The Government Argues that Edward Snowden Is a Recruiting Tool

/25 Comments/in , , , , /by

As I noted in my post on the superseding indictment against Julian Assange, the government stretched the timeline of the Conspiracy to Hack count to 2015 by describing how WikiLeaks helped Edward Snowden flee to Russia. DOJ seems to be conceiving of WikiLeaks’ role in helping Snowden as part of a continuing conspiracy designed to recruit more leakers.

Let me make clear from the onset: I am not endorsing this view, I am observing where I believe DOJ not only intends to head with this, but has already headed with it.

Using Snowden as a recruitment tool

After laying out how Chelsea Manning obtained and leaked files that were listed in the WikiLeaks Most Wanted list (the Iraq Rules of Engagement and Gitmo files, explicitly, and large databases more generally; here’s one version of the list as entered into evidence at Manning’s trial), then describing Assange’s links to LulzSec, the superseding Assange indictment lays out WikiLeaks’ overt post-leak ties and claimed ties to Edward Snowden.

83. In June 2013, media outlets reported that Edward J. Snowden had leaked numerous documents taken from the NSA and was located in Hong Kong. Later that month, an arrest warrant was issued in the United States District Court for the Eastern District of Virginia, for the arrest of Snowden, on charges involving the theft of information from the United States government.

84. To encourage leakers and hackers to provide stolen materials to WikiLeaks in the future, ASSANGE and others at WikiLeaks openly displayed their attempts to assist Snowden in evading arrest.

85. In June 2013, a WikiLeaks association [Sarah Harrison, described as WLA-4 in the indictment] traveled with Snowden from Hong Kong to Moscow.

86. On December 31, 2013, at the annual conference of the Chaos Computer Club (“CCC”) in Germany, ASSANGE, [Jacob Appelbaum] and [Harrison] gave a presentation titled “Sysadmins of the World, Unite! A Call to Resistance.” On its website, the CCC promoted the presentation by writing, “[t]here has never been a higher demand for a politically-engaged hackerdom” and that ASSANGE and [Appelbaum] would “discuss what needs to be done if we re going to win.” ASSANGE told the audience that “the famous leaks that WikiLeaks has done or the recent Edward Snowden revelations” showed that “it was possible now for even a single system administrator to … not merely wreck[] or disabl[e] [organizations] … but rather shift[] information from an information apartheid system … into the knowledge commons.” ASSANGE exhorted the audience to join the CIA in order to steal and provide information to WikiLeaks, stating, “I’m not saying doing join the CIA; no, go and join the CIA. Go in there, go into the ballpark and get the ball and bring it out.”

87. At the same presentation, in responding to the audience’s question as to what they could do, [Appelbaum] said “Edward Snowden did not save himself. … Specifically for source protection [Harrison] took actions to protect [Snowden] … [i]f we can succeed in saving Edward Snowden’s life and to keep him free, then the next Edward Snowden will have that to look forward to. And if look also to what has happened to Chelsea Manning, we see additionally that Snowden has clearly learned….”

The following section describes how, “ASSANGE and WikiLeaks Continue to Recruit,” including two more paragraphs about the Most Wanted Leaks:

89. On May 15, 2015, WikiLeaks tweeted a request for nominations for the 2015 “Most Wanted Leaks” list, and as an example, linked to one of the posts of a “Most Wanted Leaks” list from 2009 that remained on WikiLeaks’s website.

[snip]

92. In June 2015, to continue to encourage individuals to hack into computers and/or illegaly obtain and disclose classified information to WikiLeaks, WikiLeaks maintained on its website a list of “The Most Wanted Leaks of 2009,” which stated that documents or materials nominated to the list must “[b]e likely to have political, diplomatic, ethical or historical impact on release … and be plausibly obtainable to a well-motivated insider or outsider,” and must be “described in enough detail so that … a visiting outsider not already familiar with the material or its subject matter may be able to quickly locate it, and will be motivated to do so.”

Effectively, Snowden is included in this indictment not because the government is alleging any ties between Snowden and WikiLeaks in advance of his leaks (Snowden’s own book lays out reasons to think there was more contact between him and Appelbaum than is publicly known, but the superseding Assange indictment makes no mention of any contacts before Snowden’s first publications), but because WikiLeaks used their success at helping Snowden to flee as a recruiting pitch.

Snowden admits Harrison got involved to optimize his fate

This is something that Snowden lays out in his book. First, he addresses insinuations that Assange only helped Snowden out of selfish reasons.

People have long ascribed selfish motives to Assange’s desire to give me aid, but I believe he was genuinely invested in one thing above all—helping me evade capture. That doing so involved tweaking the US government was just a bonus for him, an ancillary benefit, not the goal. It’s true that Assange can be self-interested and vain, moody, and even bullying—after a sharp disagreement just a month after our first, text-based conversation, I never communicated with him again—but he also sincerely conceives of himself as a fighter in a historic battle for the public’s right to know, a battle he will do anything to win. It’s for this reason that I regard it as too reductive to interpret his assistance as merely an instance of scheming or self-promotion. More important to him, I believe, was the opportunity to establish a counterexample to the case of the organization’s most famous source, US Army Private Chelsea Manning, whose thirty-five-year prison sentence was historically unprecedented and a monstrous deterrent to whistleblowers everywhere. Though I never was, and never would be, a source for Assange, my situation gave him a chance to right a wrong. There was nothing he could have done to save Manning, but he seemed, through Sarah, determined to do everything he could to save me.

This passage is written to suggest Snowden believed these things at the time, describing what “seemed” to be true at the time. But it’s impossible to separate it from Appelbaum’s explicit comparison of Manning and Snowden at CCC in December 2013.

Snowden then describes what he thinks Harrison’s motive was.

By her own account, she was motivated to support me out of loyalty to her conscience more than to the ideological demands of her employer. Certainly her politics seemed shaped less by Assange’s feral opposition to central power than by her own conviction that too much of what passed for contemporary journalism served government interests rather than challenged them.

Again, this is written to suggest Snowden believed it at the time, though it’s likely what he has come to believe since.

Then Snowden describes believing, at that time, that Harrison might ask for something in exchange for her help — some endorsement of WikiLeaks or something.

As we hurtled to the airport, as we checked in, as we cleared passport control for the first of what should have been three flights, I kept waiting for her to ask me for something—anything, even just for me to make a statement on Assange’s, or the organization’s, behalf. But she never did, although she did cheerfully share her opinion that I was a fool for trusting media conglomerates to fairly guard the gate between the public and the truth. For that instance of straight talk, and for many others, I’ll always admire Sarah’s honesty.

Finally, though, Snowden describes — once the plane entered into Chinese airspace and so narratively at a time when there was no escaping whatever fate WikiLeaks had helped him pursue — asking Harrison why she was helping. He describes that she provided a version of the story that WikiLeaks would offer that December in Germany: WikiLeaks needed to be able to provide a better outcome than the one that Manning suffered.

It was only once we’d entered Chinese airspace that I realized I wouldn’t be able to get any rest until I asked Sarah this question explicitly: “Why are you helping me?” She flattened out her voice, as if trying to tamp down her passions, and told me that she wanted me to have a better outcome. She never said better than what outcome or whose, and I could only take that answer as a sign of her discretion and respect.

Whatever has been filtered through time and (novelist-assisted) narrative, Snowden effectively says the same thing the superseding indictment does: Assange and Harrison went to great lengths to help Snowden get out of Hong Kong to make it easier to encourage others to leak or hack documents to share with WikiLeaks. I wouldn’t be surprised if these excerpts from Snowden’s book show up in any Assange trial, if it ever happens.

