The Universe of Hacked and Leaked Emails from 2016: Podesta Emails

/12 Comments/in , , , /by

When Mueller’s team released George Papadopoulos’ plea deal last year, I noted that the initial denials that Papadopoulos had advance warning of the emails the Russians were preparing to hack and leak did not account for the entire universe of emails known to have been stolen. A year and several Mueller indictments later, we still don’t have a complete understanding of what emails were being dealt when. Because that lack of understanding hinders understanding what Mueller might be doing with Roger Stone, I wanted to lay out what we know about four sets of emails. This series will include posts on the following:

  • DNC emails
  • Podesta emails
  • DCCC emails
  • Emails Hillary deleted from her server

The series won’t, however, account for two more sets of emails, anything APT 29 stole when hacking the White House and State Department starting in 2015, or anything released via the several FOIAs of the Hillary emails turned over to the State Department from her home server. It also won’t deal with the following:

  • Emails from two Hillary staffers who had their emails released via dcleaks
  • The emails of other people released by dcleaks, which includes Colin Powell, some local Republican parties (including some 2015 emails Peter Smith sent to the IL Republican party), and others with interests in Ukraine
  • A copy of the Democrats’ analytics program copied on AWS
  • The NGP/VAN file, which was not directly released by Guccifer 2.0, but is central to one of the skeptics’ theories about an alternative source other than Russia

Meuller remains coy about how the Podesta emails were released by WikiLeaks

My post on the DNC emails noted some timing curiosities about when and how the DNC emails got shared with WikiLeaks.

The curiosities about the Podesta emails, however, are far more important for questions about Roger Stone’s knowledge of the process.

As a number of people have observed, while Mueller’s GRU indictment provides extensive details describing how Podesta was hacked and showing that the infrastructure to hack him was used for other parts of the operation, the indictment is far more coy about how the Podesta emails got to WikiLeaks.

In or around 2016, LUKASHEV sent spearphishing emails to members of the Clinton Campaign and affiliated individuals, including the chairman of the Clinton Campaign.

[snip]

For example, on or about March 19, 2016, LUKASHEV and his co-conspirators created and sent a spearphishing email to the chairman of the Clinton Campaign. LUKASHEV used the account “john356gh” at an online service that abbreviated lengthy website addresses (referred to as a “URL-shortening service”). LUKASHEV used the account to mask a link contained in the spearphishing email, which directed the recipient to a GRU-created website. LUKASHEV altered the appearance of the sender email address in order to make it look like the email was a security notification from Google (a technique known as “spoofing”), instructing the user to change his password by clicking the embedded link. Those instructions were followed. On or about March 21, 2016, LUKASHEV, YERMAKOV, and their co-conspirators stole the contents of the chairman’s email account, which consisted of over 50,000 emails.

[snip]

The funds used to pay for the dcleaks.com domain originated from an account at an online cryptocurrency service that the Conspirators also used to fund the lease of a virtual private server registered with the operational email account [email protected]. The dirbinsaabol email account was also used to register the john356gh URL-shortening account used by LUKASHEV to spearphish the Clinton Campaign chairman and other campaign-related individuals.

[snip]

On or about October 7, 2016, Organization 1 released the first set of emails from the chairman of the Clinton Campaign that had been stolen by LUKASHEV and his co-conspirators. Between on or about October 7, 2016 and November 7, 2016, Organization 1 released approximately thirty-three tranches of documents that had been stolen from the chairman of the Clinton Campaign. In total, over 50,000 stolen documents were released.

Mueller’s silence, thus far, about how the Podesta emails got shared with WikiLeaks is intriguing for several reasons, even aside from the fact that (as noted in the last post) the first documents Guccifer 2.0 shared were billed as DNC emails but (as far as have been identified) are actually Podesta ones. Perhaps Mueller doesn’t know how those emails were passed on. Perhaps the sources and methods by which the FBI learned about how they were shared are too sensitive to put in an indictment. Perhaps Mueller has reserved that story for a later indictment.

The August to September timing on receipt of the emails

The publicly known timing is no more clear.

The Roger Stone tweet on which suspicions of advance knowledge of WikiLeaks’ releases rest — warning “Trust me, it will soon [sic] the Podesta’s time in the barrel” — is dated August 21, 2016.

That date is significant, because it’s not at all clear WikiLeaks had the Podesta emails by that point (and if so, may have just obtained them).

Raffi Khatchadourian cites a WikiLeaks staffer saying they received the emails in “late summer” but also points to an August 24 Fox News interview where Assange described processing “a variety of documents, from different types of institutions that are associated with the election campaign,” which doesn’t necessarily narrow down those emails to Podesta’s.

A pattern that was set in June appeared to recur: just before DCLeaks became active with election publications, WikiLeaks began to prepare another tranche of e-mails, this time culled from John Podesta’s Gmail account. “We are working around the clock,” Assange told Fox News in late August. “We have received quite a lot of material.” It is unclear how long Assange had been in possession of the e-mails, but a staffer assigned to the project suggested that he had received them in the late summer: “As soon as we got them, we started working on them, and then we started publishing them. From when we received them to when we published them, it was a real crunch. My only wish is that we had the equivalent from the Republicans.”

As we’ll see later in this series, there was more certainty that by August 24 WikiLeaks had other hacked emails than that they had Podesta’s.

Khatchadourian also notes that the raw files are all dated September 19 and describes Assange “weaponizing” the release of the data a week or two before the files were released starting on October 7.

All of the raw e-mail files that WikiLeaks published from Podesta’s account are dated September 19th, which appears to indicate the day that they were copied or modified for some purpose. Assange told me that in mid-September, a week or two before he began publishing the e-mails, he devised a way to weaponize the information. If his releases followed a predictable pattern, he reasoned, Clinton’s campaign would be able to prepare. So he worked out an algorithm, which he called the Stochastic Terminator, to help staff members select e-mails for each day’s release. He told me that the algorithm was built on a random-number generator, modified by mathematical weights that reflected the pattern of the news cycle in a typical week. By introducing randomness into the process, he hoped to make it impossible for the Clinton war room “to adjust to the problem, to spin, to create antidote news beforehand.”

That timing lines up in interesting ways with the date when retired British diplomat Craig Murray claims he got a handoff of something (he’s never explained precisely what it was, though it sounded like it could be an encryption key) relating to the Podesta emails when he was in DC to attend the Sam Adams Award ceremony on September 25.

All of which suggests significant events relating to the transfer to WikiLeaks and preparation of the Podesta emails happened after the Stone tweet.

Still later, according to a recent WSJ report, Peter Smith indicated that he knew Podesta emails were coming ahead of time (the reporting is not clear whether this was before or after the fact).

The person familiar with Mr. Smith recalled him repeatedly implying that he knew ahead of time about leaks of Mr. Podesta’s emails.

That claim is all the more interesting when you tie it to the email shared with Smith via foldering on October 11, seemingly reflecting happiness about emails already released, which would seem to point to the Podesta emails that started to drop four days earlier.

“[A]n email in the ‘Robert Tyler’ [foldering] account [showing] Mr. Smith obtained $100,000 from at least four financiers as well as a $50,000 contribution from Mr. Smith himself.” The email was dated October 11, 2016 and has the subject line, “Wire Instructions—Clinton Email Reconnaissance Initiative.” It came from someone calling himself “ROB,” describing the funding as supporting “the Washington Scholarship Fund for the Russian students.” The email also notes, “The students are very pleased with the email releases they have seen, and are thrilled with their educational advancement opportunities.”

The email apparently linking the contemporaneous release of the Podesta emails to a future hoped for release of deleted Hillary ones is significant for several reasons. First, it shows that other geriatric rat-fuckers, in addition to Stone, linked the two. The reflection of pleasure with emails on October 11 is significant given that that was the day WikiLeaks released two Podesta emails Smith associate Jerome Corsi and Stone would use to advance an attack on Podesta pertaining to his ties with Joule Unlimited, an attack that the right wing had been pushing since August (and working on since March). The WSJ notes that both Corsi and Charles Ortel (to the latter of whom Stone now ties some of his WikiLeaks claims) were tied to both Smith and Stone, though Stone claims to have been unaware of the Smith effort.

Stone’s three different explanations for his tweet and the import of Joule emails

In this post, I looked in detail at how epically shitty Stone’s current excuse for his August 21 Podesta tweet is. Over time, Stone has basically offered at least three excuses for it.

First he adopted an explanation offered in March 2017 by Jerome Corsi. In that explanation, Corsi basically conflated two efforts: an attack on John Podesta based on his service on the board of Joule Unlimited from 2010 to 2014, and an effort to respond to mid-August reports on Paul Manafort’s corrupt ties to Russia by focusing instead on Tony Podesta.

The Joule attack research was started (per web access dates recorded in this report) two days before Podesta was spearphished, on March 17, and first rolled out publicly in a Steve Bannon-affiliated Government Accountability Insitute report on August 1.  Corsi and Stone resuscitated the attack starting on October 6 (the day before the Podesta emails started coming out), seemingly correctly anticipating the WikiLeaks email releases that Stone and Corsi would use to advance the attack.

The Corsi explanation that Stone once adopted conflated that attack with a report that Corsi did for Stone (starting at PDF 39), which largely projected onto Tony Podesta the corrupt ties to Ukraine and Russia that Paul Manafort had; the report only tangentially focused on John. The date on the Corsi report is August 31, ten days after Stone’s tweet, but Corsi claims he and Stone started it on August 14.

Stone offered a slightly different explanation when he testified under oath to the House Intelligence Committee. There, he generalized the attack on “the Podesta brothers” and attributed his tweet to “early August” discussions about the August 31 Corsi report. In his prepared statement, he made no mention of Joule.

In the wake of Corsi’s interview on September 6 and grand jury appearance on September 21 (in conjunction with which he reportedly shared a bunch of documents that would substantiate when he and Stone were talking about Joule and when about Tony Podesta), Stone changed his tune again, now only admitting publicly for the first time that Charles Ortel forwarded him an email showing James Rosen promising “a massive dump of HRC emails relating to the CF in September,” but also attributing any August 14 interest to something besides Corsi, a Breitbart post that may be this one.

Stone, however, says that the tweet was based on “an August 14th article in Breitbart News by Peter Schweitzer that reported that Tony Podesta was working for the same Ukrainian Political Party that Paul Manafort was being excoriated for,” and that “the Podesta brothers extensive business dealings with the Oligarchs around Putin pertaining to gas, banking and uranium had been detailed in the Panama Papers in April of 2016.”

Stone’s explanations seem to attempt to do three things:

  • Provide non-incriminating explanations for any foreknowledge of WikiLeaks — first pointing to Randy Credico and now to James Rosen
  • Offer explanations for discussions about Podesta that he may presume Mueller has that took place around August 14
  • Shift the focus away from Joule and the remarkable prescience with which the right wing anticipated that WikiLeaks would be able to advance an attack first rolled out on August 1

With that in mind, I find the timeline of Stone’s tweets mentioning either Podesta instructive. It shows Stone never mentioned either brother until August 15 — the day after the first of the stories on Manafort’s Ukraine corruption and after that August 14 date he seems so worried about. That tweet, “@JohnPodesta makes @PaulManafort look like St. Thomas Aquinas Where is the @NewYorkTimes?” may prove as interesting as the August 21 one.

Stone mentioned John Podesta again in that August 21 tweet.

Then he remained silent on Twitter about Clinton’s campaign chairman until the day after the Podesta emails started coming out, whereupon Stone started claiming that Podesta had been money laundering for Russia.

Stone’s first tweet as the Podesta emails dropped pointed back to an earlier Corsi post reporting that the Podesta Group was also under investigation. That same day, he pointed to the Corsi post that seemed to anticipate the Joule attack would be returning. Yet, in an interview done after the release on October 11 of the Podesta emails that both he and Corsi would later rely on to extend the Joule attack, Stone made no mention of those emails or the Joule attack. By the next day, however, Stone was relying on (but not linking) those emails.

In other words, at least as measured by his Twitter feed, Stone was uninterested in the Joule attack when it came out in August. He didn’t mention it at all in his two Podesta tweets that month (nor does he in his currently operative explanation). But he did become interested in the story in advance of the release of emails by WikiLeaks pertaining to the attack.

This is probably a good time to recall that many of the Stone associates Mueller has interviewed did research for Stone, and others had access to his social media accounts. Note that even this selection of his tweets show the use of multiple clients — Twitter Web Client, Tweetdeck, and Twitter for iPhone — that may reflect different people posting from his account.

Stone’s claims about WikiLeaks — and his outreach to Guccifer 2.0 — took place as Manafort started to panic about his own Russian ties

Given some of Stone’s explanations (and his apparent concern with offering some explanation for discussions about Podesta on August 14), I also find it notable the way this timeline overlaps with Manafort’s increasingly desperate efforts to stave off bankruptcy even while working for Trump for “free.” Part of those efforts, of course, involved criminal efforts to hide his ties to Russia in the wake of reporting on those ties in mid-August.

It’s unclear when Manafort knew for sure his ties with Russia would blow up. In the wake of the first WikiLeaks dump on July 27, he got asked about his and Trump’s ties to Russia, a question he struggled with before responding by pointing to Hillary’s deleted emails. In spite of the risk of his own Russian ties, Manafort met on August 2 with Konstantin Kilimnik, talking (among other things) about unpaid bills and the presidential election. Sometime in early August, in advance of the first NYT story substantiating his Russian ties, he was reportedly blackmailed over the secret ledgers of his work with Ukrainian oligarchs.

Remarkably, just as attention to Trump and Manafort’s ties to Russia started becoming an issue, Republicans had that GAI report insinuating a tie between Hillary and Russia all ready to go on August 1. That insinuation went through John Podesta and his ties to Joule. Before laying out that relationship, however, the GAI report suggested there must be more dirt on the topic in the emails Hillary deleted.

More recently, in January, 2015, Podesta became the campaign chairman of Hillary Clinton’s campaign for the 2016 presidential bid.85

During Hillary Clinton’s tenure as Secretary of State, he was in regular contact with her and played an important role in shaping U.S. policy. For one thing, he sat on the State Department’s Foreign Affairs Policy Board, appointed by Hillary. (The board was established in December 2011.)86

The full extent of Podesta’s email communication cannot ultimately be known because Hillary Clinton deleted approximately half of her emails after she left the State Department.

So along with everything else the report did, it built expectations that Hillary’s deleted emails would reveal secret dirt about Russia she was suppressing to win the campaign.

By the time the report came out, we know that Stone was already interested in what WikiLeaks might have, as Charles Ortel BCCed him on an email suggesting that WikiLeaks had Clinton Foundation emails to dump in September in late July.

Then, precisely as the Russian attack on Podesta was rolling out, Stone flip-flopped on his claimed belief about who hacked Hillary Clinton. Between August 1 and August 5, on the same days he was claiming to have dined with Julian Assange when he was instead in Southern California meeting his dark money associates, he started claiming that Guccifer 2.0 was just a hacktivist, not Russians. That stated belief has always been central to his claims not to have conspired with Russia.

