the same kind of pressure on Danchenko handler Kevin Helson (whom Durham seems to have referred for further investigation, on a date he doesn’t provide, for his handling of Danchenko). In July 2020, Barr provided Lindsey Graham the interview transcripts for Danchenko, which would lead to (or provide the excuse for) Danchenko’s exposure. In September 2020, the Senate Judiciary Committee would stage a FISA hearing to expose Danchenko’s past counterintelligence investigation.

None of these were effective investigative steps. Most witnesses didn’t testify at trial, and the one who did — Helson — was a devastating witness against Durham’s case (which may be why he was referred for further investigation). Those investigative steps did make Danchenko far more insecure, both legally and financially.

On September 29, John Ratcliffe would also share the report and, a week later, the underlying intelligence, around which Durham would build his Clinton conspiracy theory: A Russian intelligence Report that Hillary’s complaints about Trump’s pro-Russian bias stemmed from an attempt to cover up her email scandal and not from real concern about Russia or frustration with being victimized by a nation-state hack during an election.

On October 19, after Nora Dannehy disrupted Durham’s plan to release an initial report before the election, Barr made him Special Counsel so he could stick around for two more years to try to build the case he hadn’t done by 2020.

One of the most telling things about Durham’s actions in 2020 is that he didn’t do any of the ground work he needed to do to investigate the accusations he would make in late 2021. His primary work on the Alfa Bank case was making Danchenko far, far more vulnerable. He records virtually no obvious investigative work on the Alfa Bank allegations in 2020. He did little work on the dossier allegations. Some key investigative steps — getting a technical review of the Alfa Bank allegation and trying to secure Sergei Millian’s make-or-break testimony — waited until 2022, well after he had actually indicted these cases.

2021: Preparing actual indictments to hang failed conspiracy theories on

And it’s not just those two indictments Durham neglected in 2020. Here’s something Carter Page should think seriously about: John Durham did not do the investigation into the problems with his FISA application until the statutes of limitation started to expire in 2021. Given that investigative history, it’s fairly clear that Durham was never going to charge FBI agents in conjunction with those applications. Never. He had other priorities.

Instead, in 2021, he started making belated attempts to substantiate his Clinton conspiracy, with interviews to set up Charles Dolan as a witness.

Durham did no apparent interviews into Sergei Millian in 2021.

He did begin the effort — one paralleled and assisted by Alfa Bank lawsuit against the researchers in question, which to a DC judge seemed,”almost like they were written by the same people in some way,” — to spin the research into DNS anomalies into a deliberate plan by Hillary’s team.

In Durham’s investigations, however, there were obvious basic investigative failures. Durham didn’t interview people from Cendyn and Listrak until after the Sussmann indictment (and in the latter case, it’s not clear whether Durham spoke to anyone authoritative or even got the name of all the people interviewed).

I’ve already laid out how Durham didn’t even ask Michael Horowitz for relevant evidence until after the indictment. It was several months later before he asked Jim Baker to check his iCloud for the exculpatory communications that Sussmann correctly predicted would be there.

Durham didn’t interview Sergei Millian — and even then, he only did so remotely, with no agreement he would testify at trial — until February 2022, three months after indicting Danchenko.

These indictments — both of which could only have worked if charged as conspiracy indictments for which Durham had no evidence — were always bound to fail. They were bound to fail because they weren’t the result of an investigation, the logical progression from a clear crime committed. They were instead legal clothes hangers on which he could try to hang a conspiracy theory. They might have worked if Sussmann or Rodney Joffe or Danchenko had caved to the economic and legal pressure Durham was applying (as he did with Danchenko, Durham also got Joffe discontinued as an FBI source, but that had no financial repercussions for Joffe). But the charges were so flimsy Sussmann and Danchenko mounted a fairly clearcut defense.

Late 2021 to 2022: Chasing Clinton conspiracies

There’s a detail, though, that is all the more revealing given Durham’s failure to conduct an adequate investigation into these charges before indicting. As I noted last year, even after Sussmann was indicted, Durham refused the former Clinton lawyer’s demand for a list of the people on the Clinton campaign with whom he had coordinated his Alfa Bank efforts. It wasn’t until months later that it became clear — as Sussmann laid out in a filing — that Durham hadn’t even interviewed any of the people Sussmann purportedly coordinated with until after the indictment.

[T]he Special Counsel has alleged that Mr. Sussmann met with the FBI on behalf of the Clinton Campaign, but it was not until November 2021—two months after Mr. Sussmann was indicted—that the Special Counsel bothered to interview any individual who worked full-time for that Campaign to determine if that allegation was true.

Here’s what those interviews look like, as laid out in the Durham Report:

11/10/21: Jennifer Palmieri

11/12/21: Jake Sullivan

1/19/22: John Podesta (Russian Intelligence)

5/11/22: Hillary Clinton (Russian Intelligence)

Those questions weren’t focused on Sussmann, though. They were focused on Durham’s Clinton conspiracy, the claim that she had made a plan to frame Donald Trump.

During an interview of former Secretary Clinton, the Office asked if she had reviewed the information declassified by DNI Ratcliffe regarding her alleged plan to stir up a scandal between Trump and the Russians. 44 ° Clinton stated it was “really sad,” but “I get it, you have to go down every rabbit hole.” She said that it “looked like Russian disinformation to me; they’re very good at it, you know.” Clinton advised that she had a lot of plans to win the campaign, and anything that came into the public domain was available to her.

In addition, the Office interviewed several other former members of the Clinton campaign using declassified materials441 regarding the purported “plan” approved by Clinton.

The campaign Chairperson, John Podesta, stated that he had not seen the declassified material before, characterized the information as “ridiculous,” and denied that the campaign was involved in any such “plan.”442 Jake Sullivan, the campaign Senior Policy Advisor, stated that he had not seen the intelligence reporting before and had no reaction to it other than to say, “that’s ridiculous.”443 Although the campaign was broadly focused on Trump and Russia, Sullivan could not recall anyone articulating a strategy or “plan” to distract negative attention away from Clinton by tying Trump to Russia, but could not conclusively rule out the possibility. 444 The campaign Communications Director, Jennifer Palmieri, who was shown the Referral Memo, 445 stated that she had never seen the memorandum before, found its contents to be “ridiculous,” and could not recall anything “like this” related to the campaign. 446 She stated that Podesta, Mook, Sullivan and herself were aware of a project involving ties between Trump and Russia being conducted by Perkins Coie, the campaign law firm, but she did not think Clinton was aware of it, nor did she receive any direction or instruction from Clinton about the project.447

Another foreign policy advisor (“Foreign Policy Advisor-2”) confirmed that the campaign was focused on Trump and Russia, but that focus was due to national security concerns and not designed to distract the public from Clinton’s server issue. 448

Every single one of them called Durham’s conspiracy theories “ridiculous.”

For good reason. As I’ve laid out, the timeline Durham obscures, in which Trump’s rat-fucker had contact with Russia weeks before Hillary purportedly ginned up this plan, disproves the conspiracy theory.

Which explains something about the Sussmann trial — led by Andrew DeFilippis, the same AUSA who had willingly attempted to trump up a crime against John Kerry. Over and over, Durham’s prosecutors willfully ignored Judge Christopher Cooper’s orders, thereby introducing evidence with no evidentiary basis. They did so most blatantly when, minutes after Cooper ordered DeFilippis not to read from a paragraph of a Hillary Tweet calling on FBI to investigate the Alfa Bank allegations, he did so anyway, predictably leading the same outlets that wrote supine reviews of the Durham report to focus exclusively on something not before the jury.