Snowden’s own attempt to optimize outcomes

Curiously, Snowden did not say anything in his book about his own efforts to optimize his outcome, which is probably the most interesting new information in Bart Gellman’s new book, Dark Mirror (the book is a useful summary of some of the most important Snowden disclosures and a chilling description of how aggressively he and Askhan Soltani were targeted by foreign governments as they were reporting the stories). WaPo included the incident in an excerpt, though the excerpt below is from the book.

Early on in the process, Snowden had asked Gellman to publish the first PRISM document with a key, without specifying what key it was. When WaPo’s editors asked why Gellman’s source wanted them to publish a key, Gellman finally asked.

After meeting with the Post editors, I remembered that I could do an elementary check of the signature on my own. The result was disappointing. I was slow to grasp what it implied.

gpg –verify PRISM.pptx.sig PRISM.pptx

gpg: Signature made Mon May 20 14:31:57 2013 EDT

using RSA key ID ⬛⬛⬛⬛⬛⬛⬛⬛

gpg: Good signature from “Verax”

Now I knew that Snowden, using his Verax alter ego, had signed the PowerPoint file himself. If I published the signature, all it would prove to a tech-savvy few was that a pseudonymous source had vouched for his own leak. What good would that do anyone?

In the Saturday night email, Snowden spelled it out. He had chosen to risk his freedom, he wrote, but he was not resigned to life in prison or worse. He preferred to set an example for “an entire class of potential whistleblowers” who might follow his lead. Ordinary citizens would not take impossible risks. They had to have some hope for a happy ending.

To effect this, I intend to apply for asylum (preferably somewhere with strong Internet and press freedoms, e.g. Iceland, though the strength of the reaction will determine how choosy I can be). Given how tightly the U.S. surveils diplomatic outposts (I should know, I used to work in our U.N. spying shop), I cannot risk this until you have already gone to press, as it would immediately tip our hand. It would also be futile without proof of my claims—they’d have me committed—and I have no desire to provide raw source material to a foreign government. Post publication, the source document and cryptographic signature will allow me to immediately substantiate both the truth of my claim and the danger I am in without having to give anything up. . . . Give me the bottom line: when do you expect to go to print?

Alarm gave way to vertigo. I forced myself to reread the passage slowly. Snowden planned to seek the protection of a foreign government. He would canvass diplomatic posts on an island under Chinese sovereign control. He might not have very good choices. The signature’s purpose, its only purpose, was to help him through the gates.

How could I have missed this? Poitras and I did not need the signature to know who sent us the PRISM file. Snowden wanted to prove his role in the story to someone else. That thought had never occurred to me. Confidential sources, in my experience, did not implicate themselves—irrevocably, mathematically—in a classified leak. As soon as Snowden laid it out, the strategic logic was obvious. If we did as he asked, Snowden could demonstrate that our copy of the NSA document came from him. His plea for asylum would assert a “well-founded fear of being persecuted” for an act of political dissent. The U.S. government would maintain that Snowden’s actions were criminal, not political. Under international law each nation could make that judgment for itself. The fulcrum of Snowden’s entire plan was the signature file, a few hundred characters of cryptographic text, about the length of this paragraph. And I was the one he expected to place it online for his use.

Gellman, Poitras, and the Post recognized this would make them complicit in Snowden’s flight and go beyond any journalistic role.

After some advice from WaPo’s lawyers, Gellman made it clear to Snowden he could not publish the key (and would not have, in any case, because the slide deck included information on legitimate targets he and the WaPo had no intent of publishing).

We hated the replies we sent to Snowden on May 26. We had lawyered up and it showed. “You were clear with me and I want to be equally clear with you,” I wrote. “There are a number of unwarranted assumptions in your email. My intentions and objectives are purely journalistic, and I will not tie them or time them to any other goal.” I was working hard and intended to publish, but “I cannot give you the bottom line you want.”

This led Snowden to withdraw his offer of exclusivity which — as Gellman tells the story — is what led Snowden to renew his efforts to work with Glenn Greenwald. The aftermath of that decision led to a very interesting spat between Gellman and Greenwald — to read that, you should buy the book.

To be clear, I don’t blame Snowden for planning his first releases in such a way as to optimize the chances he wouldn’t spend the rest of his life in prison. But his silence on the topic in his own account, even while he adopted the WikiLeaks line about their goal of optimizing his outcome, raises questions about any link between Harrison’s plans and Snowden’s.

The government is using Snowden as inspiration in other cases

The superseding Assange indictment is the first place I know of where the government has specifically argued that WikiLeaks’ assistance to Snowden amounted to part of a criminal conspiracy (though it is totally unsurprising and I argued that it was clear the government was going there based on what they had argued in the Joshua Schulte case).

But it’s not the first place they have argued a tie between Snowden as inspiration and further leaks.

The indictment for Daniel Everette Hale, the guy accused of sharing documents on the drone program with Jeremy Scahill, makes it clear how Hale’s relationship with Scahill blossomed just as the Snowden leaks were coming out (and this detail makes it clear he’s the one referred to in Citizenfour as another source coming forward).

15. On or about June 9, 2013, the Reporter sent HALE an email with a link to an article about Edward Snowden in an online publication. That same day. Hale texted a friend that the previous night he had been hanging out with journalists who were focused on his story. Hale wrote that the evening’s events might provide him with “life long connections with people who publish work like this.”

Hale launched a fairly aggressive (and if it weren’t in EDVA, potentially an interesting) challenge to the Espionage Act charges against him. It included (but was not limited to) a Constitutional motion to dismiss as well as a motion to dismiss for selective prosecution. After his first motions, however, both the government’s response and Hale’s reply on selective prosecution were (and remain, nine months later) sealed.

But Hale’s reply on the Constitutional motion to dismiss was not sealed. In it, he makes reference to what remains sealed in the selective prosecution filings. That reference makes it clear that the government described searching for leakers who had been inspired “by a specific individual” who — given the mention of Snowden in Hale’s indictment — has to be Snowden.

Moreover, as argued in more detail in Defendant’s Reply in support of his Motion to Dismiss for Selective or Vindictive Prosecution (filed provisionally as classified), it appears that arbitrary enforcement – one of the risks of a vague criminal prohibition – is exactly what occurred here. Specifically, the FBI repeatedly characterized its investigation in this case as an attempt to identify leakers who had been “inspired” by a specific individual – one whose activity was designed to criticize the government by shedding light on perceived illegalities on the part of the Intelligence Community. In approximately the same timeframe, other leakers reportedly divulged classified information to make the government look good – by, for example, unlawfully divulging classified information about the search for Osama Bin Laden to the makers of the film Zero Dark Thirty, resulting in two separate Inspector General investigations.3 Yet the investigation in this case was not described as a search for leakers generally, or as a search for leakers who tried to glorify the work of the Intelligence Community. Rather, it was described as a search for those who disclosed classified information because they had been “inspired” to divulge improprieties in the intelligence community.

Hale argued, then, that the only reason he got prosecuted after some delay was because the FBI had a theory about Snowden’s role in inspiring further leaks.

Judge Liam O’Grady denied both those motions (and most of Hale’s other motions), though without further reference to Snowden as an inspiration. But I’m fairly sure this is not the only case where they’re making this argument.

The Superseding Assange Indictment Tidies Up CFAA Charges

/15 Comments/in , , /by

Yesterday, the government released a second superseding indictment against Julian Assange. The EDVA press release explains that no new counts were added, but the language describing the computer hacking conspiracy was expanded.

The new indictment does not add additional counts to the prior 18-count superseding indictment returned against Assange in May 2019. It does, however, broaden the scope of the conspiracy surrounding alleged computer intrusions with which Assange was previously charged. According to the charging document, Assange and others at WikiLeaks recruited and agreed with hackers to commit computer intrusions to benefit WikiLeaks.