In significant part because he flip-flopped publicly, he and Guccifer 2.0 started communicating, first about Stone’s claim that Guccifer 2.0 had nothing to do with Russia, then about Guccifer 2.0 being shut down on Twitter:

August 12: Guccifer 2.0:   thanks that u believe in the real

August 13: Stone: @WL @G2 Outrageous! Clintonistas now nned to censor their critics to rig the upcoming election.

Stone: @DailyCaller Censorship ! Gruciffer2 is a HERO.”

August 14: Guccifer 2.0:  Here I am! They’ll have to try much harder to block me!

Stone: First #Milo, now Guccifer 2.0 – why are those exposing the truth banned? @RealAlexJones @infowars #FreeMilo

Stone: @poppalinos @RealAlexJones @infowars @GUCCIFER_2 Thank You, SweetJesus. I’ve prayed for it.

That’s when Stone moved their conversations to DM.

That conversation, including Guccifer 2.0’s question whether Stone found “anything interesting in the docs I posted?” (which, in public context at least, would refer to some DCCC documents Guccifer had posted on WordPress on August 12) took place even as Stone was continuing to speak about knowing what was in the next WikiLeaks dump and as he responded badly to his childhood friend becoming the target of NYT’s attention on August 14.

As noted, Stone seems to be struggling to answer why he was discussing John Podesta on August 14.

To be sure, Stone was talking to Corsi on August 14 or 15. On August 15, Corsi published an interview with Stone, in which he claimed to have been badly hacked and described what he expected would come next from WikiLeaks.

But nothing in the interview mentions Podesta.

Stone’s descriptions of what WikiLeaks might dump next in that interview could reflect the BCCed James Rosen email reporting that WikiLeaks would dump Clinton Foundation documents in September, but the information he laid out went far beyond that email (and promised an October surprise, not a September dump).

“In the next series of emails Assange plans to release, I have reason to believe the Clinton Foundation scandals will surface to keep Bill and Hillary from returning to the White House,” he said.

[snip]

In a speech Southwest Broward Republican Organization in Florida, published Aug. 9 by David Brock’s left-wing website Media Matters, Stone said he had “communicated with Assange.”

“I believe the next tranche of his documents pertain to the Clinton Foundation, but there is no telling what the October surprise may be,” he said.

Stone told WND that Assange “plans to drop at various strategic points in the presidential campaigns Hillary Clinton emails involving the Clinton Foundation that have yet to surface publically.”

“Assange claims the emails contain enough damaging information to put Hillary Clinton in jail for selling State Department ‘official acts’ in exchange for contributions to the Clinton Foundation and as a reward for Clinton Foundation donors becoming clients of Teneo, the consulting firm established by Bill Clinton’s White House ‘body man’ Doug Band,” he said.

That same day, August 15, is the first time Stone ever mentioned Podesta on Twitter.

Stone claims (and claimed, in sworn testimony) that his focus on John Podesta was a response to the allegations against Manafort. That makes the confluence of all these events all the more interesting.

Corsi’s lawyer claims he avoided criminal liability

As noted above, Jerome Corsi has explained what he knows of all this in a September 21 grand jury appearance, a grand jury appearance that Mueller seems to have been working towards since having Ted Malloch questioned way back in March.

In advance of that testimony, Corsi’s attorney David Grey seemed to suggest that Corsi declined to participate in certain activities involving Stone that might have exposed him to criminal liability.

Gray said he was confident that Corsi has done nothing wrong. “Jerry Corsi made decisions that he would not take actions that would give him criminal liability,” he added, declining to elaborate.

Asked if Corsi had opportunities to take such actions, Gray said, “I wouldn’t say he was offered those opportunities. I would say he had communications with Roger Stone. We’ll supply those communications and be cooperative. My client didn’t act further that would give rise to any criminal liability.”

But Mueller is apparently now chasing down Corsi’s associates.

FBI agents have recently been seeking to interview Corsi’s associates, according to the person.

One other key player in the Podesta hand-off conflated the Podesta brothers

The close ties between how Stone focused on both Podesta brothers in response to the public allegations against Manafort is interesting for another reason.

Former Ambassador Craig Murray, the only one not denying some role in the handoff of the Podesta emails (again, he has said he didn’t get the emails themselves, which he believed were already with WikiLeaks, but something associated with them).

Murray told Scott Horton that his source had obtained whatever he received from a figure in American national security with legal access to the information.

[H]e says “The material was already, I think, safely with WikiLeaks before I got there in September,” though other outlets have suggested (with maps included!) that’s when the hand-off happened. In that account, Murray admits he did not meet with the person with legal access; he instead met with an intermediary.

But the explanation of his source’s legal access and motivation not only doesn’t make sense, but seems to parrot what Stone was saying at the time.

I also want you to consider that John Podesta was a paid lobbyist for the Saudi government — that’s open and declared, it’s not secret or a leak in a sense. John Podesta was paid a very substantial sum every month by the Saudi government to lobby for their interests in Washington. And if the American security services were not watching the communications of the Saudi government paid lobbyist then the American intelligence services would not be doing their job. Of course it’s also true that the Saudis’ man, the Saudis’ lobbyist in Washington, his communications are going to be of interest to a great many other intelligence services as well.

As Stone did, this conflates John and Tony. It wrongly suggests that US national security officials would be collecting all of Tony Podesta’s emails, or that collecting on Tony would obtain all of John’s emails. All the more interesting, this conflation would have come in a period when Manafort’s lifelong buddy, Stone, was trying to distract attention from Manafort’s own corruption — which included telling Tony not to disclose the influence-peddling he had done for Manafort in the legally required manner — by projecting Manafort’s corruption onto Tony.

One more point about Murray. Murray has ties (including through the Sam Adams Association the awards ceremony for which he was in DC attending) to NSA whistleblowers Bill Binney (Murray received the award in 2005 and Binney received it in 2015) and Kirk Wiebe. This claim that US law enforcement would collect everything (including Hillary’s deleted emails) is the kind of line that Binney was pushing at the time, including to Andrew Napolitano, who was CCed on the email Stone received about WikiLeaks’ plans in July. Napolitano is one of the people who has championed that Binney line about the hack.

In other words, it’s not just that Murray was telling a similar story as Stone, even though they’re politically very different people. It’s that he was not that distant from the network of Republicans talking about what WikiLeaks might have had.

Update: Emma Best just wrote up something she’s been tracking for some time: there are four different numbers on how many Podesta mails there are.

WikiLeaks’ own data gives us five different totals for the number of Podesta emails:

  1. 50,866
  2. 57,153
  3. 58,660
  4. 59,258
  5. 59,188

The two most authoritative answers to the question come from WikiLeaks and the Special Counsel’s office, and both indicate that the total exceeded 50,000. While WikiLeaks’ stated there were “well over 50,000” emails, the Special Counsel’s indictment simply said that “over 50,000 stolen documents were released.” Since “documents” can be construed to include both the emails and their various attachments, the SC’s total is even more vague and less definitive than WikiLeaks’.

Ultimately, he best answer to the question of how many Podesta emails there are appears to be 59,188.

This raises the possibility that Stone or Corsi saw copies that WikiLeaks didn’t publish. Mueller’s distinction between how many emails were stolen and how many released suggests FBI may know what WikiLeaks chose not to public, if in fact they did.

Timeline

July 18-21: Stone meets Nigel Farage while at RNC

July 25: Stone gets BCCed on an email from Charles Ortel that shows James Rosen reporting “a massive dump of HRC emails relating to the CF in September;” Stone now claims this explains his reference to a journalist go-between

July 27: Paul Manafort struggles while denying ties to Russia, instead pointing to Hillary’s home server

July 31: GAI report on From Russia with Money claiming Viktor Vekselberg’s Skolkovo reflects untoward ties; it hints that a greater John Podesta role would be revealed in her deleted emails and claims he did  not properly disclose role on Joule board when joining Obama Administration

August 1: Steve Bannon and Peter Schweitzer publish a Breitbart version of the GAI report

August 1: Stone NYC > LA

August 2: Manafort and Konstantin Kilimnik meet in the Grand Havana Room in Jared’s 666 Park Avenue and “talked about bills unpaid by our clients, about [the] overall situation in Ukraine . . . and about the current news,” including the presidential campaign

August 2, 2016: Stone dines with dark money funder, John Powers Middleton in West Hollywood

August 3 and 4: Manafort obtains the bio of Steve Calk, from whom he was getting a $16 million mortgage in tacit exchange for a role in the Trump administration

August 3: Stone claims to Sam Nunberg to have dined with Assange

August 3-4: Stone takes a red-eye from LAX to Miami

August 4: Stone flip-flops on whether the Russians or a 400 pound hacker are behind the DNC hack and also tells Sam Nunberg he dined with Julian Assange; first tweet in the fall StopTheSteal campaign

August 5: Trump names Calk to his advisory committee

August 5: Stone column in Breitbart claiming Guccifer 2.0 is individual hacker

August 7: Stone starts complaining about a “rigged” election, claims that Nigel Farage had told him Brexit had been similarly rigged

August 8: Stone tells Broward Republicans he has communicated with Assange, expects next tranche to pertain to Clinton Foundation

August 10: Manafort tells his tax preparer that he would get $2.4 million in earned income collectable from work in Ukraine in November

August 10: Stone asserts that Hillary’s deleted emails will be coming out

Early August: Manafort gets blackmail threat pertaining to secret ledgers

August 12: Guccifer 2.0 publicly tweets Stone

August 13: Stone claims to have been hacked

August 14: NYT publishes story on secret ledgers

August 14: Stone DMs Guccifer 2.0

August 14: Corsi claims to have started research on response to NYT story

August 14: Breitbart piece suggesting NYT was ignoring Hillary’s own ties to Russia; this may be Stone’s latest explanation for interest in Podesta on that date

August 15: Manafort and Gates lie to the AP about their undisclosed lobbying, locking in claims they would make under oath later that fall

August 15: In first tweet mentioning John Podesta, Stone claims John Podesta “makes Paul Manafort look like St. Thomas Aquinas”

August 15: Corsi reports Stone’s prediction that WikiLeaks will release deleted Hillary emails (also reports on claimed hack)

August 17: AP publishes story on Manafort’s unreported Ukraine lobbying, describing Podesta Group’s role at length

August 17: Trump adds Steve Bannon and Kellyanne Conaway to campaign leadership team (Manafort’s daughter claims he hired them)

August 19: Manafort resigns from campaign

August 21: Stone tweets it will soon be Podesta’s time on the barrel

August 26: Rebekka Mercer asks Alexander Nix whether Cambridge Analytica or GAI could better organize the leaked Hillary emails

September 12: Following further reporting in the Kyiv Post, Konstantin Kilimnik contacts Alex Van der Zwaan in attempt to hide money laundering to Skadden Arps

September 28: Corsi post (later linked on Twitter by Stone) noting that Podesta Group also under investigation

October 6: Corsi repeats the Joule/GAI claims

October 11: Release of Podesta email allegedly backing Joule story (December 31, 2013 resignation letter, January 7, 2014 severance letters)

October 11: Foldering email among Peter Smith operatives that may included coded satisfaction with emails released thus far

October 12: Roger Stone interview with the Daily Caller responding to Podesta’s allegations he knew of release in advance, which makes no mention of Joule attack

October 13: In response to accusations he knew of Podesta emails in advance, Stone repeats Joule story falsely claiming this WikiLeaks email, released October 11, substantiates it; Corsi also posts a story on Joule, like Stone not linking to the underlying WikiLeaks emails

October 17: Corsi post that actually links the WikiLeaks releases relied on in his and Stone’s October 13 posts

October 30: Additional Joule letter (including actual transfer signatures) released

October 31: Additional Joule letter released

November 1: Additional Joule letter released

As I disclosed in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

Detour: Roger Stone’s Epically Shitty Explanation for His Podesta Tweet

/10 Comments/in , /by

I need to take another detour from my series on the universe of the known hacked and leaked emails from 2016.

While working on the Podesta email post, my treatment of how epically shitty Stone’s explanation for his August 21, 2016 tweet boasting that “it would soon the Podesta’s time in the barrel” grew so big it has become its own post.

For reasons I laid out in this post, the public record is not all that convincing that Stone did have foreknowledge of the Podesta dump. Both in August, when he started talking about foreknowledge of a Hillary release, and in October, when he promised it on a specific day (that turned out to be wrong), he predicted WikiLeaks would dump Hillary’s deleted emails, not Podesta’s emails.

But Stone’s explanation for the tweet is epically shitty and increasingly makes me think he not only knew that Podesta’s emails would be released, but may have seen some of them in advance.

Effectively, Stone claimed to the House Intelligence Committee that his Podesta comment referred to a report Jerome Corsi did for him between August 14, and 31 ,2016 (which doesn’t identifiably show up in Stone’s political expenditures in this period).

My Tweet of August 21, 2016, in which I said, “Trust me, it will soon be the Podesta’s time in the barrel. #CrookedHillary” Must be examined in context. I posted this at a time that my boyhood friend and colleague, Paul Manafort, had just resigned from the Trump campaign over allegations regarding his business activities in Ukraine. I thought it manifestly unfair that John Podesta not be held to the same standard. Note, that my Tweet of August 21, 2016, makes no mention, whatsoever, of Mr. Podesta’s email, but does accurately predict that the Podesta brothers’ business activities in Russia with the oligarchs around Putin, their uranium deal, their bank deal, and their Gazprom deal, would come under public scrutiny. Podesta’s activities were later reported by media outlets as diverse as the Wall Street Journal and Bloomberg. My extensive knowledge of the Podesta brothers’ business dealings in Russia was based on The Panama Papers, which were released in early 2016, which revealed that the Podesta brothers had extensive business dealings in Russia. The Tweet is also based on a comprehensive, early August opposition research briefing provided to me by investigative journalist, Dr. Jerome Corsi, which I then asked him to memorialize in a memo that he sent me on August 31st , all of which was culled from public records. There was no need to have John Podesta’s email to learn that he and his presidential candidate were in bed with the clique around Putin.

The claim is, particularly knowing what we know about efforts Paul Manafort was making to hide his own corruption by asking Tony Podesta to avoid legally mandated reporting, … interesting. Particularly given the way this timeline overlaps with some other events, notably Manafort’s increasingly desperate efforts to stave off bankruptcy even while working for Trump for “free.” There are also some oddities about how the timing evolved from those August “research” documents and later October publications. I’ll hit both those timing issues in my Podesta email post.

For now, consider what Corsi claimed back in March 2017, the first attempt to explain Stone’s tweet. In his version, Stone’s tweet was about four different reports.

Corsi first said that he started researching the Podestas and Russia in response to reading a July 31, 2016 Government Accountability Institute report, one not mentioned in Stone’s explanation.

On July 31, 2016, the New York Post reported that Peter Schweizer’s Washington-based Government Accountability Institute had published a report entitled, “From Russia with Money: Hillary Clinton, the Russian Reset, and Cronyism.”

That report detailed cash payments from Russia to the Clintons via the Clinton Foundation which included a Putin-connected Russian government fund that transferred $35 million to a small company that included Podesta and several senior Russian officials on its executive board.

“Russian government officials and American corporations participated in the technology transfer project overseen by Hillary Clinton’s State Department that funneled tens of millions of dollars to the Clinton Foundation,” the report noted in the executive summary.