After Judge Cooper said he would reserve his decision, Berkowitz noted that in fact, DeFilippis planned to use the tweet to claim the campaign wanted to go to the FBI when the testimony at trial (from both Elias and Mook) would establish that going to the FBI conflicted with the campaign’s goals.

[T]hey are offering the tweet for the truth of the matter, that that’s what the campaign desired and wanted and that it was a accumulation of the efforts.

Number one, it’s not the truth; and in fact, it’s the opposite of the truth. We expect there to be testimony from the campaign that, while they were interested in an article on this coming out, going to the FBI is something that was inconsistent with what they would have wanted before there was any press. And in fact, going to the FBI killed the press story, which was inconsistent with what the campaign would have wanted.

And so we think that a tweet in October after there’s an article about it is being offered to prove something inconsistent with what actually happened.

Then, after both Elias and Mook had testified that they had not sanctioned Sussmann going to the FBI, DeFilippis renewed his assault on Cooper’s initial exclusion, asking to introduce it through Mook’s knowledge that the campaign had tried to capitalize on the Foer story.

Having ruled in the past that the tweet was cumulative and highly prejudicial, Cooper nevertheless permitted DeFilippis to introduce the tweet if he could establish that Mook knew that the campaign tried to capitalize on the Foer story.

But Cooper set two rules: The government could not read from the tweet and could not introduce the part of the tweet that referenced the FBI investigation. (I explained what DeFilippis did at more length in this post.)

THE COURT: All right. Mr. DeFilippis, if you can lay a foundation that he had knowledge that a story had come out and that the campaign decided to issue the release in response to the story, I’ll let you admit the Tweet. However, the last paragraph, I agree with the defense, is substantially more prejudicial than it is probative because he has testified that had neither — he nor anyone at the campaign knew that Mr. Sussmann went to the FBI, no one authorized him to go to the FBI, and there’s been no other evidence admitted in the case that would suggest that that took place. And so this last paragraph, I think, would unfairly suggest to the jury, without any evidentiary foundation, that that was the case. All right?

MR. DeFILIPPIS: Your Honor, just two brief questions on that.

THE COURT: Okay.

MR. DeFILIPPIS: Can we — so can we use — depending on what he says about whether he was aware of the Tweet or the public statement, may we use it to refresh him?

THE COURT: Sure. Sure.

MR. DeFILIPPIS: Okay. And then, as to the last paragraph, could it be used for impeachment or refreshing purposes as well in terms of any dealings with the FBI?

THE COURT: You can use anything to refresh.

MR. DeFILIPPIS: Okay.

THE COURT: But we’re not going to publish it to the jury. We’re not going to read from it. And let’s see what he says. [my emphasis]

Having just been told not to read the tweet, especially not the part about the FBI investigation, DeFilippis proceeded to have Mook do just that.

The exhibit of the tweet that got  to the jury had that paragraph redacted and that part of the transcript was also redacted. But, predictably, the press focused on little but the tweet, including the part that Cooper had explicitly forbidden from coming into evidence.

In his report, Durham obscures the timeline of all this to falsely suggest that Hillary endorsed going to the FBI in September, before Sussmann met with the FBI, and not days before the election, when Franklin Foer reported the story.

On October 31, 2016 – about one week before the election – multiple media outlets reported that the FBI had received and was investigating the allegations concerning a purported secret channel between the Trump Organization and Alfa Bank. For example, Slate published an article that discussed at length the allegations that Sussmann provided to the FBI. 1530

Also on that day, the New York Times published an article titled Investigating Donald Trump, F.B.f Sees No Clear Link to Russia. 1531 The article discussed information in the possession of the FBI about ··what cyber experts said appeared to be a mysterious computer back channel between the Trump Organization and the Alfa Bank.” 1532 The article further reported that the FBI had “spent weeks examining computer data showing an odd stream of activity to a Trump Organization server,” and that the newspaper had been provided computer logs that evidenced this activity. The article also noted that at the time of the article, the FBI had not found “any conclusive or direct link” between Trump and the Russian government and that “Hillary Clinton’s supporters … pushed for these investigations.” 1533

As noted above, in the months prior to the publication of these articles, Sussmann had communicated with the media and provided them with the Alfa Bank data and allegations. 1534 Sussmann also kept Elias apprised of his efforts. 1535 Elias, in tum, communicated with the Clinton campaign’s leadership about potential media coverage of these issues. 1536

In addition, on September 15, 2016, Elias provided an update to the Clinton campaign regarding the Alfa Bank allegations and the not-yet-published New York Times article, sending an email to Jake Sullivan (HFA 154 ° Chief Policy Advisor), Robby Mook (HF A Campaign Manager), John Podesta (HF A Campaign Chairman), and Jennifer Palmieri (HFA Head of Communications), which he billed to the Clinton campaign as “email correspondence with J. Sullivan, R. Mook, J. Podesta, J. Palmieri re: Alfa Bank Article.” 1541

On the same day that these articles were published, the Clinton campaign posted a tweet through Hillary Clinton’s Twitter account which stated: “Computer scientists have apparently uncovered a covert server linking the Trump Organization to a Russian-based bank.” 1542 The tweet included a statement from Clinton campaign advisor Jake Sullivan which made reference to the media coverage article and stated, in relevant part, that the allegations in the article “could be the most direct link yet between Donald Trump and Moscow[,] that “[t]his secret hotline may be the key to unlocking the mystery ofTrump’s ties to Russia[,]” and that”[w ]e can only assume that federal authorities will now explore this direct connection between Trump and Russia as part oftheir existing probe into Russia’s meddling in our elections.”

In context, Durham falsely leaves the impression that Hillary supported going to the FBI in advance, even though both Robby Mook and Marc Elias testified that the last thing Hillary wanted to do was let the FBI get more involved in her campaign. In context, Durham falsely leaves the impression that Sussmann had sustained contacts with the NYT starting in September and never stopping, when the evidence he cites pertains exclusively to early September communications, after which Sussmann worked with the FBI to kill the story.

In a follow-up post, I will lay out just how grotesque Durham’s conspiracy theory is — the digital equivalent of slut-shaming a rape victim.

But for now, consider the abundant evidence that Durham didn’t investigate the charges he ultimately charged. He was far too busy, instead, pursuing this Clinton conspiracy theory he started chasing at least as early as February 2020.

Update: Added table showing the organization of Durham’s Report.