It is true the description of the hacking charge has been dramatically expanded, incorporating a bunch of hacks that WikiLeaks was associated with.

But there are a few details of the charges that changed as well. The CFAA charge has actually been reworked, focused on four different kinds of hacks:

  • Accessing a computer and exceeding access to obtain information classified Secret
  • Accessing a computer and exceeding access to obtain information from protected computers at a department or agency of the United States committed in furtherance of criminal acts
  • Knowingly transmitting code that can cause damage,
    • Greater than $5000
    • Used by an entity of the US in furtherance of the administration of justice, national defense, and national security
    • Affecting more than 10 or more protected computers in a given year
  • Intentionally accessing protecting computers without authorization to recklessly cause damage,
    • Greater than $5000
    • Used by an entity of the US in furtherance of the administration of justice, national defense, and national security
    • Affecting more than 10 or more protected computers in a given year

This is a grab bag of hacking charges, and it could easily cover (and I expect one day it will cover) actions not described in this indictment. While adding this grab bag of charges, the indictment takes out a specific reference to the Espionage Act, probably to ensure at least one charge against Assange can in no way be claimed to be a political crime. It also takes out 18 U.S.C. § 641, possibly because the thinking of its applicability to leaking classified information has gotten more controversial.

The indictment also changes the dates on several of the counts. The timeline on the three counts addressing leaking of informants’ identities (something that is criminalized in the UK in ways it is not here, but also the counts that most aggressively charge Assange for the publication of information) now extends to April 2019. The timeline on the hacking charges extends (for reasons I’ll explain below), to 2015. And the overall timeline of Assange’s behavior extends back to 2007, a date that post-dates the earliest WikiLeaks activity and so raises interesting questions about what actions it was chosen to include.

As to the 2015 date, the indictment gets there by discussing WikiLeaks’ role in helping Edward Snowden flee China and the ways WikiLeaks used Snowden’s case to encourage other leakers and hackers. It describes:

  • Sarah Harrison’s trip to Hong Kong in June 2013
  • The presentation Harrison, Jake Appelbaum, and Assange gave in December 2013 encouraging potential leakers to, “go and join the CIA. Go in there, go into the ballpark and get the ball and bring it out,” and claiming that, “Edward Snowden did not save himself … Harrison took actions to protect him”
  • A conference on May 6, 2014 when Harrison recruited others to obtain classified or stolen information to share with WikiLeaks
  • A May 15, 2015 Most Wanted Leaks pitch that linked back to the 2009 list that Chelsea Manning partly responded to
  • Comments Assange made on May 25, 2015 claiming to have created distractions to facilitate Snowden’s flight
  • Appelbaum and Harrison’s efforts to recruit more leakers at a June 18, 2015 event
  • The continued advertisement for Most Wanted Leaks until at least June 2015, still linking back to the 2009 file

I’ll explain in a follow-up where this is going. Obviously, though, the government could easily supersede this indictment to add later leakers, most notably but in no way limited to Joshua Schulte, who first started moving towards leaking all of CIA’s hacking tools to WikiLeaks in 2015.

I argued, in December, that the government appeared to be moving towards a continuing conspiracy charge, one that later hackers and leakers (as well as Appelbaum and Harrison) could easily be added to. Doing so as they’ve done here would in no way violate UK’s extradition rules. And fleshing out the CFAA charge makes this airtight from an extradition standpoint; some of the crimes alleged involving Anonymous have already been successfully prosecuted in the UK.

This doesn’t mitigate the harm of the strictly publishing counts. But it does allege Assange’s personal involvement in a number of hacks and leaks that others — both in the US and UK — have already been prosecuted for, making the basic extradition question much less risky for the US.

Update: I think this allegation in the new indictment is important:

In September 2010, ASSANGE directed [Siggi] to hack into the computer of an individual former associated with WikiLeaks and delete chat logs containing statements of ASSANGE. When Teenager asked how that could be done, ASSANGE wrote that the former WikiLeaks associate could “be fooled into downloading a trojan,” referring to malicious software, and then asked Teenager what operating system the former-WikiLeaks associate used.

I’ve heard allegations from the entire period of WikiLeaks’ prominence of Assange asking to spy on one or another partner or former partner, including protected entities. One relatively recent allegation I know of targeted a former WikiLeaks associate in 2016, after a break on election-related issues. I have no idea whether these allegations are credible (and I know of none who would involve law enforcement). But allegations that Assange considered — or did — spy on his allies undercuts his claim to being a journalist as much as anything else he does. It also raises questions about what WikiLeaks did with the unpublished Vault 7 files.

Update: Dell Cameron, who is the expert on the Stratfor hack, lays out some apparently big holes in the parts of the indictment that pertain to that.

The Other Things the Press Missed by Ignoring the Details Revealed in the Joshua Schulte Prosecution

/6 Comments/in , /by

The WaPo got a copy of the WikiLeaks Task Force report introduced as evidence in the Joshua Schulte from Ron Wyden’s office and so, four months after it was first made public, is declaring the scathing report “news”. (Note, WaPo does not reveal that InnerCity Press made this report public months ago after fighting for its release.)

If the report is news it’s a testament to all the news from the trial that didn’t get reported

The report is scathing. But it describes what any news outlet that covered the trial closely would have reported in real time (as well as the evidence that one after another Schulte denial had been contradicted by evidence submitted at trial), and as such is a confession that besides some passing coverage, few national security journalists did cover this trial and all its alarming disclosures.

The trial showed that Schulte tried to make sure 1TB of data got transferred properly in early May 2017 and then wiped two TB disk drives; this report from early in the investigation assesses that Schulte stole “at least 180 gigabytes to as much as 34 terabytes of information,” something CIA later got more certainty about. The government provided evidence that Schulte inserted outside CDs and thumb drives into his CIA workstation, made a copy of a months-old backup file, and set an Admin password for the files he is accused of stealing, which is why the report focuses so closely on the findings that, “users shared systems administrator-level passwords, there were no effective removable media controls, and historical data was available to users indefinitely.”

The report was published on October 17, 2017, weeks before WikiLeaks published the source code for Hive on November 9, 2017, making this claim (though not necessarily the assessment that Schulte didn’t get the “Gold File”) out of date:

To date, WikiLeaks has released user and training guides and limited source code from two parts of DevLAN: Stash, a source code repository, and Confluence, a collaboration and communication platform. All of the documents reveal, to varying degrees, CIA’s tradecraft in cyber operations.

The trial showed that everyone from Schulte’s colleagues to then-CIA Executive Director Meroe Park had concerns about Schulte’s reliability, but none put him on leave or successfully cut off his access to the vulnerable systems, which makes this passage seem like a breathtaking understatement.

We failed to recognize or act in a coordinated fashion on warning signs that a person or persons with access to CIA classified information posed an unacceptable risk to national security.

The trial also showed that the CIA waited almost two years after this report to put “Michael,” Schulte’s CIA buddy who testified to seeing him stealing files in real time, on paid leave, making it clear they didn’t address this issue even though it appeared in the report.

The report also doesn’t include unredacted descriptions of how the leak led all of CIA’s hack-based spying to grind to a halt, such as that offered by Sean Roche, who had been Deputy Director of the Directorate for Digital Innovation.

Our capabilities were revealed, and hence, we were not able to operate and our — the capabilities we had been developing for years that were now described in public were decimated. Our operations were immediately at risk, and we began terminating operations; that is, operations that were enabled with tools that were now described and out there and capabilities that were described, information about operations where we’re providing streams of information. It immediately undermined the relationships we had with other parts of the government as well as with vital foreign partners, who had often put themselves at risk to assist the agency. And it put our officers and our facilities, both domestically and overseas, at risk.