“John Podesta failed to reveal, as required by law on his federal financial disclosures, his membership on the board of this offshore company,” the executive summary continued. “Podesta also headed up a think tank which wrote favorably about the Russian reset while apparently receiving millions from Kremlin-linked Russian oligarchs via an offshore LLC.”

Reading Schweizer’s report, I began conducting extensive research into Secretary Clinton’s “reset” policy with Russia, Podesta’s membership on the board of Joule Global Holdings, N.V. – a shell company in the Netherlands that Russians close to Putin used to launder money – as well as Podesta’s ties to a foundation run by one of the investors in Joule Energy, Hans-Jorg Wyss, a major contributor to the Clinton Foundation.

Having claimed this report got him interested in substantiating a tie between Hillary and Russia, Corsi then shifts, saying that the August 14 NYT story on Manafort’s secret ledgers did (which I would call “mid-August,” not early August). He claimed his goal in response to the NYT reporting — it’s not clear whether this started on August 1 or August 14 — was just to publicize the already-written GAI report.

On Aug. 14, 2016, the New York Times reported that a secret ledger in Ukraine listed cash payments for Paul Manafort, a consultant to the Ukraine’s former President Viktor F. Yanukovych.

When this article was published, I suggested to Roger Stone that the attack over Manafort’s ties to Russia needed to be countered.

My plan was to publicize the Government Accountability Institute’s report, “From Russia With Money,” that documented how Putin paid substantial sums of money to both Hillary Clinton and John Podesta.

Putin must have wanted Hillary to win in 2016, if only because Russian under-the-table cash payments to the Clintons and to Podesta would have made blackmailing her as president easy.

On Aug. 14, 2016, I began researching for Roger Stone a memo that I entitled “Podesta.”

So Corsi suggests the report he did for Stone was based on the GAI one.

Except Corsi’s report (starting at PDF 39, copies of the report are at this point just reproductions without metadata to track when they were written, but Corsi claims to have handed over ways for Mueller to track such things when he interviewed with Mueller’s team and then appeared before the grand jury in September) doesn’t deal with the GAI report at all. Instead, it is a direct response to the NYT Manafort report, claiming that the NYT reporting (the stuff that has since been confirmed by all of Manafort’s guilty pleas) was not substantiated. It then makes a key logical move, admitting that his report is an attempt to undermine the claim that Russia’s close ties to Manafort had some relation to the hack-and-leak.

From there, the Democratic Party narrative continues to suggest Manafort’s close relationship to the Kremlin allowed him to position the Trump campaign to receive a dump of hacked emails that embarrassed the Clinton campaign by exposing the efforts Debbie Wasserman Schultz, as chairman of the DNC, took to rig the primaries for Hillary, to the distinct disadvantage of challenger, Sen. Bernie Sanders.

The entire Democratic Party narrative is thrown into disarray if it turns out the Podesta brothers, via the Podesta Group, have tighter and more easily documentable financial ties to Russia, involving far greater numbers than have ever been suggested to tie Manafort to Russia via Ukraine.

This is a key distinction. While the report definitely responds to the burgeoning scandal about Manafort’s ties to Russian oligarchs, Corsi admits that this report is about undercutting the claim that Russia would have reason to target Hillary in a hack-and-leak effort. So yeah, it’s about Stone’s “boyhood friend and colleague” (who at the time was setting off on a crime spree to hide his Russian ties), but it’s also about his longtime buddy Donald Trump, too.

From there the Corsi report focuses on the Podesta Group, on Uranium One, on Clinton’s ties to Fethulla Gulen (whom Mike Flynn was moving towards on kidnapping at the time), as if any of that suggests closer ties to Russia than Manafort has. Virtually the only claim about John Podesta (as opposed to Tony) is that he had ties to Hillary’s Foundation.

The idea behind Corsi’s story, I suppose, is that if Corsi started writing this report on August 14, then when Stone tweeted on August 21, it would reflect a draft of the report that bears the final date of August 31. There’s no public record to support that chronology, though.

From there, Corsi notes that he and Podesta returned to the subject of the GAI report — Podesta’s ties with Joule — in October.

On October 6, 2016, I published in WND.com the first of a series of articles detailing Putin’s financial ties to Clinton and Podesta, based largely on the research contained in the Government Accountability Institute’s report, “From Russia With Money.”

On Oct. 13, 2016, Stone published on his website an article entitled, “Russian Mafia money laundering, the Clinton Foundation and John Podesta.”

So thus far, Corsi argues that the progression goes from an August 1 GAI Report, to … something … to his research starting on August 14 about entirely unrelated allegations about the Podestas, back to both he and Stone writing on Joule in October.

In his description of the October pieces, Corsi claims — citing selectively — that Stone’s Joule piece relied on his and (he seems to claim, but this is nonsense) his private research report.

A comparison of the two articles will show the extent to which Stone incorporated my research into his analysis.

Probably, Corsi is talking about that series he is referring to, which include these posts:

September 28: Media Neglect Clinton-Linked Firm’s Role in Russia Scandal (pointing out the Podesta Group was also under investigation)

October 6: Russia? Look Who’s Really in Bed with Moscow (Reiterates findings of GAI report)

October 13: Hillary Campaign Chief Linked to Money-Laundering in Russia (cites but does not link to WikiLeaks releases)

October 17: How Hillary’s Campaign Chief Hid Money from Russia (actually inking to the WikiLeaks emails and claiming the Leonidio to which Podesta transferred Joule shares was one one in Utah

Though he cites Stone’s denials of advance knowledge that WikiLeaks would dump the Podesta emails, Corsi doesn’t cite this passage in Stone’s October 13 piece.

Wikileaks emails tie John Podesta, chairman of Hillary Clinton’s 2016 presidential campaign, into the money-laundering network with the confirmation Podesta had exercised 75,000 shares out of 100,000 previously undisclosed stock options he was secretly issued by Joule Unlimited, a U.S. corporation that ties back to Vekselberg connected Joule Global Stichting in the Netherlands – a shady entity identified in the Panama Papers as an offshore money-laundering client of the notorious Panamanian law firm Mossack Fonseca.

As a clear indication of guilty conscience, the Wikileaks Podesta file further documents that Podesta made a serious effort to keep the transaction from coming to light as evidenced by his decision to transfer 75,000 common shares of Joule Unlimited to Leonidio LLC, another shady shell corporation – this one listed in Salt Lake City at the home apartment of the gentlemen who registered the company.

Stone mentions — but does not link to — some of the WikiLeaks files he’s discussing. It is true that two Podesta emails released two days earlier on October 11 (December 31, 2013 resignation letter, January 7, 2014 severance letters) relate to the stuff Stone mentions and have some of the same numbers. They certainly don’t substantiate Stone’s claim about mob ties and shell corporations. Plus, three of the Joule documents that might actually pertain to Stone’s claims weren’t released until October 30, October 31, and November 1. Significantly, the research that Corsi claims Stone relied on didn’t show up until Corsi’s October 17 post, four days after Stone’s.

That at least suggests that Stone may have had those WikiLeaks emails earlier — and it may suggest he had “WikiLeaks documents” that never got published, which he ironically would have referenced in a piece purporting to prove he didn’t have advance knowledge of the release. It also raises real questions about why Corsi resuscitated the Joule attack on October 6, as if knowing both that Podesta emails would come out and that they would include some attached documents allegedly substantiating and advancing the GAI report from the summer.

Stone also claims further research reflects an unsubstantiated further tie with (Trump inauguration donor) Viktor Vekselberg, one he didn’t repeat when he revived the post to implicate Michael Cohen last May.

Further research has documented that Viktor Vekselberg arranged for two transfers of unknown amounts to a private Clinton Foundation account in the Bank of America, with the funds passing though a pass-through account at Deutsche Bank and Trust Company Americas in New York City – with the first transfer made on Feb. 10, 2015, and the second on March 15, 2016.

Vekselberg is known to have donated to the Clinton Foundation, though it’s not clear where Stone gets the banking details.

I’m not actually sure what to make of Stone’s post. I have yet to chase down where all these claims come from (if not from Stone’s ripe imagination).

But even aside from these three unsubstantiated claims, I know this.

Corsi originally claimed that all four reports — the August 1 GAI report, his own August 14-31 private report to Stone, his own revival of the GAI report the day before the Podesta emails started coming out on October 7 (and, arguably, the entire series), and then Stone’s own piece after some WikiLeaks documents came out that sort of related to his arguments but not entirely — were part of the same effort.

That’s not right. His own report for Stone  is the outlier.

While it’s unsurprising that Manafort’s “boyhood friend” might solicit a report both to protect that boyhood friend and his longtime political mentee, Donald Trump, that report was part of a separate effort than the GAI research — which Stone would ultimately claim without proof WikiLeaks releases supported. It’s unclear which of the three things is most damning: the Stone report which claimed to use WikiLeaks research to elaborate on the GAI research, the report attempting to disprove true facts about Manafort’s ties to Russia, or the tweet.

But they don’t explain each other. And inserted into the timeline — as I’ll do — they become even more problematic.

Update: I took out a paragraph on Corsi’s timing, which was erroneous.

Update: Via the Daily Caller, Stone has now offered another explanation: that he learned of all this from a James Rosen email to Andrew Napolitano on which he was BCCed.

Stone also told The Post he had a “second source” regarding his claims about WikiLeaks the Clinton Foundation. Emails provided to The Daily Caller show the “second source” referenced is an email Stone was Bcc’d on from July 25, 2016. Stone was Bcc’d on the email by Clinton Foundation expert Charles Ortel, who was conducting a conversation with then-Fox News journalist James Rosen and Judge Andrew Napolitano.

July 2016 Email

The email included a previous exchange between Ortel and Rosen in which the Fox News journalist wrote “am told Wikileaks will be doing a massive dump of HRC emails relating to the CF in September” to Ortel. There is no evidence to suggest Rosen was aware of Stone’s visibility on the email chain.

James Rosen Email

Ortel confirmed the authenticity of the email exchanges to TheDC while Rosen declined to comment.

Stone explained to TheDC the information he learned from the email was part of the basis for his August 2016 claim of impending information from WikiLeaks about the Clinton Foundation.

This doesn’t actually explain squat. But it does put Stone in contact with people who might be explain the rest of what went down. The DC piece also provides another Stone excuse for why he was interested in Podesta’s plight on August 14, which he claims was a Schweitzer piece at Breitbart, but which might instead be this one. In any case, Stone seems to have a real urgency to have something that explains an August 14 interest in Podesta.

Update: One other point about the language in Corsi’s report making it clear it was a response to the Russian allegations. He still seems to treat the possibility that Russia did the hack seriously. That’s an interesting detail given that the guy he was purportedly doing the report for was publicly on the record blaming a 400 pound hacker in mom’s basement.

On the Roger Stone Investigation: Talking to Guccifer 2.0 or WikiLeaks Is Not a Crime

/8 Comments/in , /by

Before I get further in my series on the known universe of hacked and leaked emails from 2016, I want to explain something about Roger Stone, especially given this WaPo story that provides interesting details but claims Mueller is pursuing them in hopes of answering this question:

Did longtime Trump adviser Roger Stone — or any other associate of the president — have advance knowledge of WikiLeaks’ plans to release hacked Democratic emails in 2016?

While I don’t claim to understand much more than the rest of the world about what the Mueller probe is doing, I say with a fair degree of certainty that Mueller has not had three prosecutors chasing leads on Roger Stone since February because he wants to know if Stone had advance knowledge of WikiLeaks’ plans on releasing emails. Knowing that WikiLeaks planned on releasing emails is not a crime.

Indeed, Assange at times (most notably on June 12) telegraphed what he was up to. There were WikiLeaks volunteers and some journalists who knew what WikiLeaks was up to. None of that, by itself, is a crime.

With that in mind, consider the following:

It matters what emails Stone claimed to know would be released

At the risk of spoiling my series, let me explain the significance of it. While knowing that WikiLeaks would release emails is not by itself a crime, advance knowledge becomes more interesting based on what Stone might have done with that knowledge. Here’s why:

  • DNC emails: Mueller has presumably tracked whether and to whom George Papadopoulos shared advance knowledge of the tip he got on April 26 that the Russians would release emails to help Trump. That’s important because if he can show meeting participants knew those emails had been offered, then June 9 meeting becomes an overt act in a conspiracy. While there’s no public allegation Stone knew that WikiLeaks would be releasing Hillary emails before Julian Assange stated that publicly on June 12 (after the Trump Tower meeting and therefore at most a response to the meeting), if Stone knew that WikiLeaks would be part of the delivery method it adds to evidence of a conspiracy.
  • Podesta emails: The Democrats’ focus on Stone has always been on his seeming advance knowledge that WikiLeaks would release the Podesta emails, though the public case that he did is in no way definitive. Even assuming he did learn in advance, there are multiple channels via which Stone might have learned the Podesta emails were coming (just as an example, Democrats have necessarily always been obfuscating about how much they knew). But any presumed advance knowledge is still only a crime if Stone in some way coordinated with it or encouraged ongoing hacking.
  • Deleted Hillary emails: While the evidence that Roger Stone knew that WikiLeaks would release Podesta’s emails is inconclusive, the evidence that he “knew” WikiLeaks had Hillary’s deleted emails is not. Stone made that claim over and over. It’s actually not public whether and when WikiLeaks obtained files purporting to be Hillary’s deleted emails, though we should assume they got at least some sets of purported emails via the Peter Smith effort. If Stone had involvement in that effort, it might be criminal (because operatives were soliciting stolen emails from criminal hackers, not just making use of what got released), though Stone says he was unaware of it.
  • DCCC emails: The DCCC files, which offered more operational data about downstream campaigns, might raise other problems under criminal law. That’s because the data offered was generally more operational than the DNC and Podesta emails offered, meaning operatives could use the stolen data to tweak their campaign efforts. And Guccifer 2.0 was sharing that data specifically with operatives, providing something of value to campaigns. Guccifer 2.0 tried to do the same with Stone. The text messages between Stone and Guccifer 2.0 show the persona trying to get Stone interested in some of the DCCC files pertaining to FL. But at least on those DMs, Stone demurred. That said, if Stone received and operationalized DCCC data in some of his rat-fucking, then it might raise criminal issues.

It matters from whom Stone learned (if he did) of WikiLeaks’ plans

A big part of Mueller’s focus seems to be on testing Stone’s public claims that his go-between with WikiLeaks was Randy Credico, who had ties to Assange but was not conspiring to help Trump win via those channels.

There are other possible go-betweens that would be of greater interest. For example, the public discussion of Stone’s potential advance knowledge seems to have forgotten the suspected role of Nigel Farage, with whom Stone dined at the RNC and later met at Trump’s inauguration. That would be of heightened interest, particularly given the way Stone suggested the vote had been rigged against Brexit and Trump when in reality Russians were rigging the vote for both.

It matters whether Stone lied about the whom or the what

Stone’s testimony to the House, in which he offered explanations about any advance knowledge and his Podesta comment, was sworn. If Mueller can show he lied in his sworn testimony, that is certainly technically a crime (indeed, Sam Patten got referred to Mueller based on on his false statements to the Senate Intelligence Committee). But it’s unlikely Mueller would charge, much less investigate, Stone for 8 months solely to prove whether he lied to Congress.