Dates

5/13/19: Preliminary review 

5/28/19: UK Legat-1

6/4/19: UK ALAT-1

6/17/19: SSA-1 (Steele Reports, Papadopoulos)

6/17/19: CIA Employee-1 (Page FISA)

6/18/19: SSA-1 (bias)

6/19/19: Case Agent-1 (defensive briefing, Steele Reports, Papadopoulos)

7/2/19: Handling Agent-1 (Page FISA)

7/2/19: NYFO ASAC-1 (Page FISA)

7/3/19: Michael Harpster (Steele Reports)

8/1/19: Mike Rogers

8/6/19: NYFO ADC-1

8/12/19: Randall Coleman (Clinton Foundation, Steele Reports)

8/12/19: Diego Rodriquez (Clinton Foundation)

8/14/19: HQ Analyst-3 

9/16/19: Cyber Agent-2 (Alfa)

10/17/19: SSA-2 (Clinesmith, Papadopoulos)

8/21/19: Case Agent-1

8/29/19: OGC Unit Chief-1 (bias, Australia referral, Page FISA)

9/5/19: NYFO Case Agent-1 (Page FISA)

10/9/19: Erika Thompson; Alexander Downer

12/9/19: DOJ IG Report

12/10/19: HQ Analyst-3 

1/6/20: David Johnson (Steele Reports)

1/15/20: NYFO Case Agent-1 (Clinton Foundation)

1/16/20: Diego Rodriquez (Clinton Foundation)

1/28/20: HQ Unit Chief-3 (Clinton Foundation)

2/6/20: Special Attorney to Attorney General (may reflect grand jury)

2/7/20: Jim Baker (defensive briefing)

2/13/20: Cyber Agent-3 (Alfa)

2/19/20: HQ Analyst-3 (Page FISA)

2/25/20: HQ Analyst-2 (Russian Intelligence, Clinesmith)

2/28/20: Jonathan Moffa (Russian Intelligence)

3/18/20: Paul Abbate (Clinton Foundation)

4/14/20: Field Office-1 Handling Agent-3 

4/23/20 Field Office-1 Handling Agent (Clinton Foundation)

4/23/20: Michael Harpster (Steele Reports)

5/1/20: Mueller SSA-1

5/5/20 Field Office-1 Handling Agent (Clinton Foundation)

5/6/20: Steele Reports

5/28/20: HQ SSA-4 (Clinton Foundation)

6/11/20: Jim Baker (Russian Intelligence)

6/18/20: Jim Baker (Russian Intelligence)

6/25/20: SA-2 (Steele Reports)

6/29/20: Michael Steinbach (initial EC)

6/30/20: Referral regarding existing counterintelligence investigation

7/1/20: OI Attorney (Page FISA)

7/8/20: Ray Hülser (Clinton Foundation)

7/14/20: Kevin Helson (Page FISA)

7/22/20: SSA-1 (Russian intelligence, Steele Report) 

7/23/20: OGC Unit Chief-1 (Page FISA)

7/28/20: Baltimore Special Agent-2 (Danchenko)

8/13/20: Baltimore Case Agent-1 (Danchenko)

8/13/20: CIA Employee-2 (Alfa)

8/19/20: IC Officer #6 (Russian Intelligence)

8/20/20: WFO Clinton Foundation Case Agent-1 

8/21/20: John Brennan (Russian Intelligence)

9/9/20: Acting OGC Section Chief-1 (Clinton Foundation)

9/10/20: Field Office-1 SAC

9/22/20: Field Office-1 Handling Agent-3

9/29/20: Patrick Fallon (Clinton Foundation)

9/29/20: John Ratcliffe shares Russian Intelligence with Lindsey Graham

10/19/20: Special Counsel appointment

10/27/20: OI Unit Chief-1 (Page FISA)

11/24/20: Kevin Helson (Danchenko)

12/8/20: HQ Supervisory Analyst-1 (Danchenko)

12/15/20: HQ SSA-3 (Alfa)

12/18/20: Baltimore Special Agent-1 (Danchenko)

12/21/20: Designation to use classified information

12/23/20: IC Officer#12 (Russian Intelligence)

12/20: Referral regarding accuracy of info in non-Page FISA (possibly Millian?)

2/2/21: Tech Company-1 Employee 1 (Alfa)

2/11/21: DARPA Program Manager-1 (Alfa)

2/25/21: Tech Company-1 Employee 1 (Alfa)

3/3/21: SSA-1 signed statement on Steele Reports

3/18/21: SSA-3 (Page FISA)

3/21/21: SA-1 (Page FISA)

4/8/21: Field Office-1 SSA-1

4/13/21: US Person-1 (Dolan Associate) (Danchenko)

4/14/21: Research Exec-1 (Alfa)

4/22/21: HQ Unit Chief-2

5/5/21: SSA-2  (bias, Page FISA, Danchenko, Clinesmith, Papadopoulos)

5/5/21: Field Office-1 Handling Agent-2 (second CI investigation)

6/21/21: David Archey (Defensive briefings)

6/29/21: CIA Employee-3 (Alfa)

6/30/21: OGC Attorney-1 (Page FISA)

6/30/21: Danchenko Employer-1 Exec-1 

7/7/21: Field Office-1 ASAC-1

7/9/21: Jennifer Boone

7/9/21: Tech Company-1 Employee 1 (Alfa)

7/21/21: Foreign Policy Advisor-1 (Russian Intelligence)

7/21/21: SSA-1 (Page FISA)

7/22/21: University-1 Researcher-1 (Alfa)

7/26/21: Brian Auten (bias, Russian Intelligence, Steele Reports)

7/27/21: Kevin Helson (Danchenko)

8/21: University-1 Researcher-2 (Alfa) [appears to be one 302 on more than one conversation]

8/9/21: NJ-Based Company Exec (Danchenko)

8/10/21: University-1 Researcher-3

8/11/21: Handling Agent-1 (Page FISA)

8/16/21: Mueller Analyst-1 (Danchenko)

8/12/21: Tech Company-3 Exec-1 (Alfa)

8/31/21: Charles Dolan (Danchenko)

8/31/21: Mueller SSA-1 (Danchenko)

9/7/21: Charles Dolan (Danchenko)

9/16/21: Michael Sussmann indictment

9/17/21: Brookings Fellow-1 (Danchenko)

10/21/21: UCE-1 (Papadopoulos)

10/27/21: Listrak Employee-1 and personnel (Alfa)

10/29/21: Mueller Analyst-1 (Danchenko)

11/1/21: Charles Dolan (Danchenko)

11/3/21: Danchenko indictment

11/17/21: Cendyn CEO and CTO (Alfa)

11/9/21: Jonathan Winer (Steele Reports)

11/10/21: Jennifer Palmieri

11/12/21: Jake Sullivan

11/16/21: Brookings Fellow-2 (Danchenko)

11/17/21: Cendyn CEO and CTO (Alfa)

12/2/21: HQ Analyst-3 (Steele)

11/20/21: Victoria Nuland

11/30/21: Victoria Nuland (Steele Reports)

12/13/21: James Clapper

1/19/22: John Podesta (Russian Intelligence, Alfa)

2/2/22: David Cohen

2/5/22: Sergei Millian (Danchenko)

3/1/22: Handling Agent-1 (Page FISA)

3/28/22: Foreign Policy Advisor-2

5/11/22: Hillary Clinton (Russian Intelligence)

6/22/22: SSA-1 (Russian Intelligence)

8/9/22: Ritz GM (Danchenko)

12/14/22: Referral to DOD IG on DARPA

Bill Barr Complains that His Special Counsel Was Unable to Match Robert Mueller’s Record of Success

/64 Comments/in , , , /by

Even before the Igor Danchenko trial, Billy Barr declared victory in defeat — arguing that if John Durham could just “fill in a lot of the blanks as to what was really happening,” the inevitable acquittal would still give Durham an opportunity to spin fairy tales about what Durham imagines happened.

“What these cases show is that these are difficult cases to win,” Barr said. “There’s a reason it takes so long, and you have to build up the evidence because at the end of the day, you’re going before these juries that aren’t going to be disposed to side with the people they view as supporting Trump.”

Danchenko is slated to go on trial next month on charges of lying to the FBI about the Steele dossier, for which he was the main source. The dossier claimed that Trump and members of his campaign and company had established extensive ties to the Russian government and had colluded during the 2016 election.

The trial is widely expected to be the final criminal prosecution from Durham’s investigation before he submits a report of his findings to Attorney General Merrick Garland.

