Posts

John Durham: Destroying the Purported Victims to Save Them

/33 Comments/in , , /by

I’ve covered a great deal of prosecutions involving FISA materials. In just one — that of Reaz Qadir Khan — was the defendant able to use sensitivities around FISA to get a better plea deal (and in that case, there were extenuating circumstances, possibly including a dead FISA target and Stellar Wind collection). I also covered the Scooter Libby case, in which Libby attempted — and very nearly succeeded — in forcing prosecutors to dismiss the case by demanding the declassification of a slew of Presidential Daily Briefs. But even the Libby case may pale in comparison to the difficulties John Durham has signed up for in his prosecution of Igor Danchenko.

That’s true because Danchenko will credibly be able to demand materials from at least two FISA orders, as well as two other counterintelligence investigations, including a sensitive, multi-pronged, ongoing investigation, to defend himself.

Indeed, there’s even a chance DOJ cannot legally prosecute Danchenko in this case.

What follows is true regardless of whether Danchenko was indicted on shoddy evidence as part of a witch hunt or if Durham has Danchenko dead to rights defrauding the FBI to target Donald Trump. I remain agnostic which is the case (the truth is likely somewhere in-between). It is true regardless of whether Carter Page and Sergei Millian were truly victimized as a result of the Steele dossier, or whether they were reasonable counterintelligence targets whose investigations got blown up in a political firestorm.

This has everything to do with the prosecutorial discretion that Durham did not exercise in charging Danchenko (and because of some sloppiness in the way he did so) and nothing to do with Danchenko’s guilt or innocence or Page and Millian’s victimization.

Consider the following moves Durham made in his indictment:

  • He invoked Danchenko’s source, Olga Galkina, in his materiality claims and based his single charge pertaining to Charles Dolan on a June 15, 2017 FBI interview.
  • He relied on claims Sergei Millian made about interactions with Danchenko as part of his proof that Danchenko lied about his belief that he had spoken with Millian. Durham did so, apparently, based entirely on Millian’s currently public Twitter blatherings.
  • He made Carter Page’s FISA targeting — and its role in the investigation into Trump associates (which Durham recklessly called “the Trump campaign”) — central to his materiality claims.

Whether Igor Danchenko is a reckless smear agent or someone screwed by Christopher Steele’s own sloppiness, he is entitled to all the evidence pertaining to the full scope of the indictment, as well as any exculpatory evidence that could help him disprove Durham’s claims. One of the prosecutors in the case, Michael Keilty, already warned Judge Anthony Trenga, who is presiding over the case, that there will be “a vast amount of classified discovery” in this case. But if prosecutors haven’t vetted Millian any further than reading his Twitter feed, they may have no idea what discovery challenges they face.

There has never been a case like this one, relying on two already publicly identified FISA orders, so this is literally uncharted waters.

Durham’s Matryoshka Materiality Claims

Before I explain the challenges Durham faces, it’s worth explaining how Durham has used materiality in this indictment. Durham will have to prove not just that Danchenko lied, but that the lies were material.

The words “material” or “materiality” show up in the indictment 20 times, of which just one instance is used to mean “stuff” (in a misquotation of a Danchenko response to an FBI question stating, “related issues perhaps but … nothing specific”). Five are required in the charging language.

Maybe Durham focused so much making claims about materiality, in part, because he’s smarting about the way people made fun of him for his shoddy materiality claims in the Michael Sussmann indictment. But many of his discussions about the “materiality” of Danchenko’s alleged lies, both charged and uncharged, serve as a gratuitous way for Durham to include accusations in the indictment he didn’t charge. The tactic worked like a charm, as multiple journalists reported that things — particularly regarding the pee tape — were alleged or charged that were not. But now he’s on the hook for them in discovery.

Below, I’ve shown how these materiality claims form a nested set of allegations, such that even the materiality claims for uncharged conduct make up part of his overall materiality argument. I’m not, at all, contesting that Durham has a sound case that — if he can prove Danchenko lied — at least one of lies was material. While some of his materiality claims are provably false and some (such as the claims that Danchenko’s alleged lies about Millian in October and November 2017 mattered for FISA coverage that ended in September 2017) defy physics, the bar for materiality is low and he will clearly surpass it on some of his materiality claims.

The issue, however, is that Durham is now on the hook, with regards to discovery, for all of his materiality claims covering both the charged lies and the uncharged allegations. Danchenko may now demand evidence that undercuts these claims, even the ones that don’t relate directly to the charged lies.

The Section 702 directive targeting Olga Galkina

Durham makes two materiality claims pertaining to Danchenko’s friend, Olga Galkina, to whom he sourced all the discredited Michael Cohen reports and a claim about Carter Page’s meetings in July 2016:

  • That by lying about how indiscreet he was about his relationship with Christopher Steele, Danchenko prevented the FBI from learning that Russian spies might inject disinformation into the dossier through people like Galkina.
  • That by lying on June 15, 2017, Danchenko prevented the FBI from learning that Charles Dolan “maintained a pre-existing and ongoing relationship” with Galkina, which led Galkina to have access to senior Russian officials she wouldn’t otherwise have had. Dolan’s ties with Galkina also appear to have led to Galkina serving as a cut-out between Dolan and Danchenko for information for one of the reports (pertaining to the reassignment of a US Embassy staffer) in the dossier.

I’m unclear why Durham made these claims — possibly because it was one of the only ways to criminalize the way Dolan served as a source for reports that were unrelated to the Carter Page applications, possibly because he wanted to do so to dump HILLARY HILLARY HILLARY in the middle of his indictment. But both claims are false.

To prove the first is false, Danchenko will point to Durham’s miscitation of the question Danchenko was actually asked, his answer — “yes and no” — to a question Durham claims he answered “no” to, and to his descriptions, from his very first interview, of how Galkina knew he was collecting intelligence and had even, after the release of the dossier, tasked him with an intelligence collection request herself.

To prove the second is false, Danchenko will point to the declassified footnote in the DOJ IG Report showing that in “early June 2017” (and so, presumably before June 15), the FBI obtained 702 collection that (the indictment makes clear) reflects extensive communications between Dolan and Galkina.

The FBI [received information in early June 2017 which revealed that, among other things, there were [redacted]] personal and business ties between the sub-source and Steele’s Primary Sub-source; contacts between the sub-source and an individual in the Russian Presidential Administration in June/July 2016; [redacted] and the sub‐source voicing strong support for candidate Clinton in the 2016 U.S. elections. The Supervisory Intel Analyst told us that the FBI did not have Section 702 coverage on any other Steele sub‐source. [my emphasis]

It’s highly likely the FBI set up that June 15, 2017 interview with Danchenko precisely to ask him about things they learned via that Section 702 collection. Based on what Durham has said so far, Danchenko provided information about key details of the relationship between Galkina and Dolan in the interview, thereby validating that he was not hiding the relationship entirely.

Had Danchenko affirmatively lied about this in January or March 2017, rather than just not sharing this information, Durham might have a case. But by June 2017, the FBI was already sitting on that 702 collection (to say nothing of the contact tracing analysts would have used to justify the 702 directive). That’s almost certainly why they asked the question about Dolan.

So even if Durham could manage to avoid introducing, as evidence at trial, Danchenko’s communications with Galkina that the FBI would have first obtained under FISA 702, and thereby stave off the FISA notice process required for aggrieved persons under FISA, Danchenko is still going to have cause to make Durham admit a slew of things about that Section 702 directive targeting Galkina, including:

  • What kind of contact-tracing alerted the FBI and NSA that Galkina had US-cloud based communications that would be of investigative interest (because that contact-tracing, by itself, disproves Durham’s materiality claim)
  • What communications FBI obtained from that Section 702 order and when (because if they indeed had the Galkina-Dolan communications on June 15, then nothing Danchenko could have said impeded the FBI from discovering them)
  • The approval process behind the release of this Section 702 information to Inspector General Michael Horowitz, and then to Congress, which in turn presumably alerted Durham to it, and whether it complied with new requirements about unmasking imposed in 2018 in response to the Carter Page FISA and conspiracy theories about Mike Flynn (it surely did, because unmasking for FBI collections is not really a thing, but Danchenko will have reason to ask how Congress got the communications and from there, how Durham did)

None of this kind of information has been released to a defendant before, but all of it is squarely material to combatting the claim that the FBI didn’t know about Galkina’s communications with Dolan when they asked Danchenko a question precisely because they did know about those communications. And Danchenko has the right to ask for it because of that reference to Section 702 that Ron Johnson and Chuck Grassley insisted on declassifying.

The Sergei Millian counterintelligence investigation

The paragraph describing that Durham is relying on Sergei Millian’s Twitter rants as part of his evidence to prove that Danchenko lied five times about Millian (just four of which are charged) misspells Danchenko’s name, the single such misspelling in the indictment. [Update: Though see William Ockham’s comment below that notes there’s a different misspelling of Danchenko’s name elsewhere in the Millian part of the indictment.]

Chamber President-1 has claimed in public statements and on social media that he never responded to DANCHEKNO’s [sic] emails, and that he and DANCHENKO never met or communicated.

That makes me wonder whether it was added in at the last minute, after all the proof-reading, perhaps in response to a question from the grand jury or Durham’s supervisors. If it was, it might indicate that Durham didn’t really think through all the implications of invoking Millian as a fact witness against Danchenko.

But, unless Durham has rock-solid proof that Danchenko invented a call he claimed to believe had involved Millian altogether, then this reference now gives Danchenko cause to submit incredibly broad discovery requests about Millian to discredit Millian as a witness against him. Durham made no claim that he has such rock-solid proof in the indictment. As I’ve noted, Danchenko told the FBI he replaced his phone by the time the Bureau started vetting the Steele dossier, so to rule out that the call occurred, Durham probably would need to have obtained the phone and found sufficient evidence that survived a factory reset to rule out a Signal call.

Before I explain all the things Danchenko will have good reason to demand, let me review Durham’s explanation for why the alleged lies about Millian (Durham has charged separate lies on March 16, May 18, October 24, and November 16, 2017) were material:

Based on the foregoing, DANCHENKO’s lies to the FBI claiming to have received a late July 2016 anonymous phone call from an individual that DANCHENKO believed to be Chamber President-1 were highly material to the FBI because, among other reasons, the allegations sourced to Chamber President-1 by DANCHENKO formed the basis of a Company Report that, in turn, underpinned the aforementioned four FISA applications targeting a U.S. citizen (Advisor­ 1). Indeed, the allegations sourced to Chamber President-1 played a key role in the FBI’s investigative decisions and in sworn representations that the FBI made to the Foreign Intelligence Surveillance Court throughout the relevant time period. Further, at all times relevant to this Indictment, the FBI continued its attempts to analyze, vet, and corroborate the information in the Company Reports. [my emphasis]

As I have noted above, it is temporally nonsensical to claim that lies Danchenko told in October and November 2017 “played a role in sworn representations that the FBI made to FISC” when the last such representation was made in June 2017. And Danchenko will be able to make a solid case that no matter what he said in March and May, it would have had no impact on the targeting of Carter Page, because as a 400-page report lays out in depth, really damning details about the Millian claim that Danchenko freely did share in January had no impact on the targeting of Carter Page. Even derogatory things Christopher Steele said about Millian in October 2016 never made any of the Page FISA applications. The DOJ IG has claimed and Judge Rosemary Collyer agreed that FBI was at fault for all this, because they weren’t integrating any of the new information learned from vetting the dossier. Danchenko might even be able to call a bunch of FBI witnesses who were fired as a result to prove they were held accountable for it and so he can’t be blamed.

So Durham will substantially have to rely on “investigative decisions” and FBI efforts to vet the dossier to prove that Danchenko’s claimed lies about Millian were material. And that will make the FBI investigations into Millian himself and George Papadopoulos relevant and helpful to Danchenko’s defense, because those are some of the investigative decisions at issue.

That’s not the only reason that Danchenko will be able to demand that DOJ share information on Millian. Durham has made Millian a fact witness against Danchenko, and — by relying on Millian’s Twitter feed — in the most ridiculous possible way. So Danchenko will be able to demand evidence that DOJ should possesses (but may not) that he can use to explain why Millian might lie about a call between the two.

Some things Danchenko will credibly be able to demand in discovery include:

  • Extensive details about Sergei Millian’s Twitter account. Durham presented Millian’s Twitter account to the grand jury as authoritative with regards to Millian’s denials of having any direct call with Danchenko. Danchenko has reason to ask Durham for an explanation why he did so, as well as a collection of all tweets that Millian has made going back to 2016 (most of which Millian has since deleted, some of which will raise questions about Millian’s sincerity and claimed knowledge of non-public information). In addition, because there have been questions (probably baseless, but nevertheless persistent) during this period about whether Millian was personally running his own Twitter campaign, Danchenko can present good cause to ask for the IP and log-in information for the entire period, either from the government or from Twitter. While it would be more of a stretch, Millian’s Twitter crowd includes some accounts that have been identified as inauthentic by Twitter and others that were involved in publicly exposing Danchenko’s identity; Danchenko might point to this as further evidence of Millian’s motives behind his Twitter rants. Finally, Danchenko will also have cause to ask how Millian got seeming advance notice of his own indictment if Durham’s investigators never bothered to put Millian before a grand jury.

  • Details of the counterintelligence investigation into Millian. After the first release of the DOJ IG Report, the FBI declassified parts of discussions of a counterintelligence investigation that the New York Field Office opened into Millian days before October 12, 2016. The IG Report describes that Millian was “previously known to the FBI,” and does not tie that CI investigation to any allegations that Fusion made against Millian (though I don’t rule it out). Danchenko will obviously be able to ask for access to the still-redacted parts of those IG Report references, because the same things (whatever they were) that led FBI to think Millian was a spy would be things that Danchenko could use to offer a motive for why Millian would lie about having spoken to Danchenko. Danchenko also has cause to ask for details from Millian’s own FBI file. The basis for that counterintelligence investigation, and any derogatory conclusions, would provide Danchenko means to raise questions about Millian’s credibility or at least alternative motives for Millian to claim no such call took place.
  • Details of how Millian cultivated George Papadopoulos. The IG Report also reveals that, even before the Carter Page application, the FBI was aware of the extensive ties between Millian and George Papadopoulos. Because Durham claims that Danchenko’s alleged lies — and not direct evidence pertaining to the relationship between Millian and Papadopoulos — drove the FBI’s investigative decisions from 2017 through the end of the Mueller investigation, Danchenko will have reason to ask for non-public details about some aspects of the Papadopoulos investigation, as well, not least because (as the Mueller Report makes clear) the initial contacts between Millian and Papadopoulos exactly parallel in time — and adopted the same proposed initial meeting approach — the initial contact and the call that Danchenko claimed to believe he had with Millian. If the July 2016 call he believes he had with Millian didn’t occur, Danchenko will be able to argue persuasively, then how did he know precisely where and how Millian would conduct such meetings a week in advance of the initial meeting, in New York, that Millian had with Papadopoulos?

The Office investigated another Russia-related contact with Papadopoulos. The Office was not fully able to explore the contact because the individual at issue-Sergei Millian-remained out of the country since the inception of our investigation and declined to meet with members of the Office despite our repeated efforts to obtain an interview. Papadopoulos first connected with Millian via Linked-In on July 15, 2016, shortly after Papadopoulos had attended the TAG Summit with Clovis.500 Millian, an American citizen who is a native of Belarus, introduced himself “as president of [the] New York-based Russian American Chamber of Commerce,” and claimed that through that position he had ” insider knowledge and direct access to the top hierarchy in Russian politics.”501 Papadopoulos asked Timofeev whether he had heard of Millian.502 Although Timofeev said no,503 Papadopoulos met Millian in New York City.504 The meetings took place on July 30 and August 1, 2016.505 Afterwards, Millian invited Papadopoulos to attend-and potentially speak at-two international energy conferences, including one that was to be held in Moscow in September 2016.506 Papadopoulos ultimately did not attend either conference.

On July 31 , 2016, following his first in-person meeting with Millian, Papadopoulos emailed Trump Campaign official Bo Denysyk to say that he had been contacted “by some leaders of Russian-American voters here in the US about their interest in voting for Mr. Trump,” and to ask whether he should “put you in touch with their group (US-Russia chamber of commerce).”507 Denysyk thanked Papadopoulos “for taking the initiative,” but asked him to “hold off with outreach to Russian-Americans” because “too many articles” had already portrayed the Campaign, then-campaign chairman Paul Manafort, and candidate Trump as “being pro-Russian.”508

On August 23, 2016, Millian sent a Facebook message to Papadopoulos promising that he would ” share with you a disruptive technology that might be instrumental in your political work for the campaign.”509 Papadopoulos claimed to have no recollection of this matter.510

On November 9, 2016, shortly after the election, Papadopoulos arranged to meet Millian in Chicago to discuss business opportunities, including potential work with Russian “billionaires who are not under sanctions.”511 The meeting took place on November 14, 2016, at the Trump Hotel and Tower in Chicago.512 According to Papadopoulos, the two men discussed partnering on business deals, but Papadopoulos perceived that Millian’s attitude toward him changed when Papadopoulos stated that he was only pursuing private-sector opportunities and was not interested in a job in the Administration.5 13 The two remained in contact, however, and had extended online discussions about possible business opportunities in Russia. 514 The two also arranged to meet at a Washington, D.C. bar when both attended Trump’s inauguration in late January 2017.515 [my emphasis]

John Durham claims that Sergei Millian is a victim. But by making Millian a fact witness against Danchenko, Durham has given Danchenko the opportunity to obtain and air a great many details about why a DOJ prosecutor should review more than Twitter rants before treating Millian as a credible fact witness.

The Oleg Deripaska counterintelligence and sanctions investigations

Durham has also provided Danchenko multiple reasons to request details of a counterintelligence investigation that is ongoing and remains far more sensitive than the Millian one: The investigation into Oleg Deripaska.

