A story published in Steve Bannon’s rag, Breitbart, got circulated around the White House this morning like some President’s Daily Conspiracy, sending President Trump off on a rant attacking the counterintelligence investigation into his aides’ (and possibly his own) ties with Russia.

Let me unpack it.

The story basically captures a narrative Mark Levin rolled out Thursday night (that is, right after Jeff Sessions recused himself from the Russian hack investigation), which basically lards out the story of counterintelligence intercepts mostly targeting Russians, to suggest Jeff Sessions was brought down in an invented coup.

The Louise Mensch story

The story starts with this Louise Mensch story. For those who don’t know, Mensch is a former Tory Member of Parliament turned American rock promoter wife. Since quitting Parliament to spend more time with her family, she has become a pundit known for taking reasonable observations, injecting just a bit of whack, and turning them into fairly unhinged theories. Perhaps her best known foray into investigative work is when she unknowingly used her own racist search history to impugn a Jeremy Corbyn supporter. In spite of her still apparent tolerance for racism, she offered up her support to Hillary on Valentines Day in 2016. Of late, she has been writing unified theories of Russian spying that start from real nuggets and important observations, then spin loose from the actual supporting evidence.

Back to Mensch’s original article. At a time when Hillary’s team was furious that the FBI had been publicly discussing her emails rather than Trump’s Russian ties, Mensch reported that the FBI got a FISA order in October, after having been denied a more broadly drawn order earlier in the year.

The timing of the October FISA order has been backed in subsequent reporting. It is Mensch’s explanation for the basis of the order that is the problem, as it relied on the dodgy Alfa Bank story.

Contrary to earlier reporting in the New York Times, which cited FBI sources as saying that the agency did not believe that the private server in Donald Trump’s Trump Tower which was connected to a Russian bank had any nefarious purpose, the FBI’s counter-intelligence arm, sources say, re-drew an earlier FISA court request around possible financial and banking offenses related to the server. The first request, which, sources say, named Trump, was denied back in June, but the second was drawn more narrowly and was granted in October after evidence was presented of a server, possibly related to the Trump campaign, and its alleged links to two banks; SVB Bank and Russia’s Alfa Bank. While the Times story speaks of metadata, sources suggest that a FISA warrant was granted to look at the full content of emails and other related documents that may concern US persons.

[snip]

The FISA warrant was granted in connection with the investigation of suspected activity between the server and two banks, SVB Bank and Alfa Bank. However, it is thought in the intelligence community that the warrant covers any ‘US person’ connected to this investigation, and thus covers Donald Trump and at least three further men who have either formed part of his campaign or acted as his media surrogates. The warrant was sought, they say, because actionable intelligence on the matter provided by friendly foreign agencies could not properly be examined without a warrant by US intelligence as it involves ‘US Persons’ who come under the remit of the FBI and not the CIA. Should a counter-intelligence investigation lead to criminal prosecutions, sources say, the Justice Department is concerned that the chain of evidence have a basis in a clear  warrant

I will return to some other aspects of the Alfa Bank story shortly. But for now, consider that the evidence never said a private server “in Donald Trump’s Trump Tower … was connected to a Russian bank.” Rather, it showed that a marketing server in Philadelphia was pinging Alfa Bank and Grand Rapid’s Spectrum Health. As it turns out, it was pinging at least 16 other servers, but that detail was suppressed when the story got packaged up for the press by yet unidentified people. So even if the FBI would have needed a FISA warrant to read traffic involving a Russian (that is, non-US person located overseas) bank — which it wouldn’t — it’s highly unlikely they would have gotten that far, because the story didn’t hold up (and was easily explained by the spam that the servers in question were getting). Moreover, there is no way the FBI would have imagined “financial and banking offenses” from a spam marketing server sending regular pings to a bank. So even if the FBI continued to investigation suspected ties between Alfa Bank and Trump (again, more on that in a follow-up), the specific reference Mensch used to hang the FISA order on should never have involved allegations of a wiretap in Trump Tower.

This is not to say FISC didn’t issue an order pertaining to financial questions involving Russians. Mensch also points to David Corn’s piece on the Trump dossier, which we now know alleges a bunch of other, far more substantive financial issues. Later reporting described a tip from a Baltic country. But all of those pertain to suspected Russian bribes of people close to Trump or Paul Manafort’s corruption, not a spam marketing server sending spam to past clients of Trump hotels.

Which is to say that Mensch took a great tip — that there had been a FISC order — and slapped it onto dodgy allegations floating around in ways that didn’t even make sense for FISA, much less the allegations themselves.

Only Mensch says Trump was personally targeted in the FISA order

All that’s important because this is where the allegation that the order “covers Donald Trump” comes from.

The BBC, the next outlet to report it, claimed “Neither Mr Trump nor his associates are named in the Fisa order, which would only cover foreign citizens or foreign entities – in this case the Russian banks.” That didn’t make sense either, because — again — if the targets were two Russian banks, then FBI wouldn’t need a FISA order. And while it went on to to say three of Trump’s associates were the “subject” of the investigation (but not the target of the FISA order), it did cite someone outside of DOJ claiming that “it’s clear this is about Trump.” That’s still different than wiretapping Trump Tower.