But if Stone did lie — claiming he learned of WikiLeaks’ plans from Credico when in fact he learned from someone also conspiring with the Russians — then those lies would lay out the import of Stone’s role, in what he was hypothetically trying to cover up.

Stone’s flip-flop on blaming the Russians at the moment he claimed to have knowledge of WikiLeaks’ plans is of likely interest

There’s a data point that seems very important in the Roger Stone story. On or around August 3, the very same day Stone told Sam Nunberg that he had dined with Julian Assange, Stone flip-flopped on his public statements about whether Russia had hacked Hillary or some 400 pound hacker in a basement had. During that period, he went from NY (where he met with Trump) to LA to coordinate with his dark money allies, then went home to Florida to write a column that became the first entry in Stone’s effort to obfuscate the Russian role in the hack. That flip-flop occurred just before Stone started making public claims about what WikiLeaks had.

I suspect that flip-flop is a real point of interest, and as such may involve some other kind of coordination that the press has no public visibility on (particularly given that his claimed meeting with Assange happened while he was meeting with his dark money people).

Mueller may have had probable cause Roger Stone broke the law by March

In the wake of Michael Caputo’s testimony, Roger Stone briefly claimed that he must have been targeted under FISA, apparently based on the fact that Mueller had (possibly encrypted) texts he didn’t provide himself showing that he and Caputo had had contact with a presumed Russian dangle they had hidden in prior sworn testimony. A more likely explanation is that Stone’s was one of the at-least five phones Mueller got a warrant for on March 9, in the wake of Rick Gates’ cooperation. But if that’s the case, then it means that Mueller already had shown probable cause Stone had committed some crime by the time he got this phone.

Mueller is scrutinizing Stone for more than just knowledge of WikiLeaks

Even the public reporting on Mueller’s investigative actions make it clear that he is scrutinizing Stone for more than just a hypothetical knowledge of, much less coordination with, WikiLeaks. He seems to have interest in the two incarnations of Stone’s Stop the Steal dark money group, which worked to intimidate Cruz supporters around the RNC and worked to suppress Democratic voters in the fall. There’s reason to suspect that the ways in which Stone and his people sloshed that money around did not follow campaign finance rules (in which case Don McGahn might have played a role). Certainly, Andrew Miller seems to worry that his own role in that sloshing might lead to criminal exposure. But Jerome Corsi has also suggested that Stone might have pitched some legally suspect actions to him, and those would constitute rat-fuckery, not campaign finance violations in the service of rat-fuckery.

Now, those other potential crimes might just be the gravy that Mueller has repeatedly used, charging people with unrelated crimes (like Mike Flynn’s Turkish influence peddling or Michael Cohen’s Stormy Daniel payoffs) to get their cooperation in the case in chief. Or they might be something that more closely ties to conspiracy with Russians.

The larger point, however, is that isolated details from Stone-friendly witnesses (and from Stone himself) may not be the most reliable way to understand where Mueller is going with his investigation of Stone. Certainly not witnesses who say Mueller has spent 8 months scrutinizing whether Stone lied about his foreknowledge of WikiLeaks’ actions.

As I disclosed in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

The Universe of Hacked and Leaked Emails from 2016: DNC Emails

/11 Comments/in , , , /by

When Mueller’s team released George Papadopoulos’ plea deal last year, I noted that the initial denials that Papadopoulos had advance warning of the emails the Russians were preparing to hack and leak did not account for the entire universe of emails known to have been stolen. A year and several Mueller indictments later, we still don’t have a complete understanding of what emails were being dealt when. Because that lack of understanding hinders understanding what Mueller might be doing with Roger Stone, I wanted to lay out what we know about four sets of emails. This series will include posts on the following:

  • DNC emails
  • Podesta emails
  • DCCC emails
  • Emails Hillary deleted from her server

The series won’t, however, account for two more sets of emails, anything APT 29 stole when hacking the White House and State Department in 2015, or anything released via the several FOIAs of the Hillary emails turned over to the State Department from her home server. It also won’t deal with the following:

  • Emails from two Hillary staffers who had their emails released via dcleaks
  • The emails of other people released by dcleaks, which includes Colin Powell, some Republican party officials (including some 2015 emails Peter Smith sent to the IL Republican party), and others with interests in Ukraine
  • A copy of the Democrats’ analytics program copied on AWS
  • The NGP/VAN file, which was not directly released by Guccifer 2.0, but is central to one of the skeptics’ theories about an alternative source other than Russia

DNC Emails

The “DNC emails” are generally thought of as the 44,000 emails WikiLeaks released on July 22, 2016. The GRU indictment describes the theft and conveyance of those emails this way:

Between on or about May 25, 2016 and June 1, 2016, the Conspirators hacked the DNC Microsoft Exchange Server and stole thousands of emails from the work accounts of DNC employees. During that time, YERMAKOV researched PowerShell commands related to accessing and managing the Microsoft Exchange Server.

[snip]

On or about June 22, 2016, Organization 1 sent a private message to Guccifer 2.0 to “[s]end any new material [stolen from the DNC] here for us to review and it will have a much higher impact than what you are doing.” On or about July 6, 2016, Organization 1 added, “if you have anything hillary related we want it in the next tweo [sic] days prefable [sic] because the DNC [Democratic National Convention] is approaching and she will solidify bernie supporters behind her after.” The Conspirators responded, “ok . . . i see.” Organization 1 explained, “we think trump has only a 25% chance of winning against hillary . . . so conflict between bernie and hillary is interesting.”

After failed attempts to transfer the stolen documents starting in late June 2016, on or about July 14, 2016, the Conspirators, posing as Guccifer 2.0, sent Organization 1 an email with an attachment titled “wk dnc link1.txt.gpg.” The Conspirators explained to Organization 1 that the encrypted file contained instructions on how to access an online archive of stolen DNC documents. On or about July 18, 2016, Organization 1 confirmed it had “the 1Gb or so archive” and would make a release of the stolen documents “this week.”

On or about July 22, 2016, Organization 1 released over 20,000 emails and other documents stolen from the DNC network by the Conspirators. This release occurred approximately three days before the start of the Democratic National Convention. Organization 1 did not disclose Guccifer 2.0’s role in providing them. The latest-in-time email released through Organization 1 was dated on or about May 25, 2016, approximately the same day the Conspirators hacked the DNC Microsoft Exchange Server.

Raffi Khatchadourian (who has done as much work as anyone else on the known universe of emails) noted that by the time the July 14 exchange had happened, Julian Assange had already said he had emails and Guccifer 2.0 had already said he had shared them with WikiLeaks.

On June 12th, three days before the creation of Guccifer 2.0, Assange announced that he had a substantial trove of Clinton-related e-mails that were pending publication. Likewise, Guccifer 2.0 proclaimed, on its very first post on the WordPress site, “The main part of the papers, thousands of files and mails, I gave to Wikileaks. They will publish them soon.” Again and again, the G.R.U. officers tried to drive home this point—which, of course, was evidently the main point of creating the persona. “I sent a big part of docs to WikiLeaks,” Guccifer 2.0 told the editor of the Smoking Gun that same day. On June 17th, Guccifer 2.0 said in another e-mail, “I gave WikiLeaks the greater part of the files.” (For e-mail, the G.R.U. gave Guccifer 2.0 another fake identity: Stephan Orphan.)

In other words, both the G.R.U. and Assange appear to have confessed to the transmission and reception of a large trove of Clinton-related e-mails in mid-June, before Guccifer 2.0 was apparently created. The indictment does not address this. There is no way to say precisely what that trove was—if it was the Podesta archive given to WikiLeaks much earlier than is generally presumed, or the D.N.C. e-mails, or both, or something else. (There is also the possibility that both parties were not speaking truthfully.) But, if Assange did have the D.N.C. e-mails before Guccifer 2.0 was created, then the details in the indictment take on new meaning. Some version of the following may be true: it is mid-June, with the convention approaching, and Assange is about to release a bombshell, when he notices the sudden appearance of Guccifer 2.0, a “hacker” edging into his turf, inviting journalists to write in. So he writes in, asking for material that interests him. He has already gone through the D.N.C. e-mails and has recognized that the trove highlights conflict within the Democratic Party. He signals that he wants more on that specific issue. The G.R.U. is happy to comply, through its new cutout. Perhaps some of it overlaps with what the G.R.U. already provided, making Guccifer 2.0’s confessions literally accurate. Perhaps it is the same irrelevant dross that Guccifer 2.0 fed to others.

Last year, I visited Assange several times in the Ecuadorian Embassy in London. He often emphasized to me that the sourcing of his election publications was complex. I usually took this as a dodge. But the sourcing may indeed have been multilayered. There are many conceivable ways that G.R.U. officers could have provided e-mails to WikiLeaks before they created Guccifer 2.0. They could have used the WikiLeaks anonymous-submission system. They could have used a different fictitious online persona. They could have used a human intermediary. Last year, James Clapper told me, “It was done by a cutout, which of course afforded Assange plausible deniability.” In January, 2017, Clapper oversaw a formal intelligence assessment on Russian meddling. At the time, more than one news organization reported that a classified version of the assessment made clear that the intermediaries between the G.R.U. and WikiLeaks were already known. (Certainly, the intelligence community would also have been in possession of Guccifer 2.0’s Twitter D.M.s at that time, too.) One intelligence official, describing the report, indicated to Reuters last year that the e-mails relayed to WikiLeaks had followed a “circuitous route,” by a series of handoffs, on their journey from Moscow. Such a scenario seems to be at odds with the idea that Guccifer 2.0 merely sent WikiLeaks an encrypted link to download it all in one swoop.

An earlier Khatchadourian piece describes WikiLeaks experiencing some pressure to publish before the convention.

In early July, for example, Guccifer 2.0 told a Washington journalist that WikiLeaks was “playing for time.” There was no public evidence for this, but from the inside it was clear that WikiLeaks was overwhelmed. In addition to the D.N.C. archive, Assange had received e-mails from the leading political party in Turkey, which had recently experienced a coup, and he felt that he needed to rush them out. Meanwhile, a WikiLeaks team was scrambling to prepare the D.N.C. material. (A WikiLeaks staffer told me that they worked so fast that they lost track of some of the e-mails, which they quietly released later in the year.) On several occasions, and in different contexts, Assange admitted to me that he was pressed for time. “We were quite concerned about meeting the deadline,” he told me once, referring to the Democratic National Convention.

His original release date for the D.N.C. archive, he explained, was July 18th, the Monday before the Convention; his team missed the deadline by four days. “We were only ready Friday,” he said. “We had these hiccups that delayed us, and we were given a little more time—” He stopped, and then added, strangely, “to grow.”

Khatchadourian’s earlier mention of a July 18 deadline is quite interesting, given the response from WikiLeaks to a Guccifer 2.0 email, promising to publish that week, on the 18th.

Khatchadourian also describes WikiLeaks as doing significant work to verify the emails — more than they could have done in the time between July 14 and July 22.

Once they were in Assange’s hands, his overriding concern was to insure that they were genuine. “We had quite some difficulties to overcome, in terms of the technical aspects, and making sure we were comfortable with the forensics,” he recalled. As an Australian, he had only a vague grasp of the way the D.N.C. operated, which made deciphering the political significance of the e-mails difficult. “It’s like looking at a very complex Hieronymus Bosch painting from a distance,” he told me. “You have to get close and interact with it, then you start to get a feel.” Often, a first encounter with a WikiLeaks database submission can be overwhelming—as one former staffer told me, “My heart sinks a bit.”

To work on the material, Assange had to coördinate with operatives outside the building, and avoid surveillance inside it. “I have a lot of security issues in the Embassy,” he told me. “It’s not like you can be comfortable with your source material and read it.” He would not tell me how many people worked on the project, except that the number was small. “We’re all secret squirrels now,” he said.

All this raises questions about how much verification WikiLeaks did, and if instead this was a tale told to Khatchadourian, not to mention why they had confidence publishing them would not blow up on them.

Now, I have suggested that one possible second source of the emails — or at least one alternate explanation that Russia and WikiLeaks might claim that could provide GRU some plausible deniability — would be via the contents of email boxes stolen using passwords released just before the DNC hack from Yevgeniy Nikulin’s past hacks of Linked-In and MySpace. Nikulin has utterly stalled his prosecution until February by refusing not only to cooperate with his defense (though he has had repeated contacts from Russian diplomatic officials), but also with a competency evaluation. So we won’t learn anything (and Nikulin won’t be coerced to cooperate) anytime soon as a result of his extradition to the US.

But, as part of an effort to track changes to WikiLeaks’ website and the DNC emails, Emma Best identified what at first appeared to be a change in one email but ultimately just revealed that the cache includes both the sent and received copies of some emails.

After pointing this out on Twitter and listing the 36 known instances, one user checked a copy of the DNC emails they had retrieved months before. They found what appeared to be a modification to the email – a missing piece of metadata that identified the internal IP address that sent the email. After several hours of searching and comparing five different caches of DNC emails, the difference was both confirmed and explained – WikiLeaks’ copy of the DNC emails comes from several accounts, which resulted in some duplicates in their cache. The internal message ID for the duplicates would be the same, but differences in metadata would appear based on whether the email was being sent or received, and in the case of the former what device and client was sending the emails. Since the x-originating-ip metadata which seemed to appear and then disappear is added by the server when it’s sent, it would naturally be missing from the sender’s copy of the email. This addresses the most alarming question regarding the DNC emails, but does nothing to address the rest.

There are reasons to believe that this means the email in question comes from the Microsoft Exchange server and not from someone’s own mailbox (Update: though I may be 100% wrong on this point). Which, if my speculation that WikiLeaks might invoke the Nikulin alternate theory, might still show Assange got the emails in one batch early on, but then published what he got via the delivery identified in the indictment and didn’t spend much time vetting that delivery.

Meanwhile, it’s crucial to note, as Khatchadourian does in his earlier piece, that emails Guccifer 2.0 claimed were DNC documents when he released them the day after the WaPo revealed the DNC had been hacked didn’t come from the DNC; those that have been identified came, instead, from John Podesta. It wasn’t until July 6 that the Guccifer 2.0 documents billed as DNC ones actually were.

But then, on July 6th, just before Guccifer 2.0 complained that WikiLeaks was “playing for time,” this pattern of behavior abruptly reversed itself. “I have a new bunch of docs from the DNC server for you,” the persona wrote on WordPress. The files were utterly lacking in news value, and had no connection to one another—except that every item was an attachment in the D.N.C. e-mails that WikiLeaks had. The shift had the appearance of a threat. If Russian intelligence officers were inclined to indicate impatience, this was a way to do it.

The notion that the Guccifer 2.0 persona may have — in addition to discrediting the WaPo article and providing a quick cover for the Russian attribution of the hack — served to pressure Assange to keep to some kind of July 18 deadline raises more stakes on that detail from the GRU indictment, but also may relate to the kind of signaling we saw elsewhere.

Update: I should have laid out some of the logic behind emails we’ve got. First, WikiLeaks has claimed that all the emails they have come from the “accounts” of seven identified people.