Oleg Deripaska was the most likely client for a tasking Steele gave Danchenko immediately before the DNC one, collecting on Paul Manafort. Danchenko credibly claimed to the FBI that he did not know what client had hired Steele. If Deripaska was that client, it would be relevant and helpful to Danchenko’s defense to understand why Deripaska hired Steele.

That’s true, in significant part, because Deripaska is also the most likely culprit behind any disinformation injected into the Steele dossier. Among other things, by asking Steele to collect on Manafort and then monitoring how Steele did that, Deripaska could have used it to identify Steele’s reporting network.

Durham blames Danchenko for hiding the possibility of disinformation with one of his (false) uncharged conduct claims, but the Deripaska angle, about which Danchenko claimed to have no visibility either in real time in 2016 or by 2017, when he is accused of lying, would be the more important angle. And we know they were aware of the possibility and trying to assess whether that was possible even as they were vetting the dossier. But, as Bill Priestap told DOJ IG, he couldn’t figure out how this would work.

what he has tried to explain to anybody who will listen is if that’s the theory [that Russian Oligarch 1 ran a disinformation campaign through [Steele] to the FBI], then I’m struggling with what the goal was. So, because, obviously, what [Steele] reported was not helpful, you could argue, to then [candidate] Trump. And if you guys recall, nobody thought then candidate Trump was going to win the election. Why the Russians, and [Russian Oligarch 1] is supposed to be close, very close to the Kremlin, why the Russians would try to denigrate an opponent that the intel community later said they were in favor of who didn’t really have a chance at winning, I’m struggling, with, when you know the Russians, and this I know from my Intelligence Community work: they favored Trump, they’re trying to denigrate Clinton, and they wanted to sow chaos. I don’t know why you’d run a disinformation campaign to denigrate Trump on the side. [brackets original]

Since Durham blamed Danchenko for hiding the possibility of disinformation when questions like these did more to impede such considerations, Danchenko has good reason to ask for anything assessing whether Deripaska did use the dossier as disinformation, not least because DOJ was getting ample information to pursue that angle before Danchenko’s first interview, via Bruce Ohr (for which DOJ fired Ohr).

There’s a Millian angle to Danchenko’s case he should get information on the counterintelligence investigation into Deripaska, too. At a time when Deripaska was already tasking both sides of his double game — using Christopher Steele to make Paul Manafort legally vulnerable and then using Manafort’s legal and financial vulnerability to entice his cooperation in the election operation — Deripaska and Millian met at the St. Petersburg International Economic Forum in June 2016, the same convention that Michael Cohen was invited to attend to pursue an impossibly lucrative Trump Tower deal and to which Russian Deputy Prime Minister Sergei Prikhodko repeatedly invited Trump (as this post makes clear, Mueller obtained only unsigned versions of Trump’s letter declining Prikhodko’s invitation).

Millian’s documented meeting with Deripaska during 2016 would provide Danchenko several reasons to want access to some of the investigative materials from the Deripaska investigations. First, if Millian and Deripaska had further contact, either in 2016, or since then, it would suggest that Millian’s denials that he called Danchenko may be part of the same disinformation strategy as any disinformation inserted via Deripaska-linked sources into the dossier itself.

If Millian had no ongoing relationship with Deripaska after they met up in June 2016, however, it suggests a possible alternate explanation for the call that, Danchenko consistently claimed in 2017, he believed to be Millian: That someone learned of Danchenko’s outreach (the Novosti journalists through whom Danchenko first got Millian’s contact information are one possible source of this information, but not the only one) and called Danchenko seemingly in response to Danchenko’s outreach to Millian as another way to inject disinformation into the dossier.

Finally, Danchenko may request information on Deripaska to unpack the provenance of the investigation against him altogether. After meeting with a Deripaska deputy in January 2017, Paul Manafort returned to the US and pushed a strategy to discredit the Russian investigation by discrediting the dossier, using Deripaska’s associate Konstantin Kilimnik to obtain information about its sources. That strategy adopted by Manafort is a strategy that has led, directly, to this Durham inquiry.

If Deripaska participated in any disinformation efforts involving the dossier and instructed Manafort to exploit the disinformation he knew had been planted — if this very investigation is the fruit of the same disinformation campaign that Durham blames Danchenko for hiding — then Danchenko would have good reason to make broad discovery requests about it.

DOJ has continued to redact Deripaska-related investigative detail under ongoing investigation exemptions. And Treasury refused Deripaska’s own attempt to learn why he was sanctioned. So it’s likely DOJ would want to guard these details closely.

But Deripaska’s key role in the Russian operation even as he was tasking Steele to harm Manafort, the tie between Millian and Deripaska, and the effort to use the dossier to discredit the Russian investigation make such requests directly relevant and helpful to Danchenko’s defense.

The Carter Page FISA Collection

This entire Durham investigation is, at least metonymically, an attempt to avenge Carter Page’s (and through him, Trump’s) purported victimization at the hands of the Steele dossier.

But even with Page, Durham’s materiality claims may expose Page to more scrutiny than he ever would have been without this case. Page may well have been victimized by the dossier itself, but Danchenko is not accused of any crime in conjunction with his collection related to the dossier. Instead, he is charged with lies to the FBI in March, May, October, and November 2017. There’s plenty of evidence in the 400-page DOJ IG Report that nothing Danchenko could have said in those earlier interviews could have altered FISA targeting decisions in April and June, and it would be impossible for lies told in October and November to have affected coverage that ended in September.

That means that Durham will have to provide Danchenko a great deal of information on the investigation into Page — including on Page’s willing sharing of non-public information with Russians in 2013, his seeming efforts to reestablish contact with the Russians in 2015, his enthusiastic pursuit of Russian funding to set up a think tank in 2016, and his ongoing connections in 2017 — to afford Danchenko the ability to argue that the dossier didn’t matter because, as a Republican Congressperson with access to all the intelligence told me in July 2018, the case for surveilling Page was a slam dunk even without it.

Providing Danchenko the Mueller materials will be the easy part. They would be helpful to Danchenko’s defense because they show that rumors about Page meeting Igor Sechin were circulating Moscow, not just among Steele’s sources; there was time during Page’s July 2016 trip to Moscow that was unaccounted for, even to those who organized his trip; and via the Page investigation, Mueller corroborated that Kirill Dimitriev (the guy who had a back channel meeting with Erik Prince) would be an important source on Russia’s tracking of Trump. Mueller materials will also show that the FBI came to suspect that one of the contacts involved in bringing Page to Russia in July 2016 was being recruited by Russian spies, providing independent reason to continue the investigation into Page. Mueller investigative materials will provide new details on Konstantin Kilimnik’s report to Paul Manafort that Page was claiming to speak on Trump’s behalf on his trip to Moscow in December 2016, something that may have exposed Trump as a victim of Page’s misrepresentations in Russia, which in turn, heightened the import of learning why Page was making such claims. Language from Mueller’s still-classified description of his decision not to charge Page as a Russian agent may also prove relevant and helpful to Danchenko’s defense.

But it’s not just the Mueller materials. To combat Durham’s claim that Danchenko’s claimed lies were material to the ongoing targeting of Carter Page in April and June 2017, the defendant obviously must be given access to substantial materials from Page’s FISA applications (October 2016, January 2017, April 2017, June 2017). Danchenko will be able to undercut Durham’s materiality arguments in at least two ways with these materials. First, as Andrew McCabe understood it, the first period of FISA collection was “very productive,” and others at FBI described that the collection showed Page’s, “access to individuals in Russia and [his communications] with people in the Trump campaign, which created a concern that Russia could use their influence with Carter Page to effect policy.” Danchenko can certainly ask for these discussions to argue that, even before he ever spoke to the FBI in January 2017, things the FBI learned by targeting Page under FISA created new reason to continue to task him, independent of the dossier.

Even more critically, redacted passages of the DOJ IG Report suggest that the decision to continue targeting Page in June 2017 stemmed almost entirely from a desire to get to financial and encrypted app information from Page that might not be otherwise available.

[A]vailable documents indicate that one of the focuses of the Carter Page investigation at this time was obtaining his financial records. NYFO sought compulsory legal process in April 2017 for banking and financial records for Carter Page and his company, Global Energy Capital, as well as information relating to two encrypted online applications, one of which Page utilized on his cell phone. Documents reflect that agents also conducted multiple interviews of individuals associated with Carter Page.

Case Agent 6 told us, and documents reflect, that despite the ongoing investigation, the team did not expect to renew the Carter Page FISA before Renewal Application No. 2’s authority expired on June 30. Case Agent 6 said that the FISA collection the FBI had received during the second renewal period was not yielding any new information. The OGC Attorney told us that when the FBI was considering whether to seek further FISA authority following Renewal Application No. 2, the FISA was “starting to go dark.” During one of the March 2017 interviews, Page told Case Agent 1 and Case Agent 6 that he believed he was under surveillance and the agents did not believe continued surveillance would provide any relevant information. Cast Agent 6 said [redacted]

SSA 5 and SSA 2 said that further investigation yielded previously unknown locations that they believed could provide information of investigative value, and they decided to seek another renewal. Specifically, SSA 5 and Case Agent 6 told us, and documents reflect, that [redacted] they decided to seek a third renewal. [redacted]

If declassified versions of this report (and the underlying back-up) confirm that, it means Danchenko’s alleged lies in May and June were virtually meaningless in ongoing decisions to target Page, because FBI would otherwise have detasked him if not for very specific accounts they wanted to target. Danchenko would need to be able to get declassified versions of that material to be able to make that argument.

Then there’s the FISA collection used to reauthorize FISA targeting on Page. There’s enough public about what FBI obtained for Danchenko to argue that he needs this collection to rebut the materiality claims Durham has made. For example, one redacted passage in reauthorization applications suggests that FBI learned information about whether Page’s break with the campaign was as significant as the campaign publicly claimed it was. Another redacted passage suggests FBI may have obtained intelligence that contradicted Page’s denials of certain meetings in Russia. A third redacted passage suggests that the FBI learned that Page was engaged in a limited hangout with his admissions of such meetings. Not only might some of this validate the dossier (and explain why Mueller treated the question of Page’s trips to Russia as inconclusive), but it provides specific reasons the FISA collection justified suspicions of Page, meaning FBI was no longer relying on the dossier.

Finally, since Durham claims that Danchenko’s lies impeded the FBI’s efforts to vet the dossier, Danchenko will need to be provided a great deal of information on those efforts.  This is another instance where files released as part of Trump’s efforts to undermine the investigation will help Danchenko prove there are discoverable materials he should get. This spreadsheet is what FBI used to vet the dossier. It shows that the FBI obtained information under the Carter Page FISA they used to vet a claim Danchenko sourced to his friend, Galkina, whom Durham made central to questions of materiality. Similarly, the FBI used information from the Page FISA to help vet the claim that Danchenko sourced (incorrectly or not) to Millian, which is utterly central to the case against him. Given Durham’s claims that Danchenko’s lies prevented FBI from doing this vetting, he can easily claim that obtaining this vetting information may be helpful and material to his defense (though it may in fact not be helpful).

This is a very long list and I’m not saying that Danchenko will succeed in getting this information, much less using it at trial.

What I’m saying is that it is quite literally unprecedented for a defendant to know specific details of two FISA orders — the 702 directive targeting Galkina and the Carter Page FISAs — that they can make credible arguments they need access to to mount a defense. Similarly, the ongoing, sensitive counterintelligence investigation into Oleg Deripaska (and Konstantin Kilimnik) is central to the background of the dossier. And Durham has made someone who — like Danchenko before him, was investigated as a potential Russian asset — a fact witness in this case.

Normally, prosecutors might look at the discovery challenges such legitimate defense demands would pose and decide not to try the case (it’s one likely reason, for example, why David Petraeus got away with a wrist-slap for sharing code-word information with his mistress, because the discovery to actually prosecute him would have done more damage than the conviction was worth; similarly, the secrecy of some evidence Mueller accessed likely drove some of his declination decisions). But Durham didn’t do so. He has committed himself to deal with some of the most sensitive discovery ever provided, and to do so with a foreign national defendant, all in pursuit of five not very well-argued false statements charges. That doesn’t mean Danchenko will get the evidence. But it means Durham is now stuck dealing with unprecedented discovery challenges.

In a follow-up, I’ll talk about how this will work and why it may be literally impossible for Durham to succeed.

Update: I’ve corrected the date of the month of the charged interview pertaining to Charles Dolan.

Update: In a story on an ongoing counterintellience investigation into a Russian expat group, Scott Stedman notes that the group was involved in Millian’s pitch to Papadopoulos in 2016.

Forensic News can reveal that Gladysh’s pro-Trump internet activity was much broader than previously known. In 2020, Gladysh’s Seattle-based Russian-American Cooperation Initiative founded a news website that nearly exclusively promoted Trump and disseminated Russian propaganda, according to internet archives.

The news website featured articles with the titles such as “Second Trump term is crucial to prospect of better U.S.-Russia relations, safer world,” and “Biden victory will spell disaster for U.S.-Russia relations, warns billionaire.” The billionaire referenced by the outlet is Oleg Deripaska, a key figure in the 2016 Trump campaign’s collusion with Russia.

[snip]

Morgulis attempted to rally Russian voters for Donald Trump in both the 2016 and 2020 U.S. Presidential Elections and allied himself with numerous associates connected to Russian intelligence and influence operations that have caught the attention of the FBI.

According to the Washington Post, Morgulis and Sergei Millian worked on a plan to rally Russian voters for Trump in 2016. Millian, who was in contact with Trump aide George Papadopoulos, later fled the country and was not able to be interviewed by investigators.

[snip]

Morgulis, Branson, and Millian all received Silver Archer Awards in 2015, a Russian public affairs accomplishment given to U.S. persons advancing Russian cultural and business interests. The founder of Silver Archer is Igor Pisarsky, a “Kremlin-linked public relations power player” who facilitated money transfers from a Russian oligarch to Maria Butina.

This will provide Danchenko cause to ask for details of that counterintelligence investigation.

Durham’s Materiality Claims

Durham’s general materiality argument makes three claims about the way that Danchenko’s alleged lies affected the FBI investigation. And then, nested underneath those claims, he made further claims (about half of which aren’t even charged), about the materiality of other things, a number of which have nothing to do with the Carter Page FISA. Of particular note, the bulk (in terms of pages) of this indictment discusses lies that Durham doesn’t tie back to Carter Page, even though he could have, had he treated Olga Galkina differently.