[snip]

Because operations were involved we had to get a team together that did nothing but focus on three things, in this priority order. In an emergency, and that’s what we had, it was operate, navigate, communicate, in that order. So the first job was to assess the risk posture for all of these operations across the world and figure out how to mitigate that risk, and most often, the vast, vast majority we had to back out of those operations, shut them down and create a situation where the agency’s activities would not be revealed, because we are a clandestine agency.

Nor does the October 2017 report include details about the exploits — such as that these tools were USB drives that NOCs and/or assets would stick into target computer systems, making it likely the leak endangered people who had used the tools — that provide some idea of the kinds of damage the leak did.

Schulte claims the “classified” information on his server consisted of Snowden documents

Meanwhile, there have been several updates in the government’s attempt to retry Schulte.

First, on May 21, the court docketed a hand-written letter from Schulte to Judge Paul Crotty, dated April 12. In it, he claimed He had no counsel,” which is confusing because he has appeared in court subsequent to the letter and its posting with the same trial team (though in a recent filing, his lawyers said Steve Bellovin may not be available to serve as expert in his retrial). Based on his claim to have no lawyers, he asked for access to a bunch of things withheld in discovery, a number of which are things his lawyers had tried but failed to obtain already. That includes his own server, which (according to Schulte, who has proven utterly unreliable) the government withheld because it held “classified” information consisting of the publicly released Snowden files.

The claim is interesting in any case. If Schulte viewed the files while still at CIA, it would be a violation of the government’s ridiculous claims that clearance holders could not view those files without violating their clearance. It’s also interesting given Schulte’s claims, to colleagues, that Snowden should be executed, even while saying elsewhere that Snowden didn’t harm anyone.

The government floated — and then did not fully develop (possibly as part of an agreement to avoid a subpoena to Mike Pompeo) a theory about Schulte’s ties to other leaks, including Snowden’s. That makes the fact they’re still sitting on these files far more interesting. (Schulte used the reports about the hacking of Angela Merkel in his defense.)

DOJ’s superseding indictment tries to make the retrial easier to win

Then there are the circumstances surrounding a third superseding indictment obtained against Schulte on June 8 (which the WaPo notes but doesn’t explain). As the government had explained, they got the indictment to make the specific allegations more clear for the jury than the second indictment, which was released before CIA had declassified the things used at trial.

These counts are based on the same conduct that was at issue during the February trial, namely, the defendant’s theft and transmission of the Backup Files, his destruction of log files and other forensic data on DEVLAN in the course of committing that theft, his obstruction of the investigation into the leak of the Backup Files, and his transmission and attempted transmission of national defense information while detained at the MCC. The modifications in the Proposed Indictment, however, are intended to make clear what conduct is covered in the specific counts. Thus, the Proposed Indictment (i) contains two separate § 793(e) counts related to (1) the defendant’s transmission of writings containing national defense information from the MCC and (2) the defendant’s attempted transmission of writings containing national defense information from the MCC, whereas the S2 Indictment grouped that conduct together in a single count; (ii) clarifies that all the § 793(e) counts, pertaining both to the transmission of the Backup Files and the defendant’s conduct in the MCC, charge the transmission of documents and writings, which does not require proof that the defendant had reason to believe the information therein could be used to harm the United States; (iii) contains two separate § 1030(a)(5)(A) counts specifying that the charged harmful computer commands at issue are (1) the defendant’s manipulation of the Confluence virtual server and (2) the defendant’s log deletions, whereas the S2 Indictment grouped that conduct together in a single count; and (iv) lists the false statements underlying the obstruction charge, which had previously been identified for the defendant in a bill of particulars, whereas the S2 Indictment did not do so.

Here’s a table that shows the difference between the second superseding indictment and the new one.

The government had dropped Count Two during the trial to make it clear that Schulte was exceeding his access when he stole the files he allegedly sent to WikiLeaks. And Schulte had challenged the 641 charge on legal grounds, which explains the dropped charges (marked in black). Jury questions had made it clear that jurors were fighting over what Schulte leaked and tried to leak from jail, and couldn’t agree upon whether Schulte’s various manipulations of the backup servers amounted to a crime. By turning each into two charges, the government not only tells the jury precisely what to look for, but might even get prosecutors to focus on describing why the forensics prove the crime rather than describing the CIA’s personnel disputes. In other words, this superseding indictment is an effort to make it more likely Schulte will be found guilty for the actions described at trial.

Meanwhile, whereas elsewhere the new indictment aims to make things more explicit for the jury, the new one does not mention two things that were laid out in the bill of particulars laying out his false statements and obstruction in the second indictment: any reference to the Brutal Kangaroo tool that Schulte was working on at home and then may have brought back into work, and a discussion of a proffer session that took place on November 16, 2017 where Schulte falsely claimed to have been approached by an unknown male on the way to a court appearance. The government dropped the latter before Schulte’s trial. As to the former, it’s unclear whether the government has decided Brutal Kangaroo (which might have been used to help steal the files or unknown follow-up ones) is too sensitive to explain, or whether they want to make the obstruction charges more generalized.

Now that a bunch of journalists have effectively confessed they missed all this in real time, maybe they’ll finally get around to explaining why the government is having to revamp their charges to try they guy the CIA claims burned their hacking ability to the ground, which seems as newsworthy as this out-of-date, already published report.

Schulte doesn’t want a suburban jury

Nothing the government has done, however, will prevent jury nullification, which appears to have been a key factor in the first trial. Given the notes from the jury, at least two jurors seemed to be unwilling consider fairly clear evidence, and one of them hid that she had outside knowledge (comments she made publicly after she was dismissed suggested she believed Schulte’s claims that the government was using child porn to frame him for this leak).

Ultimately, prosecutors are going to have to explain to a NY jury why they should care that the CIA department in charge of hacking everyone else got hacked itself, all while Schulte’s lawyers make claims about what CIA does when it hacks that the CIA is not about to rebut publicly.

Which may explain why Schulte is preparing to challenge the circumstances of the most recent indictment. The grand jury on the most recent indictment is a White Plains one, not a Manhattan one.

The unusual circumstances of the S3 indictment—the grand jury was sitting in White Plains as opposed to Manhattan, and most members of the public in the Southern District of New York were still under a stay-at-home order—may have compromised the defendant’s right to a grand jury selected from a fair cross-section of the community. Accordingly, through this letter-motion and the accompanying declaration of statistician Jeffrey Martin, Mr. Schulte respectfully requests access to the records and papers used in connection with the constitution of the Master and Qualified Jury Wheels in the United States District Court for the Southern District of New York, pursuant to the Fifth and Sixth Amendments to the United States Constitution and the Jury Selection and Service Act (“JSSA”), 28 U.S.C. § 1867(a) and (f).

While this motion to get records of how this jury was chosen may not lead to a challenge, ultimately, he seems prepared to argue that the pandemic prevented him from being tried by a jury of his peers. And that’s happening all while he’s refusing (as is his right) to toll Speedy Trial rights during the pandemic. (Plus, I’m not sure prosecutors are being very attentive to excluding the time that the defense itself has asked for.)

The press is only now waking up to what the trial (and the prior court filings) has shown. Perhaps now that they’ve tuned in they’ll bother to explain why the guy who allegedly burned the CIA to the ground may well get off on all his Espionage and hacking related charges?

Prosecutors Have Discovered the Joshua Schulte Is a Hack-and-Leak Case, Not a Personnel Dispute

/5 Comments/in , /by

While I’ve been buried in the Mike Flynn beat, on Monday, there was a status hearing in the Joshua Schulte case.