But despite Durham’s limited success in the courtroom, Barr defended the investigation he ordered, saying the courtroom was allowing Durham to establish a record of what had occurred with the so-called Russiagate investigation.

“I think Durham got out a lot of important facts that fill in a lot of the blanks as to what was really happening,” Barr said. “My expectation is … the Danchenko trial will also allow for a lot of this story to be told, whether or not he’s ultimately convicted. I hope he’s convicted, but if he isn’t, I still think it provides an avenue to tell the story of what happened.”

Like an obedient puppy, Durham did use the trial as an opportunity to get extraneous details into the public record. On top of the $1 million dollar offer that Brian Auten said, vaguely, Christopher Steele might have gotten if he had corroborated the dosser — which has been treated like an FBI attempt to bribe a source for dirt on Trump and as the most exonerating possible detail, rather than an effort to investigate a real threat to the country — Durham went out of his way to give the full names of people at various meetings so Carter Page and Donald Trump can add them to lawsuits.

Mind you, along the way, the trial also revealed the FBI’s own assessment of Danchenko’s cooperation, which contributed to 25 investigations and which Barr burned to a crisp by exposing him, with Lindsey Graham’s help, as a source in 2020.

Q. And you were concerned, in July of 2020, when you became aware that Attorney General Barr was going to release a redacted version of Mr. Danchenko’s interview in January of 2017?

A. Yes.

Q. You were upset about that?

A. I was.

Q. You found out about that during a telephone conference, right?

A. I did.

Q. And you disagreed with that decision?

A. I did.

Q. The OIG had already completed a report on that investigation, correct?

A. Yes.

Q. And you thought that the release of that document was dangerous?

A. Yes.

Q. You even wrote up a memo of that phone call you were on in July of 2020 where you learned that they were going to publish a redacted version of his interview, correct?

A. I did.

[snip]

Q. And within an hour of Mr. Danchenko’s January interview being released to the senate judiciary committee, the senate judiciary committee, I won’t say who, released it to the public?

A. They did.

[snip]

Q. So, Agent Helson, you wrote in October of 2020 that from 2017 until present day, Mr. Danchenko had provided information on at least 25 FBI investigations assigned to at least six field offices?

A. Correct.

Q. In addition, he aided the United States Government by introducing the United States Government to a sub-source who had provided additional information separate to his report, correct?

A. Correct.

[snip]

Q. And it’s noted that he — his reporting contributed to at least 25 active FBI investigations.

[snip]

Q. In July of 2020 his identity became public after the release of the redacted version of his interview in January of 2017. Since that public disclosure, he has received threatening messages via social media and email. It’s resulted in significant damage to his reputation from false and baseless claims aimed to undermine his credibility. Those are your words, correct?

A. Correct.

Q. The Washington Field Office had assessed that this will have negative ramifications with respect to his ability to provide for his family via personal income for the foreseeable future, correct?

A. Correct.

Q. And while the FBI cannot promise complete anonymity to anyone who provides information, his identity became public only after the decision was made to release the redacted version of his interview, correct?

A. Correct.

Q. As a result of that act, his ability to continue to provide information viable to the FBI is diminished as is his ability to provide financial support to his family.

After the trial, Barr has been spending time on Fox News declaring — as much of the frothy right has — that this record, of how he deliberately harmed national security for revenge, exposed the corruption of what Barr calls “Russiagate,” the moniker frothers use to distract from the real substance of the Russian investigation.

I was disappointed, obviously. I think they did a good job prosecuting the case. Their ability to put evidence on, in a very difficult case, was limited by some rulings, and they weren’t able to get access to some witnesses overseas. So it was a tough — it was a tough case, so this should show people that it’s hard to win these cases, and sometimes it takes time to … to achieve justice. But as people say — I think Andy McCarthy said — the real public interest being served here was exposing the full extent of the corruption that was involved in Russiagate [sic] and the abuse by the FBI in that whole episode. And I think Durham is going to get a report out that’s gonna lay out all the facts.

Barr and everyone else are pointing to the exposures they and Durham made to justify their actions because they didn’t have evidence to support their claims.

Barr is whining that getting false statements convictions is hard. But Robert Mueller was able to prove that:

  • Alex Van der Zwaan lied to cover up his efforts, in conjunction with Konstantin Kilimnik and Rick Gates, to cover up Manafort’s effort to spin Ukraine’s politicized Yulia Tymoshenko prosecution during the 2016 election
  • George Papadopoulos lied to cover up his advance knowledge of the Russian effort to help Trump
  • Mike Flynn lied to cover up his back channel calls with Sergei Kislyak to undermine Obama Administration policy (and also that he was a paid agent of Turkey during the campaign)
  • Michael Cohen lied to hide the secret negotiations he had directly with the Kremlin about an impossibly lucrative real estate deal
  • Paul Manafort conspired to cover up a front organization he set up with Konstantin Kilimnik and (at a preponderance of the evidence standard) lied to cover up his August 2016 meeting with Kilimnik
  • Roger Stone lied and intimidated Randy Credico to cover up his real back channel to the Russian operation

I mean, Robert Mueller had no problem getting convictions, whether from guilty pleas, jury verdicts, or (in the case of Manafort’s lies about the August 2, 2016 meeting) a judge’s ruling.

One reason he had no problem was that these defendants were generally guilty of a lot more than just lying. It’s a lot easier to get Flynn to admit he lied about his back channel discussions with the Russian Ambassador, after all, when he was also on the hook for secretly being an agent of Turkey. It’s lot easier to get Papadopoulos to admit he lied about his advance warning of the Russian operation when he’s trying to stave off foreign agent charges tied to Israel. It’s a lot easier to get a jury verdict against Stone when he spent months plotting out his lies with multiple people on emails.

Mueller wasn’t able to get false statement verdicts from everyone, mind you. For example, because Steve Bannon and Erik Prince deleted their texts from early January 2017, Mueller did not charge them for false statements made to cover up meetings to set up a back channel with UAE and Russia. That’s one lesson that Durham should have taken to heart: Absent the mobile app records from Sergei Millian and Igor Danchenko, he had no way of knowing whether Millian called Danchenko on July 26, 2016.

That’s not the only evidentiary complaint Barr makes here. He’s complaining that Durham was unable to get hearsay admitted against Danchenko. He’s angry that Durham was not permitted to introduce Millian’s wild Twitter boasts as evidence without requiring Millian to show up and make those claims under oath. And he’s complaining that Durham wasn’t able to introduce his pee tape conspiracies without charging it.

But the most alarming of the former Attorney General’s statements — before and after the trial — embrace the notion that it is a proper goal of failed prosecutions to expose information that does not rise to the level of criminality.

As I’ll show in a follow-up, the Durham fiasco is part of a piece of Barr’s larger actions, both his other failed prosecutions — most notably, that of Greg Craig — but also his efforts to undo the convictions for which there was no reasonable doubt of guilt.

It’s not enough to talk about Durham’s unprecedented failure … it’s not enough to note that Durham and his prosecutors repeatedly failed to take basic investigative steps before embracing and charging conspiracy theories that juries didn’t buy … it’s not enough to note how, in an attempt to prove those conspiracy theories, Durham and his prosecutors and abused the prosecutorial system.

Durham’s entire project is a continuation of Barr’s unprecedented politicization of DOJ, one that not only places Republicans attempting to secretly work for hostile nations above the law, but that has made the country far less safe in many other ways.

