Posts

Peter Debbins Pleads

Peter Debbins — who was charged with spying for Russia in August — pled guilty today. The statement of facts he pled to almost exactly maps his indictment, with two main additions. The statement explains the EDVA venue I was so so interested in.

From in or around December 1996 to in or around January 2011, in an offense begun and committed outside of the jurisdiction of any particular State or district of the United States, the defendant, also known as “Ikar Lesnikov,” who after the conduct required for the offense occurred was arrested in and first brought to the Eastern District of Virginia, and whose last known address is in the Eastern District of Virginia, did unlawfully and knowingly conspire with others to communicate, deliver, and transmit to a foreign government, to wit: the Russian Federation (hereinafter, “Russia”), and representatives, officers, agents, employees, subjects, and citizens thereof, directly and indirectly, documents, writings, and information relating to the national defense of the United States, with the intent and reason to believe that such documents, writings, and information were to be used to the injury of the United States and to the advantage of a foreign government, namely, Russia.

Thanks for explaining that, DOJ! Debbins was in the UK when they first started this investigation, which gave the government the choice to land him in the least friendly venue for spies and leakers.

In addition, there’s several paragraphs that seem inconsistent with the fact that the information he admitted sharing was classified Secret.

2. As of 2008, Executive Order 12958 signed on April 17, 1995, as amended by Executive Order 13292 signed on March 25, 2003, governed the system for classifying, safeguarding, and declassifying national security information.’ Under that Executive Order, national security information was classified as “TOP SECRET,” “SECRET,” or “CONFIDENTIAL.” National security information was information owned by, produced by, produced for, and under the control of the U.S. Government, and that was classified as follows:

a. Information was classified as TOP SECRET if its unauthorized disclosure reasonably could be expected to cause exceptionally grave damage to the national security that the original classification authority was able to identify and describe.

b. Information was classified as SECRET if its unauthorized disclosure reasonably could be expected to cause serious damage to the national security that the original classification authority was able to identify and describe.

c. Information was classified as CONFIDENTIAL if its unauthorized disclosure reasonably could be expected to cause damage to the national security that the original classification authority was able to identify and describe.

3. Access to national security information classified at any level could be further restricted through compartmentation in Sensitive Compartmented Information (SCI) categories. Only individuals possessing both the appropriate security clearance and specific, additional permissions could have authorized access to SCI.

That suggests there’s more he shared that was far more sensitive, information DOJ doesn’t want to lay out (unsurprisingly). If so, that’s covered by this boilerplate language.

This statement of facts includes those facts necessary to support the plea agreement between the defendant and the United States. It does not include each and every fact known to the defendant or to the United States, and it is not intended to be a full enumeration of all of the facts surrounding the defendant’s case.

That said, the plea itself emphasizes that the NDI he shared with Russia was classified Secret.

As set forth in the accompanying statement of facts, the national defense information that is the subject of this conspiracy and the terms of this plea agreement was, and is, classified at the Secret level.

While that still exposes him to a possible life sentence, the plea puts his guidelines at 39, with the possibility that he’ll get a two or three point admission of guilt reduction, which would put him in a 188 to 235 month range. But the government is giving him no guarantees at all.

The United States and the defendant have not agreed on any further sentencing issues, whether related to the Sentencing Guidelines or the factors listed in 18 U.S.C. § 3553(a), other than those set forth above or elsewhere in this Plea Agreement. Any stipulation on a Guidelines provision does not limit the parties’ arguments as to any other Guidelines provisions or sentencing factors under Section 3553(a), including arguments for a sentence within or outside the advisory Guidelines range found by the Court at sentencing.

The government included intentional incomplete testimony among the reasons it can breach the plea agreement at a preponderance of the evidence standard.

If the defendant withdraws from this agreement, or commits or attempts to commit any additional federal, state, or local crimes, or intentionally gives materially false, incomplete, or misleading testimony or information, or otherwise violates any provision of this agreement, then:

That may be boilerplate, but in this case it will ensure that Debbins honestly provides anything more sensitive about his relationship with Russia.

Again, none of that is surprising. It just suggests that if there’s something more here, DOJ isn’t going to reveal that.

Returning to Venue in the Peter Debbins Case

In my post on the Peter Debbins indictment, I noted with curiosity the EDVA venue for the former Special Forces guy charged with sharing information with GRU. Just one of the alleged acts, a January 3, 2011 email, took place in EDVA. I suggested that might mean Debbins would eventually be prosecuted for later acts, acts which took place in Virginia.

Several filings and the WaPo account of his detention hearing (not to mention the involvement of prosecutor David Aaron, one of the people who prosecuted Hal Martin, the guy originally accused of being the Shadow Brokers source) raise further questions whether that’s true.

According to the current story, DOJ discovered that Debbins had been recruited by Russia when he self-reported that recruitment in a SF-86 in July 2019. After that, FBI interviewed him 8 times; on July 11, 2019, they got him to describe that recruitment in a voluntary statement (PDF 5ff). As demonstrated below, the interactions with GRU officers map onto the indictment very closely (which is to say, in indicting Debbins, the government only told Debbins and his Russian handlers what he already told them).

That said, Debbins’ statement includes two later details: further emails with a guy named Nikolai, lasting until May 2011 (and therefore presumably extending venue in EDVA), and a description of GRU officers going to his Russian military officer father-in-law’s office in 2012, inquiring what Debbins was doing in DC, in response to which his wife’s father provided outdated information.