There were three main news items in the hearing.

First, prosecutors revealed unsurprisingly that they’re going retry Schulte. More interesting, they said they planned to supersede the indictment against Schulte, alleging the same charges, but providing more information on them. They cited the notes from jurors, which made it crystal clear that the jurors were confused by the forensic testimony and how the charges related to that testimony. What the limits of Schulte’s legal access were seemed to be particularly confusing (something that is not sufficiently clear in the law anyway). At the time of both the initial Espionage indictment and the superseding one, the CIA was still trying to keep secret specifically what had been stolen when and how, but now that that’s public. I expect the superseding indictment to explain more clearly what was stolen and how Schulte allegedly exceeded his legal accesses to do that.

In discussions around that superseding indictment, prosecutor David Denton said something to the effect that grand juries are only available in emergencies. As far as the public record goes, however, grand juries aren’t available at all, so Denton’s disclosure was news. That only matters in the Schulte case insofar as he’s going to refuse most Speedy Trial exclusions (meaning prosecutors may be forced to find some way to start a new trial before COVID lockdowns end). But it’s an interesting admission more generally.

Finally, prosecutors said they didn’t think the retrial will take as long as his initial trial. In my summary of why the prosecution was in a remarkably weak position as the last trial went to the jury, I described how prosecutors had made it look like the Vault 7 breach was just a really nasty personnel dispute to which burning the CIA’s hacking abilities to the ground was just a side dispute.

Add that to the pace of the trial, which feels like a nasty employment dispute to which the massive breach of the CIA’s hacking tools became just a side-dispute. That’s often true of CIA trials — it certainly was for Jeffrey Sterling. But the long parade of CIA witnesses — Schulte’s buddy, two other colleagues, his boss, his boss’s boss, his boss’s boss’s boss, her boss, and then yet another boss, plus a CIA SysAdmin and a security guy — all describing a series of disputes escalating from a nerf gun fight to WikiLeaks burning the CIA’s hacking capabilities to the ground refocused the trial onto whether Schulte’s complaints had merit and not on what the forensic evidence showed.

And Sabrina Shroff did a superb job of defending not the forensic case (indeed, defense expert Steve Bellovin did not take the stand to float any of the alternate theories that Schulte has been offering for two years, and in so doing will leave Shroff to claim Michael could have accessed the backup without prosecutors having gotten him to admit that wouldn’t have worked), but instead arguing that her client was maligned by the entire CIA. The boss, the boss’s boss, the boss’s boss’s boss, the boss’s boss’s boss’s boss, and then the senior-most boss are all lined up against Schulte for being an asshole. She even defused utterly damning notes about working with Russia (which I’ll return to). From the transcripts, it seemed like Shroff rattled a good many government witnesses, too, and a number of them (one of the FBI agents and the classification expert, especially) seemed to come off as unresponsive as a result.

I expect prosecutors will shorten the trial by limiting this testimony to just the four or so people who have first-hand knowledge of Schulte’s actions (and in the retrial, the government won’t have to backpedal as they try to fix their late disclosure that Schulte’s buddy Michael had been put on paid leave by the CIA). If so, that should make it easier for prosecutors to focus on why the circumstantial forensic evidence strongly supports Schulte’s involvement.

All that said, prosecutors also seemed to be fighting jury nullification in Schulte’s trial, with at least two jurors who were determined to acquit Schulte no matter what other jurors said. That may be a WikiLeaks thing (one that would be far less likely to happen if this were tried in EDVA, which is why Julian Assange says he can’t get a fair trial in EDVA). But it also may be the case that CIA’s hacking department doesn’t make a very sympathetic hacking victim.

“ur submission form is too fucking slow, spent the whole day uploading 1 gb.”

/12 Comments/in , , /by

As I noted, one of the Roger Stone-related warrant applications released last week includes more details on the communications between the Guccifer 2.0 persona and WikiLeaks leading up to the DNC release. Emma Best examines the filing from a perspective of how someone, purportedly with no prior relationship to WikiLeaks, would go about transferring even a marginally significant submission to WikiLeaks. Almost a month of back-and-forth transpires between the first contact with Guccifer 2.0 and the successful transfer of the DNC files.

A key exchange, however, happened on July 6, 2016. After Guccifer 2.0 inquires whether WikiLeaks received some documents Guccifer 2.0 sent, the persona gets cranky because it took so long to upload a 1 GB file to WikiLeaks submission system. [I’m using Best’s conversion of this filing into a nifty transcription.]

Guccifer 2.0: “fuck, [I] sent 4 docs on brexit on jun 29, an archive in gpg[.] ur submission form is too fucking slow, [I] spent the whole day uploading 1 gb”

WikiLeaks: “We can arrange servers l00x as fast. The speed restrictions are to anonymise the path. Just ask for custom fast upload point in an email.”

Guccifer 2.0: “will u be able to check ur email?”

WikiLeaks: “We’re best with very large data sets. e.g. 200gb. these prove themselves since they’re too big to fake”

Almost two weeks into this exchange, WikiLeaks says they can arrange for a custom server to transfer larger data sets — of around 200 GB.

These exchanges should, to a significant extent, be considered theater. Both sides of this conversation knew that the FBI would be watching all DMs between WikiLeaks and the Guccifer 2.0 persona. So it can’t be taken as a definitive indication of how any files get sent.

Still, it shows how WikiLeaks would respond, using the public communication accounts, to a request to submit data in July 2016.

That’s significant because it shows how things might have proceeded, two months earlier, when Joshua Schulte allegedly sent 1TB of data to WikiLeaks on May 1, 2016.

While the prosecution in Schulte’s case provided forensic evidence to explain when he stole the CIA files and sent them to WikiLeaks, key gaps remain (perhaps most notably, how he got the files out of his building, though that may be because of certain classification decisions). And because Schulte used Tails and wiped his devices afterwards, there’s no record of him actually sending the files.

Here’s how prosecutor Matthew Laroche described that process in his closing arguments.

Just as a general matter, you know this information was transmitted to WikiLeaks because they posted it on the internet. They obviously got it, and the question is when did he send it?

And that’s answered by what he did on the 30th and May 1. Let’s look at the evening of the 30th.

At 6:47 p.m., he is searching for Google history and Google view browsing history. He is concerned about what he’s been searching for. On the evening, that night, he is searching for digital disk-wipe utility on several occasions, and at 10:52 p.m., he visits a website Kill Your Data Dead With These Tips and Tools. The defendant is interested in finding out how to securely delete information that might connect him to the leak, anything that he might’ve brought home with the leak on it, anything that he might’ve used to transfer it.

And at 10:55 p.m., he runs a similar search for SSD wipe utility. And you’ll remember all those hard drives that were recovered from his home. He was wondering how to wipe them to make sure that there was no evidence of his activities.

Now, overnight, he continues working.

At 12:19 a.m., the defendant mounted his D drive onto his virtual machine, the same D drive that had those encrypted files, data2.bkp through data6.bkp. They’re in his D drive. He mounts his D drive.

Then, overnight, he is constantly looking at his computer. On at least four occasions, he is unlocking his virtual machine in the middle of the night: 1:57 a.m.; 2:34 a.m.; 2:56 a.m.; 3:18 a.m. He is doing that because he is transferring data and he wants to make sure it’s happened correctly. And you know that is the case because of the Google searches he runs at of the end the night and the early morning.

At 3:18 a.m., just after he unlocks his screen saver, the defendant searches for How Long Does It Take to Calculate MD5?

Remember, calculating an MD5 is a way to confirm that what you transferred from one place to another is the same, that it went correctly, that there were no errors. You calculate an MD5 to confirm that what you transferred transferred correctly, and that’s what he’s looking for at 3:18 a.m.