It’s not just Durham prosecuted two men without any real hope of winning conviction, all to expose things that aren’t crimes. It’s that Billy Barr hired him to do just that.

John Durham Wants to Lecture EDVA Jurors about Being Played by Foreign Spies

/72 Comments/in , /by

We’ve gotten to that stage of another Durham prosecution where each new filing reads like the ramblings of a teenager contemplating philosophy after eating hallucinogenic mushrooms for the first time. This time it’s a reply filing in a motion in limine written by Michael Keilty (who I used to think was the adult in this bunch).

Before I show what I mean, I’m going to just share without comment my favorite part of the filing, where someone claims in all seriousness that hotel staffers — in a foreign country!! — don’t gossip about the kink of famous people.

It strains credulity, however, to believe that Ritz Carlton managers – with no apparent relationship to the defendant – would confirm lurid sexual allegations about a U.S. presidential candidate to a guest, let alone a stranger off the street.

Well, okay, I’ll make one comment. This is a gross misrepresentation of what Danchenko said, which is that the hotel staffers did not deny the rumor, not that they had confirmed them.

That done, I’m going to jump to the end, to where Keilty argues Durham should be able to present the allegation that led to the predication of a counterintelligence investigation against Danchenko in 2009 as well as the reason it was closed (because the FBI incorrectly believed Danchenko had left the US). Durham should be able to do that, the filing argues, so that the jury can contemplate the FBI’s obligation to consider whether they’re being played by foreign spies. [All the bold and underlining in this post are mine; the italics are Durham’s.]

The defendant asks the Court to limit the admissibility of evidence concerning the FBI’s prior counterintelligence investigation of the defendant to only the fact that there was an investigation. Limiting the evidence in this manner would improperly give the jury the false impression that the investigation closed due to a lack of evidence against the defendant. As discussed in its moving papers, the Government believes the facts underlying the investigation are admissible as direct evidence because in any investigation of potential collusion between the Russian Government and a political campaign, it is appropriate and necessary for the FBI to consider whether information it receives via foreign nationals may be a product of Russian intelligence efforts or disinformation. And in doing so, the FBI must consider the actual facts of the prior investigation. Had the FBI known at the time of his 2017 interviews that the defendant was providing them with false information about the sourcing of his claims, this naturally would have (or should have) caused investigators to revisit the prior counterintelligence investigation and raise the prospect of revisiting prior conduct by the defendant, including his statements to a Brookings Institute colleague regarding receipt of classified information in exchange for money and his prior contact with suspected intelligence officers. Whether or not the defendant did or did not carry out work on behalf of Russian intelligence, these specific facts are something that any investigator would or should consider and, therefore, the jury is entitled to learn at trial about the facts of the prior investigation in assessing the materiality of the defendant’s alleged false statements. The defendant should not be permitted to introduce the existence of the counterintelligence investigation for his benefit while suppressing the details of his conduct at issue in that very investigation.

This largely repeats the argument Keilty made in his original motion, before Danchenko responded, “Bring it!” to this request. I’ve underlined the language that appears exactly the same in both.

The Government anticipates that a potential defense strategy at trial will be to argue that the defendant’s alleged lies about the sourcing of the Steele Reports were not material because they had no affect on, and could not have affected, the course of the FBI’s investigations concerning potential coordination or conspiracy between the Trump campaign and the Russian Government. Thus, the Government should be able to introduce evidence of this prior counterintelligence investigation (and that facts underlying that investigation) as direct evidence of the materiality of the defendant’s false statements. Such evidence is admissible because in any investigation of potential collusion between the Russian Government and a political campaign, it is appropriate and necessary for the FBI to consider whether information it receives via foreign nationals may be a product of Russian intelligence efforts or disinformation. Had the FBI known at the time of his 2017 interviews that the defendant was providing them with false information about the sourcing of his claims, this naturally would have (or should have) caused investigators to revisit the prior counterintelligence investigation and raise the prospect that the defendant might have in fact been under the control or guidance of the Russian intelligence services. Whether or not the defendant did or did not carry out work on behalf of Russian intelligence, the mere possibility that he might have such ties is something that any investigator would consider and, therefore, the jury is entitled to learn at trial about the prior investigation in assessing the materiality of the defendant’s alleged false statements.

As noted, Danchenko responded to this request by stating that he planned to elicit the fact of the investigation himself.

The government seeks to admit evidence, in its case-in-chief or to rebut a potential defense strategy, that Mr. Danchenko was previously the subject of an FBI counterintelligence investigation over 10 years ago. On this point, Mr. Danchenko generally agrees that the proffered evidence is admissible but likely disagrees about the extent of evidence that should be admitted at trial. It is not disputed that Mr. Danchenko was the subject of a counterintelligence investigation. Nor is it in dispute that the counterintelligence investigation was closed in 2011. Likewise, it will not be in dispute that the FBI agents involved in the Crossfire Hurricane investigation were well aware of the prior counterintelligence investigation, that it was factored into their evaluation of Mr. Danchenko’s credibility and trustworthiness, that an independent confidential source review committee accounted for the prior investigation when recommending the continued use of Mr. Danchenko as a confidential human source through December 2020, and that the agents involved in the prior investigation were consulted and ultimately raised no objections, at the time, to Mr. Danchenko’s continued use as a source.

As an initial matter, those facts obliterate the government’s argument that any alleged false statements were material to the government’s ability to evaluate whether Mr. Danchenko could have been working for the Russians all along. It would be one thing to argue that the Crossfire Hurricane investigators were not aware of the prior investigation and Mr. Danchenko failed to inform them of it when asked. But, as one might expect, Mr. Danchenko was not aware of the investigation. He learned of it when then Attorney General William Barr made public a summary of that investigation on September 24, 2020. Moreover, it stretches credibility to suggest that anything else would have caused the FBI to be more suspicious of Mr. Danchenko’s statements and his potential role in spreading disinformation than the very fact that he was previously investigated for possibly engaging in espionage on behalf of Russia. Armed with that knowledge, however, and based on the substantial and “critical” information Mr. Danchenko provided to the FBI throughout his time as a source, the FBI nevertheless persisted. The Special Counsel perhaps disagrees with that decision, but Mr. Danchenko’s trial on five specific statements and this is not the place to air out the Special Counsel’s dissatisfaction.

Mr. Danchenko himself intends to elicit from government witnesses their general knowledge of Mr. Danchenko’s prior investigation. But the details of that investigation are not relevant and, more importantly, are unproven, would involve multiple levels of hearsay to establish the basis for the investigation let alone prove the allegation, and resulted in no negative action or conclusion. Indeed, the investigation was closed and to undersigned counsel’s knowledge never reopened even after the Special Counsel’s investigation and Indictment. Contrary to the Special Counsel’s insinuations and allegations, we expect the jury will hear that Mr. Danchenko was a vital source of information to the U.S. government during the course of his cooperation and was relied upon to build other cases and open other investigations. [my emphasis]

Curiously, this dispute is taking place without discussion of how Durham intends to introduce this information, other than precisely the way Danchenko proposes to: by asking the Crossfire Hurricane witnesses what they knew about it, which would lead them to explain that they knew about the prior investigation and took it into account, which would be the relevant issue as far as materiality.