      • Danchenko’s lies were material because FBI relied on the dossier to obtain FISA warrants on Carter Page: “The FBI’ s investigation of the Trump Campaign relied in large part on the Company Reports to obtain FISA warrants on Advisor-1.”
        • Danchenko’s lie about believing Millian called him in July 2016 because it formed the basis of the FISA applications targeting Page: Danchenko’s alleged lies to the FBI about Millian, “claiming to have received a late July 2016 anonymous phone call from an individual that DANCHENKO believed to be Chamber President-I were highly material to the FBI because, among other reasons, the allegations sourced to Chamber President-I by DANCHENKO formed the basis of a Company Report that, in turn, underpinned the aforementioned four FISA applications targeting a U.S. citizen (Advisor­ 1).”
      • Danchenko’s lies were material because they made it harder for the FBI to vet the dossier: “The FBI ultimately devoted substantial resources attempting to investigate and corroborate the allegations contained in the Company Reports, including the reliability of DANCHENKO’s sub-sources.”
        • Danchenko’s lies about how indiscreet he was about collecting information for Steele prevented the FBI from understanding whether people, including Russia, could inject disinformation into the dossier: Accordingly, DANCHENKO’s January 24, 2017 statements (i) that he never mentioned U .K. Person-I or U .K. Investigative Firm-I to his friends or associates and (ii) that “you [the FBI] are the first people he’s told,” were knowingly and intentionally false. In truth and in fact, and as DANCHENKO well knew, DANCHENKO had informed a number of individuals about his relationship with U.K. Person-I and U.K. Investigative Firm-I. Such lies were material to the FBI’ s ongoing investigation because, among other reasons, it was important for the FBI to understand how discreet or open DANCHENKO had been with his friends and associates about his status as an employee of U .K. Investigative Firm-I, since his practices in this regard could, in tum, affect the likelihood that other individuals – including hostile foreign intelligence services – would learn of and attempt to influence DANCHENKO’s reporting for U.K. Investigative Firm1.
        • Dancheko’s lies about Charles Dolan prevented the FBI from learning that Dolan was well-connected in Russia, Dolan had ties to Hillary, and Danchenko gathered some of his information using access obtained through Dolan:  DANCHENKO’s lies denying PR Executive-1 ‘s role in specific information referenced in the Company Reports were material to the FBI because, among other reasons, they deprived FBI agents and analysts of probative information concerning PR Executive-I that would have, among other things, assisted them in evaluating the credibility, reliability, and veracity of the Company Reports, including DANCHENKO’s sub-sources. In particular, PR Executive-I maintained connections to numerous people and events described in several other reports, and DANCHENKO gathered information that appeared in the Company Reports during the June Planning Trip and the October Conference. In addition, and as alleged below, certain allegations that DANCHENKO provided to U.K. Person-I, and which appeared in other Company Reports, mirrored and/or reflected information that PR Executive-I himself also had received through his own interactions with Russian nationals. As alleged below, all of these facts rendered DANCHENKO’s lies regarding PR Executive-1 ‘s role as a source of information for the Company Reports highly material to the FBI’ s ongoing investigation. [snip] PR Executive-1 ‘s role as a contributor of information to the Company Reports was highly relevant and material to the FBI’s evaluation of those reports because (a) PR Executive-I maintained pre-existing and ongoing relationships with numerous persons named or described in the Company Reports, including one of DANCHENKO’s Russian sub-sources ( detailed below), (b) PR Executive-I maintained historical and ongoing involvement in Democratic politics, which bore upon PR Executive-I’s reliability, motivations, and potential bias as a source of information for the Company Reports, and (c) DANCHENKO gathered some of the information contained in the Company Reports at events in Moscow organized by PR Executive-I and others that DANCHENKO attended at PR Executive-1 ‘s invitation. Indeed, and as alleged below, certain allegations that DANCHENKO provided to U.K. Person-I, and which appeared in the Company Reports, mirrored and/or reflected information that PR Executive-I himself also had received through his own interactions with Russian nationals.
          • Danchenko’s lies about Dolan prevented the FBI from asking whether Dolan spoke to Danchenko about the Ritz Hotel: Based on the foregoing, DANCHENKO’s lies to the FBI denying that he had communicated with PR Executive-I regarding information in the Company Reports were highly material. Had DANCHENKO accurately disclosed to FBI agents that PR Executive-I was a source for specific information in the aforementioned Company Reports regarding Campaign Manager-1 ‘s departure from the Trump campaign, see Paragraphs 45-57, supra, the FBI might have taken further investigative steps to, among other things, interview PR Executive-I about (i) the June 2016 Planning Trip, (ii) whether PR Executive-I spoke with DANCHENKO about Trump’s stay and alleged activity in the Presidential Suite of the Moscow Hotel, and (iii) PR Executive-1 ‘s interactions with General Manager-I and other Moscow Hotel staff. In sum, given that PR Executive-I was present at places and events where DANCHENKO collected information for the Company Reports, DANCHENKO’s subsequent lie about PR Executive-1 ‘s connection to the Company Reports was highly material to the FBI’ s investigation of these matters.
          • Danchenko’s lies about Dolan prevented the FBI from asking Dolan whether he knew about a Russian Diplomat being reassigned from the US Embassy: Based on the foregoing, DANCHENKO’s lies to the FBI denying that he had communicated with PR Executive-I regarding information in the Company Reports were highly material. Had DANCHENKO accurately disclosed to FBI agents that PR Executive-I was a source for specific information in the Company Reports regarding Campaign Manager-I ‘s departure from the Trump campaign, see Paragraphs 45-57, supra, the FBI might also have taken further investigative steps to, among other things, interview PR Executive-I regarding his potential knowledge of Russian Diplomat-1 ‘s departure from the United States. Such investigative steps might have assisted the FBI in resolving the above-described discrepancy between DANCHENKO and U.K. Person-I regarding the sourcing of the allegation concerning Russian Diplomat-I.
          • Danchenko’s lies about Dolan prevented the FBI from asking whether Dolan was the source for the [true] report about reasons why Paul Manafort had left the Trump campaign: Based on the foregoing, DANCHENKO’s lie to the FBI about PR Executive-I not providing information contained in the Company Reports was highly material. Had DANCHENKO accurately disclosed to FBI agents that PR Executive-I was a source for specific information in the aforementioned Company Reports regarding Campaign Manager-I’s departure from the Trump campaign, see Paragraphs 45-57, supra, the FBI might have taken further investigative steps to, among other things, interview PR Executive-I regarding his potential knowledge of additional allegations in the Company Reports regarding Russian Chief of Staff-I. Such investigative steps might have, among other things, assisted the FBI in determining whether PR Executive-I was one of DANCHENKO’s “other friends” who provided the aforementioned information regarding Putin’s firing of Russian Chief of Staff-I.
        • Danchenko’s lies about a phone call made it harder for the FBI to vet the dossier: Danchenko’s alleged lies about Millian were material because, “at all times relevant to this Indictment, the FBI continued its attempts to analyze, vet, and corroborate the information in the Company Report.”
      • The FBI took and did not take certain actions because of Danchenko’s lies: “The Company Reports, as well as information collected for the Reports by DANCHENKO, played a role in the FBI’s investigative decisions and in sworn representations that the FBI made to the Foreign Intelligence Surveillance Court throughout the relevant time period.”
        • Danchenko’s alleged lies about Millian affected both FBI’s investigative decisions and played a role in their FISA applications: They “played a key role in the FBI’s investigative decisions and in sworn representations that the FBI made to the Foreign Intelligence Surveillance Court throughout the relevant time period.”

Sources

DOJ IG Report on Carter Page

Mueller Report

October 2016 Page FISA Application

January 2017 Page FISA Application

April 2017 Page FISA Application

June 2017 Page FISA Application

Dossier vetting spreadsheet

Danchenko posts

The Igor Danchenko Indictment: Structure

John Durham May Have Made Igor Danchenko “Aggrieved” Under FISA

“Yes and No:” John Durham Confuses Networking with Intelligence Collection

Daisy-Chain: The FBI Appears to Have Asked Danchenko Whether Dolan Was a Source for Steele, Not Danchenko

Source 6A: John Durham’s Twitter Charges

John Durham: Destroying the Purported Victims to Save Them

John Durham’s Cut-and-Paste Failures — and Other Indices of Unreliability

Aleksej Gubarev Drops Lawsuit after DOJ Confirms Steele Dossier Report Naming Gubarev’s Company Came from His Employee

In Story Purporting to “Reckon” with Steele’s Baseless Insinuations, CNN Spreads Durham’s Unsubstantiated Insinuations

On CIPA and Sequestration: Durham’s Discovery Deadends

The Disinformation that Got Told: Michael Cohen Was, in Fact, Hiding Secret Communications with the Kremlin

 

Share this entry

The Igor Danchenko Indictment: Structure

/56 Comments/in , /by

I’m going to do a series of posts on John Durham’s indictment of Igor Danchenko. Because the indictment is an organizational shit-show and because the order Durham adopts obscures real problems with the indictment, I’m going to do the posts out of order. But I want to start by laying out the organization he uses, which will serve as a means to link the series I will do and explain the import. (I’ll do running updates on this post.)

Here’s the organization; I’ve bolded the parts of the indictment that pertain to actually charged crimes, I’ve italicized those that don’t relate to the charges, and underlined one that includes other dodgy claims:

I. Introduction and Overview

A. Igor Danchenko

B. Orbis and Its Role in the 2016 Presidential Election Campaign

C. Charles Dolan

D. Danchenko’s Relationship with Dolan

E. Olga Galkina

F. Danchenko Introduces Galkina to Dolan

G. Sergei Millian

H. Danchenko’s US Election Reporting

II. Danchenko’s False Statements Involving Dolan

A. Dolan Provides Information Regarding Paul Manafort

B. Danchenko’s Statements to the FBI Regarding Dolan

III. The Materiality of Danchenko’s [Alleged] Lies Regarding Dolan

A. Danchenko’s Allegations Regarding Salacious Sexual Activity

    1. Dolan and Organizer-1 Receive a Tour of the Ritz Presidential Suite
    2. Danchenko’s Statements to the FBI Regarding the Ritz

B. Danchenko’s Allegations Regarding Russian Diplomat-1

    1. Danchenko’s Statements to the FBI Regarding Russian Diplomat-1

C. Danchenko’s Allegation Regarding Russian Chief of Staff-1

    1. Danchenko’s Statements to the FBI Regarding Chief of Staff-1

IV. Danchenko’s False Statement Regarding Disclosure of His Relationship with Steele and Orbis

V. Danchenko’s False Statements Regarding Allegations Sourced to Sergei Millian

A. Danchenko’s Alleged Phone Call with Millian

B. Danchenko’s False Statement Regarding His Alleged Phone Call with Millian

VI. The Materiality of Danchenko’s [Alleged] Lies Regarding Millian

Charges

  • On or about June 15, 2017, Danchenko denied to agents of the FBI that he had spoken with Dolan about any material contained in the Company Reports, when in truth and in fact, Dolan was the source for an allegation contained in a Company Report dated August 22, 2016 and was otherwise involved in the events and information described in the reports. [my emphasis]
  • On or about March 16, 2017, Danchenko stated to agents of the FBI that he received a late July 2016 telephone call from an individual who DANCHENKO believed was “probably” Chamber President-1, when in truth and in fact, and as the defendant well knew. Chamber President-1 never called DANCHENKO.
  • On or about May 18, 2017, Danchenko stated to agents of the FBI that he “was under the impression” that a late July 2016 telephone call that he received was from Chamber President-1, when in truth and in fact, and as the defendant well knew. Chamber President-1 never called DANCHENKO.
  • On or about October 24, 2017, Danchenko stated to agents of the FBI that he believed that he spoke to Chamber President-1 on the telephone on more than one occasion, when in truth and in fact, and as the defendant well knew, DANCHENKO never spoke to Chamber President-1.
  • On or about November 16, 2017, Danchenko stated to agents of the FBI that he believed that he had spoken to Chamber President-1 on the telephone, when in truth and in fact, DANCHENKO never spoke to Chamber President-I.

The reason I’m starting by laying out this structure is to show that two entire sections of this indictment (both italicized), Section III (Materiality of Danchenko’s alleged lies regarding Dolan) and Section IV (Danchenko’s False Statement regarding disclosure of his relationship with Steele and Orbis), are not charged at all. When Durham did something analogous in the Michael Sussmann indictment, Sussmann accused him of improperly including 404b information in the indictment.

In this case, however, it’s even worse. Section III insinuates that Dolan is the source for dossier allegations that Durham doesn’t even try to prove. He introduces them by making a provably bullshit materiality claim. Worse still, the evidence Durham presents totally undermines those allegations. Nevertheless, having included those insinuations, propagandists like Kim Strassel and purportedly serious reporters like Jonathan Swan have treated those allegations as if they’ve actually been charged. So this section was a very successful way that Durham used credulous hacks to repeat claims he’s not even trying to prove are true.

Section IV, as I will argue, is an outright misrepresentation, a claim that Danchenko lied about a topic when in fact Durham misrepresented the public record (which may be why it’s not charged). On paper, this section mostly attempts to corroborate Charge 1, that Danchenko lied about what Dolan said. But it’s more cynical both for the materiality claim Durham invents (that FBI couldn’t have known that Russia was feeding disinformation to Danchenko and Steele) and because Durham treats Hillary Clinton, not Russia, as the hostile adversary to the US.

Finally, in the underlined section on Olga Galkina, Durham attempts to insinuate that Galkina and Dolan had some conspiracy going. This section is another uncharged allegation. It’s made all the worse because all the available evidence (including that Galkina is credibly alleged to be the source for the most discredited claims in the dossier, that Michael Cohen was in Prague) suggests something more nefarious was going on. In this section, then, Durham runs interference for Russian intelligence.

The point of this structure is that Durham has used both the two italicized sections and the underlined one to make wild (and in some cases, provably false) insinuations without even intending to prove them.

Danchenko posts

The Igor Danchenko Indictment: Structure

John Durham May Have Made Igor Danchenko “Aggrieved” Under FISA

“Yes and No:” John Durham Confuses Networking with Intelligence Collection

Daisy-Chain: The FBI Appears to Have Asked Danchenko Whether Dolan Was a Source for Steele, Not Danchenko

Source 6A: John Durham’s Twitter Charges

John Durham: Destroying the Purported Victims to Save Them

John Durham’s Cut-and-Paste Failures — and Other Indices of Unreliability

Aleksej Gubarev Drops Lawsuit after DOJ Confirms Steele Dossier Report Naming Gubarev’s Company Came from His Employee

In Story Purporting to “Reckon” with Steele’s Baseless Insinuations, CNN Spreads Durham’s Unsubstantiated Insinuations

On CIPA and Sequestration: Durham’s Discovery Deadends

The Disinformation that Got Told: Michael Cohen Was, in Fact, Hiding Secret Communications with the Kremlin

Share this entry

John Durham Admits He Overstated Evidence in His Michael Sussmann Materiality Statement

/42 Comments/in , /by

In my post laying out Michael Sussmann’s motion for a Bill of Particulars, I expressed the following:

  • His claim that he needed the exact quote of the lie he purported told Jim Baker was well-founded
  • Durham would respond to Sussmann’s demand for more specificity about materiality by saying that was up to the jury
  • Sussmann surely knew the names of the other people at a CIA meeting where, Durham alleges, just two people present now claim that Sussmann lied about having a client
  • Sussmann surely knew there were no people on the Clinton Campaign with whom he had — as Durham had insinuated in a materiality statement — [personally] coordinated; he knew any such communications happened through Marc Elias

As I tweeted out here, Durham’s response to Sussmann affirms all of those predictions.

  • Durham responded to the request for the exact quote of the lie Sussmann purportedly told by block-quoting the indictment (which doesn’t quote his lie), but not providing the actual lie he told or the context in which he allegedly told it; in the process, Durham seemed to commit that he was not charging Sussmann with a lie of omission but only alleging Sussmann omitted material information with an alleged affirmative lie
  • Durham quoted the traditional definition of materiality (not the one DOJ espoused with Mike Flynn), and said it was up to the jury to decide
  • Durham admitted that he introduced the CIA lie as 404b information, not an actual charge (and seemed to concede he has no proof that Sussmann told exactly the same lie to the CIA as he allegedly did to the FBI)

But it’s Durham’s response to the request for the names of the Clinton Campaign people with whom Sussmann allegedly coordinated that I find most telling. Sussmann had asked for the identity of the Clinton Campaign people that Durham mentioned in a passage (bolded below) from paragraph 6 of the indictment that Durham used as one of three prongs in his materiality statement.

Finally, Mr. Sussmann seeks the identities of certain representatives and agents of the Clinton Campaign mentioned in the Indictment that the Special Counsel has refused to provide to date.7 The Indictment alleges that Mr. Sussmann, Tech Executive-1, and Law Firm-1 “coordinated, and were continuing to coordinate, with representatives and agents of the Clinton Campaign with regard to the data and written materials that Sussmann gave to the FBI and the media.” Indictment ¶ 6. The Indictment does not identify by name the alleged “representatives and agents of the Clinton Campaign.” Id.

The animating theory of the Special Counsel’s Indictment is that Mr. Sussmann was secretly working on behalf of the Clinton Campaign, and he intentionally and falsely stated that he was not acting on behalf of any client in order to conceal his ties to the campaign. The Special Counsel should not be permitted, on the one hand, to allege that Mr. Sussmann was working on behalf of the Clinton Campaign, but on the other hand, decline to identify the specific individuals with whom he was purportedly working. Among other things, Mr. Sussmann may wish to call such individuals as witnesses in his defense at trial, but, unless he knows of their identities, he will have no ability to do so. At base, an indictment must provide a defendant with the “essential facts constituting the offense charged.” Fed R. Crim. P. 7(c)(1). And no facts could be more essential than the names of the witnesses involved.

Having made these allegations, the Special Counsel must illuminate them—by identifying the relevant individuals referenced—to allow Mr. Sussmann to decide how to respond appropriately. See Butler, 822 F.2d at 1193 (the indictment must enable the defendant to understand the charges against him and prepare a defense); cf. Hubbard, 474 F. Supp. at 80 (ordering bill of particulars to define “unnecessarily vague” phrases used in the indictment). Therefore, Mr. Sussmann respectfully asks this Court to order the Special Counsel to provide a bill of particulars identifying, by name, the “representatives and agents of the Clinton Campaign” with respect to Paragraph 6.

7 The Special Counsel has identified virtually all of the other anonymous individuals and entities referred to in the Indictment (except, as noted above, the Agency-2 employees).

In my post, I suggested that Sussmann isn’t so much trying to get these names, but because he knows this claim is false, he’s trying to get Durham to admit that there are no names — because (Sussmann knows) he didn’t coordinate directly with the Clinton Campaign.

Sussmann likely doesn’t really need these names because he likely knows that Durham has nothing to substantiate this claim. If he did, Durham would have described such evidence in his speaking indictment.

And Durham’s response cedes the point: In response to a question about the “agents and representatives of the Clinton Campaign” with whom Sussmann directly coordinated referenced in paragraph 6, Durham explains that that reference is just a “summary” of “facts” later alleged in paragraphs 25(e), 20(d), and 20(g).

Paragraph 6 is a portion of the “Introduction and Overview” section of the Indictment that summarizes facts later alleged with specificity. And the later parts of the Indictment provide details underlying the more generalized allegation in Paragraph 6. For example, Paragraph 25(e) of the Indictment states that [Elias] had exchanged emails about the [Alfa Bank] allegations with the Clinton Campaign’s campaign manager, communications director, and foreign policy advisor which the defendant had provided to a newspaper. Ind. ¶ 25(e). Indeed, the government also provided the true identities of each of those referenced individuals to defense counsel in a discovery letter dated October 20, 2021. Likewise, Paragraphs 20(d) and 20(g) allege that the defendant, one of his law partners, and [Rodney Joffe] each communicated via email with an investigative firm that was at the time acting as an agent of the Clinton Campaign. The government similarly has provided the identity of that investigative firm to the defense in its October 20 discovery letter, even though counsel was undoubtedly already aware of that firm’s identity. Moreover, it was a production of information by the defendant’s counsel (i.e., a privilege log) that first alerted the government to these cited emails. Accordingly, the defendant is neither entitled to, nor needs any greater detail, regarding the identities of the individuals identified in Paragraph 25(e) at this stage, and any further information in that regard will be disclosed in due course in discovery prior to trial. At bottom, the defendant’s demand here is not an appropriate use of a motion for a bill of particulars and should be denied.

In response to the request for the identities of the Clinton Campaign people he was coordinating with, Durham pointed to the following allegations:

d. In or around the same time period [mid-August 2016], SUSSMANN, [Marc Elias], and personnel from [Fusion GPS] began exchanging emails with the subject line, “Connecting you all by email.”

[snip]

g. Later in or about August 2016, [Rodney Joffe] exchanged emails with personnel from [Fusion GPS].