Then at 3:21 a.m., the defendant visits a website, How Can I verify That a 1TB File — one terabyte file — transferred correctly?

That description is based off this forensic testimony from Michael Berger.

Prosecutors described this as happening overnight. Overnight transmission of a 1TB file using WikiLeaks’ public submission site would be utterly impossible given the state of it at the time and the volume of data Schulte was transferring, and probably impossible regardless of how much time someone spent. Overnight transmission of 1TB of data using Tails, even to a dedicated server, would be difficult enough. Best describes that, “1 TB over Tor in one night is unlikely.”

The government timeline does have Schulte in possession of the data earlier than that, potentially giving him a week to transfer the data, with this process describing just the end of the process.

Still, the way this would happen, normally, would be for WikiLeaks to set up a dedicated server to accept the files. And that would take prior communication. Such communication likely would have happened over Jabber, not Twitter (Schulte’s opsec was piss poor in many ways but he did use Jabber).

Such a prior conversation is entirely consistent with testimony provided elsewhere, where prosecutors focused on the website’s alternative submission process.

But the seeming necessity for prior communication before this transfer happened suggests Schulte’s alleged theft and transfer of the files might not have been as reactive a decision as portrayed in his prosecution.

It would take premeditation to send WikiLeaks a 1TB file, whatever the timing. Prosecutors may know that, and have an explanation for when such prior communications happened, but they’re withholding those details for any of a number of reasons. Or it may be a big hole in this story. Schulte insists he didn’t do it and a jury failed to convict.

One way or another, however, the state of the WikiLeaks’ submission system as it existed in 2016 presents a big gap in prosecutors’ current story.

Update: Two important details for those trying to figure out how long this transfer would really take. First, Schulte ran a commercial server specifically focused on video streaming at the time, so his upload speeds would not limit the transfer time at all. Second, Schulte at least claimed that hiding data for exfiltration was his speciality. That by itself wouldn’t help him send stuff to WikiLeaks, at least not without prior contact. But it does mean that the means by which he transferred this file relied on tools he has developed at CIA.

On June 24, 2016, WikiLeaks DMed Guccifer 2.0 about Celebrating Brexit

/27 Comments/in , , /by

Among the Roger Stone-related warrants released last night is one, dated November 6, 2017, that obtained the WikiLeaks and Julian Assange Twitter accounts.

On or about June 24, 2016, Guccifer 2.0 wrote to Target Account 1, “How can we chat? Do u have jabber or something like that?” I know from my training and experience that “Jabber” is an instant messaging service. Target Account 1 wrote back, “Yes, we have everything. We’ ve been busy celebrating Brexit. You can also email an encrypted message to [email protected]. They key is here.” 1 A web link was attached to the message. I know from my training and experience that an encryption “key” is a string of information created for scrambling and unscrambling data.

On July 6 — the day when WikiLeaks asked for Hillary materials — Guccifer 2.0 bitched about WikiLeaks’ slow submission process and claimed to have sent Brexit-related documents days earlier.

On or about July 6, 2016, Guccifer 2.0 wrote to Target Account 1, “have u received my parcel?” Target Account 1 responded, “Not unless it was very recent. [we haven’t checked in 24h].”2 Guccifer 2.0 replied, “I sent it yesterday, an archive of about 1 gb. via [website link]. [A]nd check your email.” Target Account 1 wrote back, “Wil[l] check, thanks.” Guccifer 2.0 responded, ” let me know the results.” Target Account 1 wrote back, “Please don’t make anything you send to us public. It’s a lot of work to go through it and the impact is severely reduced if we are not the first to publish.” Guccifer 2.0 replied, “agreed. How much time will it take?” Target Account 1 responded, ” likely sometime today.” Guccifer 2.0 wrote back, “will u announce a publication? and what about 3 docs [I] sent u earlier?” Target Account 1 responded, ” I don’t believe we received them. Nothing on ‘Brexit’ for example.” Guccifer 2.0 wrote back, “wow. have you checked ur mail?” Target Account 1 replied, “At least not as of 4 days ago . . . . For security reasons mail cannot be checked for some hours.” Guccifer 2.0 wrote back, “fuck, [I] sent 4 docs on brexit on jun 29, an archive in gpg[.] ur submission form is too fucking slow, [I] spent the whole day uploading 1 gb.”

Later that day, amid an ongoing discussion about how to best target Clinton, including WikiLeaks’ request for Clinton Foundation documents, Guccifer 2.0 wrote back and claimed to have sent Brexit documents successfully.

On or about that same day, Guccifer 2.0 sent Target Account 1 a message reading, “sent brexit docs successfully.”

The affidavit, as whole, provides more details about how WikiLeaks and Guccifer 2.0 communicated. But it also suggests that, in addition to playing to their mutual loathing for Hillary Clinton, Guccifer 2.0 also tried to appeal to WikiLeaks’ claimed support for Brexit.

Chelsea Manning’s Release May Not Be the End of Her Troubles

/28 Comments/in /by

When I wrote this post noting that Judge Anthony Trenga had ordered Chelsea Manning be released, I admitted, I don’t know what it means. I was hoping that when her lawyers released a statement it would bring more clarity. But that statement — released hours after the release — offered no such clarity (though it does make it clear that right now her focus is on recovering from the suicide attempt and malign effects of incarceration, not any celebration of her freedom). It attributed her release to “the apparent conclusion” of the grand jury.

Judge Anthony Trenga today ordered Chelsea Manning’s release from confinement, after the apparent conclusion of the grand jury to which she had been subpoenaed, and before which she refused to testify. He further ordered that she pay $256,000 in fines which accrued each day she refused to cooperate with the grand jury.

Needless to say we are relieved and ask that you respect her privacy while she gets on her feet.

That tells us no more than Trenga’s opinion revealed and arguably shifts the emphasis from “the business of” the grand jury to the grand jury itself. There’s no reason to believe this grand jury expired (it was understood to be a newly seated one last May, which should mean it would have two more months). Rather, written two days after the grand jury appearance scheduled, Trenga’s opinion says the grand jury is done with whatever it was doing.

That’s one of the reasons I focused so closely on what prosecutors told Jeremy Hammond Tuesday, when he also refused to testify before the grand jury. They asserted that Julian Assange is a Russian spy.

“What could the United States government do that could get you to change your mind and obey the law here? Cause you know” — he basically says — “I know you think you’re doing the honorable thing here, you’re very smart, but Julian Assange, he’s not worth it for you, he’s not worth your sacrifice, you know he’s a Russian spy, you know.”

[snip]

He implied that all options are on the table, they could press for — he didn’t say it directly, but he said they could press for criminal contempt. … Then he implies that you could still look like you disobeyed but we could keep it a secret — “nobody has to know I just want to know about Julian Assange … I don’t know why you’re defending this guy, he’s a Russian spy. He fucking helped Trump win the election.”

Amid suggestions that prosecutors were considering further legal means against Hammond, one of them used the example of Bartleby the Scrivener — whose example Hammond had followed in the grand jury in preferring not to answer questions — to remind that refusing to answer questions led Bartleby to die in prison.

Let me be clear, I’m not saying I agree with that observation, nor am I ceding that prosecutors definitely have proof that Assange is a Russian spy. But unless you believe that Hammond entirely made up these two exchanges, then everyone on all sides of the WikiLeaks divide would do well to take note of it. Julian Assange’s prosecutors are asserting to a witness that he is a Russian spy, which is far more than they’ve put into any indictment, yet.