In December 2019, Debbins asked his Senator, Mike Rounds, to intercede in the investigation (PDF 10ff.), claiming that he couldn’t even get unclassified employment while the FBI was investigating. He also claimed that the FBI had told him “they [were] pretty well done with [his] case.” Debbins’ claim to Rounds had to have been false. His resume (PDF 16) shows he was continually employed in this period, working as an intelligence trainer for Cosolutions until January 2020 and then working as a Cyber Financial Crimes Project Manager for a Ukrainian American university after that. Which suggests he was trying to get his Senator to intervene based on a false representation, perhaps as a way to figure out what was really happening in the investigation.

The FBI also searched Debbins’ home in the UK and executed search warrants sometime after March 8, 2020 (to shift from a counterintelligence investigation to a criminal one, the FBI would want to parallel construct what they already knew with such searches).

To explain why they needed to detain Debbins now after letting him wander around freely for over a year after disclosing these decade old contacts, AUSA Thomas Traxler (who is also prosecuting Julian Assange) explained that they needed to corroborate his statement before arresting him.

Traxler said the government was “concerned” Debbins would flee over the past year but had to corroborate the statement. It would have been “premature” to arrest him any earlier, Traxler said.

The real thing that got Magistrate Judge John Anderson to deny Debbins bail was the list of things Debbins has done since the last act in his statement. Senior DIA CI Expert David Tomlinson described how, when Debbins worked at Booz Allen Hamilton from 2014 to 2016, he was read into one Special Access Program and six Alternative or Compensatory Control Measures (which are less classified but nevertheless restricted on a need-to-know basis). Defense Intelligence Senior Leader Joseph Simon described how Debbins’ training, both while in Special Forces and in his cybersecurity jobs since, would make it easy for him to flee if he were not detained. Both declarations make it clear that Debbins has been working on Russian language counterintelligence for almost a decade, precisely the kind of positions that would be most valuable to Russia. His resume further makes it clear he spent three years at Fort Meade and 20 months working for Booz at Quantico, VA.

It would be fairly remarkable if GRU were willing to let a former recruit work in such positions, with a signed admission of his involvement with them from years earlier, without asking for further cooperation.

All the declarations submitted for his detention hearing make clear the affiant is not revealing all he knows about this case.

Finally, as WaPo noted, in addition to having organizational ties that overlap with Mike Flynn and Erik Prince, Debbins told a friend he’d get a job in Donald Trump’s NSC.

In early 2017, Debbins told a friend via email that he was a candidate for a position on the National Security Council, “specifically Special Assistant to the President and Senior Director for Russia and Central Asia.”

It is not clear how serious his candidacy was; he never served in the Trump administration.

DOJ is not saying — and they might never say anything publicly if they wanted to obscure what damage Debbins has done and what they know or don’t know. DOJ could get Debbins to plead to facts he has already admitted to in his statement, and push for a stiff sentence based off classified declarations laying out related conduct.

But it sure seems likely his related conduct in EDVA extends beyond that one January 2011 email.

The EDVA Venue and the Peter Debbins Indictment

DOJ just rolled out the indictment of a former Special Forces officer for spying for Russia.

The general story is that GRU started recruiting Peter Rafael Dzibinski Debbins when he traveled to Russia via family ties when he was young. He went on to join the Army and then the Special Forces. Along the way, he told GRU about who was in his units and what their mission was. The timeline in the indictment starts in 1996, when Debbins traveled to Chelyabinsk as a student. Debbins met with GRU officers in Russia repeatedly; after he joined the Army he provided details of what his units did, including when he was stationed in Azerbijan in 2004, where his clearance was suspended and he was discharged from the Army.

After he was discharged, on his trips to Russia in 2008 and 2010, Debbins tried to drum up Russian business. The indictment seems to suggest he started to get cold feet in 2009, resisting the recruitment.

Beginning in April 2009, DEBBINS and [Russian Intelligence Officer] 7 began exchanging a series of emails that, on their face, referenced potential business opportunities. In an April 2009 email, RIS 7 encouraged DEBBINS to travel to Russia for a visit, but DEBBINS did not commit to the trip. Later, in August 2009, RIS sent an email to DEBBINS inviting DEBBINS to travel to Russia and offering to pay his expenses. DEBBINS, however, did not travel at that time.

Subsequent to that seeming moment of resistance, however, Debbins got a new TS/SCI security clearance and traveled to Russia to discuss business with someone linked to the GRU. He did not, as most recently instructed, bring a Field Manual, because (he said) he feared he’d be caught by DHS.

Nevertheless, his GRU handlers still pitched him on a business deal. On January 3, 2011, after being reminded of his ties to GRU, Debbins moved to DC and started working on the business deal with the Russian.

A January 3 email from Debbins to the business partner is the single thing that (presumably) happened in EDVA, and the single thing that happened in 2011, the last year of the scope of this indictment.

On January 3, 2011, DEBBINS sent the RUSSIAN NATIONAL an email stating that he had moved to “the capital,” meaning Washington, D.C., and that he was working on their business matter.

And yet, even though Debbins had closest ties to Minnesota for the span of this indictment (and could have gotten venue in North Carolina through Special Forces for some of the overseas stuff), the venue is EDVA.

That may be because that’s the easiest place to win a national security case.

Or it may be because what has happened since 2011, when Debbins has been traveling elite circles and working on cybersecurity, is of more interest to the government. [h/t Laura Rozen for both links] According to one online biography, Debbins was at Fort Meade from around 2012 to 2015 and then worked as a contractor since.

Later, I got a job working at Fort Meade as a Russian analyst and did that for three years. I then transitioned to working as a cyber instructor for CACI for another three years.

Which is to say it’s unclear whether this indictment is about what happened between 1996 and 2011 — the span covered by the indictment — or about what has happened since.