[snip]

e. On or about September 15, 2016, [Elias] exchanged emails with the Clinton Campaign’s campaign manager, communications director, and foreign policy advisor concerning the [Alfa Bank] allegations that SUSSMANN had recently shared with [Franklin Foer]. [Elias] billed his time for this correspondence to the Clinton Campaign with the billing entry, “email correspondence with [Jake Sullivan], [name of campaign manager], [name of communications director] re: [Alfa Bank] Article.” [emphasis added by Durham]

That is, in response to a question, tell me what agents of the Clinton Campaign Sussmann and Joffe and Perkins Coie coordinated with, which is something (Durham claims) Sussmann lied to hide, Durham responded by pointing to 1) an email where Elias connected Fusion GPS and Sussmann via email (well after the identification of the Alfa Bank anomaly), 2) emails that Joffe exchanged with Fusion GPS, and 3) an email that Elias sent Jake Sullivan and others about the Franklin Foer article.

Effectively, Durham’s response admits that he has presented no evidence either Sussmann or Joffe ever spoke directly to members of the Clinton Campaign about the Alfa Bank allegations. He sustains the claim only by raising Elias, whom he doesn’t mention in that materiality statement.

He also admits that he is treating Fusion GPS as an agent of the Clinton Campaign, which it arguably is, but only through Perkins Coie. The indictment presents no evidence that the Campaign was directly managing Fusion, or even aware of it. There’s no place in this indictment where the Clinton Campaign provided directions into this effort that would amount to an instruction to feed information to the FBI, something that goes to the heart of whether or not Sussmann was representing Hillary at the meeting with Baker. (Right wing conspiracists have, in recent days, pointed back to Sussmann’s June 2016 efforts to get the FBI to attribute the DNC hack to Russia, conflating an interest in attribution to Russia and a later effort to investigate Trump’s ties to Russia.)

Durham might not even have the content of his emails with Fusion GPS or Elias’ emails with Sullivan and others. He only knows of these communications, Durham explains, because Sussmann invoked privilege over them in a privilege log shared with Durham.

In the indictment, Durham makes much of something April Lorenzen (the security expert who used the name Tea Leaves during this project but whom Durham has needlessly referred to as Originator-1) said on August 20, 2016 that reflects an obvious technical point: “even if we found what [Joffe] asks us to find in DNS, we don’t see the money flow, and we don’t see the content of some message saying, ‘send money here’.” That is, the DNS traffic they were following was proof of some kind of messaging. But it was not proof of what was being said. Durham may have the same problem: he may not have proof regarding what direction these communications flowed and what was really said.

I would not be remotely surprised if Durham used the fact that he obtained a false statements indictment as a basis to obtain a probable cause warrant to obtain these communications via other means (perhaps via whatever company hosts Perkins Coie’s email) such that an FBI filter team could do their own privilege determination of them. Durham is working on a theory that this is all two parallel conspiracies to defraud the government, and would need to use a crime-fraud exception to get to content that, he believes as a matter of faith, would prove the case. A big part of this investigation is an exercise in exposing Hillary to the same invasive investigative scrutiny as Trump (as if the Clinton email and Clinton Foundation investigations didn’t already do that), and Trump’s attorneys keep having their communications seized. So I’m sure Durham would relish seizing the communications of Elias and Sussmann.

That said, for the existing indictment charging only Sussmann with a single false statement, Durham claims that Sussmann lied to James Baker by disclaiming that both his work to chase down this Alfa Bank anomaly and his scheduling of a meeting at which he gave Baker a heads up that a media outlet was going to publish the story in order to hide that he was “coordinating” with the Clinton Campaign. But Durham presents no evidence Sussmann ever spoke to anyone at the Clinton Campaign on this topic … and the only evidence he presents that anyone spoke to Hillary’s people comes well after the white papers provided to the FBI were substantially complete.

This doesn’t really fly in an indictment charging just Sussmann. It effectively treats this as a conspiracy, without (yet) charging a conspiracy. With his response to Sussmann’s motion for a Bill of Particulars, Durham has effectively accused and treated all the named people of engaging in a conspiracy without showing any evidence that they were doing anything other than trying to understand an anomaly involving Trump’s company and a Russian bank.

Share this entry

Michael Sussmann Attempts to Bill [of Particulars] Durham for His Sloppy Indictment Language

/35 Comments/in , , /by

“Without prejudice to any other pretrial motions”

Michael Sussmann’s lawyers reserve their right to challenge the Durham indictment of Sussmann via other pretrial motions in their motion for a Bill of Particulars six different times. The motion does so three different times when noting that Durham used squishy language to paraphrase Sussmann’s alleged lie and couldn’t seem to decide whether he affirmatively lied or lied by omission.

Mr. Sussmann is entitled to understand which particular crime he must defend himself against. Without prejudice to any other pretrial motions Mr. Sussmann may bring on the matter, Mr. Sussmann is also entitled to additional particulars regarding the alleged omissions in the Indictment, including regarding the legal duty, if any, that required him to disclose the allegedly omitted information the Indictment suggests he should have disclosed.

[snip]

The Special Counsel should be required to clarify which crime he believes Mr. Sussmann committed and, to the extent the Special Counsel is proceeding on an omissions theory, he should be required to provide additional particulars (without prejudice to any motions Mr. Sussmann may make later).

[snip]

To the extent that the Special Counsel believes the Indictment is alleging a material omission under Section 1001(a)(1), and without prejudicing any other motions Mr. Sussmann may make on this issue, the Special Counsel should be required to clarify: (1) what specific information Mr. Sussmann failed to disclose; (2) to whom he failed to disclose it; (3) what legal duty required Mr. Sussmann to make the required disclosure; and (4) why the omission was material. See United States v. Safavian, 528 F.3d 957, 964 (D.C. Cir. 2008). [my emphasis]

It does so twice when asking that Durham address problems with his claims that Sussmann’s alleged lie was material.

The Indictment does make several allegations regarding materiality, and yet these allegations are vague, imprecise, and inconsistent. Suggesting the FBI might have asked more questions, taken other steps, or allocated resources differently, without specifying how or why it would have done so, leaves Mr. Sussmann having to guess about the meaning of the allegations that the Special Counsel has leveled against him. Accordingly, without prejudice to any pretrial motions Mr. Sussmann may make regarding materiality, Mr. Sussmann requests that the Court order the Special Counsel to provide more detail about why the purported false statement was material.

[snip]

Accordingly, without prejudice to any pretrial motions Mr. Sussmann may make regarding materiality, Mr. Sussmann requests that the Special Counsel be ordered to provide more detail about why the purported false statement was material. See Fed. R. Crim. P. 7(c)(1). [my emphasis]

And the motion does so again when pointing out that Durham hasn’t included specifics about another alleged lie, to just two of an unidentified number of people who attended a meeting at CIA, which Sussmann elsewhere describes as improper inclusion of 404(b) material in an indictment.

Without prejudicing any other motions Mr. Sussmann may make on this issue, the Special Counsel should first be required to clarify the false statement alleged to have been made to the two anonymous Agency-2 employees, and any other individuals present at the meeting, in February 2017. [my emphasis]

A list of things John Durham didn’t provide in his Michael Sussmann indictment

It’s only after making it clear that this is just his opening move before filing a motion to dismiss and other legal challenges to the indictment…

The Indictment is seriously vulnerable to challenge as a matter of law, and Mr. Sussmann will make relevant pretrial motions at the appropriate time. For now, Mr. Sussmann moves for a bill of particulars.

…that Sussmann lays out a list of things he claims he can’t figure out from Durham’s sloppy indictment:

For the foregoing reasons, this Motion for a Bill of Particulars should be granted, and the Court should order the Special Counsel to promptly:

A. Provide particulars regarding the specific false statement the Special Counsel alleges Mr. Sussmann made to Mr. Baker, namely:

1. The exact words of Mr. Sussmann’s alleged false statement;

2. The specific context in which the statement was made so that the meaning of the words is clear;

3. What part of the statement is allegedly false, i.e., whether the statement was false because Mr. Sussmann allegedly stated he was not “acting on behalf of any client in conveying particular allegations concerning a Presidential Candidate” as alleged in Paragraph 46, or if he falsely stated that he was not doing any “work” on behalf of a client more generally, as alleged in Paragraphs 4, 27(a), 28;

4. What is meant by “his work,” as referenced in Paragraph 4;

5. What is meant by “acting [or acted] on behalf of any client” as alleged in Paragraphs 27(a) and 30; and

6. What “this” refers to in the Assistant Director’s notes referenced in Paragraph 28.

B. Provide particulars regarding the statutory violation charged and, if applicable any alleged omissions, namely:

1. Which crime the Special Counsel believes Mr. Sussmann has committed; and

2. To the extent the Special Counsel alleges that Mr. Sussmann made a material omission in violation of 18 U.S.C. § 1001(a)(1), as suggested by Paragraph 30 of the Indictment –

a. the specific information Mr. Sussmann allegedly failed to disclose;

b. to whom he allegedly failed to make that disclosure;

c. what legal duty required Mr. Sussmann to disclose such information; and

d. why the allegedly omitted information was material.

C. Provide particulars regarding how the alleged false statement to Mr. Baker was material, specifically:

1. The “other reasons” Mr. Sussmann’s false statement was material, as alleged in Paragraphs 5 and 32;

2. What “his work” refers to as referenced in Paragraph 5, what about such work was unknown to the FBI, and how the “political nature of his work” was material to the FBI’s investigation;

3. How Mr. Sussmann’s alleged false statement was material to the FBI’s ability to “assess and uncover the origins of the relevant data and technical analysis,” as alleged in Paragraph 5, when Mr. Sussmann disclosed the origins of the data and technical analysis;

4. How Mr. Sussmann’s role as a paid advocate was materially “relevant” to the FBI’s investigation, as alleged in Paragraph 32, given that the information itself raised serious national security concerns and the FBI otherwise enables civilians to provide anonymous tips; and

5. What potential questions, additional steps, resource allocations, or more complete information the FBI would have gathered absent Mr. Sussmann’s false statement, as alleged in Paragraph 32.

D. Provide particulars regarding the alleged false statement Mr. Sussmann made to all Agency-2 employees and representatives, as alleged in Paragraphs 39 and 42, namely:

1. The exact words of Mr. Sussmann’s alleged false statement;

2. The specific context in which the statement was made so that the meaning of the words is clear;

3. What portion of the statement is allegedly false;

4. The identities of all individuals to whom the statement was made, including:

a. both Employee-1 and Employee-2 as referenced in Paragraph 42; and

b. anyone else present who also heard the false statement.

E. Provide particulars regarding the identities of the “representatives and agents of the Clinton Campaign” referenced in Paragraph 6.

Motions for a Bill of Particular rarely work

Make no mistake, most demands for a Bill of Particulars like this fail. The prosecution will argue that everything Sussmann needs is in the indictment and, if Judge Christopher Cooper agrees, Sussmann will just submit his motion to dismiss and other challenges like he’s clearly planning to do anyway.

That’s almost certainly what will happen for several of these requests, such as the names of Clinton Campaign personnel Durham accuses Sussmann of coordinating with on the Alfa Bank materials. But Sussmann likely doesn’t really need these names because he likely knows that Durham has nothing to substantiate this claim. If he did, Durham would have described such evidence in his speaking indictment. Sussmann may well know there are no names — of campaign personnel with whom he personally coordinated in advance of the James Baker meeting, at least — to give, because he didn’t coordinate with anyone from the campaign (Durham probably wants to substantiate this claim by charging Marc Elias in a conspiracy with Sussmann, but that all depends on being able to prove that anyone was lying about all this).

Similarly, Sussmann seems to know — and Durham may not — that there were more than just two people at a February 9, 2017 meeting at which Sussmann tried to bring new concerns to the attention of the government. This request seems to suggest there was at least one and possibly other witnesses who were at this meeting that Durham should know of who didn’t corroborate a claim that Sussmann lied, witnesses Durham didn’t mention in his indictment.

Likewise, Sussmann is unlikely to get very far asking for more details about Durham’s materiality claim, in particular, Durham’s repeated allegation that what he presented were just some, “among other reasons,” why Sussmann’s alleged lie was material. Prosecutors will argue that materiality is a matter for the jury to decide. But if Sussmann can force Durham to admit he has a theory of prosecution he hasn’t included in his indictment — that Durham believes that, rather than raising a real anomaly to the FBI’s attention because it was a real anomaly, lawyers who were paid by Hillary were trying to start a witch hunt against Donald Trump (never mind that the actual investigation that would prove at least three Trump officials, and probably Trump himself, got advance warning of a Russian attack on Hillary started three weeks before the meeting at which Sussmann is alleged to have lied) — then it will make it far easier for Sussmann to attack the indictment down the road.

What a false statement charge is supposed to look like

But Sussmann may succeed on his key complaint, that Durham has built a 27-page indictment around a false claim allegation without any means to clearly lay out what was the specific lie Sussmann told.

To understand what Sussmann means when he says,

It is simply not enough for the Indictment to make allegations generally about the substance of the purported false statement. Rather, the law requires that the Special Counsel identify the specific false statement made, i.e., the precise words that were allegedly used.

We can look at the false statements that Trump’s associates made to cover up the Trump campaign’s ties to Russia. For example, for each of six charged lies in the Roger Stone indictment, Mueller’s prosecutors quoted the precise questions he was asked as well as his response, then laid out specific evidence that each lie was a lie.

22. During his HPSCI testimony, STONE was asked, “So you have no emails to anyone concerning the allegations of hacked documents . . . or any discussions you have had with third parties about [the head of Organization 1]? You have no emails, no texts, no documents whatsoever, any kind of that nature?” STONE falsely and misleadingly answered, “That is correct. Not to my knowledge.”

23. In truth and in fact, STONE had sent and received numerous emails and text messages during the 2016 campaign in which he discussed Organization 1, its head, and its possession of hacked emails. At the time of his false testimony, STONE was still in possession of many of these emails and text messages, including:

a. The email from STONE to Person 1 on or about July 25, 2016 that read in part, “Get to [the head of Organization 1] [a]t Ecuadorian Embassy in London and get the pending [Organization 1] emails . . . they deal with Foundation, allegedly.”;

b. The email from STONE to Person 1 on or about July 31, 2016 that said an associate of Person 1 “should see [the head of Organization 1].”;

c. The email from Person 1 to STONE on or about August 2, 2016 that stated in part, “Word is friend in embassy plans 2 more dumps. One shortly after I’m back. 2nd in Oct. Impact planned to be very damaging.”;

d. Dozens of text messages and emails, beginning on or about August 19, 2016 and continuing through the election, between STONE and Person 2 in which they discussed Organization 1 and the head of Organization 1;

e. The email from STONE on or about October 3, 2016 to the supporter involved with the Trump Campaign, which read in part, “Spoke to my friend in London last night. The payload is still coming.”; and

f. The emails on or about October 4, 2016 between STONE and the high-ranking member of the Trump Campaign, including STONE’s statement that Organization 1 would release “a load every week going forward.”

For some of Stone’s charged lies, prosecutors even had communications with Jerome Corsi or Randy Credico or one of his lawyers showing Stone planned in advance to lie.

In George Papadopoulos’ statement of offense, for each of several lies outlined, prosecutors laid out specifically what he told the FBI and then laid out how Papadopoulos’ own communications records and his later testimony proved those statements to be false.

c. Defendant PAPADOPOULOS claimed he met a certain female Russian national before he joined the Campaign and that their communications consisted of emails such as, ‘”Hi , how are you?”‘ In truth and in fact, however, defendant PAPADOPOULOS met the female Russian national on or about March 24, 2016, after he had become an adviser to the Campaign; he believed that she had connections to Russian government officials; and he sought to use her Russian connections over a period of months in an effort to arrange a meeting between the Campaign and Russian government officials.

The most recent Mueller backup liberated by Jason Leopold reveals that, in addition to Papaodpoulos’ communications and later testimony that prove this particular claim to be an intentional lie, Papadopoulos also emailed the FBI on January 27 after consulting his records, laying out his claim that he met Olga before he joined the Trump campaign and never met her after that.

As promised, wanted to send you the name of the individual that Joseph Mifsud introduced me to over lunch in February or early March (while I was working with the London Center of International Law Practice and did not even know at that time whether or not I would even have moved back to the U.S. or especially worked on another presidential campaign).

He introduced her as his student, but was looking to impress her by meeting with me fresh off my Ben Carson gig. That is all I know. Never met her again.

I could go on for each of the false statements charged against Trump’s flunkies (and also show how, when Andrew Weissmann fell short of this kind of evidence, Amy Berman Jackson ruled against prosecutors on two of five claimed lies alleged in Paul Manafort’s plea breach determination).

Even Mike Flynn’s statement of offense, substantiating a charge that Trump loyalists have spent years wailing about, laid out clearly the two charged lies.

During the interview, FLYNN falsely stated that he did not ask Russia’s Ambassador to the United States (“Russian Ambassador”) to refrain from escalating the situation in response to sanctions that the United States had imposed against Russia. FLYNN also falsely stated that he did not remember a follow-up conversation in which the Russian Ambassador stated that Russia had chosen to moderate its response to those sanctions as a result of FL YNN’s request.

[snip]

During the January 24 voluntary interview, FLYNN made additional false statements about calls he made to Russia and several other countries regarding a resolution submitted by Egypt to the United Nations Security Council on December 21, 2016. Specifically FLYNN falsely stated that he only asked the countries’ positions on the vote, and that he did not request that any of the countries take any particular action on the resolution. FLYNN also falsely stated that the Russian Ambassador never described to him Russia’s response to FL YNN’s request regarding the resolution.