The leaks come from the accounts of seven key figures in the DNC: Communications Director Luis Miranda (10520 emails), National Finance Director Jordon Kaplan (3799 emails), Finance Chief of Staff Scott Comer (3095 emails), Finanace Director of Data & Strategic Initiatives Daniel Parrish (1742 emails), Finance Director Allen Zachary (1611 emails), Senior Advisor Andrew Wright (938 emails) and Northern California Finance Director Robert (Erik) Stowe (751 emails).

Khatchadourian says they actually come from ten accounts.

The twenty thousand or so D.N.C. e-mails that WikiLeaks published were extracted from ten compromised e-mail accounts, and all but one of the people who used those accounts worked in just two departments: finance and strategic communications. (The single exception belonged to a researcher who worked extensively with communications.)

DNC automatically deleted emails after 30 days if they weren’t specifically saved (which is where this exfiltration estimate came from, which was off from the Mueller date by a week). Emails that precede the 30 day window (so April 19 or 25) or that weren’t part of one of the identified accounts may indicate another source.

As I disclosed July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

Yevgeniy Prigozhin’s Paid Trolls Prove His Legal Challenge to His Indictment To Be False

/39 Comments/in , , /by

I have long argued that the most visible error that Robert Mueller’s team has made thus far in their investigation of Russian involvement in the 2016 election was in charging Concord Management as part of the Internet Research Agency indictment. Doing so effectively charged Vladimir Putin’s crony, Yevgeniy Prigozhin, in both his natural and corporate form, giving him a way to defend against the charges without having to show up in person in the US to do so. On April 11, almost two months after first being indicted (and after Prigozhin assumed an official role in management of Concord so he could claim he needed to be personally involved in any defense of the company), some American lawyers from Reed Smith showed up to start defending Concord against the charges.

By paying money to have lawyers defend his corporate self against trolling accusations, Prigozhin got the opportunity to do several things:

  • Obtain discovery about what the government knew of his companies’ efforts and communications with (among others) Vladimir Putin
  • Challenge Robert Mueller’s authority as Special Counsel
  • Dispute Mueller’s theory that online trolls operated by foreigners should be subject to regulation under campaign finance law and DOJ’s Foreign Agents Registration Act (as well as laws prohibiting visa fraud)

Thus far, Prigozhin’s efforts have done no real damage. Mueller found a way to limit what Prigozhin could look at by requiring his lawyers keep most discovery here in the US. And he beat back Prigozhin’s first challenge to his authority in Judge Dabney Friedrich’s District Court; Concord has submitted an amicus brief in Roger Stone aide Andrew Miller’s challenge to Mueller’s authority under the same theory, but it won’t get a chance to appeal Friedrich’s decision itself unless the case actually goes to trial.

Prigozhin’s third challenge, to Mueller’s theory of the case, poses more of a problem. While Special Counsel has lots of case law to argue that when charging ConFraudUS you don’t need to prove the underlying crimes (here, that Prigozhin’s trolls committed campaign finance, FARA, and visa fraud violations), Prigozhin’s lawyers nevertheless have argued — starting formally in a brief filed on July 15 — that those poor Russian trolls sowing division in the US had no way of knowing they were supposed to register with the FEC and DOJ before doing so, and so could not be accused of fraudulently hiding their Russian nationality, location, and funding. Effectively, the brief argued over and over and over — some form of the word “willful” shows up 99 times in the filing, “mens rea” shows up 33 times, “knowingly” shows up 58 times — that these poor Russian trolls just can’t be shown to have willfully violated America’s laws against unregistered foreign influence peddling because they had no way to know about those laws.

No case has specifically addressed whether a willfulness mens rea is required in a § 371 defraud conspiracy case like this one. But that is only because of the novelty of this Indictment. In circumstances where, as here, complex regulations are implicated against a foreign national with no presence in the United States, and the threat of punishing innocent conduct is extant, courts frequently have expressed the need for a heightened mens rea requirement. And even in those cases favored by the Special Counsel in his prior briefing, which he erroneously believes serve to relax the standard for criminal intent—requiring only some vague proof that Concord knew “on some level” the existence of some unspecified “regulatory apparatus” governing foreign nationals who participate in some fashion in United States elections (Hr’g Tr. 9:17–22)— the concerns over the proof of mens rea are evident, just as they should be in any conspiracy case. It is simply impossible for any person, whether a foreign national or a U.S. citizen, to have any knowledge of, let alone understand, the Special Counsel’s imaginary “on some level” mens rea standard. Further, none of the cases relied upon by the Special Counsel provide any reason not to impose a willfulness requirement in this case.

As Mueller’s August 15 response emphasized, the trolls focused their challenge to this indictment on Brett Kavanaugh well before he was confirmed.

Concord repeatedly invokes (at 1, 7, 17, 19, 20, 23-24, 27, 31, 32) Judge Kavanaugh’s majority opinion in Bluman v. Federal Election Comm’n, 800 F. Supp. 2d 281 (D.D.C. 2011), sum aff’d, 565 U.S. 1104 (2012), and his concurring opinion in United States v. Moore, 612 F.3d 698 (D.C. Cir. 2010), but neither addresses Section 371. Bluman—a civil case—assessed the constitutionality of the ban on non-citizens’ political expenditures and cautioned that, when the government “seek[s] criminal penalties for violations of th[at] provision” (which requires a defendant “act ‘willfully’”), the government must prove the defendant’s “knowledge of the law.” 800 F. Supp. 2d at 292 (citation omitted; emphasis added). Similarly, Moore concerned a violation of Section 1001, which “proscribes only those false statements that are ‘knowingly and willfully’ made.’” 612 F.3d at 702 (Kavanaugh, J., concurring) (emphasis added). Accordingly, Judge Kavanaugh opined, the government must prove that “the defendant knew his conduct was a crime.” Id. at 704. Because Count One need not allege a violation of a substantive offense other than Section 371 and that statute does not contain an express “willful” element, Bluman and Moore contribute nothing to Concord’s mens rea argument.

Kavanaugh, Kavanaugh, Kavanaugh, Kavanaugh, Kavanaugh, Kavanaugh, Kavanaugh, Kavanaugh, Kavanaugh, the troll lawyers have been chanting since 6 days after he was nominated. And while Mueller’s team argued that those past Kavanaugh opinions did not address ConFraudUS, the newest Supreme Court Justice clearly believes any legal limits on foreign influence peddling must be clearly conveyed to those foreigners doing their influence peddling. Kavanaugh’s elevation, then, presented the real possibility that by charging Concord, Mueller might make it easier for foreigners to tamper in our election than for Americans.

Moreover, it looked like Trump appointee Dabney Friedrich (who gave the challenge to Mueller’s authority far more consideration than she should have) was sympathetic to the troll challenge to the indictment.  Not only did Friedrich seem sympathetic to the Concord challenge in a hearing on Monday, on Thursday she ordered Mueller’s team to be more specific about whether the trolls had to — and knew they had to — register with the FEC and DOJ.

Specifically, should the Court assume for purposes of this motion that neither Concord nor its co-conspirators knowingly or unknowingly violated any provision, civil or criminal, of FECA or FARA by failing to report expenditures or by failing to register as a foreign agent?

That is the genius (and I suspect, the entire point) of the complaint against Prigozhin’s accountant, Elena Alekseevna Khusyaynova, who oversees the funding of all these trolls, which was unsealed yesterday.

It provides proof that Prigozhin and Concord continued to engage in ConFraudUS long after receiving notice, in the form of that February 16 indictment, that the US considered engaging in such trolling without registration a crime.

Among the overt acts of the conspiracy, for example, the complaint describes Khusyaynova:

  • Requesting payment from Concord for trolling expenses on February 21, February 28, March 6, April 6, May 8, May 10, June 1, June 4, June 9, and July 10, 2018
  • Submitting a 107 million ruble budget in March to cover April’s expenditures, a 111 million ruble budget in April to cover May’s expenditures, and a 114 million budget for June in June (the complaint calculates these budgets to amount to over $5.25 million, though not all of that got spent in the US)
  • Following up with a Concord employee on April 11 and 12 to make sure one of Concord’s laundering vehicles, Almira LLC, paid its part of the budget for March expenditures
  • Spending $60,000 in Facebook ads and $6,000 in Instagram ads between January and June of this year
  • Spending $18,000 for “bloggers” and “developing accounts” on Twitter between January and June

In other words, the complaint shows that even after Concord got indicted for spending all this money to influence American politics, even after it hired lawyers to claim it didn’t know spending all that money was illegal, it continued to spend the money without registering with FEC or DOJ. The very same day Prigozhin’s lawyers filed their attorney appearances in court in DC, his accountant in St. Petersburg was laundering more money to pay for trolling.

But the true genius of the complaint comes in the evidence of trolling it cites. As noted, the complaint cites two trolls tweeting about the February 16 indictment of their own trolling.

@JemiSHaaaZzz (this was an RT): Dear @realDonaldTrump: The DOJ indicted 13 Russian nationals at the Internet Research Agency for violating federal criminal law to help your campaign and hurt other campaigns. Still think this Russia thing is a hoax and a witch hunt? Because a lot of witches just got indicted.

[snip]

@JohnCopper16: Russians indicted today: 13 Illegal immigrants crossing Mexican border indicted today: 0 Anyway, I hope that all those Internet Research Agency f*ckers will be sent to gitmo.

@JohnCopper16: We didn’t vote for Trump because of a couple of hashtags shilled by the Russians. We voted for Trump because he convinced us to vote for Trump. And we are ready to vote for Trump again in 2020!

Prigozhin has paid 7 months of legal fees arguing that he had no idea that this was a crime, even while paying $5 million, part of which paid his own trolls to describe being indicted for “violating federal criminal law” and asking to be sent to Gitmo for that crime.

And his trolls continued to claim they had knowledge of American campaign law, as when on March 14, almost a month after the indictment, @TheTrainGuy13 reposted a pro-Trump tweet noting that voter fraud is a felony.

The complaint even cites @KaniJJackson tweeting about a Net Neutrality vote on May 17, well after Reed Smith had told the court they were representing Concord to make claims that Prigozhin had no idea unregistered political trolling was illegal.

Ted Cruz voted to repeal #NetNeutrality. Let’s save it and repeal him instead.

Here’s the list of GOP senators who broke party lines and voted to save #NetNeutrality: Susan Collins John N Kennedy Lisa Murkowski Thank you!

Since July, Prigozhin’s Reed Smith lawyers have spent 326 pages briefing their claim that their poor foreign client and his trolls had no way of knowing that the United States expected him and his trolls to register before tampering in US politics. Even while they were doing that, in a complaint filed in sealed form three weeks ago, on September 28, DOJ had compiled proof that even after receiving official notice of the fact that the US considered that a crime on February 16, even after Prigozhin showed on April 11 his knowledge that the US considered that a crime by hiring attorneys to argue he couldn’t have known, he and his accountant and his trolls continued trolling.

As persuasive as Reed Smith lawyers have been in arguing Prigozhin couldn’t have known this was illegal, his trolls have laid out far better proof that he knew he was breaking the law.

As I disclosed July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

In What May Be a Second Bid to Go after Yevgeniy Prigozhin and Vladimir Putin, DOJ Charges Prigozhin’s Troll Accountant

/10 Comments/in , /by

The Eastern District of VA just charged the accountant for Yevgeniy Prigozhin’s influence operation Project Lakhta, Elena Alekseevna Khusyaynova, with conspiring to defraud the US, the same charge that Prigozhin company laywers lawyers are aggressively fighting in DC right now. On top of everything else, this charge may be an effort to get a second bid at laying out the crimes behind Prigozhin’s influence operation, first laid out on Mueller’s Internet Research Agency indictment, in a sustainable way.

Khusyaynova may be named, but the real target is Prigozhin

The affadvit against Khusyaynova not only incorporates the IRA indictment by reference, it repeats the introductory paragraph on Concord Consulting (the entity that’s challenging the Mueller indictment), changing only the name (replacing ORGANIZATION, referring to Internet Research Agency, with Project Lakhta, and lumping both Concord entities into one).

Defendants Concord Management and Consulting LLC and Concord Catering (collectively, “Concord”) are related Russian entities with various Russian government contracts. Concord was the primary source of funding for Project Lakhta operations. Concord controlled funding, recommended personnel, and oversaw Project Lakhta activities through reporting and interaction with the management of the various Project Lakhta entities.

It also repeats a paragraph from the IRA indictment on how Lakhta laundered money through a bunch of bank accounts.

To conceal the nature of Project Lakhta activities, since at least January 2016 the Conspiracy labeled the funds paid by Concord to Project Lakhta as payments related to software support and development. Moreover, since at least January 2016, Concord distributed funds to Project Lakhta through approximately fourteen bank accounts held in the names of Concord affiliates, including Glavnaya Liniya LLC, Merkuriy LLC, Obshchepit LLC, Potentsial LLC, RSP LLC, ASP LLC, MTTs LLC, Kompleksservis LLC, SPb Kulinariya LLC, Almira LLC, Pishchevik LLC, Galant LLC, Rayteks LLC, and Standart LLC.

The complaint against Khusyaynova focuses closely on Prigozhin, even calling him “Putin’s Chef” (not something that appeared in the IRA indictment). It also presents the same theory of the case as laid out in the IRA indictment: that by obscuring their foreign identity, the trolls prevent DOJ from administration FARA and the FEC from administering FECA.

In other words, while Khusyaynova may be named, the focus in this complaint is on Prigozhin’s use of money laundering to move Concord’s money into a troll operation targeting the US.

Prigozhin continues to fund influence operations affecting US politics

The complaint then lays out the influence operations conducted under the larger Lakhta umbrella, including IRA but also GlavSet, Federal News Agency, and others, describing how Khusyaynova funded it all. Of significant note, it describes how she paid for advertising on social media sites.

In addition to administrative expenses, such as office rent, utility payments, and garbage disposal, the budget identified IT expenses, such as “registration of domain names” and the purchase of “proxy servers,” and social media marketing expenses, such as expenses for “purchasing posts for social networks,” “[a]dvertisement on Facebook,” [a]dvertisement on VKontakte,” “[a]dvertisement on Instagram,” “[p]romoting news postings on social networks,” and social media optimization software (such as Twidium and Novapress) (preliminary translation of Russian text). The budgets also contained a section on “USA, EU” activities, which included itemized expenditures for “Instragram,” “Facebook advertisement” and “Activists” (preliminary translation of Russian text).

Having laid out that Khusyaynova was funneling money from Concord to pay for these things, the affidavit lays out how this funding engaged in US politics.

Its description of the trolling makes it clear that the trolls are still being instructed to take a view that benefits Trump, down to attacking Mueller.

Special prosecutor Mueller is a puppet of the establishment. List scandals that took place when Mueller headed the FBI. Direct attention to the listed examples. State the following: It is a fact that the Special Prosecutor who leads the investigation against Trump represents the establishment: a politician with proven connections to the U.S. Democratic Party who says things that should either remove him from his position or disband the entire investigation commission. Summarize with a statement that Mueller is a very dependent and highly politicized figure; therefore, there will be no honest and open results from the investigation. Emphasize that the work of this commission is damaging to the country and is aimed to declare impeachment of Trump. Emphasize that it cannot be allowed, no matter what.