Hammond suggested that when prosecutors “implied that all options are on the table,” he took that to mean he might be held in criminal contempt. Manning’s camp was expressing similar concerns before the grand jury appointment on Tuesday, that they believed the government might respond to her bid to be released by ratcheting up her legal exposure. But if prosecutors really do believe Assange is a Russian spy, it would give them tools far beyond criminal contempt.

It is a crime by itself in the US to refuse to tell authorities about espionage. As Ron Wyden’s bill to fix the Espionage Act makes clear, prosecutors can charge someone under the Espionage Act for conspiracy, aiding and abetting, accessory after the fact, or misprision of a felony. Misprision is effectively not telling a court or other authority about what you know as soon as possible.

Whoever, having knowledge of the actual commission of a felony cognizable by a court of the United States, conceals and does not as soon as possible make known the same to some judge or other person in civil or military authority under the United States, shall be fined under this title or imprisoned not more than three years

And under the Espionage Act statute Assange has already been charged under as well as 18 USC § 794 (sharing defense information with a foreign government like Russia), such conspiracy language exposes the person found conspiring not to just three years, but to the same punishments as the person himself. If Julian Assange shared with Russia some of the information Manning shared with him, for example, that may expose her for his acts.

This is why I focused so intently on the language that prosecutors in the Joshua Schulte case were using, treating WikiLeaks as a criminal organization. If the federal government currently conceives of WikiLeaks in these terms, it means Hammond and Manning’s silence may expose them far more than they or their current advisors seem to be envisioning. And that was based off language describing WikiLeaks like an organized crime entity, not someone led by (as prosecutors claimed the other day) a Russian spy.

Again, I am not defending this stance. I’m not saying I agree with it. I’m making an observation that people on all sides of the WikiLeaks divide — but especially those caught in the spell of the lies that Assange’s people are telling to combat extradition — would do well to note.

The government is using language that is far, far more serious than virtually anyone seems to be accounting for, including Manning and Hammond. Prosecutors may well have been blowing smoke to try to cow Hammond into cooperating. Or they may have been putting Hammond on notice of the stakes he was facing.

Chelsea Manning Released from Jail … with a Massive Fine

/18 Comments/in /by

Judge Anthony Trenga just ordered Chelsea Manning released from jail, a day before her attempt to be released based off a claim that coercion would never get her to testify.

Trenga declared that motion moot, though. The reason he released her is because the work of the grand jury has finished.

By Order dated March 12, 2020, after finding that the business of Grand Jury 19-3 had concluded, the Court dismissed Grand Jury 19-3.

Upon consideration of the Court’s May 16, 2019 Order, the Motion, and the Court’s March 12, 2020 Order discharging Grand Jury 19-3, the Court finds that Ms. Manning’s appearance before the Grand Jury is no longer needed, in light of which her detention no longer serves any coercive purpose. The Court further finds that enforcement of the accrued, conditional fines would not be punitive but rather necessary to the coercive purpose of the Court’s civil contempt order.

Her total fine amounts to $256,000.

I have no idea, yet, what this means. But I’m glad she has been released.

Update: Jeremy Hammond has also been released back to federal prison.

 

Hours before She Attempted to Kill Herself, Prosecutors May Have Told Chelsea Manning that Julian Assange Is a Russian Spy

/33 Comments/in , , /by

Back when the government first subpoenaed Chelsea Manning, I laid out why that was likely to be counterproductive.

[U]nless there’s a really good legal reason for the government to pursue its own of evolving theory of WikiLeaks’ activities, it doesn’t make sense to rush where former WikiLeaks supporters are headed on their own. In virtually all venues, activists’ reversed understanding of WikiLeaks is bound to have more credibility (and almost certainly more nuanced understanding) than anything the government can offer. Indeed, that would likely be especially true, internationally, in discussions of Assange’s asylum claim.

A charge against Assange in conjunction with Vault 7 or the 2016 election operation might accelerate that process, without foreclosing the government’s opportunity to present any evolved understanding of WikiLeaks’ role in the future (especially if tied to conspiracy charges including the 2016 and 2017 activities).

But getting into a subpoena fight with Chelsea Manning is likely to have the opposite effect.

That’s true, in part, because post-commutation a lot of people worry about the impact renewed pressure from the government against Manning will have, regardless of the legal soundness of it. The government wanted Aaron Swartz to become an informant when they ratcheted up the pressure on him between 2011 and 2013. They didn’t get that information. And his suicide has become a key symbol of the reasons to distrust law enforcement and its ham-handed legal tactics.

Yesterday, Manning tried to kill herself. While the statement released by her lawyers notes that she has a hearing tomorrow on whether she should be freed because no amount of coercion will make her cooperate with the grand jury, the statement is silent about the fact that she was brought before the grand jury yesterday, hours before the suicide attempt.

I know of no account of what happened in that grand jury appearance. But Jeremy Hammond was also brought before the grand jury in advance of a hearing, also on Friday, in a bid to be freed (in Hammond’s case, he’d be released back into federal prison to serve out his sentence for hacking Stratfor). He gave an account of the appearance in an interview yesterday (the part about the grand jury starts after 41:20). Hammond described how, before entering the grand jury, the prosecutor asked whether there was anything the government could do to get him to change his mind about not testifying.

“What could the United States government do that could get you to change your mind and obey the law here? Cause you know” — he basically says — “I know you think you’re doing the honorable thing here, you’re very smart, but Julian Assange, he’s not worth it for you, he’s not worth your sacrifice, you know he’s a Russian spy, you know.”

The questions he was asked in the grand jury were apparently no surprise: the prosecutor asked whether Assange asked Hammond to hack any websites. Hammond describes the questions as the same as were asked in his last appearance, in September. Because Hammond decided to answer in the same way Bartleby the Scrivener answered questions — by saying he preferred not to answer — the prosecutor afterwards tried to chat up Hammond about world literature. He even reminded that Bartleby died in prison. The prosecutor then repeated that Assange is a Russian spy.

He implied that all options are on the table, they could press for — he didn’t say it directly, but he said they could press for criminal contempt. … Then he implies that you could still look like you disobeyed but we could keep it a secret — “nobody has to know I just want to know about Julian Assange … I don’t know why you’re defending this guy, he’s a Russian spy. He fucking helped Trump win the election.”

Hammond asked why Assange wasn’t charged in the 2016 operation, and the prosecutor appears to have responded that the extradition would take a long time. One of the prosecutors reminded Hammond that one of his Anonymous co-defendants was now a professor in the UK. One asked whether Hammond would discuss Sabu, which surprised him. Hammond said that Sabu was the only one who asked him to hack into any websites. The FBI officer in the room pulled out a notebook and started taking notes.

There’s no indication that prosecutors said the same things to Manning as they did to Hammond, though this is the same grand jury and same prosecutors and both are obviously being asked about Assange.

Which means it is likely that hours before Manning attempted to kill herself, prosecutors tried to get her to answer questions about the man she sent entire databases of secrets to by claiming he is a Russian spy. They may well now have evidence of that — but if they used that tack, they were basically asking Manning to testify that the understanding she has of her own actions are entirely wrong and that the sacrifices she made were for a purpose other than the one she believed in.

Sadly, if Hammond is any indication, Manning is also getting a distorted view of the extradition fight over Assange. As I have noted, WikiLeaks supporters are telling at least three outright lies by:

  • Pretending that discussions of a pardon only started in August 2017, in exchange for testimony claiming that Russia didn’t hack the DNC, rather than started well before the FBI investigation into Trump’s campaign was public, as either an implicit or explicit payoff for election assistance
  • Claiming that Mike Pompeo’s designation of WikiLeaks as a non-state hostile intelligence agency was part of the larger attack on the press that formally started four months afterwards and presenting his claim that the First Amendment doesn’t protect someone stealing American secrets solely to destroy America out of context
  • Distorting the timing of UC Global’s increased surveillance of Assange to hide that it followed the Vault 7 publication

These are cynical, transparent lies being spread by a bunch of people claiming to support journalism. Probably, WikiLeaks supporters are also lying about how Assange repeatedly got tipped off to prosecutorial steps against him, presenting that as proof of Trump’s hostility against Assange.