Not only did prosecutors describe what a transcript of these calls said, but they also had testimony from both Flynn himself and KT McFarland substantiating that these were lies. They even had a text that Flynn sent McFarland, before any of these intercepts had leaked, that Flynn later admitted he had deliberately written to cover up the content of his calls with Sergey Kislyak.

Then, after Sidney Powell spent six months trying to claim that one of Flynn’s lies wasn’t clearly laid out in his original 302, Judge Emmet Sullivan meticulously pointed out that the notes of both FBI interviewers matched every iteration of Flynn’s 302.

Having carefully reviewed the interviewing FBI agents’ notes, the draft interview reports, the final version of the FD302, and the statements contained therein, the Court agrees with the government that those documents are “consistent and clear that [Mr. Flynn] made multiple false statements to the [FBI] agents about his communications with the Russian Ambassador on January 24, 2017.” Gov’t’s Surreply, ECF No. 132 at 4-5. The Court rejects Mr. Flynn’s request for additional information regarding the drafting process for the FD-302s and a search for the “original 302,” see Def.’s Sur-Surreply, ECF No. 135 at 8- 10, because the interviewing FBI agents’ notes, the draft interview reports, the final version of the FD-302, and Mr. Flynn’s own admissions of his false statements make clear that Mr. Flynn made those false statements.

These are what false statements charges are supposed to look like. They’re backed by contemporaneous admissible evidence and laid out in specific detail in charging documents.

Trump and his supporters have wailed for years about these charges. Except prosecutors had evidence to substantiate them, the kind of evidence Durham makes no claim to have.

What few witnesses Durham has may not all agree on Sussmann’s alleged lies

Sussmann is more likely to succeed with his request to have his alleged false statement laid out in quote form and in context — and even if he doesn’t, he may back Durham into a corner he doesn’t want to be in — because Sussmann has presented several central questions about what the allegation really is. Is it that Sussmann didn’t offer up that he was working with (Sussmann claims) Rodney Joffe or  (Durham also alleges) Hillary on the Alfa Bank issues? Is it that Sussmann falsely claimed not to be billing the meeting with James Baker (evidence of which Durham has not presented)? Or does Durham have any shred of evidence that Baker affirmatively asked Sussmann, “are you sharing this on behalf of a client,” or even less supported in the indictment, “are you sharing this on behalf of Trump’s opponent, Hillary Clinton”? Similarly, Durham doesn’t explain whether when he claims that Sussmann lied about “this,” or “his work,” he means about the meetings that were actually billed to Hillary’s campaign internally at Perkins Coie (even if Hillary paid no money specifically tied to those meetings), or that the meeting with Baker was billed to one or another client (no evidence of which Durham presents). Those details will all be necessary for Durham to prove his case and for Sussmann to rebut it. And Sussmann needs to know whether he should focus his time on the absence of billing records substantiating that he met with Baker and then billed it to Hillary (something implicated by the meaning of “this” and “his work”), or whether he needs to focus on showing whether Priestap distinguished these allegations from the other claims about a Russian information operation undeniably targeting Hillary (something implicating whether this is supposed to be a crime of commission or omission).

It’s quite possible that Durham has presented these allegations using such squishy language because what little evidence he has doesn’t actually agree on the claimed lies. That is, it may be that Baker believes Sussmann simply didn’t bother explaining which client he was working for, but Bill Priestap, the next in line in a game of telephone, differently understood from Baker’s report that Sussmann affirmatively failed to provide Baker information that (Priestap’s own notes prove) the FBI already had anyway, that he was working with Hillary Clinton.

If, having had these weaknesses laid out by Sussmann’s attorneys, Durham can show that all his evidence actually substantiates the same false claim, he could get a superseding indictment making that clear. But once he does that, it may tie his hands at trial.

But it’s distinctly possible that Durham can’t prove that what little evidence he has backs the same interpretation of Sussmann’s alleged lie. That is, there may be a reason — on top of the fact that he has no contemporaneous transcript from a witness — that he avoided being more specific in his indictment, and that’s because it was the only way he could cobble together enough evidence to get a grand jury to indict.

So while much of the rest of this motion of a Bill of Particulars may serve only to call attention to gaping holes in the rest of the indictment, the request for specifics about what, specifically, Sussmann is alleged to have said when he lied may succeed. And even if it doesn’t, it may force Durham to commit to an interpretation that not all of his thin evidence would ultimately support.

Share this entry

In Indictment Accusing Michael Sussmann of Hiding Details about Researchers, John Durham Hid Details about Researchers

/45 Comments/in , , /by

In my initial John Durham Is the Jim Jordan of Ken Starrs post pointing to all the problems with John Durham’s attempt to criminalize victims reporting on information operations, I described Durham’s description of why Michael Sussmann’s alleged lie was material.

SUSSMANN’s lie was material because, among other reasons, SUSSMANN’s false statement misled the FBI General Counsel and other FBI personnel concerning the political nature of his work and deprived the FBI of information that might have permitted it more fully to assess and uncover the origins of the relevant data and technical analysis, including the identities and motivations of SUSSMANN’s clients.

Had the FBI uncovered the origins of the relevant data and analysis and as alleged below, it might have learned, among other things that (i) in compiling and analyzing the Russian Bank-1 allegations, Tech Executive-1 had exploited his access to non-public data at multiple Internet companies to conduct opposition research concerning Trump; (ii) in furtherance of these efforts, Tech Executive-1 had enlisted, and was continuing to enlist, the assistance of researchers at a U.S.-based university who were receiving and analyzing Internet data in connection with a pending federal government cybersecurity research contract; and (iii) SUSSMAN, Tech Executive-1, and Law Firm-1 had coordinated, and were continuing to coordinate, with representatives and agents of the Clinton Campaign with regard to the data and written materials that Sussmann gave to the FBI and the media. [my emphasis]

John Durham says it is a crime to hide details about the researchers who first identified the Alfa Bank anomaly.

Yet, even based on the indictment, I identified a number of holes in Durham’s description of what the researchers had done. Yesterday, NYT and CNN both published stories identifying the four researchers — Rodney Joffe (Tech Executive-1), April Lorenzen (Tea Leaves, whom Durham needlessly renamed Originator-1), Manos Antonakakis (Researcher-1), and David Dagon (Researcher-2) — showing that the holes I identified in the indictment indeed left out information that totally undermined Durham’s insinuations.

For example, I noted that the date when what NYT identifies as DARPA shared information with the researchers is important to identify whether they obtained the data in order to research Trump.

At some point [Durham doesn’t provide even a month, but by context it was at least as early as July 2016 and could have been far, far earlier], TE-1’s company provided a university with data for a government contract ultimately not contracted until November 2016, including the DNS data from an Executive Branch office of the US government that Tech Exec-1’s company had gotten as a sub-contractor to the US government. [This date of this is critical because it would be the trigger for a Conspiracy to Defraud charge, if Durham goes there.]

NYT describes that DARPA first approached potential partners in the spring, long before Sussman or Joffe got involved.

The involvement of the researchers traces back to the spring of 2016. DARPA, the Pentagon’s research funding agency, wanted to commission data scientists to develop the use of so-called DNS logs, records of when servers have prepared to communicate with other servers over the internet, as a tool for hacking investigations.

DARPA identified Georgia Tech as a potential recipient of funding and encouraged researchers there to develop examples. Mr. Antonakakis and Mr. Dagon reached out to Mr. Joffe to gain access to Neustar’s repository of DNS logs, people familiar with the matter said, and began sifting them.

I noted that Durham didn’t give the date when Lorenzen first started looking at the the DNS data. That date is another read of whether she had done so out of malice targeting Trump.

By some time in late July 2016 [the exact date Durham doesn’t provide], a guy who always operated under the pseudonym Tea Leaves but whom Durham heavy-handedly calls “Originator-1” instead had assembled “purported DNS data” reflecting apparent DNS lookups between Alfa Bank and “mail1.trump-email.com” that spanned from May 4 through July 29.

NYT reveals that Lorenzen and Dagon first started talking about using the DNS data to check other election-related hacking at a conference that went from June 13 to June 16 (meaning, the DNC hack would have been revealed during the conference).

Separately, when the news broke in June 2016 that Russia had hacked the Democratic National Committee’s servers, Mr. Dagon and Ms. Lorenzen began talking at a conference about whether such data might uncover other election-related hacking.

Ms. Lorenzen eventually noticed an odd pattern: a server called mail1.trump-email.com appeared to be communicating almost exclusively with servers at Alfa Bank and Spectrum Health. She shared her findings with Mr. Dagon, the people said, and they both discussed it with Mr. Joffe.

I noted that Durham had left out all mention of the WikiLeaks release and Trump’s invitation to Russia to keep hacking his opponent.

It appears (though Durham obscures this point) that all the actions laid out in this indictment post-date the press conference. Virtually everyone in the US committed to ensuring America’s national security was alarmed by Trump’s comments in this press conference. Yet Durham doesn’t acknowledge that all these actions took place in the wake of public comments that made it reasonable for those committed to cybersecurity to treat Donald Trump as a national security threat, irrespective of partisan affiliation.

Durham will work hard to exclude detail of Trump’s press conference from trial. But I assume that if any of the named subjects of this investigation were to take the stand at trial, they would point out that it was objectively reasonable after July 27 to have national security concerns based on Trump’s encouragement of Russia’s attack on Hillary Clinton and his defensive denials of any business ties. Any of the named subjects of the indictment would be able to make a strong case that there was reason to want to, as a matter of national security, test Trump’s claim to have no financial ties to Russia. Indeed, the bipartisan SSCI Report concluded that Trump posed multiple counterintelligence concerns, and therefore has concluded that Durham’s portrayal of politics as the only potential motive here to be false.

Central to Durham’s theory of prosecution is that there was no sound national security basis to respond to anomalous forensic data suggesting a possible financial tie between Trump and Russia. Except that, after that July 27 speech — and all of these events appear to post-date it — that theory is unsustainable.

NYT reveals that when Dagon shared the data with Joffe on July 29, he did so in the context of those two events.

“Half the time I stop myself and wonder: am I really seeing evidence of espionage on behalf of a presidential candidate?” Mr. Dagon wrote in an email to Mr. Joffe on July 29, after WikiLeaks made public stolen Democratic emails timed to disrupt the party’s convention and Mr. Trump urged Russia to hack Mrs. Clinton.

I noted that Durham was probably wrong to believe that an August discussion about whether the data could have been spoofed was inculpatory.

Still others (such as the recognition that this could be spoofed data) will almost certainly end up being presented as exculpatory if this ever goes to trial, but Durham seems to think is inculpatory.

NYT describes that a later discussion doubted that the data could have been spoofed.

The indictment quotes August emails from Ms. Lorenzen and Mr. Antonakakis worrying that they might not know if someone had faked the DNS data. But people familiar with the matter said the indictment omitted later discussion of reasons to doubt any attempt to spoof the overall pattern could go undetected.

I noted that Durham attributed the view that the DNS traffic was a “red herring” to everyone involved, including Sussmann, even though Sussmann appears not to have been on the email.

In one place, Durham describes “aforementioned views,” plural, that the Alfa Bank data was a “red herring,” something only attributed to TE-1 in the indictment, seemingly presenting TE-1’s stated view on August 21 to everyone involved, including Sussmann, who does not appear to have been on that email chain.

NYT describes that after that, Joffe came to discount the marketing server explanation.

Mr. Tyrrell, his lawyer, said that research in the weeks that followed, omitted by the indictment, had yielded evidence that the specific subsidiary server in apparent contact with Alfa Bank had not been used to send bulk marketing emails. That further discussion, he said, changed his client’s mind about whether it was a red herring.

“The quotation of the ‘red herring’ email is deeply misleading,” he said, adding: “The research process is iterative and this is exactly how it should work. Their efforts culminated in the well-supported conclusions that were ultimately delivered to the F.B.I.”

It also explains that in context, Joffe referenced a June article describing Trump’s interest in a Trump Tower Moscow.

The indictment says Mr. Joffe sent an email on Aug. 21 urging more research about Mr. Trump, which he stated could “give the base of a very useful narrative,” while also expressing a belief that the Trump server at issue was “a red herring” and they should ignore it because it had been used by the mass-marketing company.

The full email provides context: Mr. Trump had claimed he had no dealings in Russia and yet many links appeared to exist, Mr. Joffe noted, citing an article that discussed aspirations to build a Trump Tower in Moscow. Despite the “red herring” line, the same email also showed that Mr. Joffe nevertheless remained suspicious about Alfa Bank, proposing a deeper hunt in the data “for the anomalies that we believe exist.”

He wrote: “If we can show possible email communication between” any Trump server and an Alfa Bank server “that has occurred in the last few weeks, we have the beginning of a narrative,” adding that such communications with any “Russian or Ukrainian financial institutions would give the base of a very useful narrative.”

In my post, I noted that Durham neglected to describe that the researchers turned out to correctly suspect Trump was hiding efforts to broker a Trump Tower deal.

According to Michael Cohen, when Trump walked off the stage from that July 27 press conference, Cohen asked Trump why he had claimed that he had zero business ties with Russia when he had in fact been pursuing an impossibly lucrative deal to brand a Trump Tower in Moscow. And we now know that within hours of Trump’s request, GRU hackers made a renewed assault on Hillary’s own servers. By the time security researchers pursued anomalous data suggesting covert communications with a Russian bank, Cohen had already participated in discussions about working with two sanctioned Russian banks to fund the Trump Tower deal, had agreed to work with a former GRU officer to broker it, had spoken to an aide of Dmitry Peskov, and had been told that Putin was personally involved in making the deal happen. Just on the Trump Tower basis alone, Trump had publicly lied in such a way that posed a counterintelligence risk to America.

In my post, I noted that Durham downplayed that, when Joffe asked the researchers if the paper Sussmann wrote was plausible, they said it was.

On September 14, TE-1 [not Sussmann] sent the white paper he had drafted to Researcher 1, Researcher 2, and Tea Leaves to ask them if a review of less than an hour would show this to be plausible. Though some of them noted how limited the standard of “plausibility” was, they agreed it was plausible, and Researcher 2 said [Durham does not quote the specific language here] “the paper should be shared with government officials.”

NYT describes that Durham misrepresented the enthusiasm with which Lorenzen “wholeheartedly” expressed her belief the explanation was plausible.

The indictment also quoted from emails in mid-September, when the researchers were discussing a paper on their suspicions that Mr. Sussmann would soon take to the F.B.I. It says Mr. Joffe asked if the paper’s hypothesis would strike security experts as a “plausible explanation.”

The paper’s conclusion was somewhat qualified, an email shows, saying “there were other possible explanations,” but the only “plausible” one was that Alfa Bank and the Trump Organization had taken steps “to obfuscate their communications.”

The indictment suggested Ms. Lorenzen’s reaction to the paper was guarded, describing an email from her as “stating, in part, that it was ‘plausible’ in the ‘narrow scope’ defined by” Mr. Joffe. But the text of her email displays enthusiasm.

“In the narrow scope of what you have defined above, I agree wholeheartedly that it is plausible,” she wrote, adding: “If the white paper intends to say that there are communications between at least Alfa and Trump, which are being intentionally hidden by Alfa and Trump I absolutely believe that is the case,” her email said.

NYT shows several more ways that Durham utterly misrepresented how seriously the researchers took this thesis.

The indictment cited emails by Mr. Antonakakis in August in which he flagged holes and noted they disliked Mr. Trump, and in September in which he approvingly noted that the paper did not get into a technical issue that specialists would raise.

Mr. Antonakakis’ lawyer, Mark E. Schamel, said his client had provided “feedback on an early draft of data that was cause for additional investigation.” And, he said, their hypothesis “to this day, remains a plausible working theory.”

The indictment also suggests Mr. Dagon’s support for the paper’s hypothesis was qualified, describing his email response as “acknowledging that questions remained, but stating, in substance and in part, that the paper should be shared with government officials.”

The text of that email shows Mr. Dagon was forcefully supportive. He proposed editing the paper to declare as “fact” that it was clear “that there are hidden communications between Trump and Alfa Bank,” and said he believed the findings met the probable cause standard to open a criminal investigation.

“Hopefully the intended audience are officials with subpoena powers, who can investigate the purpose” of the apparent Alfa Bank connection, Mr. Dagon wrote.

One of the first things Michael Sussmann is going to do after this story is request information on what the grand jury was told, including whether any of this was affirmatively misrepresented to the grand jury.

The sheer amount of communications that, in days, these researchers have been able to prove were misrepresented, too, suggests DOJ has cause to review whether Durham misrepresented the substance of this indictment to those who approved it, up to and including Merrick Garland.

John Durham says it is a crime to lie about these researchers in an effort to launch an investigation. And yet, the available evidence suggests he did just that.

Update: To be clear, he can’t be prosecuted for any of this. Prosecutors have expansive immunity for such things.

Share this entry

John Durham Is the Jim Jordan of Ken Starrs

/61 Comments/in , , /by

Last Thursday, John Durham indicted Michael Sussmann, the Perkins Coie lawyer who advised the DNC, DCCC, and Clinton Campaign about cybersecurity in 2016 as they struggled to deal with a hostile nation-state attack aiming — in part — to help elect their opponent. The indictment accuses Sussmann of lying to FBI General Counsel James Baker at a September 19, 2016 meeting at which Sussmann shared information about the curious DNS traffic between a server used by a Trump marketing contractor and Alfa Bank.

emptywheel’s long history of debunking the Alfa Bank story

Before I unpack the indictment, let me remind readers that when this story first publicly broke, I explained why the Spectrum Health (aka my boob hospital at the time) aspect of the allegations made no sense, criticized Hillary’s team (including Jake Sullivan) for jumping on the story, and echoed Rob Graham’s criticism of the researchers who accessed DNS data to conduct this research.

In addition to his technical debunking, Robert Graham made an equally important point: researchers shouldn’t be accessing this data for ad-lib investigations into presidential candidates, and it’s not even clear who would have access to it all except the NSA.