Another of the trolls posted this image:

Though other trolls called to take to the streets and protest if Trump fires Mueller. Several of the trolls even RTed…

Dear @realDonaldTrump: The DOJ indicted 13 Russian nationals at the Internet Research Agency for violating federal criminal law to help your campaign and hurt other campaigns. Still think this Russia thing is a hoax and a witch hunt? Because a lot of witches just got indicted.

Or tweeted on both sides of the Mueller indictment of the IRA.

Russians indicted today: 13 Illegal immigrants crossing Mexican border indicted today: 0 Anyway, I hope that all those Internet Research Agency f*ckers will be sent to gitmo.

We didn’t vote for Trump because of a couple of hastags shilled by the Russians. We voted for Trump because he convinced us to vote for Trump. And we are ready to vote for Trump again in 2020!

And one of the key allegations involves the effort to provide advertising in support of this flash mob against Trump, including collaborating with Move On and Code Pink. Another of the key allegations describes @CovfefeNationUS’ efforts to raise money targeting (among others) Tammy Baldwin, Claire McCaskill, Nancy Pelosi, Maxine Waters, and Elizabeth Warren.

All of this, of course, is political influence peddling. By citing paid influence peddling, including some that extended beyond the time of the IRA indictment (meaning Concord was on notice that they needed to register) you make it clear this is paid foreign tampering.

This complaint re-situates the charges against Concord in sustainable way

I said, above, that this complaint may be designed to make the charges against Prigozhin sustainable. It comes — with its preliminary translation of Russian passages suggesting some haste — on the heels of a legal challenge by Concord’s US lawyer — of the ConFraudUs theory in this case. Concord has argued that because the indictment doesn’t allege it knew it had to register under FECA and FARA, the conspiracy itself is unsustainable.

Earlier this week, there was a hearing on that challenge in which Trump appointee Dabney Friedrich showed some sympathy for Concord’s argument.

Mueller alleges Concord Management, along with other defendants named in the indictment, conspired to impede the ability of the Justice Department to enforce the Foreign Agents Registration Act — which requires people who are lobbying in the U.S. on behalf of foreign individuals or entities disclose that lobbying — and the ability of the FEC to administer its ban on foreign expenditures in elections, under the Federal Election Campaign Act (FECA) .

Concord Management is arguing that Mueller has not shown in the indictment that the Russians knew about their legal obligations under those regulations, which according to Dubelier is required to bring criminal charges under the law, and is using the conspiracy charge as a workaround.

“They don’t have the evidence to charge a substantive violation of FARA or a substantive passport violation or a substantive FECA violation, because there is no evidence anywhere that any of these foreign people knew anything about any of these laws or regulations, none,” Dubelier said at the hearing.

Prosecutors argued that to bring the conspiracy count, all they need to show is that defendants had some knowledge that the government regulated those areas and that they took actions to impede that enforcement through acts of deception.

“It doesn’t matter if they knew it was the FEC or the DOJ or some other agency,” Mueller prosecutor Jonathan Kravis argued Monday. “They know that there is a lawful government function here, and they are acting with a purpose of interfering with it.”

Kravis pointed to the Russian trolls’ alleged move to disguise not just their identities, but the origin of the computer networks they used to influence the election on social media.

Then today, the judge in that case, Friedrich, asked for more briefing from Mueller’s team.

By issuing this complaint, the government does several things.

First, because this is just a complaint, Prigozhin isn’t going to be able to challenge it; his employee, Khusyaynova, would first have to be indicted, and then would have to show up in person to contest the charges, which isn’t going to happen.

But also, because this complaint focuses on the accountant’s role, it focuses much more closely (though not exclusively) on the laundering of the money, and not the laundering of the Russian origin of the voices engaging in politics.

In addition, because the conduct charged in the indictment continued after Concord was indicted in February 2018, they can no longer claim (as they are in the challenge to Mueller) that they didn’t have the knowledge and intent they were breaking the law. In the Concord challenge they argue,

In the absence of allegations specifically showing that Concord intended to interfere, or entered a conspiracy to interfere, with a lawful function relating to a U.S. election in a deceitful and dishonest manner, there is no basis for a § 371 defraud conspiracy charge whether elections were interfered with or not.

… And go on to cite the newest Justice on the Supreme Court insisting that you can’t charge foreigners unless you can be sure they know their conduct is against the law.

[W]e caution the government that seeking criminal penalties for violations of [law regulating foreign nationals’ political contributions or expenditures] will require proof of defendant’s knowledge of the law. There are many aliens in this country who no doubt are unaware of the statutory ban on foreign expenditures

Imagine how easy it will be to respond to this claim, regarding conduct that continued for four months after the initial indictment for the same conduct.

The result compelled by these overarching constitutional principles with respect to a § 371 defraud conspiracy is plain enough: where an indictment purports to charge in a complex and technical regulatory environment like U.S. elections and likewise threatens to sweep in core political speech as part of the offense, the indictment must spell out how and why the targeted individual or entity knew it was violating the law.

Finally, because this complaint focuses on a different named defendant, is charged out of a different office with no visible overlap in team, and encompasses a more recent time period (showing that the government continues to collect solid information on Prigozhin’s operation), there’s no double jeopardy issue and Friedrich can’t touch this case.

I don’t know whether Mueller will just dismiss Concord from the other indictment, and be done with that nuisance once and for all, or whether this is just designed to ensure that the allegations, and the tie to Putin, remain intact regardless of what happens in DC. But it does seem like a hasty bid to solidify the charges in a way that hews closer to past legal precedent.

Update: This post has been updated since initial posting.

PSA: Don’t Misunderstand the Function of a Mueller Report

/25 Comments/in , , /by

About a million people have asked me to weigh in on this story, which relies on unnamed defense attorneys (!! — remember that its author, Darren Samuelson, was among those citing Rudy Giuliani’s FUD in the wake of the Paul Manafort plea) and named former prosecutors, warning that people may be disappointed by the Mueller “report.”

President Donald Trump’s critics have spent the past 17 months anticipating what some expect will be among the most thrilling events of their lives: special counsel Robert Mueller’s final report on Russian 2016 election interference.

They may be in for a disappointment.

That’s the word POLITICO got from defense lawyers working on the Russia probe and more than 15 former government officials with investigation experience spanning Watergate to the 2016 election case. The public, they say, shouldn’t expect a comprehensive and presidency-wrecking account of Kremlin meddling and alleged obstruction of justice by Trump — not to mention an explanation of the myriad subplots that have bedeviled lawmakers, journalists and amateur Mueller sleuths.

Perhaps most unsatisfying: Mueller’s findings may never even see the light of day.

The article then goes on to cite a range of impressive experts, though it quotes zero of the defense attorneys, not even anonymously, except in linking back to Rudy warning that the White House would try to block the public release of any report by invoking executive privilege.

Without having first laid out what Samuelson imagines people expect from the report or even what he himself thinks, the piece’s quotes lay out the assumptions of his sources. “He won’t be a good witness,” says Paul Rosenzweig, suggesting he imagines Congress will invite Mueller to testify about his report to understand more about it. Mary McCord, who knows a bit about the investigation having overseen parts of it when she was still acting NSD head, said “It will probably be detailed because this material is detailed, but I don’t know that it will all be made public,” which seems to suggest it will collect dust at DOJ. Paul McNulty, who worked with Mueller in the Bush Administration, acknowledges that Mueller, “knows there are a lot of questions he needs to address for the sake of trying to satisfy a wide variety of interests and expectations.” All those quotes may be true and still irrelevant to what might happen with the Mueller report.

Later in his piece, Samuelson does lay out his assumptions (this time citing none of his impressive sources). Samuelson posits, for example, that, “it will be up to DOJ leaders to make the politically turbo-charged decision of whether to make Mueller’s report public.” He claims Democrats hope to win a majority and with it “subpoena power to pry as much information as possible from the special counsel’s office.” In those comments, Samuelson betrays his own assumptions, assumptions which may not be correct.

Start with this. Even though Samuelson has covered this investigation closely, he somehow missed the speaking indictments covering Russian actions, to say nothing of the 38 pages of exhibits on how Paul Mananfort runs a campaign accompanying the plea deal of Trump’s former campaign manager. It appears he has missed the signs that Mueller — if he has an opportunity — will not be using his mandated report to do his talking.

He’ll use indictments.

Which is probably something you don’t learn listening to defense attorneys who won’t go on the record. But you might learn if you consider what Patrick Fitzgerald has to say. Like McNulty, Fitz also worked closely with Mueller, not just during the four years he served as special counsel investigating the CIA leak case, but during the almost 11 years when Fitz was US Attorney in Chicago and Mueller was FBI Director. Also, while he’s not a defense attorney in the Mueller case, he is representing a key witness, Jim Comey, in it and had a partner, Greg Craig, investigated by it. Fitz basically says that the Scooter Libby trial revealed “a fair amount about what we did.”

Patrick Fitzgerald, the independent counsel in the Plame investigation, was under no obligation to write a report because of the specific guidelines behind his appointment. Testifying before Congress as his probe was ending, Fitzgerald defended the approach by noting that grand jury witnesses expect secrecy when they testify. He also noted that a 2007 public trial involving I. Lewis “Scooter” Libby, a former top aide to Vice President Dick Cheney convicted for perjury, had revealed much of the investigation’s details.

“I think people learned a fair amount about what we did,” Fitzgerald said. “They didn’t learn everything. But if you’re talking about a public report, that was not provided for, and I actually believe and I’ve said it before, I think that’s appropriate.”

Fitz is right. He revealed a lot in that trial, having fought hard to be able to get much of it cleared by the spooks to be publicly released. He revealed enough that, had the Democratically-controlled Congress seen fit in 2007, they could have conducted investigations into the impropriety of things constitutional officer Dick Cheney did in pushing the release of Valerie Plame’s identity. In a key hearing, Joe Wilson actually pulled any punches directed at Cheney. It is my belief, having been present at some key events in this period, that had a witness instead laid out all the evidence implicating Cheney, Congress may well have taken the evidence Fitz released in the trial and used it to conduct further investigation.

No one will have to make that case about Trump to Democrats in the wake of a Mueller investigation, I imagine.

I’ve got a piece coming out next week that lays out what role I think the vaunted Mueller report really plays, because I think it does play a role, a role that Samuelson doesn’t even consider.

But for now, I’ll point to Fitz comments as a way to say that, even drawing as he does on a great number of experts about how such investigations have worked in the past, Samuelson is not drawing the correct lessons. The first of which is that Mueller would prefer to lay out his “report” in trial exhibits.

As I disclosed July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

Who Told Carter Page that James Wolfe Was the Source of the FISA Leak?

/20 Comments/in , , /by

There’s a detail in the Statement of the Offense filed in conjunction with the guilty plea former Senate Intelligence Committee Director of Security James Wolfe worth further attention.

As I had noted when Wolfe was indicted, while the indictment catches Wolfe red-handed in lies about unclassified leaks Wolfe gave to Ali Watkins and some NBC reporters, it seems more interested in, and therefore probably arose out of, Wolfe’s ties with the reporters on the WaPo story first reporting that Carter Page had been targeted with a FISA order. Rather than having to prove that Wolfe leaked classified FISA information to a journalist with better operational security than the others, the government chose instead to charge him for the more easily proved case that he lied to the FBI.

The statement of offense confirms that the investigation arose in response to the FISA story.

On April 11, 2017, classified national security information concerning the existence and predication of FBI surveillance of an individual (“MALE-1”) pursuant to the Foreign Intelligence Surveillance Act (FISA) was published in an article authored by three reporters, including REPORTER #1.

In April 2017, the Federal Bureau of Investigation (FBI) opened an investigation into the unauthorized disclosure of this classified information to the news media.

And whereas the indictment had mostly discussed Wolfe’s conversations with the WaPo reporter obliquely, the statement of the offense describes how Wolfe followed up by email after meeting the reporter on December 9, 2015, and how the reporter then checked in the day before the election.

What’s more interesting, however, are the details about the aftermath of the story, when Carter Page wrote to the journalist in question and BCCed Wolfe.

On May 8, 2017, MALE-1 emailed REPORTER #1 complaining about REPORTER #1’s reporting of him (MALE-1). According to the metadata recovered during the search of Wolfe’s email, Wolfe was blind-copied on that email by MALE-1.

The day before Page sent that email, he had written a letter to Richard Burr and Mark Warner, complaining about the WaPo story and Ali Watkins’ reporting that Page was the anonymous person named in the  case. It seems that Page either learned or discovered that Wolfe might be the person who leaked the FISA news.

And as the Statement lays out, it seems that Wolfe and the journalist in question exchanged an encrypted file.

On May 11, 2017, at 11:13 a.m., REPORTER #1 emailed Wolfe, “What’s your cell?” The signature block of REPORTER #1’s email contained the reporter’s name, affiliation with a national news outlet, and telephone numbers.

On May 11, 2017, at 5:16 p.m., REPORTER #1 sent a second email to Wolfe, writing “Hi! When can we get coffee?” This time, the signature block of the second email included a 44-character long code made up of letters and numbers that appears to be a “PGP” fingerprint. If used, this fingerprint would have permitted Wolfe to send REPORTER #1 an email using an application that would encrypt the contents of the message, but not the subject line or the name of the sender.

Between the December 9, 2015, November 7, 2016, and two May 11, 2017 emails, the Statement lays out four email exchanges between Wolfe and this journalist. But the indictment says there was a fifth, possibly in June 2017.

For example, between in or around December 2015 and in or around June 2017, WOLFE and REPORTER #1 communicated at least five times using his SSCI email account.

In any case, that Page BCCed Wolfe suggests that he suspected Wolfe was the source, and perhaps said as much in his email to the reporter (thus explaining the follow-up between them).

As it is this Statement (and the indictment of Natalie Mayflower Sours Edwards for sharing FinCen data with Jason Leopold yesterday, but I’ll return to that) may suggest that the government obtained the reporter’s emails, but then parallel constructed doing so by collecting Wolfe’s. But it also suggests that Page knew precisely who leaked the FISA information.

As I disclosed in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

On Corey Lewandowski’s Big Legal Bills and Mueller’s Deadline from Rosenstein

/167 Comments/in , /by

Quarterly political spending reports are out and they provide some hints about which current or former Trump aides have been spending a lot of time with Mueller’s investigators. The NYT reported the other day that the Trump campaign has paid $173,000 in the past quarter to the law firm representing Corey Lewandowski.

The campaign also paid $173,000 to Mintz Levin, a law firm that has helped Mr. Trump’s first campaign manager, Corey Lewandowski, handle inquiries related to the Russia investigations.

The suggestion that Lewandowski has spent quality time with Mueller’s team of late is particularly interesting, for several reasons. First, Lewandowski had a number of key interactions with George Papadopoulos regarding the outreach from Russia, including drafting Trump’s first foreign policy speech, which Papadopoulos reportedly told Ivan Timofeev was a sign that the campaign was interested in pursuing a Trump-Putin meeting.