Given Danchenko’s suggestion (bolded above) that the counterintelligence agents from 2011 didn’t complain that Danchenko was used as a source “at the time,” I wonder whether they’ve since decided (or been coerced, as Durham has done with so many of his witnesses) that they now think it’s relevant. That might explain why Danchenko was discontinued as a source, too: Imagine if, after Billy Barr violated DOJ guidelines by making this public in 2020, the original agents were invited to complain in October 2020, which led to Danchenko’s discontinuation. Perhaps Durham wants to have those other agents testify as witnesses about what a sketchy man they believed Danchenko to be, over ten years ago, so sketchy that they lost track of him and concluded incorrectly he had left the country.

But having learned that Danchenko not only is willing but wants Crossfire Hurricane witnesses to explain how they took this earlier counterintelligence investigation into account, Durham has doubled down that that is not enough. It is not enough to hear how the FBI personnel who interviewed Danchenko took the earlier investigation into account, the jurors must learn the details of the earlier investigation so they can take it into account.

Granted, your average EDVA jury might have one or two people who have security clearances on it. But Durham is effectively asking untrained jurors to weigh decade-old uncharged and unproven counterintelligence allegations in their deliberation over whether answers Danchenko gave the FBI five years ago should have been viewed more skeptically by trained counterintelligence personnel. He’s doing so even though (and this a key point in Danchenko’s motion to dismiss, though that MTD is unlikely to work) the FBI took action based on Danchenko’s responses on these topics as if the answer was precisely what Durham says it should have been.

The FBI took Danchenko’s descriptions of Charles Dolan’s close ties to Russians like Dmitry Peskov and opened an investigation into him, just like Durham says would have happened if Danchenko had not (allegedly) hidden that Dolan provided him information that showed up in the dossier. The FBI took Danchenko’s descriptions of how sketchy the call he thought might have been with Sergei Millian and concluded from that that the report in the dossier wasn’t all that credible (though they didn’t incorporate that into their FISA applications), just like Durham says should have happened. And based, in part, on Danchenko’s description of his contributions to the dossier, the Mueller team made no further use of the dossier — not to predicate the investigation into Michael Cohen, not to continue the investigation into Paul Manafort (which was premised instead on his money laundering), not to direct the focus of the investigation, which instead looked at things like the June 9 Trump Tower meeting and Konstantin Kilimnik’s role, both of which would have been in the dossier if it were a credible product.

Durham is accusing Dancehnko of lying about two topics that the FBI nevertheless responded to (Page FISA aside) as if they took the answer to be precisely what Durham says it should have been.

He’s doing it in a filing where Durham can’t keep straight basic details of knowability and truth.

For example, in one place he accused Danchenko of telling the truth, just not the truth that Durham wishes he had told. He says it is proof that Danchenko lied that he truthfully answered Christopher Steele would know about Dolan because Danchenko cleared his October 2016 trip to Russia with Steele.

Second, when the defendant was asked “would Chris know of [Dolan]?” the defendant replied “I think he would . . . . because I cleared my [October] trip with Chris.” However, as discussed in the Government’s moving papers, the defendant (1) attempted to broker business between Steele and Dolan, (2) provided Dolan with a copy of his Orbis work product, and (3) apparently informed Dolan of Steele’s former employment with MI-6.

Two of Durham’s complaints — that Danchenko provided Dolan something from Orbis and that Danchenko informed Dolan that Steele worked for MI6 (I suspect Durham is wrongly attributing this to Danchenko but let’s run with it) — have nothing to do with what Steele would know, and so would be non-responsive to the FBI question. They have to do with what Dolan would know, not what Steele would know (even there, as I have noted, the uncharged question Danchenko was asked and his response were not what Durham claims it was).

Durham similarly complains that Danchenko didn’t tell the FBI something he didn’t know but that they did: the extent of communications between Dolan and Olga Galkina.

Third, while the defendant did introduce Dolan to Ms. Galkina, the Government anticipates introducing evidence through the defendant’s handling agent that the defendant was unaware of the extent of communication between Dolan and Galkina. This is a highly material fact given that both Dolan and Galkina are alleged to have been sources for the Steele Reports.

Durham may mean to suggest that if only Danchenko had … I’m not even sure what, the FBI would have discovered the communications that he describes here and wants to present at trial that the FBI discovered. Except as I noted last year, the reason the FBI started asking about Dolan is because they targeted Olga Galkina with a 702 directive that disclosed the contacts she had with Dolan. The FBI came into the interview in question knowing what Danchenko didn’t know and nevertheless Danchenko didn’t hide what he did know. What Danchenko did not know but the FBI did is proof, Durham says, that Danchenko lied.

Perhaps the craziest claimed proof that Danchenko is lying in this filing is where Durham complains that Danchenko didn’t offer up something that his own witness, Dolan, still won’t testify to.

According to the indictment, Danchenko both visited Dolan at the Ritz on June 14, 2016 and posted a picture of the two of them in Red Square (remember, he’s claiming Danchenko was hiding this stuff — the stuff he posted on social media).

On or about June 14, 2016, DANCHENKO visited PR Executive-1 and others at the Moscow Hotel, and posted a picture on social media of himself and PR Executive-1 with Red Square appearing in the background.

He complains that when Danchenko was specifically asked if Dolan could be a source for Steele (Durham has persistently misrepresented the nature of this question), he did mention they were in Moscow together in fall 2016, but didn’t mention June 2016.

In the January 2017 interviews, the defendant never mentioned Charles Dolan. Further, during the defendant’s June 2017 interview with the FBI (which forms the basis of the false statement charge related to Dolan), the defendant only informed the FBI that he was present with Dolan during the October 2016 YPO conference. Again, the defendant conveniently whitewashed Dolan from the June 2016 planning trip in Moscow.

[snip]

First, as discussed above, the defendant did not inform the FBI that Dolan was present at the Ritz Carlton in June 2016. Again, this is a material omission because the defendant informed the FBI that he collected information for the Steele Reports in June 2016, but not during the October 2016 trip. Dolan’s proximity to the defendant during this time period is a highly relevant fact.

Durham wants to prove that Danchenko told an affirmative lie in June 2017 by denying that he had spoken to Dolan about topics that showed up in the dossier (in reality, Danchenko told the FBI, “We talked about, you know, related issues perhaps but no, no, no, nothing specific”). And to support that claim, he offers as proof that Danchenko offered up true information but not the information that Durham himself would have wanted him to offer up. Again, he’s arguing that Danchenko lied by pointing to his true statements.

And he’s making that argument even though his primary witness to all this — Dolan — apparently continues to testify that he does not remember meeting Danchenko at the Ritz.

[T]he Government anticipates that Dolan will testify that he has no recollection of seeing the defendant at the Ritz Carlton in June 2016.

Durham will prove that Igor Danchenko lied, he says, because along with offering true information, he didn’t offer up something that his star witness still won’t testify to remembering.

Let’s go back, shall we, to where we started: The urgency of letting EDVA jurors consider whether FBI’s counterintelligence personnel weighed Igor Danchenko’s past counterintelligence investigation adequately before they decided he was credible and took exactly the actions they would have taken if Danchenko had testified the way Durham claims he falsely did not.

It has been clear from the start that they did take the past CI investigation into account. Indeed, when his interview transcript was first made public, I observed that Danchenko’s interviewers were most skeptical of his evasions about ties to Russian spies. And Danchenko reveals that “an independent confidential source review committee” gave that earlier investigation particular focus when they did a source review of Danchenko’s reporting.

The Crossfire Hurricane team considered it and found Danchenko reliable. The confidential source review committee considered it and found Danchenko reliable. But Durham knows better, and he’s betting that an untrained EDVA jury will agree with him on that point.