The big story isn’t the conspiracy theory about Trump, but that these malware researchers exploited their privileged access for some purpose other than malware research.

[snip]

In short, of all the sources of “DNS malware information” I’ve heard about, none of it would deliver the information these researchers claim to have (well, except the NSA with their transatlantic undersea taps, of course).

[snip]

[B]efore Tea Leaves started pushing this story to the press, the FBI had been investigating it for two months.

Which, to my mind, raises even more questions about the anonymous researchers’ identities, because (small world and all) the FBI likely knows them, in which case they may have known that the FBI wasn’t jumping on the story by the time they started pitching it.

Or the FBI doesn’t know them, which raises still more questions about the provenance of these files.

Ah well, if President Hillary starts a war with Russia based off Iraq-War style dodgy documents, at least I’ll have the satisfaction of knowing my boob clinic is right there on the front lines.

In March 2017, I observed that the weird Alfa Bank entry in the Steele dossier suggested a feedback loop between the Alfa Bank server story and the dossier project. Then days after that, I noted all the ways that the packaging of this story made it more suspect.

In 2018, I complained about the way Dexter Filkins had strained to sustain the story, while noting that people ought to look more closely at why Alfa Bank might be the focus here; the Mueller Report since confirmed that within weeks after the story broke publicly, Vladimir Putin pushed Oligarchs from Alfa Bank to fight harder against western sanctions, something that the alleged source for the Alfa Bank entry in the dossier seemed to parrot.

In short, I not only have consistently criticized this story, but done so in ways that anticipate the most justifiable parts of the indictment. It’s only the last bit — how the Alfa narrative echoes Putin’s interests — that this indictment doesn’t incorporate.

I guess with five more years Durham might get there…

So in unpacking this indictment, I’m in no way defending the Alfa Bank – Trump Tower story. It was a sketchy allegation, the packaging of it was suspect, and those who conducted the research arguably violated ethical guidelines.

I got to where Durham got in this indictment years and years ago. But that doesn’t make it a crime.

John Durham’s “narrative”

Moreover, that doesn’t mean Durham should tell as strained a “narrative” as those who packaged up this story. Central to Durham’s indictment is an assumption that if a victim of a crime who believed at the time that the crime had a — since confirmed — political goal reports suspicious, potentially related details, the victim must be motivated exclusively out of self-interest, not good citizenship or a concern about national security. That is, this entire indictment assumes that when Russia attacks a Presidential candidate, that is not itself a national security concern, but instead nothing more than a political dispute.

Effectively, John Durham has made it a crime for someone victimized by a Russian influence operation to try to chase down Russian influence operations.

Tech Executive-1 and Clinton both had retained Perkins Coie long before this, with Sussmann getting involved specifically for cybersecurity help in the wake of the Russian hack

The indictment, perhaps deliberately, obscures the timeline and facts leading up to the charged lie. But here’s the story it tells. First, all of Durham’s subjects established contracts with each other, even though all of those contracts (including Fusion GPS’) had scopes far larger than oppo research on Trump’s relationship with Russia.

  • In February 2015, Tech Executive-1 (whom I’ll call TE-1 for brevity) retained Sussmann to deal with a US government agency [Durham does not say whether this matter was resolved or continued in this period in 2016, which is central to the question of what kind of client of Sussmann’s TE-1 was].
  • In April 2015, the Clinton Campaign retained Perkins Coie and made Marc Elias the Campaign’s General Counsel.
  • In April 2016, the victim of a Russian government election-related attack, the DNC, retained Sussmann to help it deal with aftermath, which included meeting with the FBI. As the indictment describes this was not just legal support but cybersecurity.
  • [After a Republican retained them first and on a date that Durham doesn’t reveal,] Perkins Coie retained Fusion GPS to conduct oppo research on Trump pertaining to Russia [and other topics, though Durham doesn’t mention those other topics].

Durham only mentions in passing, later, that the researchers involved here similarly knew each other through relationships that focused on cybersecurity and predated these events.

Via means and on specific dates that Durham doesn’t always provide, Tea Leaves, TE-1, Sussmann, and two Researchers got the DNS data showing an anomaly

There are two sets of research here: that done in a university setting and that done at companies associated with TE-1, though TE-1 is the pivot to both. As depicted, Durham suggests the former are more legally exposed than the latter.

  • By some time in late July 2016 [the exact date Durham doesn’t provide], a guy who always operated under the pseudonym Tea Leaves but whom Durham heavy-handedly calls “Originator-1” instead had assembled “purported DNS data” reflecting apparent DNS lookups between Alfa Bank and “mail1.trump-email.com” that spanned from May 4 through July 29.
  • Tea Leaves was a business associate of TE-1 and via means Durham doesn’t describe, the data Tea Leaves gathered was shared with TE-1.
  • “In or about July 2016” [at a time that, because of the laws of physics, must post-date the late July date when Tea Leaves collected this data and the date when he shared them with TE-1], TE-1 alerted Sussmann to the data.
  • On July 31, Sussmann billed the Clinton Campaign for 24 minutes with the billing description, “communications with Marc Elias regarding server issue.”
  • At some point [Durham doesn’t provide even a month, but by context it was at least as early as July 2016 and could have been far, far earlier], TE-1’s company provided a university with data for a government contract ultimately not contracted until November 2016, including the DNS data from an Executive Branch office of the US government that Tech Exec-1’s company had gotten as a sub-contractor to the US government. [This date of this is critical because it would be the trigger for a Conspiracy to Defraud charge, if Durham goes there.]
  • In or about August 2016 [Durham doesn’t provide a date], a federal government was finalizing but had not yet signed a cybersecurity research contract with [presumably] that same university to receive and analyze large quantities of public and non-public data “to identify the perpetrators of malicious cyber-attacks and protect U.S. national security.” Tea Leaves was the founder of a company that the university was considering [Durham doesn’t provide the date of consideration, but generally these things precede finalization] for a subcontract with the government contract.

TE-1 directs employees of companies under his control to research this issue

Though Durham’s indictment is somewhat vague, at least one piece of research from companies associated with TE-1 was shared with the FBI; it appears that other threads of research were not shared.

  • In or about early August 2016 [the dates of which Durham doesn’t provide], TE-1 directed personnel at two companies in which he had an ownership interest to search for what the indictment calls, “any Internet data reflecting potential connections or communications between Trump or his associates and Russia,” which Durham describes to be “derogatory information on Trump.” In connection with this tasking, TE-1 later stated [on a date Durham doesn’t describe] he was working with someone who had close ties to the Democratic Party.
  • At some point, an individual tasked with this work described being “uncomfortable regarding this tasking,” [Durham doesn’t describe when he learned this or whether there is any contemporaneous proof].
  • At some point [Durham doesn’t describe the date], TE-1 provided one of his companies with personal (but publicly available) data from six Trump associates and one purported US-based lobbyist for Alfa Bank and directed these individuals should be the focus of that company’s data queries and analysis [Durham doesn’t say whether these six associates overlapped with the people Fusion had been tasked to research, nor does he allege they got included in the eventual reports to the FBI; both details are needed to assess his case].
  • On August 12, 2016, Sussmann, Elias, and TE-1 met in Elias’ office; Sussmann billed his time to the Clinton Campaign describing, “confidential meetings with Elias, others.”
  • On August 15, employees at one of the companies queried their holdings against a set of addresses that referred to Trump and/or Alfa Bank.
  • During the same time period [Durham doesn’t specify when], employees at Internet Company-3 drafted a written paper that included technical observations that Sussmann would later convey to the FBI.

Around the time this started, Sussmann met Fusion and a bunch of meetings happened that were billed to Hillary

  • On July 29, Sussmann and Marc Elias met with Fusion GPS [Durham doesn’t affirmatively claim this data pertained to the server issue], and Sussmann billed his time to the Hillary Campaign under “General Political Advice,” a different description than all the other Fusion meetings that Durham more credibly claims relate to the Alfa Bank allegation.
  • Around “the same [August] time period” [Durham doesn’t provide the date], Sussmann, Elias, and Fusion personnel began exchanging emails with the subject line, “Connecting you all by email;” [Durham doesn’t say who initiated the email, but it suggests that before this period, Sussmann and Fusion did not have direct contact].
  • On August 17, 2016, Sussmann, Elias, and TE-1 conducted an additional conference call, for which Sussmann billed his time to the Clinton campaign, noting “telephone conference with” TE-1 and Elias.
  • On August 19, 2016, Sussman and Elias had another in-person meeting that Sussmann described as a meeting with TE-1, which was billed as a “confidential meeting with Elias, others.”

Researchers 1 and 2 and Tea Leaves worked with TE-1 on a “storyline” and “narrative” with varying degrees of skepticism expressed

This is the stuff Durham–with some justification–will and has used to taint all this as a political project.

  • On July 29, Researcher-2 emailed Researcher-1 the data compiled by Tea Leaves [Durham provides no evidence that TE-1 was involved in this exchange].
  • On August 19, Researcher-1 queried Internet data maintained by TE-1’s company [it is not clear but this suggests it was not the data turned over to the University] for the aforementioned mail1.trump-email.com domain. Researcher-1 then emailed TE-1 with the list of domains that had communicated with it, saying the list, “does not make much sense with the storyline you have.”
  • On August 20, Tea Leaves emailed Tech Exec-1, Researcher-1, and Researcher 2, stating that, “even if we found what [TE-1] asks us to find in DNS, we don’t see the money flow, and we don’t see the content of some message saying, ‘send money here’.” Tea Leaves then explained that one could fill out sales forms and cause them, “to appear to communicate with each other in DNS.” Tea Leaves then noted that “it’s just not the case that you can rest assured that Hillary’s opposition research and whatever professional gov and investigative journalists are also digging come up with the same things.”
  • On August 20, TE-1 clarified that the task was “indeed broad,” and that,
    • Being able to provide evidence of *anything* that shows an attempt to behave badly in relation to this [Durham doesn’t describe what the antecedent of “this” is], the VIPs would be happy. They’re looking for a true story that could be used as the basis for closer examination.
  • Still on August 20, seemingly distinguishing between that task and the Alfa Bank allegations, TE-1 said, “the prior hypothesis was all that they needed: mailserver dedicated or related to trump … and with traffic almost exclusively with Alfa was sufficient to do the job. … Trump has claimed he and his company have had NO dealings with .ru other than the failed Casino, and the Miss universe pageant. He claims absolutely NO interaction with any financial institutions. So any potential like that would be jackpot.” [Ellipses original]
  • On August 21, TE-1 emailed the recipients [but not, apparently, Sussmann], urging them to do further research on Trump which would “given the base of a very useful narrative.” He added that he didn’t believe the trump-email.com domain was a secret communications channel but a “red herring,” because the host was “a legitimate valid company,” stating they could “ignore it, together with others that seem to be part of the marketing world.”
  • On August 22, Researcher-1 raised doubts about whether, using only the tools they were currently using, they could prove their hypothesis. Among the concerns raised is that they couldn’t prove that “this is not spoofed [] traffic.” [brackets original; bolded in the original]
  • Later in or about August 2016 [on dates Durham doesn’t provide], TE-1 exchanged emails with personnel from Fusion.

Sussmann drafts a white paper and (via unstated means) TE-1 gets Researchers 1 and 2 and Tea Leaves to review it

  • Between September 5 and September 14, Sussmann drafted a white paper, generally billing his time to the Clinton Campaign, but on September 14, billing time to both Clinton and TE-1.
  • On September 14, TE-1 [not Sussmann] sent the white paper he had drafted to Researcher 1, Researcher 2, and Tea Leaves to ask them if a review of less than an hour would show this to be plausible. Though some of them noted how limited the standard of “plausibility” was, they agreed it was plausible, and Researcher 2 said [Durham does not quote the specific language here] “the paper should be shared with government officials.”

Sussmann shares this and other information with James Baker and–Durham claims–affirmatively lies about whether he is representing someone

  • Both before the September 19 meeting and after it (notably in a September 12 meeting involving the NYTimes, in which Marc Elias also participated), Sussmann spoke to the press about what Durham credibly suggests was the Alfa Bank white paper. Sussmann billed this to Clinton.
  • On September 19, Sussmann met with Baker and provided him with three white papers and a thumb drive with data. Durham doesn’t actually make clear where all three of these came from.
  • On September 19, Sussmann met with James Baker. Durham claims that “he stated falsely that he was not acting on behalf of any client” [which Durham cannot quote because there’s no contemporaneous record], that he had been approached by multiple cyber experts [Durham doesn’t say whether the three he named were Researcher 1, Researcher 2, and Tea Leaves or other people, as seems to be the case], three white papers [which I may return to because this is another problematic spot in his story], and some of the data, which Durham calls “purported.”
  • Immediately after the September 19 meeting, Baker met with Bill Priestap whose notes read:
    • Michael Sussman[n] — Atty: Perkins Coie — said not doing this for any client
      • Represents DNC, Clinton Foundation, etc. []
      • Been approached by Prominent Cyber People (Academic or Corp. POCs), People like: [three names redacted]
  • Durham substantiates a claim that Sussmann billed the meeting itself to Hillary to a description, “work and communications regarding confidential project,” that does not, at least as he quotes it, mention a meeting with the FBI General Counsel at all.

Some of this — the reference to crafting a narrative and a storyline — is damning and validates my discomfort with the political nature of this project five years ago. Other parts of this emphasize the researchers’ insistence on truth from at least parts of this effort. Still others (such as the recognition that this could be spoofed data) will almost certainly end up being presented as exculpatory if this ever goes to trial, but Durham seems to think is inculpatory.

In one place, Durham describes “aforementioned views,” plural, that the Alfa Bank data was a “red herring,” something only attributed to TE-1 in the indictment, seemingly presenting TE-1’s stated view on August 21 to everyone involved, including Sussmann, who does not appear to have been on that email chain. He claims Sussmann, Researcher 1 and 2, TE-1, and Tea Leaves drafted the white paper(s) shared with the FBI, but all he substantiates is a less than one hour review by everyone but Sussmann. He leaves out a great deal of detail about what Jean Camp and someone using the moniker Tea Leaves did and said, publicly, after the FBI meeting, which may totally undercut Durham’s “narrative.”

But other parts, even of the story that Durham tells, are problematic for his narrative. First, there is not (yet) the least hint that Tea Leaves — whom he calls “The Originator” — fabricated this data (or even packaged it up misleadingly, though I think there is evidence he did). Nor is there the least hint that TE-1 asked Tea Leaves to come up with the data. That part of the story is fundamentally important and Durham simply ignores it with that legally unnecessary — particularly given that Durham clearly labels this person as Tea Leaves — moniker “Originator,” giving the anomalous forensic data a kind of virgin birth. And while two of the four tech experts described herein (there appear to be at least three others not described) expressed some doubt about the meaning of it, none of them seems to have doubted that there was an anomaly in the Trump marketing server and Alfa Bank.

Based on this story, though, Durham insinuates Sussmann fed information that he, Sussmann, knew to be bullshit to the FBI on behalf of both Hillary and TE-1, and in so doing affirmatively hid that the bullshit “storyline” was designed to help Hillary which (he claims) would have led the FBI to treat it differently.

In spite of a lot of thus far extraneous details, that’s the only crime he has alleged.

The existing case is remarkably weak

As a number of people have noted, as charged this is a remarkably weak case. Ben Wittes dedicates a section of his post on this indictment to those weaknesses. They are, succinctly:

  • The evidence regarding the core allegation in the indictment pits Sussmann’s word against James Baker’s; there are no other witnesses.
  • After the meeting with Baker, Sussmann repeatedly admitted under oath he was representing a client, a detail which could be exculpatory or inculpatory.
  • Baker testified to Congress he did believe Sussmann was representing a client (meaning Baker will be used to discredit Baker, the one witness to Sussmann’s alleged lie).
  • Even in Bill Priestap’s nearly-contemporaneous notes which are the only documentation of Sussmann’s comments, he describes Sussmann as Hillary’s lawyer (including for the Clinton Foundation, which may be incorrect), so FBI knew full well that Sussmann represented Hillary.
  • Priestap’s notes may be inadmissible hearsay at trial.

The NYT article predicting these charges also claim Durham is conflating Sussmann’s tracking of his hourly work with the actual money charged to the Hillary campaign.

Moreover, internal billing records Mr. Durham is said to have obtained from Perkins Coie are said to show that when Mr. Sussmann logged certain hours as working on the Alfa Bank matter — though not the meeting with Mr. Baker — he billed the time to Mrs. Clinton’s 2016 campaign.

[snip]

They are also said to have argued that the billing records are misleading because Mr. Sussmann was not charging his client for work on the Alfa Bank matter, but needed to show internally that he was working on something. He was discussing the matter with Mr. Elias and the campaign paid a flat monthly retainer to the firm, so Mr. Sussmann’s hours did not result in any additional charges, they said.

There are a number of other ways that Sussmann’s presumably well-funded defense will combat these charges. But as to the allegation buried amid all these details, Durham’s evidence is weak.

Durham’s materiality broadcasts his bid for a ConFraudUS conspiracy

But that’s not what this is about.

Durham is not just alleging that Sussmann was hiding that he was working for Hillary. He is also claiming that Sussmann was at the same time representing TE-1 at that meeting. In the indictment, I think that’s based on a single data point — that Sussmann billed TE-1’s company for “communications regarding confidential project” on September 14. I’m not sure whether that makes the false statements case still weaker or stronger.

But it’s a key part of where Durham obviously wants to go.