April 27: Papadopoulos to Corey Lewandowski

“to discuss Russia’s interest in hosting Mr. Trump. Have been receiving a lot of calls over the last month about Putin wanting to host him and the team when the time is right.”

April 27: Papadopoulos authored speech that he tells Timofeev is “the signal to meet”

[snip]

May 4, Papadopoulos to Lewandowski (forwarding Timofeev email):

“What do you think? Is this something we want to move forward with?”

May 14, Papadopoulos to Lewandowski:

“Russian govemment[] ha[s] also relayed to me that they are interested in hostingMr. Trump.”

[snip]

June 19: Papadopoulos to Lewandowski

“New message from Russia”: “The Russian ministry of foreign affairs messaged and said that if Mr. Trump is unable to make it to Russia, if a campaign rep (me or someone else) can make it for meetings? I am willing to make the trip off the record if it’s in the interest of Mr. Trump and the campaign to meet specific people.”

Lewandowski was also the person that the House Intelligence Committee treated most curiously. HPSCI originally interviewed him in January, during the phase when HPSCI seemed to be interviewing key witnesses to be able to pass on to Trump how they would testify. At that point, Mueller had not yet contacted Lewandowski.

Even though Lewandowski never worked in the Administration, in that first appearance with HPSCI, he invoked privilege over parts of his testimony. On March 8, HPSCI brought him back, the very last witness in their so-called investigation. After his three hour appearance, Adam Schiff discussed subpoenaing Lewnadowski to compel him to answer questions he had still refused to answer (Schiff had also demanded HPSCI compel full testimony from Hope Hicks). In the same discussion of compelling Lewandowski to answer questions,  Schiff suggested the committee should subpoena Stephen Miller.

After Lewandowski’s testimony had wrapped, Schiff raised a new name he wanted to speak to: White House aide Stephen Miller.

Which is curious because WSJ reports that the legal defense fund supporting specific former campaign staffers paid Akin Gump $115,000.

The fund directed most of its third-quarter spending to legal consulting, paying nearly $115,000 to the law firm Akin Gump Strauss Hauer & Feld LLP and another $8,500 to Schertler & Onorato LLP. The latter firm has represented Keith Schiller, Mr. Trump’s longtime bodyguard who was interviewed by the House Intelligence Committee as part of its Russia investigation.

It’s not publicly known which former campaign staffer Akin Gump represents, but two of the few key Trump people whose lawyers have not been publicly identified are Brad Parscale (though the campaign would probably pay for his legal defense at this point) and Miller.

Miller is the person whom Papadopoulos has said he would have told about the Russian offer of emails had he actually connected by phone the day he learned of it.

Meanwhile, Bloomberg reports (possibly based on Congressional sources) that Mueller is preparing to offer “reports” on his investigation.

Mueller is close to rendering judgment on two of the most explosive aspects of his inquiry: whether there were clear incidents of collusion between Russia and Donald Trump’s 2016 campaign, and whether the president took any actions that constitute obstruction of justice, according to one of the officials, who asked not to be identified speaking about the investigation.

[snip]

Rosenstein has made it clear that he wants Mueller to wrap up the investigation as expeditiously as possible, another U.S. official said.

This is actually not at all surprising. Trump is going to start firing people after the election, so Mueller’s ability to work unimpeded may be dramatically curtailed shortly after that. If he’s going to bring a big indictment, he has to do so in that time frame. Plus, after securing Paul Manafort and Michael Cohen’s cooperation, he has cooperating witnesses on all the elements of a conspiracy Mueller had identified by last March, not to mention slam dunk obstruction charges tied to floated pardons. Everyone is scheduled to start being sentenced after the election, too. With the hints he has gotten extensive Lewandowski testimony (and reports that he had obtained far more documentation pertaining to Don Jr’s actions), it would suggest that Mueller has at least tracked the game of telephone between Russians offering emails to the candidate anxious to accept that offer.

So this tells us what we might expect: the denouement of the Mueller investigation will happen, unless Trump works to undercut it, just after the election.

Update: In their plan for further investigation released in March, HPSCI Dems described that in his second committee appearance Lewandowski refused, “to answer questions regarding his communication with President Trump regarding former FBI Director Comey, Special Counsel Mueller, and Attorney General Sessions, as well as his communications with certain administration officials pertaining to the June 9, 2016 meeting at Trump Tower.” So it sounds like he’s also got evidence pertaining to the June 9 meeting.

As I disclosed in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

The First Amendment Wall-Splat that Anticipates Any Defense of a Trump Conspiracy or WikiLeaks Charge

/17 Comments/in , , , /by

Last week, lawyers from Jones Day representing the Trump campaign submitted a response to a lawsuit by two Democratic donors and a DNC employee (the case is referred to as Cockrum after donor Roy Cockrum) that presents an interesting, but imperfect, preview of any defense of a Trump conspiracy and/or a WikiLeaks charge in the election hack-and-leak.

Effectively, the Democrats attempt to hold the Trump campaign responsible for having their private information (social security numbers in the case of the donors and more personal conversations in the case of DNC employee Scott Comer) posted in the emails released by WikiLeaks on July 22, 2016. They do so by arguing that the Trump campaign conspired with agents of Russia, agreeing to provide policy considerations in exchange for the assistance presented by the email release, which therefore makes them parties to the injury associated with the hack-and-leak.

The campaign isn’t responsible for information released as part of their conspiracy because the First Amendment protects it

In response, the Trump campaign (represented by Jones Day, and therefore by more competent lawyers than some of the clowns representing the president in the Mueller investigation) only secondarily deny the campaign entered into a conspiracy with the Russians as governed by the laws invoked by plaintiffs (you should not take this emphasis as admission of guilt in a conspiracy, but rather the most efficacious way of defeating the lawsuit). As a primary defense, they point to First Amendment precedent to argue two things: First, the campaign can’t be held responsible for the theft of information because they only sought the dissemination of already stolen documents — they had nothing to do with the theft of the documents, the campaign argues.

In Bartnicki v. Vopper, 532 U.S. 514 (2001), the Supreme Court held that the First Amendment protects a speaker’s right to disclose stolen information if (1) the speaker was “not involved” in the acquisition and (2) the disclosure deals with “a matter of public concern.” Id. at 529, 535. There, union leaders spoke on the phone about using violence against school-board members to influence salary negotiations. Id. at 518–19. An unknown person secretly intercepted the call and shared the illegal recording with a local radio host, who played it on his show. Id. at 519. The Court ruled that the First Amendment protected the radio broadcast, because the host “played no part in the illegal interception” and “the subject matter of the conversation was a matter of public concern.” Id. at 525. The Court reasoned that “state action to punish the publication of truthful information seldom can satisfy constitutional standards.” Id. at 527. The state has an interest in deterring theft of information, but it must pursue that goal by imposing “an appropriate punishment” on “the interceptor”—not by punishing a speaker who was “not involved in the initial illegality.” Id. at 529. The state also has an interest in protecting “privacy of communication,” but “privacy concerns give way when balanced against the interest in publishing matters of public importance.” Id. at 533–34. In short, “a stranger’s illegal conduct does not suffice to remove the First Amendment shield from speech about a matter of public concern.” Id. at 535.

“An opposite rule”—under which a speaker may be punished for truthful disclosures on account of a “defect in the chain of title”—“would be fraught with danger.” Boehner v. McDermott, 484 F.3d 573, 586 (D.C. Cir. 2007) (opinion of Sentelle, J., joined by a majority of the en banc court). “U.S. newspapers publish information stolen via digital means all the time.” Jack L. Goldsmith, Uncomfortable Questions in the Wake of Russia Indictment 2.0 (July 16, 2018).1 Indeed, they “openly solicit such information.” Id. Punishing “conspiracy to publish stolen information” “would certainly narrow protections for ‘mainstream’ journalists.” Id.

The Campaign satisfies the first part of Bartnicki’s test: It “played no part in the illegal interception.” Bartnicki, 532 U.S. at 525. That is clear from Plaintiffs’ factual theory: “Defendants entered into an agreement with other parties, including agents of Russia and WikiLeaks, to have information stolen from the DNC publicly disseminated in a strategic way.” (Am. Compl. ¶ 16) (emphasis added). The complaint reinforces that theory on every page: “the publication of hacked information pursuant to the conspiracy” (id. ¶ 20); “conspiracy … to disseminate information” (id. ¶ 78); “extracting concessions … in exchange for the dissemination of the information” (id. ¶ 149); “an agreement to disseminate the hacked DNC emails”) (id. at 42); “motive to coordinate regarding such dissemination” (id. ¶ 153); “an agreement regarding the publication” (id. ¶ 154); “agreed … to publicly disclose” (id. ¶ 296) (all emphases added).

In a key move, the response points to the chronology (they incorrectly say) the plaintiffs lay out to show that the Campaign didn’t enter into a conspiracy with the Russians until after the theft had already taken place.

That is no surprise. Given Rule 11, Plaintiffs could not have alleged the Campaign’s involvement in the initial hack. According to Plaintiffs’ own account, Russian intelligence hacked the DNC’s networks “in July 2015,” and gained access to email accounts “by March 2016.” (Id. ¶ 86.) But the Campaign supposedly became motivated to work with Russia only in “the spring and summer of 2016” (id. at 25), and supposedly entered into the agreement in “secret meetings” in “April,” “May,” “June,” and “July” 2016 (id. ¶¶ 89–104). In other words, Plaintiffs themselves say that the alleged conspiracy was formed after the hack and after the acquisition of the emails—so that the Campaign could not have participated in the initial theft.

From there, the Campaign shifts to the second part of the First Amendment argument: what they encouraged the Russians (and WikiLeaks) to publish was a matter of public concern.

The Campaign also satisfies the second part of Bartnicki’s test: the disclosure deals with “a matter of public concern.” Bartnicki, 532 U.S. at 525. Whether speech deals with issues of public concern is “a matter of law.” Snyder v. Phelps, 580 F.3d 206, 220 (4th Cir. 2009). “Speech deals with matters of public concern when it can be fairly considered as relating to any matter of political, social, or other concern to the community, or when it is a subject of legitimate news interest.” Snyder v. Phelps, 562 U.S. 443, 453 (2011) (citations and quotation marks omitted). A court applying this test must examine the “content, form, and context” of the speech. Id.

Courts judge the public character of a disclosure in the aggregate, not line by line. Regardless of whether the particular sentence complained about is itself of public concern, the disclosure is constitutionally protected if the disclosure as a whole deals with a matter of public concern. For example, in Bartnicki, leaders of a teachers’ union spoke on the phone about “blow[ing] off [school-board members’] front porches” to influence salary negotiations. 532 U.S. at 519. Even though the threat to “blow off” porches was not itself speech about public issues, the First Amendment protected the disclosure because the host made it while “engaged in debate about” teacher pay—“a matter of public concern.” Id. at 535. The “public concern” test thus turns on the broader context of the disclosure, not the nature of the specific fact disclosed.

To substantiate their “public concern” defense, the response points to (and includes as exhibits) a handful emails out of the tens of thousands dumped in just the DNC release and some bad press coverage, and argues that because WikiLeaks has a policy of not redacting emails, the information that damaged the plaintiffs just came out along with this public concern information.

These emails revealed important information about the Clinton Campaign and Democratic Party. For example:

  • The emails revealed DNC officials’ hostility toward Senator Sanders. DNC figures discussed portraying Senator Sanders as an atheist, because “my Southern Baptist peeps would draw a big difference between a Jew and an atheist.” (Ex. 1.) They suggested pushing a media narrative that Senator Sanders “never ever had his act together, that his campaign was a mess.” (Ex. 2.) They opposed his push for additional debates. (Ex. 3.) They complained that he “has no understanding” of the Democratic Party. (Ex. 4.)
  • According to The New York Times, “thousands of emails” between donors and fundraisers revealed “in rarely seen detail the elaborate, ingratiating and often bluntly transactional exchanges necessary to harvest hundreds of millions of dollars from the party’s wealthy donor class.” These emails “capture[d] a world where seating charts are arranged with dollar totals in mind, where a White House celebration of gay pride is a thinly disguised occasion for rewarding wealthy donors and where physical proximity to the president is the most precious of currencies.” (Ex. 5.)
  • The emails revealed the coziness of the relationship between the DNC and the media. For example, they showed that reporters would ask DNC to pre-approve articles before publication. (Ex. 6.) They also showed DNC staffers talking about giving a CNN reporter “questions to ask us.” (Ex. 7.)
  • The emails revealed the DNC’s attitudes toward Hispanic voters. One memo discussed ways to “acquire the Hispanic consumer,” claiming that “Hispanics are the most brand loyal consumers in the World” and that “Hispanics are the most responsive to ‘story telling.’” (Ex. 8.) Another email pitched “a new video we’d like to use to mop up some more taco bowl engagement.” (Ex. 9.)

WikiLeaks, however, did not redact the emails, so the publication also included details that Plaintiffs describe as private.

In this scenario, even assuming the Trump campaign did enter a conspiracy with the Russians, the plaintiffs in this lawsuit were just collateral damage to disclosures protected by the First Amendment.

The conspiracy to hurt individual Democratic donors defense

As noted, the defense against the claim that the campaign entered into a conspiracy with the Russians is only a secondary part of the defense here. Perhaps that’s because this part of the defense is far weaker than the First Amendment part.

As part of it, the response notes that the plaintiffs would have had to enter into a conspiracy with the goal and the state of mind laid out by the two laws primarily cited by plaintiffs, to intimidate voters and to intentionally inflict harm on plaintiffs. Once again, this part of the argument treats the plaintiffs as collateral damage to the goals of embarrassing the DNC effectuated by the publication of materials by WikiLeaks, which has a policy of not redacting anything in its releases.

Plaintiffs do not plausibly allege these states of mind. For one thing, Plaintiffs allege that the object of the purported conspiracy was to promote the Trump Campaign and to embarrass the DNC and the Clinton Campaign. (Am. Compl. ¶ 190.) They do not allege facts showing that the Campaign even knew of Mr. Comer, Mr. Cockrum, or Mr. Schoenberg, much less that Campaign officials met with Russian agents for the purpose of disclosing these individuals’ social security numbers, gossip, and stomach-flu symptoms.

For another thing, Plaintiffs fail to address (let alone refute) the “obvious alternative explanation” for the disclosure of their emails (Iqbal, 556 U.S. at 682): WikiLeaks’ “accuracy policy,” under which WikiLeaks does not redact or “tamper with” the documents it discloses. (Ex. 10.) The upshot is that Plaintiffs do not plausibly allege that the Campaign acted with the purpose of intimidating Plaintiffs; do not plausibly allege that the Campaign acted with the specific intent to disclose Plaintiffs’ allegedly private emails; and do not plausibly allege that the Campaign acted with knowledge that the WikiLeaks email collection included Plaintiffs’ allegedly private emails.

It’s the other part of the conspiracy defense where the response is dangerously weak, given the possibility that Mueller will roll out another indictment providing more detail on negotiations between the campaign and Russia (which plaintiffs could then add in an amended complaint). Here, the campaign argues only that the plaintiffs haven’t shown proof of a conspiracy because they have not yet pointed to evidence that the campaign sought the DNC emails specifically, including the details that allegedly damaged the plaintiffs.