But it’s not just Danchenko’s credibility that is at issue. As I previously noted, one reason Durham wants to get into the nitty gritty details of the predication of the investigation against Danchenko is because he expects Danchenko will look at the investigations of others on whom Durham is relying as sources.

[T]he Government expects the defense to introduce evidence of FBI investigations into other individuals who the Government anticipates will feature prominently at trial. Thus, the introduction of the defendant’s prior counterintelligence investigation – should the defense open the door – does not give rise to unfair prejudice that substantially outweighs its probative value.

Durham wants to be able to talk about the earlier counterintelligence investigation that the Crossfire Hurricane team did consider, because Danchenko is likely to raise the counterintelligence investigation into Sergei Millian and Dolan and probably some other people too. There’s no evidence Durham considered those counterintelligence investigations before building elaborate conspiracy theories based on the claims of those witnesses.

Durham said that in the same section where he also said,

[T]n any investigation of potential collusion between the Russian Government and a political campaign, it is appropriate and necessary for the FBI to consider whether information it receives via foreign nationals may be a product of Russian intelligence efforts or disinformation.

That is, shortly before Durham said that he has to talk about the predication of the counterintelligence investigation into Danchenko to even things out if he decides to raise the counterintelligence investigations into Millian, Dolan, and who knows who else, Durham said it is necessary to consider whether someone is being played by Russian intelligence.

In fact, he originally made this claim in a long filing in which he laid out how he had had his ass handed to him by Sergei Millian (though he didn’t confess how badly Millian had played him).

 

Before Durham charged Danchenko, he had not obtained the evidence from the DOJ IG investigation; he shows no familiarity with either the Mueller Report or the Senate Intelligence Committee Report. He never once made Millian substantiate his claims in an interview in which he could be held accountable for false claims. And he never once interviewed George Papadopoulos to learn how Millian was cultivating him during precisely the period that Durham is sure he didn’t call Danchenko. But he wants a jury to decide that the Crossfire Hurricane team didn’t consider the reliability of someone about whom the FBI has opened a counterintelligence investigation.

Durham charged two men as part of a larger uncharged conspiracy theory that the Hillary campaign “colluded” [sic] with Russia to say bad things about Donald Trump. And yet he never “consider[ed] whether information” he received from Millian and others “may be a product of Russian intelligence efforts or disinformation.”

And because he charged this case without considering that, Durham is demanding that he get to present why the FBI opened a counterintelligence investigation against Danchenko 13 years ago.

On the Belated Education of John Durham

/59 Comments/in , /by

In a filing on September 2 in the Igor Danchenko case, John Durham confirmed that Danchenko had been a paid FBI source from March 2017 through October 2020.

In March 2017, the FBI signed the defendant up as a paid confidential human source of the FBI. The FBI terminated its source relationship with the defendant in October 2020.

I had heard this — though not with the sourcing such that I could publish. Apparently it was news to the frothers, who’ve been wailing about it ever since. Here’s Margot at the Federalist Faceplant, Jonathan Turley, and Chuck Ross at his new digs at the outlet that first hired Christopher Steele. Here’s the former President during an obsequious Hugh Hewitt interview.

Danchenko’s status was implicit in a lot of what is public. Even absent the frothers doing any kind of journalism, or even critical thinking, what did they think this reference in Danchenko’s motion to dismiss meant?

The government had unfettered access to Mr. Danchenko for approximately four years following his first interview in January 2017, and not once did any agent ever raise concerns about the now purportedly contradictory post-call emails.

As I hope to show in a follow-up, it actually makes a lot of sense.

Meanwhile, in Danchenko’s response to that filing, he revealed that information he provided to the FBI was used in a memorandum supporting the opening of an investigation into Charles Dolan, one of Durham’s star witnesses against Danchenko. (Note, this reference stops short of saying that the FBI did open an investigation into Dolan, just that someone proposed doing so.)

[T]he Special Counsel ignores, and conceals from this Court, that Mr. Danchenko was interviewed dozens of times and during the course of those interviews, particularly when asked specific questions about Dolan (which was not often), Mr. Danchenko (1) told the FBI about the Moscow trips with Dolan, (2) told the FBI that Steele knew of Dolan, (3) told the FBI that not only was Dolan doing work with Olga Galkina but that Mr. Danchenko himself had introduced them, and (4) told the FBI that Dolan had connections and relationships with high-level Kremlin officials, including President Putin’s personal spokesperson, Dmitry Peskov. Indeed, when agents drafted a December 2017 communication in support of opening an investigation into Dolan, they included the information Mr. Danchenko provided them as support for opening the investigation. 3 [emphasis original]

This may not be the last surprise investigation we hear about. Back in the original filing on September 2, Durham argued he should be able to talk about the 2008 allegation that led to a counterintelligence investigation into Danchenko, in part, because (Durham predicted bitterly) Danchenko will likely raise investigations into others, plural, who will “feature prominently at trial.”

[T]he Government expects the defense to introduce evidence of FBI investigations into other individuals who the Government anticipates will feature prominently at trial. Thus, the introduction of the defendant’s prior counterintelligence investigation – should the defense open the door – does not give rise to unfair prejudice that substantially outweighs its probative value.

Effectively, Durham is arguing that if Danchenko points out that Durham’s witnesses should not be considered reliable based on suspicions they were working for Russia’s interests, then he should be able to point out that Danchenko was once similarly suspected as well. Durham also wants to point out that Dolan twice asserted that Danchenko might be a Russian spook, but also allegedly always knew of his role at Orbis — assertions that, in tandem, could actually hurt Durham’s case, given the subsequent disclosure that Dolan was investigated himself. Durham may not understand that, yet.

One of these people whose investigation Danchenko will raise at trial is undoubtedly Sergei Millian, whose cultivation of George Papadopoulos in exactly the same time period Danchenko claims to have believed he spoke to Millian was one of a number of things the FBI investigated starting in 2016.

Danchenko’s response to Durham’s demand that he be allowed to raise the 11-year old counterintelligence investigation into Danchenko (besides providing a somewhat different timeline) was basically to say, “Bring it!” He intends to raise that counterintelligence investigation himself, he claims. Note: Durham doesn’t note, but it is clear from the January interviews of Danchenko, that FBI interviewers probed Danchenko about that prior investigation in their very first interviews in 2017.

As noted, I hope to return to all this dizzying spy-versus-spy shit in a follow-up. By then we’re likely to have several more disclosures, plus some details about the known investigation into Millian.

This all shows there was not a shred of prosecutorial discretion exercised before charging Danchenko. Even if Danchenko had done grievous harm to the US, no sane prosecutor would have charged this case with such easily impeached witnesses. Even Durham now seems to understand his materiality claims are flimsy. And yet, to prove a five year old false statements allegation, he has forced the government to declassify a whole range of sensitive material, including this detail about Dolan.

And that process apparently continues to be a struggle for Durham (as I predicted it would be).

Consider the timeline implied by Danchenko’s footnote about the Dolan revelation. Danchenko claims that he only just learned about the Dolan investigation opening memo.

3 The December communication is highly exculpatory with regard to the essential element of materiality and it is not clear why it was only produced 30 days from the start of trial. It was produced as Jencks material (also late by the terms of the Court’s Order requiring all Jencks to be produced by September 1) but is obviously Brady evidence. The defendant understands that the CIPA procedures may have slowed the production of certain categories of discovery but given the Indictment’s allegations about the materiality of Mr. Danchenko’s failure to attribute public information to Dolan, the production of this specific document should have been a priority for declassification.