Not only are many of the details Durham included in the indictment irrelevant to the false statements charge, but if they were crimes by themselves, they would have been tolled under any five year statute of limitations already. There are only two conceivable purposes for including them in this indictment. First, to give the Alfa Bank Oligarchs more cause to sue more people, effectively a US prosecutor assisting Russians in cynical lawfare. Durham’s investigation incorporates stuff the Oligarchs have already liberated, so is itself derivative of Russian lawfare. Effectively, that means that a prosecutor working for Bill Barr’s DOJ pursued a prosecution that was complementary to an intelligence-related effort by foreigners who pay Kirkland & Ellis a lot of money. Sussmann will have real cause to question whether Brian Benczkowski (who recused from matters involving this aspect of Alfa Bank) or any other Kirkland & Ellis lawyer had a role in this strand of the investigation.

Then there’s the most obvious way to extend the statute of limitations on the events that happened in July and August 2016: to include them in a conspiracy that continued after those dates (and indeed, Durham refers to Elias, Researcher 1 and 2, and Tea Leaves in the way DOJ often uses to refer to charged or uncharged co-conspirators).

Given the extended statement Durham includes to explain why Sussmann’s alleged lie is material under the charged statute, that’s undoubtedly where Durham wants to head with his investigation.

SUSSMANN’s lie was material because, among other reasons, SUSSMANN’s false statement misled the FBI General Counsel and other FBI personnel concerning the political nature of his work and deprived the FBI of information that might have permitted it more fully to assess and uncover the origins of the relevant data and technical analysis, including the identities and motivations of SUSSMANN’s clients.

Had the FBI uncovered the origins of the relevant data and analysis and as alleged below, it might have learned, among other things that (i) in compiling and analyzing the Russian Bank-1 allegations, Tech Executive-1 had exploited his access to non-public data at multiple Internet companies to conduct opposition research concerning Trump; (ii) in furtherance of these efforts, Tech Executive-1 had enlisted, and was continuing to enlist, the assistance of researchers at a U.S.-based university who were receiving and analyzing Internet data in connection with a pending federal government cybersecurity research contract; and (iii) SUSSMAN, Tech Executive-1, and Law Firm-1 had coordinated, and were continuing to coordinate, with representatives and agents of the Clinton Campaign with regard to the data and written materials that Sussmann gave to the FBI and the media.

Don’t get me wrong. This will clearly pass the incredibly low standard for materiality under existing precedent. Though Sussmann will surely make much of citing the invented standard Billy Barr used to try to dismiss the Mike Flynn prosecution, which first requires the investigation in question to be legitimate.

The Government is not persuaded that the January 24, 2017 interview was conducted with a legitimate investigative basis and therefore does not believe Mr. Flynn’s statements were material even if untrue. Moreover, we not believe that the Government can prove either the relevant false statements or their materiality beyond a reasonable doubt.

[snip]

In any event, there was no question at the FBI as to the content of the calls; the FBI had in its possession word-for-word transcripts of the actual communications between Mr. Flynn and Mr. Kislyak. See Ex. 5 at 3; Ex. 13. at 3. With no dispute as to what was in fact said, there was no factual basis for the predication of a new counterintelligence investigation. Nor was there a justification or need to interview Mr. Flynn as to his own personal recollections of what had been said. Whatever gaps in his memory Mr. Flynn might or might not reveal upon an interview regurgitating the content of those calls would not have implicated legitimate counterintelligence interests or somehow exposed Mr. Flynn as beholden to Russia.

If DOJ had no interest in figuring out whether Trump was undermining sanctions to pay off a quid pro quo, they sure as hell have no interest in launching a 3-year investigation to figure out the tie between these allegations and Hillary that was obvious to Priestap in real time, particularly given how quickly the FBI dismissed the allegations in 2017 and given that the allegations are not publicly known to have had a tie to their larger Russian investigation.

Still, while Durham will have no trouble proving Sussmann’s claimed lie meets the standards of materiality, Durham’s claims for it are ridiculous.

It’s a load of horseshit that FBI would have treated this tip any differently — which amounted to investigating it, alerting the press there was nothing to it, then dismissing it pretty quickly, as far as is public — if they knew that Sussmann was formally being paid at that meeting by Hillary, if he in fact was. Priestap knew Sussmann was representing Hillary and said as much in the best evidence Durham has! In fact, FBI’s warning to the NYT about this story in October could be presented as evidence that FBI already incorporated an assumption this came from Hillary.

Likewise, it’s a load of horseshit that FBI couldn’t know that the Bureau needed to ID the researchers behind the project. If I was able to figure that was important out before the 2016 election, and I did, then the experts at the FBI surely figured that out.

But what Durham’s materiality statement emphasizes — what Durham claims Sussmann intended to hide with his claimed lie — is that, “researchers at a U.S.-based university … were receiving and analyzing Internet data in connection with a pending federal government cybersecurity research contract.” That’s the significance of ¶¶23a through e of the indictment, which describe how TE-1 provided data that included some from an Executive Branch office of the U.S. government, which his company had obtained “as a sub-contractor in a sensitive relationship between the U.S. government and another company,” to the university at which Researcher 1 and 2 were working, and both with his university researcher allies and employees of his own company, he tasked people to research Donald Trump. Durham is suggesting that subset of data taints the whole pool that TE-1 shared, making it a Federal interest.

It’s not just that Durham is working on a theory that Sussmann deliberately dealt garbage to the FBI (which GOP sources also did on the Clinton Foundation) while trying to hide that fact. It’s that data originally sourced from the government was used in doing that research.

It’s actually the kind of argument that DOJ prosecutors typically succeed with. Except it’s all premised on proving that Sussman was trying to hide all this in his meeting with Baker. Even if the evidence surrounding the meeting weren’t so flimsy, this is another degree of motive that Durham is straining mightily to make.

Durham needs Sussmann to have lied, because a deliberate attempt to obscure the rest is necessary for his “storyline.” His evidence that Sussmann lied — much less, deliberately — is shoddy. But if he can’t get that, then his hopes for a larger “narrative” collapse.

The parts of the story Durham doesn’t tell

That becomes more clear when you consider some details that Durham doesn’t include in his indictment.

Two details that were public to everyone involved make it clear why Durham’s silence about the exact dates in July when this operation started is so corrupt.

On July 22, WikiLeaks published emails that were at the time believed and since have been confirmed by the FBI to have been hacked by Russia. Durham hides the dates in July when many of these events transpired, but everything he includes suggests this activity post-dated the time when WikiLeaks published stolen emails and the entire security community in the US, surely including every researcher mentioned in this story, coalesced on the belief that Russia was the culprit. Durham refers to Russia’s attack on Hillary (and therefore on the US) inaccurately as, “the hacking of its email servers by the Russian government” and “a hack” (the hack went well beyond just email and continued through the period of Sussmann’s meeting with Baker). But, amazingly, Durham’s “narrative” doesn’t account for the fact that Hillary was targeted not just with an attack but with an information operation. And the timeline he presents here affirmatively hides that these events took place after the entire security community understood that there was an information operation aspect to the attack.

Then, on July 27, Trump gave a press conference in Florida where he said numerous things that make all the actions of Sussmann and others justifiable on national security grounds. First, Trump raised doubts about the Russian attribution of the DNC hack that, by that point in July, was the consensus among national security experts, undoubtedly including every tech expert mentioned in this indictment.

I watched this guy Mook and he talked about we think it was Russia that hacked. Now, first of all was what was said on those that’s so bad but he said I watched it. I think he was live. But he said we think it was Russia that hacked.

And then he said — and this is in person sitting and watching television as I’ve been doing — and then he said could be Trump, yeah, yeah. Trump, Trump, oh yeah, Trump. He reminded me of John Lovitz for “Saturday Night Live” in the liar (ph) where he’d go yes, yes, I went to Harvard, Harvard, yes, yes. This is the guy, you have to see it. Yes, it could be Trump, yes, yes. So it is so farfetched. It’s so ridiculous. Honestly I wish I had that power. I’d love to have that power but Russia has no respect for our country.

And that’s why — if it is Russia, nobody even knows this, it’s probably China, or it could be somebody sitting in his bed. But it shows how weak we are, it shows how disrespected we are. Total — assuming it’s Russia or China or one of the major countries and competitors, it’s a total sign of disrespect for our country. Putin and the leaders throughout the world have no respect for our country anymore and they certainly have no respect for our leader. So I know nothing about it.

Trump then offered his bullshit explanation for why he wouldn’t release his tax returns, framing it in terms of whether he had business ties to Russia.

TRUMP: Because it’s under order. And I’ll release them when the audits completed. Nobody would release when it’s under — I’ve had audits for 15 or 16 years. Every year I have a routine audit. I’m under audit, when the audits complete I’ll release them. But zero, I mean I will tell you right now, zero, I have nothing to do with Russia, yes?

Trump then said the nation-state hack of his opponent wasn’t the important thing, the content of the emails that were released was, thereby encouraging the press to participate in the information operation aspect of this attack.

He already did something today where he said don’t blame them, essentially, for your incompetence. Let me tell you, it’s not even about Russia or China or whoever it is that’s doing the hacking. It was about the things that were said in those e-mails. They were terrible things, talking about Jewish, talking about race, talking about atheist, trying to pin labels on people — what was said was a disgrace, and it was Debbie Wasserman Schultz, and believe me, as sure as you’re sitting there, Hillary Clinton knew about it. She knew everything.

Trump then asked Russia to further hack his opponent.

Russia, if you’re listening, I hope you’re able to find the 30,000 e-mails that are missing.

Trump then doubled down on the comment he made about his taxes, assuring the press that he had “zero” business ties with Russia.

TRUMP: No, I have nothing to do with Russia, John (ph). How many times do I have say that? Are you a smart man? I have nothing to with Russia, I have nothing to do with Russia.

And even — for anything. What do I have to do with Russia? You know the closest I came to Russia, I bought a house a number of years ago in Palm Beach, Florida.

Palm Beach is a very expensive place. There was a man who went bankrupt and I bought the house for $40 million and I sold it to a Russian for $100 million including brokerage commissions. So I sold it. So I bought it for 40, I told it for 100 to a Russian. That was a number of years ago. I guess probably I sell condos to Russians, OK?

QUESTION: (OFF-MIKE)

TRUMP: Of course I can. I told you, other than normal stuff — I buy a house if I sold it to a Russian. I have nothing to do with Russia. I said that Putin has much better leadership qualities than Obama, but who doesn’t know that?

QUESTION: (OFF-MIKE)

TRUMP: Of course not. I own the Trump organization. Zero, zero. Go ahead.

Trump then reiterated his claim that no one could attribute the DNC hack to Russia.

TRUMP: No, but they seem to be, if it’s Russians. I have no idea. It’s probably not Russia. Nobody knows if it’s Russia. You know the sad thing is? That with the technology and the genius we have in this country, not in government unfortunately, but with the genius we have in government, we don’t even know who took the Democratic National Committee e-mails. We don’t even know who it is.

I heard this morning, one report said they don’t think it’s Russia, they think it might be China. Another report said it might be just a hacker, some guy with a 200 I.Q. that can’t get up in the morning, OK? Nobody knows. Honestly they have no idea if it’s Russia. Might be Russia. But if it’s any foreign country, it shows how little respect they have for the United States. Yes, ma’am.

Finally, Trump also stated that he would consider lifting sanctions on Russia.

QUESTION: I would like to know if you became president, would you recognize (inaudible) Crimea as Russian territory? And also if the U.S. would lift sanctions that are (inaudible)?

TRUMP: We’ll be looking at that. Yeah, we’ll be looking.

Each of these comments, individually, would have raised eyebrows. The same comments, made by an American citizen, would equally have raised alarms among those committed to cybersecurity.

But for a presidential candidate to encourage the hostile nation-state information operation targeting his opponent, then ask the hostile nation-state to further target her, in conjunction with the repeated denials of any business ties to Russia raised real, legitimate questions about whether Trump was putting his own interests above the national security of the country.

You might excuse Durham for excluding this from his indictment because after all he was busy indicting a ham sandwich based on hearsay evidence he might be able to exclude these facts at trial. Except that an August 20 comment from TE-1 that Durham quotes in his indictment may be a direct reference to (and at the least incorporates knowledge of) this press conference.

Trump has claimed he and his company have had NO dealings with .ru other than the failed Casino, and the Miss universe pageant. He claims absolutely NO interaction with any financial institutions. So any potential like that would be jackpot.

That is, Durham included what appears to be a reference to the July 27 press conference. It appears (though Durham obscures this point) that all the actions laid out in this indictment post-date the press conference. Virtually everyone in the US committed to ensuring America’s national security was alarmed by Trump’s comments in this press conference. Yet Durham doesn’t acknowledge that all these actions took place in the wake of public comments that made it reasonable for those committed to cybersecurity to treat Donald Trump as a national security threat, irrespective of partisan affiliation.

Durham will work hard to exclude detail of Trump’s press conference from trial. But I assume that if any of the named subjects of this investigation were to take the stand at trial, they would point out that it was objectively reasonable after July 27 to have national security concerns based on Trump’s encouragement of Russia’s attack on Hillary Clinton and his defensive denials of any business ties. Any of the named subjects of the indictment would be able to make a strong case that there was reason to want to, as a matter of national security, test Trump’s claim to have no financial ties to Russia. Indeed, the bipartisan SSCI Report concluded that Trump posed multiple counterintelligence concerns, and therefore has concluded that Durham’s portrayal of politics as the only potential motive here to be false.

Central to Durham’s theory of prosecution is that there was no sound national security basis to respond to anomalous forensic data suggesting a possible financial tie between Trump and Russia. Except that, after that July 27 speech — and all of these events appear to post-date it — that theory is unsustainable.

The parts of the story Durham doesn’t tell

And not only was it objectively reasonable to test whether Trump’s claims to have “zero” business ties to Russia were false, but those suspecting that Trump was hiding such ties were, in fact, correct.

According to Michael Cohen, when Trump walked off the stage from that July 27 press conference, Cohen asked Trump why he had claimed that he had zero business ties with Russia when he had in fact been pursuing an impossibly lucrative deal to brand a Trump Tower in Moscow. And we now know that within hours of Trump’s request, GRU hackers made a renewed assault on Hillary’s own servers. By the time security researchers pursued anomalous data suggesting covert communications with a Russian bank, Cohen had already participated in discussions about working with two sanctioned Russian banks to fund the Trump Tower deal, had agreed to work with a former GRU officer to broker it, had spoken to an aide of Dmitry Peskov, and had been told that Putin was personally involved in making the deal happen. Just on the Trump Tower basis alone, Trump had publicly lied in such a way that posed a counterintelligence risk to America.

But that was not the only thing that Trump had done by the date when a bunch of security researchers responded to anomalous forensic data to test whether Trump was hiding further ties to Russia’s attack on Hillary Clinton.

In March, Trump hired Paul Manafort, a financially desperate political operative with close ties to a Russian intelligence officer, Konstantin Kilimnik, who (SSCI provided three redacted examples of) may have been involved in the hack-and-leak operation. In April, Manafort started leveraging his relationship with Trump to try to make money. In May, Manafort started regularly sending Kilimnik the campaign’s internal polling data. All that happened before researchers started testing Trump’s claims to have had no tie to Russia. On July 28, Kilimnik emailed Manafort to set up a meeting to talk about the future of Ukraine. Just days after the researchers started the inquiry, on August 2, Manafort met with Kilimnik to discuss carving up Ukraine in the same meeting where he described his strategy to win the election.

In April, an academic with close ties to Russia, Joseph Mifsud, told an unqualified braggart whom Trump had added to his team to pretend he had a foreign policy plan, George Papadopoulos, that Russia had thousands of Hillary’s emails that they intended to release to help Trump.

In May, according to Rick Gates’ testimony, Roger Stone started claiming he had advance knowledge of what would become the WikiLeaks releases. On or about June 15, per Gates, Stone told him that “he had contact with Guccifer 2.” According to a warrant affidavit targeting Stone, he searched Google on “Guccifer” before the Guccifer website went up that day. On June 23, Manafort called Stone and then the two old friends met for 30 minutes in the Trump cafeteria. On June 30, Stone spoke to Trump. According to multiple sources (including Michael Cohen), Stone knew of the DNC drop before it happened.

In June, Don Jr accepted a meeting with Natalia Veselnitskaya at which he believed he would get dirt on Hillary Clinton. At the meeting, Veselnitskaya asked Don Jr to end sanctions on Russia, and the candidate’s son said his dad would reconsider it if he won.

In short, the researchers who, in the wake of Trump’s damning comments, were testing whether Trump had lied about having ties to Russia, not only had objectively reasonable reasons to do that research. But their suspicions were proven correct, over and over again.

Durham describes the outcome of the FBI investigation into the allegations this way:

The FBI’s investigation of these allegations nevertheless concluded that there was insufficient evidence to support the allegations of a secret communications channel with Russian Bank-1. In particular, and among other things, the FBI’s investigation revealed that the email server at issue was not owned or operated by the Trump Organization but, rather, had been administered by a mass marketing email company that sent advertisements for Trump hotels and hundreds of other clients.

Nothing here suggests the FBI disproved that this was an anomaly.

And there’s one more detail that Durham didn’t include in the Sussmann indictment: on July 26, Australia first shared their report about what George Papadopoulos told Alexander Downer in May. The next day, July 27, the FBI Legat in the UK got the tip. On July 31 — before the substantive research into the Alfa Bank allegation began — the FBI opened an UNSUB investigation into who got advance warning about the Russian operation and shared it with George Papadopoulos. In other words, by hiding the dates when Tea Leaves first discovered the anomalous data, Durham is hiding not just the damning things that publicly happened before the Alfa Bank operation got started, but probably details about the tip that turned into the Crossfire Hurricane investigation.

In the wake of the Sussmann indictment, the usual Russian denialists have claimed that this proves that what they call “Russiagate” was all a fraud.