Earlier in yesterday’s interview, Hammond adopted the distorted claim about Pompeo as “proof” that Assange’s prosecution is political and also that Trump has hostility to the guy who helped him get elected. I doubt whether having an accurate understanding of this would have changed Hammond’s decision not to testify, but he does, apparently, believe the lies.

And I doubt whatever prosecutors told Manning yesterday was the sole cause of yesterday’s attempt. Her attorneys had tried unsuccessfully to prevent yesterday’s testimony, which doesn’t make sense in the context of this week’s hearing unless they believed that even appearing before the grand jury would cause Manning a great deal of stress.

I have no idea what Assange’s relationship with Russia is — that’s presumably the entire point of the grand jury. There’s no doubt there were Russians in chat rooms where the Stratfor hack happened and that Assange was in discussions during the hacks. Obviously, Assange played a key role in the 2016 Russian operation as well as efforts after the fact to invent hoaxes to disclaim Russian involvement. And Joshua Schulte expressed (sometimes contradictory) willingness to seek Russian help after he allegedly sent CIA’s hacking tools to WikiLeaks.

But making such claims amid the stress of a grand jury appearance — if they, in fact, did so — isn’t going to help someone who has a history of self-harm.

King Josh in Jail, Part One: The Informant

/14 Comments/in , /by

The testimony on accused Vault 7 leaker Joshua Schulte’s conduct in MCC raised more questions than answers. So I want to do a series of three or four posts to look more closely at it (I’m using the term “King Josh” because it was one of his passwords at the CIA).

In this post I want to look at the jail house informant who is the publicly acknowledged basis by which prosecutors discovered that Schulte had a phone in jail, Carlos Bentances Luna Mera.

Betances is a 41 year old citizen of the Dominican Republic who twice migrated to the US without documentation, the first time in 1996 (he was deported in 2001), and then again around 2008. At some point, Betances married and had children. During both periods, he began to work as a low level cog in narcotics trafficking.

Betances was arrested on March 15, 2018 in conjunction with the trafficking. The only federal complaint unsealed in the docket is for illegal reentry, and in that magistrates docket, proceedings were continued in both April and May 2018, something that would happen if Betances were forgoing indictment and moving directly to a plea. Given his testimony, there must be a sealed criminal docket showing a guilty plea on nine counts covering multiple narcotics trafficking and conspiracy counts, illegal reentry, identity fraud, mail fraud, and taking a phone into jail.

That suggests that Betances flipped almost immediately, perhaps, at first, to cooperate against his network of suppliers. That’s consistent with an answer Betances gave when Schulte’s lawyer, Sabrina Shroff, suggested that cooperation on using a phone in jail, “was the most valuable to the government,” more than on all his narcotics charges. Betances responded, “Well, may I remind you that I had been cooperating before I talked to them?”

According to the testimony, Betances didn’t start spying on Schulte until sometime in summer 2018, at least four months after he was jailed, and didn’t first meet with prosecutors until September 2018. So the public story is that Betances got busted and flipped, managed to play a role in smuggling and hiding phones in jail that put him in a key spot to interact with Schulte and his cellmate, Omar Amanat (I’ll look at Amanat and his brother in the next post), and only after that happened witnessed something that led him to start taking pictures and videos of Schulte’s phone use. That went on for maybe a month before — aware that something big was going to go down in the library — Betances sent a note to the guards, who thwarted it. Some days later, Schulte was thrown in the SHU and a big hunt started for the phones and Schulte’s other activities in jail.

That thing that led Betances to prepare to inform on Schulte (again, per the testimony) is that one day sometime in the summer, Schulte said he wanted Russia’s help.

[W]e were in Chino’s cell [Chino was also part of the cell phone smuggling and sharing network] and I heard Josh saying that Russia had to help in in the things that he was doing.

Here’s how Betances described it on cross (through a translator) to a very dubious Sabrina Shroff:

Shroff: So anyway, it’s you who walks in when Mr. Schulte and Omar are talking, correct?

Betances: Yes, correct.

Shroff: And you walk in to give them a heads-up that somebody’s coming, correct?

Betances: Yes, correct.

Shroff: And just as you walk in, you hear him say the word “Russia,” correct?

Betances: That’s correct, yes.

Shroff: And that’s what prompts fear into you to go cooperate with the United States Attorney’s Office?

Betances: It sounded interesting to me.

Shroff: Right.

Hearing Schulte mention Russia led Betances to do a remarkable amount of surveillance on Schulte’s phones, which he stored for him behind his cell locker.

He took two pictures of the apps Schulte loaded onto the phone, and — per his testimony — got Schulte and Amanat to explain the function of WhatsApp, Signal, Proton Mail, Orbot, Turbo VPN, and Secure Delete. Betances also got pictures of the things Schulte was writing on his phone, including the initial emails to Shane Harris that would form part of the basis for the Espionage Act charges on which the jury was hung.

He took several videos of Schulte using his phone.

After having taken these pictures on September 1, Betances waited around three weeks before he alerted the guards that something big was going down in the library, and then was removed from MCC when guards found at least some of these phones in his cell.

Shroff: And before you decided to cooperate, you simply decided to take photos, is that your testimony?

Betances: Just to be clear with the defense attorney’s question in deciding to cooperate, when they were working on sending whatever they were going to send from the library, that’s when I decided to cooperate.

Shroff: My only question was when did you take this photograph?

Betances: In the summer of 2018.

Shroff: Right. Months before you’re now saying that you decided to cooperate, right?

Betances: Could you repeat that question? You confused me.

Shroff: You took the photo before you decided to cooperate, according to you, correct?

Betances: Yes, yes.

Shroff: Right. And you’re saying you just decided to take these photos for no reason at all, right?

Betances: May I remind you that the reason I took it was because I head the conversation that I heard?

According to his testimony on redirect, Betances did all this without government instruction.

Karamarju: Now, all of the photographs that you testified about, did the government tell you to take any of those photographs?

Betances: No.

The remarkable coincidence that a jailhouse informant would end up first smuggling in and then guarding her client’s illegal phones and then taking pictures from them is not the only thing Shroff was skeptical about. She also doubted the circumstances by which Betances exposed his wife to the risk of smuggling phones into jail as well as his ability — with little English — to figure out what Schulte was doing, to the extent he did.

Still, all that is explicable if Betances’ attorney negotiated a plea deal with narcotics prosecutors and the attorney coached Betances through how to dramatically increase the value of his cooperation by catching Joshua Schulte attempting to leak classified information from his jail cell.

Betances’ surveillance was critical to obtaining the jail warrants that would lead to the discovery of Schulte’s very damning prison notebooks, several phones, three of the Proton Mail accounts he was using, and his Signal traffic. And that’s just what prosecutors revealed in this case.

Betances met with prosecutors in Schulte’s case a bunch of times: first in September 2018, then October and December 2018, several times in 2019, and then perhaps five times in 2019.

None of that means Betances made this stuff up. He certainly doesn’t have the English skills to write those emails to Shane Harris. And while the evidence regarding Schulte’s comments about Russia are contradictory, there is corroboration for it.

But it does present a number of remarkable coincidences that just ended up providing Schulte the means to communicate “securely” from his jail cell, only to have that activity thwarted at the moment he attempted to act.

image_print