[T]he Amended Complaint fails to plausibly allege that the Campaign conspired with or aided and abetted the publishers of the DNC emails. Plaintiffs allege a series of meetings between the Campaign and Russian agents in 2016. (Id. ¶ 15.) But Plaintiffs do not allege that any of the meetings in any way concerned the DNC emails, much less the information about Plaintiffs contained in those emails. The allegation that people met to discuss something does not raise a plausible inference that they met to discuss collaborative efforts to release specific emails hacked from the DNC to influence an election, much less to intimidate or embarrass Plaintiffs. Cf. Twombly, 550 U.S. at 567 n.12 (regular meetings do not suggest conspiracy).

This argument may be sufficient for this civil suit, but for a number of reasons, such an argument would be totally insufficient in a criminal case. For starters, there likely is evidence, not least obtained from Paul Manafort’s cooperation, that the campaign had some idea of what they might get in exchange for entering into a quid pro quo with the Russians. As it is, Jones Day is utterly silent about Don Jr’s, “If it’s what you say I love it especially later in the summer” email, which reflects some expectation, already by June 3, 2016, of what the campaign would get for entering into a conspiracy, even though plaintiffs quote it in their complaint.

But also, the conspiracy charged in a criminal indictment would allege a different goal — in part, the embarrassment of the DNC and support of the Trump campaign that the campaign response stops far short of denying. So while with respect to the suit brought by these plaintiffs, the argument that the defendants did not have the mindset of trying to intimidate voters or damage the plaintiffs, if and when Mueller charges a conspiracy, it will argue a different mind set, to defraud the US’ election integrity, in part to obtain a thing of value from the Russians. And that mindset is going to be much easier to prove.

This response does next to nothing to deny that mindset.

Instead, much later in the response (as part of an argument that plaintiffs can’t claim a conspiracy to violate campaign finance laws because the FEC preempts it), the campaign does address what might be one defense in a criminal indictment charging that the Trump team conspired with Russia with the goal of obtaining illegal campaign donations in the form of dirt on Hillary. The response argues that such released emails do not constitute a thing of value, but are instead protected political speech.

Plaintiffs in all events fail to establish a conspiracy to violate any federal campaign-finance law. Plaintiffs assert that federal law prohibits foreign nationals from making “a contribution or donation of money or other thing of value” in connection with an election, 52 U.S.C. § 30121(a), and that “Defendant’s co-conspirators … contributed a ‘thing of value’ … in the form of the dissemination of hacked private emails” (Am. Compl. ¶ 215). This assertion is incorrect. For one, there is a fundamental difference between contributing a thing of value and engaging in pure political speech. Pure political speech constitutes “direct political expression”; in contrast, “while contributions may result in political expression if spent by a candidate or association to present views to the voters, the transformation of contributions into political debate involves speech by someone other than the contributor.” Buckley v. Valeo, 424 U.S. 1, 21–22 (1976). The disclosure of information about a political party is pure political speech, not a political contribution. The disclosure itself directly expresses political messages; unlike money, it does not need to be transformed into a political message by somebody else.

For another, treating a disclosure of information as a “contribution” would violate the First Amendment. The Supreme Court has held that the First Amendment guarantees Americans the right to receive political speech from foreigners. Lamont v. Postmaster General, 381 U.S. 301, 306 (1965). Yet under Plaintiffs’ theory, it would be illegal to solicit political information from a foreign national, because the provision of such information would amount to a “contribution.” For example, “if the Clinton campaign heard that Mar-a-Lago was employing illegal immigrants in Florida and staffers went down to interview the workers, that would be a crime.” Eugene Volokh, Can it be a crime to do opposition research by asking foreigners for information? (July 27, 2017).2 “Or say that Bernie Sanders’s campaign heard rumors of some misconduct by Clinton on her trips abroad—it wouldn’t be allowed to ask any foreigners about that.” Id. The First Amendment does not tolerate such results.

This claim, if it were substantiated, would have repercussions across Mueller’s work, extending to the Internet Research Agency indictment (indeed, Concord Consulting is trying to make similar arguments, though not as brazenly suggesting that foreigners have a First Amendment right to weigh in on our elections).

Yet, as I’ve noted, Mueller has already collected evidence of how much a similar campaign to the one the Russians conducted would cost a campaign, in the form of the spooked up Psy-Group campaign offered by Israelis and Gulf supporters: $3.31 million. That is, Mueller has the evidence to show that the Russians did not just release the information, but engaged in an entire social media campaign to maximize the value of the information they released, and that information goes beyond simple publication to the stuff that political consultants charge real money for.

The other problems with this defense

There is far more to the campaign’s defense (notably, extensive arguments about whether state or federal law applies to particularly parts of the complaint, and if it’s state law, whether it’s Maryland, New Jersey, and Tennessee as plaintiffs argue, or Virginia and New York as defendants do) than what I’ve laid out, and this suit would be a challenge in any case. But there are other problems with the defense.

In a piece on this response, Floyd Abrams argues that there are key differences between the primary First Amendment precedent on which the defense relies and this case. For example, the Bartnicki case focused on material the entirety of which was in the public interest, whereas the bulk of what the Russians gave WikiLeaks is not.

[T]he entirety of the wiretapped recording in Bartnicki was of undoubted public interest while some portions of the purloined DNC documents had a special claim to being of no sustainable public interest while inflicting substantial potential privacy harm—including social security numbers sent to the DNC which WikiLeaks, as it has repeatedly chosen to do, decided to make public.

Jones Day may well realize this is a weak part of their argument, as they return to WikiLeaks’ failure to redact information that had no public interest in a number of ways. At one point, they argue that if WikiLeaks redacted information some information of public interest might get withheld as part of the process.

To establish public-disclosure liability, a plaintiff must show that the facts at issue are not “of legitimate concern to the public”—in other words, that the facts are not “of the kind customarily regarded as ‘news.’” Second Restatement § 652D & comment g. Like the First Amendment test, the tort-law test requires courts to analyze speech “on an aggregate basis.” Alvarado v. KOB-TV, LLC, 493 F.3d 1210, 1221 (10th Cir. 2007). A publisher does not have to “parse out concededly public interest information” “from allegedly private facts.” Id. That is because redactions would undermine the “credibility” of a disclosure, causing the public to doubt its accuracy. Ross v. Midwest Commc’ns, Inc., 870 F.2d 271, 275 (5th Cir. 1989). Further, requiring publishers to redact—“to sort through an inventory of facts, to deliberate, and to catalogue”—“could cause critical information of legitimate public interest to be withheld until it becomes untimely and worthless to an informed public.” Star-Telegram, Inc. v. Doe, 915 S.W.2d 471, 475 (Tex. 1995).

At another point, they argue (this is one of their most ridiculous arguments) that WikiLeaks is just an intermediary that the Russians used to post injurious messages.

Under section 230 of the Communications Decency Act (47 U.S.C. § 230), a state may impose liability on “the original culpable party who posts [tortious] messages,” but not on “companies that serve as intermediaries for other parties’ potentially injurious messages.” Zeran v. America Online, 129 F.3d 327, 330–31 (4th Cir. 1997). As a result, a website that provides a forum where “third parties can post information” is not liable for the third party’s posted information. Klayman v. Zuckerberg, 753 F.3d 1354, 1358 (D.C. Cir. 2014). Since WikiLeaks provided a forum for a third party (the unnamed “Russian actors”) to publish content developed by that third party (the hacked emails), it cannot be held liable for the publication.

And the insistence that WikiLeaks is known not to redact information may hurt the Trump campaign if it gets that far.

Abrams also points to how entering into a conspiracy might change the legal liability of the Trump campaign.

[T]he Bartnicki defendants were at all times entirely independent of the person who surreptitiously made the wiretapped recording available to it while the Trump campaign is accused in Cockrum of conspiring with its alleged Russian source after the information had been hacked to make the information public.

Even for the purpose of this lawsuit, the claim that the Trump campaign entered into a conspiracy only after the information had been hacked may not be sustainable. After all, George Papadopoulos learned the Russians were going to release emails, of some sort (even if he believed they were Hillary server emails rather than DNC ones), well before the Russians were ejected from the DNC servers a month later. The Russians first contacted the Trump campaign about this conspiracy on April 26, 2016, after they had stolen the Podesta emails in March; but the DNC emails that are the subject of this lawsuit weren’t exfiltrated, at least according to the GRU indictment, until a month later.

Between on or about May 25, 2016 and June 1, 2016, the Conspirators hacked the DNC Microsoft Exchange Server and stole thousands of emails from the work accounts of DNC employees.

So Papadopoulos’ responsiveness might be enough to sustain a claim that the Trump campaign was engaged in this conspiracy before the emails in question were stolen. Indeed, this paragraph from the response (cited above) falsely claims that the plaintiffs suggested the theft ended in March.

Plaintiffs could not have alleged the Campaign’s involvement in the initial hack. According to Plaintiffs’ own account, Russian intelligence hacked the DNC’s networks “in July 2015,” and gained access to email accounts “by March 2016.” (Id. ¶ 86.) But the Campaign supposedly became motivated to work with Russia only in “the spring and summer of 2016” (id. at 25), and supposedly entered into the agreement in “secret meetings” in “April,” “May,” “June,” and “July” 2016 (id. ¶¶ 89–104). In other words, Plaintiffs themselves say that the alleged conspiracy was formed after the hack and after the acquisition of the emails—so that the Campaign could not have participated in the initial theft.

Here’s what the complaint really says:

In order to defeat Secretary Clinton and help elect Mr. Trump, hackers working on behalf of the Russian government broke into computer networks of U.S. political actors involved in the 2016 election, including the DNC and the Clinton Campaign. Elements of Russian intelligence gained unauthorized access to DNC networks in July 2015 and maintained that access until at least June 2016. By March 2016, the Russian General Staff Main Intelligence Directorate (GRU) gained unauthorized access to DNC networks, DCCC networks, and the personal email accounts of Democratic Party officials and political figures.

By May 2016, the GRU had copied large volumes of data from DNC networks, including email accounts of DNC staffers. Much of the GRU’s activity within the DNC networks took place between March and June 2016, at the very same time its agents were intensifying their outreach to and securing meetings with agents of the Trump Campaign.

[snip]

According to the indictment, “in and around April 2016, the Conspirators began to plan the release of materials stolen from the Clinton Campaign, DCCC, and DNC.” And “in or around June 2016,” when the Trump Campaign was taking meetings with Russian agents to “get information on an opponent,” the indicted Russians and their coconspirators began to “stage[] and release[]” the stolen emails.

All that said, if the plaintiffs are relying on the June 9 meeting to establish the conspiracy, or even Don Jr’s June 3 email enthusiastically responding to Rob Goldstone’s offer, the campaign can argue in this suit that the actual theft of the emails in question — the DNC emails revealing the donors social security numbers and Comer’s embarrassing comments — were, according to the public record, already stolen by the time the campaign entered into the conspiracy.

But that’s not going to work if Mueller charges a criminal conspiracy. That’s true, in part, because the criminal conspiracy would include the social media part of the Russian assistance, which continued well after the June 9 meeting (the plaintiffs here couldn’t argue the social media exploitation hurt them because the emails including the information damaging to them wasn’t promoted by Russian social media actors). It would also include the DCCC releases, which led to the provision of opposition research to Republican operatives.

Indeed, even the hacking continued after the June 9 meeting. As the plaintiffs pointed out, on July 27, Russian hackers even seemed to respond directly to Trump’s request for assistance.

191. On July 27, 2016, during the Democratic National Convention, Mr. Trump held a press conference in Florida. During his remarks, Mr. Trump called on Russia to continue its cyberattacks, stating, “Russia, if you’re listening, I hope you’re able to find the 30,000 [Secretary Clinton] emails that are missing.” Although the Trump Campaign—and later, then-White House press secretary Sean Spicer—claimed that Mr. Trump was “joking,” when Mr. Trump was asked at the time to clarify his remark and whether he was serious, Mr. Trump stated: “If Russia or China or any other country has those emails, I mean, to be honest with you, I’d love to see them.”

192. According to the July 13, 2018 indictment of twelve Russian nationals filed by the Special Counsel, agents of the Russian government attempted that same day—July 27, 2016— “to spearfish for the first time email accounts at a domain hosted by a third-party provider and used by Clinton’s personal office.” In other words, on the day that Mr. Trump publicly said that he hoped Russia would be able to find missing emails related to Secretary Clinton, Russian intelligence for the first time attempted to hack email accounts on Secretary Clinton’s own server.

That particular hack was not successful, but a hack of the Democrats’ AWS hosted analytics program in September was; see ¶34. As I understand it, the targeting of Hillary’s campaign went on in a series of waves, and those waves might be shown to correlate to Trump’s requests for assistance.

So, absent proof that someone in the campaign encouraged Papadopoulos after having learned about the emails in April, the plaintiffs in this suit will struggle to show that Russian hacking of the emails that injured them took place after Trump’s campaign entered into the conspiracy. But Mueller won’t have that problem. And all that’s before the Peter Smith operation, which asked for assistance from Guccifer 2.0 and reached out to presumed Russian hackers to obtain information from Hillary’s home server. Plus, that’s all separate from the social media campaign which continued to benefit the Trump campaign up to the election.

The ironies of a First Amendment defense

There’s a detail about this response, however, that (relying as it does on a strong First Amendment defense) deserves more attention. The response claims that the entire purpose of this suit suit is to obtain discovery on the President on a number of topics — notably his tax returns and business relationships — that Democrats have been unable to fully pursue elsewhere.

The object of this lawsuit is to launch a private investigation into the President of the United States. The Amended Complaint already foreshadows discovery into the President’s “tax returns” (Am. Compl. ¶ 238), his “business relationships” (id.), his conversations with “Director Comey” (id. ¶ 251), and on and on.

Much later, in the conspiracy section, in an argument that seems designed for Brett Kavanaugh’s review, the response argues that plaintiffs need a more plausible claim to be able to get discovery from the President.

Rule 8 requires a complaint to state a “plausible” claim for relief. Ashcroft v. Iqbal, 556 U.S. 662, 678 (2009). A complaint satisfies this standard if its “factual content” raises a “reasonable inference” that the defendant engaged in the misconduct alleged. Id. at 678. This requirement protects defendants against “costly and protracted discovery” on a “largely groundless claim.” Bell Atlantic Corp. v. Twombly, 550 U.S. 544, 558 (2007). This protection is essential here, where Plaintiffs’ explicit goal is to burden the President with discovery. The President’s “unique position in the constitutional scheme” requires him to “devote his undivided time and attention to his public duties.” Clinton v. Jones, 520 U.S. 681, 697–98 (1997). Courts must thus ensure that plaintiffs do not use “civil discovery” on “meritless claims” to interfere with his responsibilities. Cheney v. U.S. District Court, 542 U.S. 367, 386 (2004).

It’s only after making the claim that this suit is all about obtaining public interest information such as the President’s tax returns that the campaign makes an argument justifying the release of all this information in the name of public interest.

According to the logic Jones Day lays out here, the Democrats’ mistake was in not finding foreign hackers to steal and then publish Trump’s tax returns.

As I disclosed in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post.