Such claims defy the rules of physics, suggesting that events that happened after the FBI opened an investigation to learn how and why the Trump campaign (via three channels, as it turns out) learned of the Russian attack in advance were in fact the cause of it.

It is likely that Durham will be able to exclude all these details from a Michael Sussmann trial, at least if it remains just a false statements case. He will be able to convince Judge Christopher Cooper, who is presiding over the case, that this information — that the researchers not only had reason to believe Trump presented a cybersecurity risk to the country, but that the researchers turned out to be right, and that FBI had itself determined there was reason to carry out the same kinds of investigations that the researchers did, possibly before any one of them took a single step — is irrelevant to the case against Sussmann. But if Durham charges ConFraudUS based on a claim that it was illegitimate to look into why Donald Trump was inviting Russia to hack his opponent, it will become centrally important that, before these researchers started conducting their investigation, the FBI had likewise decided such an investigation had merit.

The Alfa Bank story was sleazy and unethical. But it was still, nevertheless, an instance where someone representing the victim of a nation-state attack attempted to chase down information that may have pertained to that nation-state attack.

John Durham will go down in history as the guy who decided that torturing detainees, even in excess of legal guidance, was not a crime, but a victim sharing concerns about nation-state hacking is.

Update: It’s likely that Richard Burt was one of the people investigated as part of this effort. Per the Mueller Report, he was the person Petr Aven asked to establish a tie with Trump’s transition in 2016.

After the December 2016 all-hands meeting, A ven tried to establish a connection to the Trump team. A ven instructed Richard Burt to make contact with the incoming Trump Administration. Burt was on the board of directors for LetterOne (L 1 ), another company headed by Aven, and had done work for Alfa-Bank. 1169 Burt had previously served as U.S. ambassador to Germany and Assistant Secretary of State for European and Canadian Affairs, and one of his primary roles with Alfa-Bank and Ll was to facilitate introductions to business contacts in the United States and other Western countries. 1170

While at a L1 board meeting held in Luxembourg in late December 2016, Aven pulled Burt aside and told him that he had spoken to someone high in the Russian government who expressed interest in establishing a communications channel between the Kremlin and the Trump Transition Team. 1171 Aven asked for Burt’s help in contacting members of the Transition Team. 1172 Although Burt had been responsible for helping Aven build connections in the past, Burt viewed Aven’s request as unusual and outside the normal realm of his dealings with Aven. 1173

Burt, who is a member of the board of CNI (discussed at Volume I, Section IV.A.4, supra), 1174 decided to approach CNI president Dimitri Simes for help facilitating A ven’ s request, recalling that Simes had some relationship with Kushner. 1175 At the time, Simes was lobbying the Trump Transition Team, on Burt’s behalf, to appoint Burt U.S. ambassador to Russia.1176

Burt contacted Simes by telephone and asked if he could arrange a meeting with Kushner to discuss setting up a high-level communications channel between Putin and the incoming Administration. 1177 Simes told the Office that he declined and stated to Burt that setting up such a channel was not a good idea in light of the media attention surrounding Russian influence in the U.S. presidential election. 1178 According to Simes, he understood that Burt was seeking a secret channel, and Simes did not want CNI to be seen as an intermediary between the Russian government and the incoming Administration. 1179 Based on what Simes had read in the media, he stated that he already had concerns that Trump’s business connections could be exploited by Russia, and Simes said that he did not want CNI to have any involvement or apparent involvement in facilitating any connection. 118

Update: Corrected scope of Benczkowski’s recusal. His should cover the server issue (and Alfa Bank issues for the first two years he was CRM).

Update: Brian Krebs wrote a post laying out all the people who still believe there’s something going on technically. I don’t think that’s inconsistent, at all, with this one. As noted, everyone who looked at this believes it’s an anomaly. What I keep pointing to is the aftermath of that anomaly got Alfa Bank to act in a certain way that is consistent with Putin’s interests. Krebs notes that it has also led to a lot of scrutiny of security researchers in the US, not unlike the way the aftermath of the Steele dossier discredited most top Russian experts in the US government.

Update: This transcript of Preet Bharara and Joyce Vance discussing the many weaknesses of the Durham indictment largely replicates what I’ve laid out here but is worth a review.

Share this entry

Homeland Security Chair Ron Johnson Thinks It Scandalous that Lawyer of Hacking Victim Talks to FBI about Hack

/50 Comments/in , /by

In the never-ending scandal industry of Republican members of Congress trying to make a huge deal out of the fucking Steele dossier, Senate Homeland Security Chair Ron Johnson is demanding that Christopher Wray provide more information (including on the John Doe investigations into Scott Walker’s corruption in WI). Johnson never went to such lengths to obtain information from the FBI during the investigation of the Boston Marathon bombing, but I guess he has different priorities.

Among the things he’s demanding are details of a conversation that Perkins Coie attorney Michael Sussmann had with then FBI General Counsel James Baker.

According to public reports, former FBI General Counsel James Baker met with Michael Sussman, [sic] an attorney with the Perkins Coie law firm, which retained Fusion GPS in 2016 to research allegations about then-candidate Donald Trump. Fusion GPS hired Christopher Steele, author of the Steele dossier–and Mr. Sussman allegedly provided the FBI with information “related to Russian interference in the election, hacking and possible Trump connections.”

The John Solomon piece that has gotten Ron Johnson all hot and bothered about this contact says that Sussmann gave Baker some materials on Russian hacking and possible Trump connections with it.

Baker identified lawyer Michael Sussman, [sic] a former DOJ lawyer, as the Perkins Coie attorney who reached out to him and said the firm gave him documents and a thumb drive related to Russian interference in the election, hacking and possible Trump connections.

Michael Sussmann has been publicly identified as the person that helped the DNC respond to the Russian hack since June 14, 2016, the day the hack first became public.

Chief executive Amy Dacey got a call from her operations chief saying that their information technology team had noticed some unusual network activity.

“It’s never a call any executive wants to get, but the IT team knew something was awry,” ­Dacey said. And they knew it was serious enough that they wanted experts to investigate.

That evening, she spoke with Michael Sussmann, a DNC lawyer who is a partner with Perkins Coie in Washington. Soon after, Sussmann, a former federal prosecutor who handled computer crime cases, called Henry, whom he has known for many years.

His role in helping the DNC help respond to the hack was further described by the NYT’s magnum opus on it.

No one knew just how bad the breach was — but it was clear that a lot more than a single filing cabinet worth of materials might have been taken. A secret committee was immediately created, including Ms. Dacey, Ms. Wasserman Schultz, Mr. Brown and Michael Sussmann, a former cybercrimes prosecutor at the Department of Justice who now works at Perkins Coie, the Washington law firm that handles D.N.C. political matters.

“Three most important questions,” Mr. Sussmann wrote to his clients the night the break-in was confirmed. “1) What data was accessed? 2) How was it done? 3) How do we stop it?”

Mr. Sussmann instructed his clients not to use D.N.C. email because they had just one opportunity to lock the hackers out — an effort that could be foiled if the hackers knew that the D.N.C. was on to them.

“You only get one chance to raise the drawbridge,” Mr. Sussmann said. “If the adversaries know you are aware of their presence, they will take steps to burrow in, or erase the logs that show they were present.”

The D.N.C. immediately hired CrowdStrike, a cybersecurity firm, to scan its computers, identify the intruders and build a new computer and telephone system from scratch. Within a day, CrowdStrike confirmed that the intrusion had originated in Russia, Mr. Sussmann said.

The NYT even describes Sussmann and DNC executives meeting with “senior F.B.I. officials” — a description that would fit the FBI’s General Counsel, Baker, whom Sussman would have known from when they worked on national security cases at DOJ together.

The D.N.C. executives and their lawyer had their first formal meeting with senior F.B.I. officials in mid-June, nine months after the bureau’s first call to the tech-support contractor. Among the early requests at that meeting, according to participants: that the federal government make a quick “attribution” formally blaming actors with ties to Russian government for the attack to make clear that it was not routine hacking but foreign espionage.

“You have a presidential election underway here and you know that the Russians have hacked into the D.N.C.,” Mr. Sussmann said, recalling the message to the F.B.I. “We need to tell the American public that. And soon.”

In other words, there has been public reporting for years that Sussmann spoke to the FBI, reporting that even explains why he was involved — because he was the guy with experience working on cybersecurity. But in spite of that, the Chair of one of the committees most centrally involved in cybersecurity is now suggesting that victims of nation-state hacking and their lawyers should not talk to the FBI about that hacking.

As I disclosed in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

Share this entry

The DNC-Centric Focus of the HPSCI Investigation

/22 Comments/in , , /by

Through the duration of the various Russia investigations, skeptics always harp on two questions pertaining to the Russian election year hacks — why the Democrats never turned over the DNC “server,” singular, to the FBI, allegedly leaving the FBI to rely on Crowdstrike’s work, and whether several sets of files released via Guccifer 2.0 showed signs of non-Russian origin. That is, skeptics look exclusively at the DNC, not the totality of the known Russian targeting.

Looking at the list of witnesses the House Intelligence Committee called (which the committee will release in the coming weeks) shows one reason why: that the most public and propagandist of all the Russia investigations focused on the DNC to the detriment of other known Democratic targets.

Here’s what the list of the HPSCI interviews looks like arranged by date (HPSCI will not be releasing the bolded interviews).

  1. [Comey, Jim (May 2 and 4, 2017): Intel]
  2. [Rogers, Mike (May 4, 2017): Intel]
  3. [Brennan, John (May 23, 2017): Intel]
  4. Coats, Dan (June 22, 2017): Intel
  5. Farkas, Evelyn (June 26, 2017): Ukraine/RU DOD
  6. Podesta, John (June 27, 2017): Clinton Chair
  7. Caputo, Michael (July 14, 2017): RU tied Trump
  8. Clapper, James (July 17, 2017): Intel
  9. Kushner, Jared (July 25, 2017): June 9 etc
  10. Carlin, John (July 27, 2017): Early investigation
  11. Gordon, JD (July 26, 2017): Trump NatSec
  12. Brown, Andrew (August 30, 2017): DNC CTO
  13. Tamene, Yared (August 30, 2017): DNC tech contractor
  14. Rice, Susan (September 6, 2017): Obama response to hack/unmasking
  15. Stone, Roger (September 26, 2017): Trump associate
  16. Epshteyn, Boris (September 28, 2017): RU-tied Trump
  17. Tait, Matthew (October 6, 2017): Solicit hack
  18. Safron, Jonathan (October 12, 2017): Peter Smith
  19. Power, Samantha (October 13, 2017): Obama response to hack/unmasking
  20. Catan, Thomas (October 18, 2017): Fusion
  21. Fritsch, Peter (October 18, 2017): Fusion
  22. Lynch, Loretta (October 20, 2017): Investigation
  23. Parscale, Brad (October 24, 2017): Trump’s data
  24. Cohen, Michael (October 24, 2017): Trump lawyer
  25. Rhodes, Benjamin (October 25, 2017): Obama response to hack/unmasking
  26. McCord, Mary (November 1, 2017): Early investigation
  27. Kaveladze, Ike (November 2, 2017): June 9 meeting
  28. Yates, Sally (November 3, 2017): Early investigation
  29. Schiller, Keith (November 7, 2017): Trump bodyguard
  30. Akhmetshin, Rinat (November 13, 2017): June 9
  31. Samachornov, Anatoli (November 28, 2017): June 9
  32. Sessions, Jeff (November 30, 2017): Trump transition
  33. Podesta, John (December 4, 2017): Dossier
  34. Denman, Diana (December 5, 2017): RNC platform
  35. Henry, Shawn (December 5, 2017): Crowdstrike
  36. Trump, Jr. Donald (December 6, 2017): June 9
  37. Phares, Walid (December 8, 2017): Trump NatSec
  38. Clovis, Sam (December 12, 2017): Trump NatSec
  39. Goldfarb, Michael (December 12, 2017): Dossier
  40. Elias, Marc (December 13, 2017): Dossier
  41. Nix, Alexander (December 14, 2017): Cambridge Analytica
  42. Goldstone, Rob (December 18, 2017): June 9
  43. Sussmann, Michael (December 18, 2017): Hack and dossier
  44. McCabe, Andrew (December 19, 2017): Early investigation
  45. Kramer, David (December 19, 2017): Dossier
  46. Sater, Felix (December 20, 2017): RU connected Trump
  47. Gaeta, Mike (December 20, 2017): Dossier go-between
  48. Sullivan, Jake (December 21, 2017): Dossier
  49. [Rohrabacher, Dana (December 21, 2017): Russian compromise]
  50. [Wasserman Schultz, Debbie (December 21, 2017): dossier]
  51. Graff, Rhona (December 22, 2017): June 9
  52. Kramer, David (January 10, 2018): Dossier
  53. Bannon, Stephen (January 16, 2018): Trump official
  54. Lewandowski, Corey (January 17, 2018): Trump official
  55. Dearborn, Rick (January 17, 2018): Trump official
  56. Bannon, Stephen (February 15, 2018): Trump official
  57. Hicks, Hope (February 27, 2018): Trump official
  58. Lewandowski, Corey (March 8, 2018): Trump official

While John Podesta, one of the earliest spearphishing victims, was one of  the earliest witnesses (and, as HPSCI shifted focus to the dossier, one of the last as well), the other hack witnesses, DNC CTO Andrew Brown and DNC IT contractor Yared Tamene, represent the DNC. Perhaps that’s because of the NYT’s big story on the hack, which was obviously misleading in real time and eight months old by the time of those interviews. While Perkins Coie lawyer and former DOJ cyber prosecutor Michael Sussmann would surely have real insight into the scope of all the Democratic targets, he was interviewed during HPSCI’s dossier obsession, not alongside Brown and Tamene.

All of which is to say that the HPSCI investigation of the hack was an investigation of the hack of the DNC, not of the full election year attack.

To get a sense of some of what that missed, consider the victims described in the GRU indictment (which leaves out some of the earlier Republican targets, such as Colin Powell). I’ve included relevant paragraph numbers to ID these victims.

  1. Spearphish victim 3, March 21, 2016 (Podesta)
  2. Spearphish victim 1 Clinton aide, March 25, 2016 (released via dcleaks)
  3. Spearphish victim 4 (DCCC Employee 1), April 12, 2016 ¶24
  4. Spearphish victim 5 (DCCC Employee), April 15, 2016
  5. Spearphish victim 6 (possibly DCCC Employee 2), April 18, 2016 ¶26
  6. Spearphish victim 7 (DNC target), May 10, 2016
  7. Spearphish victim 2 Clinton aide, June 2, 2016 (released via dcleaks)
  8. Spearphish victim 8 (not described), July 6, 2016
  9. Ten DCCC computers ¶24
  10. 33 DNC computers ¶26
  11. DNC Microsoft Exchange Server ¶29
  12. Act Blue ¶33
  13. Third party email provider used by Clinton’s office ¶22 (in response to July 27 Trump request)
  14. 76 email addresses at Clinton campaign ¶22 (in response to July 27 Trump request)
  15. DNC’s Amazon server ¶34
  16. Republican party websites ¶71
  17. Illinois State Board of Elections ¶72
  18. VR Systems ¶73
  19. County websites in GA, IA, and FL ¶75
  20. VR Systems clients in FL ¶76

Effectively, HPSCI (and most hack skeptics) focused exclusively on item 11, the DNC Microsoft Exchange server from which the emails sent to WikiLeaks were stolen.

Yet, at least as laid out by Mueller’s team, the election year hack started elsewhere — with Podesta, then the DCCC, and only after that the DNC. It continued to target Hillary through the year (though with less success than they had with the DNC). And some key things happened after that — such as the seeming response to Trump’s call for Russia to find more Hillary emails, the Info-Ops led targeting of election infrastructure in the summer and fall, and voter registration software. Not to mention some really intriguing research on Republican party websites. And this barely scratches on the social media campaign, largely though not entirely carried out by a Putin-linked corporation.

HPSCI would get no insight on the overwhelming majority of the election year operation, then, by interviewing the witnesses they did. Of particular note, HPSCI would not review how the targeting and release of DCCC opposition research gave Republican congressmen a leg up over their Democratic opponents.

And while HPSCI did interview the available June 9 meeting witnesses, they refused to subpoena the information needed to really understand it. Nor did they interview all the witnesses or subpoena available information to understand the Stone operation and the Peter Smith outreach.

Without examining the other multiple threads via which Russia recruited Republicans, most notably via the NRA, HPSCI wouldn’t even get a sense of all the ways Russia was trying to make Republicans and their party infrastructure into the tools of a hostile foreign country. And there are other parts of the 2016 attack that not only don’t appear in these interviews, but which at least one key member on the committee was utterly clueless about well past the time the investigation finished.

The exception to the rule that HPSCI didn’t seek out information that might damn Republicans, of course, is the interview of Dana Rohrabacher, who (along with President Trump) proved reliably willing to entertain Russian outreach via all known channnels. But that’s one of the interviews Republicans intend to keep buried because — according to an anonymous Daily Beast source — they don’t want Rohrabacher’s constituents to know how badly Russia has pwned him before November 6.

“The Republicans are trying to conceal from the voters their colleague Dana Rohrabacher’s Russia investigation testimony,” said a committee source familiar with the issue. “There were highly concerning contacts between Rohrabacher and Russians during the campaign that the public should hear about.”

By burying the Comey, Rogers, and Brennan transcripts, Republicans suppress further evidence of the degree to which Russia specifically targeted Hillary, and did so to help not just Trump, but the Republican party.

I’m sure there will be some fascinating material in these transcripts when they’re released. But even before the selective release, designed to hide any evidence gathered of how lopsided the targeting was, the scope of these interviews makes clear that the HPSCI investigation was designed to minimize, as much as possible, evidence showing how aggressively Russia worked to help Republicans.

As I laid out in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

Share this entry