When Danchenko says that Counterintelligence Information Procedures Act may have slowed the production of this, he’s suggesting (charitably) that someone at DOJ took a long time to release this information to Durham and that Durham had no control over that process. That’s another thing I predicted in this post about how CIPA would affect this case: “it can end up postponing the time when the defendant actually gets the evidence he will use at trial. So it generally sucks for defendants.”

The trial starts on October 11. This footnote suggests that Danchenko only received this information 30 days before trial, so around September 11, in the week before he filed this. Whenever it was disclosed, if he received it after the September 1 deadline, that would make it too late for the September 2 deadline for Danchenko’s own motion to dismiss. It would put it after Durham’s September 2 filing — the one bitching about how much of the trial Danchenko will use to focus on the investigations into witnesses, plural, against him — which means the plural reference may not have incorporated Dolan. Danchenko would have learned about this over a month after his own deadline to lay out what classified information he intended to use at trial, and at least a week after the August 30 CIPA conference, at which the two sides debated about what classified information Danchenko should be allowed to use at trial.

It also comes after a series of delays in Durham’s classified discovery. In May, I described what was publicly billed as the last one.

It’s that record that makes me so interested in Durham’s second bid to extend deadlines for classified discovery in the Igor Danchenko case.

After Danchenko argued he couldn’t be ready for an April 18 trial date, Durham proposed a March 29 deadline for prosecutors to meet classified discovery; that means Durham originally imagined he’d be done with classified discovery over six weeks ago. A week before that deadline, Durham asked for a six week delay — to what would have been Friday. Danchenko consented to the change and Judge Anthony Trenga granted it. Then on Monday, Durham asked for another extension, this time for another month.

When Durham asked for the first delay, he boasted they had provided Danchenko 60,000 unclassified documents and promised “a large volume” of classified discovery that week (that is, before the original deadline).

To date, the government has produced over 60,000 documents in unclassified discovery. A portion of these documents were originally marked “classified” and the government has worked with the appropriate declassification authorities to produce the documents in an unclassified format.

[snip]

Nevertheless, the government will produce a large volume of classified discovery this week

This more recent filing boasts of having provided just one thousand more unclassified documents and a mere 5,000 classified documents — for a case implicating two known FISA orders and several past and current counterintelligence investigations.

To date, the Government has produced to the defense over 5,000 documents in classified discovery and nearly 61,000 documents in unclassified discovery. The Government believes that the 5,000 classified documents produced to date represent the bulk of the classified discovery in this matter.

Danchenko waited six weeks and got almost nothing new.

But then on August 16, Durham filed a supplemental CIPA filing, suggesting there were more substitutions of classified information he wanted Judge Anthony Trenga to approve (a supplemental filing is not, by itself, unusual).

The point is, for months, Durham kept saying he’d have all the secrets delivered to Danchenko by his new deadline in June, promise, and then he dropped this bombshell on Danchenko just weeks before trial.

In the August 29 hearing on all this, Judge Trenga deferred most CIPA decisions until after Danchenko files a new CIPA filing on September 22 — so if any of this remains classified, Danchenko still has a chance, with just days notice, to argue he needs it at trial. They’ll fight about these issues again on September 29.

But given Durham’s performance in the Sussmann case, it’s not entirely clear these missed classified deadlines are DOJ’s fault. After all, Durham never even asked DOJ IG for relevant discovery in Sussmann’s (and therefore, we should assume, this) case until after Sussmann was charged. He didn’t investigate Rodney Joffe’s true relationship with the FBI and other agencies until Sussmann asked him to. He didn’t ask Jim Baker for his own iCloud content until early this year, after belatedly rediscovering Baker phones he had been told about years ago.

It’s not just his belated request for information from DOJ IG that we know to have affected this case too. Durham also has never interviewed George Papadopoulos — not before he went on a junket to Italy chasing Papadopoulos’ conspiracy theories, and not since. Thus, Durham never tested whether Millian’s cultivation of Papadopoulos undermines his evidence against Danchenko — and it does, obviously and materially.

Because of Durham’s obvious failures to take the most basic investigative steps before charging wild conspiracy theories, there are several possible explanations why he’s only providing Danchenko news of this Dolan memo a month before trial:

  1. Someone tried to hide this from Danchenko and ultimately was overridden. If that’s the explanation, it makes Andrew DeFilippis’ August departure from the team and, according to the NYT, DOJ, all the more interesting.
  2. DOJ delayed the time until they let Durham disclose this because of some sensitivity about the investigation. Recall that Dolan has ties to Putin spox Dmitri Peskov, who was sanctioned earlier this year, followed by his family.
  3. Durham didn’t know.

The last possibility — that Durham had no fucking clue that one of his star witnesses had been (at least considered) for investigation — is entirely plausible. It’s entirely consistent with what we saw in the Sussmann case, though worse even than that case in terms of timing.

Durham came into this investigation treating the conspiracy theories of Papadopoulos and Trump as credible. He seems to have believed, all along, that Sergei Millian was a genuinely aggrieved victim and not someone playing him, for at least a year, for a fool. He seems to have decided that he knew better than FBI’s experts about who had credibility about Russia and who didn’t. Along the way he forced the FBI to cut its ties with Joffe and — given the October 2020 cut-off of Danchenko’s ties to the FBI, probably Danchenko as well. He did all this with a lead prosecutor who believed it was problematic for DARPA to investigate the Guccifer 2.0 persona used by the GRU.

Durham walked into this investigation believing and parroting, without first testing, Trump’s claims that the Russian investigation was abusive. Based on those beliefs, he chased all manner of conspiracy theory in an attempt to allege pre-meditation and malice on the part of Hillary and everyone else involved with the dossier. His Sussmann prosecution ended in humiliating failure. This prosecution, win or lose, may do worse for Durham’s project: it may reveal unknown details about Russian efforts to tamper in 2016, efforts that harmed both Republicans and Democrats alike.

The Durham prosecutions have been shitshows and undoubtedly a disaster for those targeted. It’s not yet clear what will happen with the Danchenko trial (or even whether it will go to trial; given that CIPA issues still have to be resolved, there’s still a chance Durham will have to dismiss it rather than going to trial). Durham will still write a report that may try to resuscitate his conspiracy theories that were disproven in the Sussmann trial.

But thus far, the actual record of the Durham investigation shows that when actually bound by the rules of evidence, when actually obligated to dig through DOJ’s coffers to discover what DOJ learned as it tried to understand Russia’s intervention in 2016, reality looks nothing like the conspiracy theories Durham has chased for three years.

John Durham’s education process has been a painful process for all personally involved (except maybe Sergei Millian, gleefully dicking around from afar). But along the way he’s debunking many of the conspiracy theories he was hired to sustain.

Update: Chuck Ross is outraged that I suggested his boss had paid for Steele (and lying that I said Paul Singer paid for the dossier, which I pointedly did not say). It is true that the payment for Fusion GPS’ Trump project had shifted to Perkins Coie before Steele first sent Danchenko to Russia.

It’s also true that, based on length of project, Ross’ current boss paid for much of Nellie Ohr’s work on Trump’s ties to Russia, which includes some of Fusion’s early work on Paul Manafort and Felix Sater, and possibly early work on Millian (she continued to work on Millian until she left Fusion).

And since Chuck is so upset, I should point out that his former co-columnist, Oleg Deripaska, also reportedly paid for Steele’s work (in that case, research on Paul Manafort), though also through the cut-out of a law firm.