The Guardian, reporting a week later, says that four of Trump’s associates were the targets of the broadly written FISA requested during the summer.

The Guardian has learned that the FBI applied for a warrant from the foreign intelligence surveillance (Fisa) court over the summer in order to monitor four members of the Trump team suspected of irregular contacts with Russian officials. The Fisa court turned down the application asking FBI counter-intelligence investigators to narrow its focus. According to one report, the FBI was finally granted a warrant in October, but that has not been confirmed, and it is not clear whether any warrant led to a full investigation.

But it doesn’t even confirm that the FISC order took place. Here’s a piece I did in January pushing back against claims that anything should be interpreted by the original “rejection” of the FISA order.

Andy McCarthy relies on Mensch to suggest the FISA order is improper

Mensch’s reliance on the Alfa server story also led Andy McCarthy to suggest impropriety in January, which is the next thing cited in Levin/Breitbart. McCarthy ignores the underlying premise — however discredited — of the Alfa story (that it was being used to bribe Trump) and uses Mensch’s inexact language to suggest FBI agents were instead using FISA to investigate bank crimes.

From the three reports, from the Guardian, Heat Street, and the New York Times, it appears the FBI had concerns about a private server in Trump Tower that was connected to one or two Russian banks. Heat Street describes these concerns as centering on “possible financial and banking offenses.” I italicize the word “offenses” because it denotes crimes. Ordinarily, when crimes are suspected, there is a criminal investigation, not a national-security investigation.

According to the New York Times (based on FBI sources), the FBI initially determined that the Trump Tower server did not have “any nefarious purpose.” But then, Heat Street says, “the FBI’s counter-intelligence arm, sources say, re-drew an earlier FISA court request around possible financial and banking offenses related to the server.”

Again, agents do not ordinarily draw FISA requests around possible crimes. Possible crimes prompt applications for regular criminal wiretaps because the objective is to prosecute any such crimes in court. (It is rare and controversial to use FISA wiretaps in criminal prosecutions.) FISA applications, to the contrary, are drawn around people suspected of being operatives of a (usually hostile) foreign power.

Probably the only thing in the larger range of allegations against Trump people that might be treated as a crime rather than a counterintelligence investigation is Paul Manafort’s acceptance of payments from Ukrainian oligarchs he may not have properly disclosed. Yet later reporting actually confirmed that that started as a criminal investigation, for which (as McCarthy points out) is a lot easier to get warrants. The rest involves bribery by a foreign power, so spying. So an appropriate use of FISA.

The expansion of 12333 sharing and the preservation of evidence

Amid a treatment of the Mike Flynn resignation, the release of the dossier (Breitbart sort of tweaks the timeline of these two, though I get that capturing the timeline is tough), and the Sessions’ disclosures, Breitbart discusses the expansion of information sharing and preservation of evidence.

6. January: Obama expands NSA sharing. As Michael Walsh later notes, and as the New York Times reports, the outgoing Obama administration “expanded the power of the National Security Agency to share globally intercepted personal communications with the government’s 16 other intelligence agencies before applying privacy protections.” The new powers, and reduced protections, could make it easier for intelligence on private citizens to be circulated improperly or leaked.

[snip]

10. March: the Washington Post targets Jeff Sessions. The Washington Postreports that Attorney General Jeff Sessions had contact twice with the Russian ambassador during the campaign — once at a Heritage Foundation event and once at a meeting in Sessions’s Senate office. The Post suggests that the two meetings contradict Sessions’s testimony at his confirmation hearings that he had no contacts with the Russians, though in context (not presented by the Post) it was clear he meant in his capacity as a campaign surrogate, and that he was responding to claims in the “dossier” of ongoing contacts. The New York Times, in covering the story, adds that the Obama White House “rushed to preserve” intelligence related to alleged Russian links with the Trump campaign. By “preserve” it really means “disseminate”: officials spread evidence throughout other government agencies “to leave a clear trail of intelligence for government investigators” and perhaps the media as well.

I think I was the one who first identified the irony of expanding 12333 sharing rules — a move that had been in the works since 2004, when CIA started pushing to resume sharing it had had under Stellar Wind — right as CIA and FBI were investigating Trump allies as potential Russian spies.

Understand: On January 3, 2017, amid heated discussions of the Russian hack of the DNC and public reporting that at least four of Trump’s close associates may have had inappropriate conversations with Russia, conversations that may be inaccessible under FISA’s probable cause standard, Loretta Lynch signed an order permitting the bulk sharing of data to (in part) find counterintelligence threats in the US.

This makes at least five years of information collected on Russian targets available, with few limits, to both the CIA and FBI. So long as the CIA or FBI were to tell DIRNSA or NSA’s OGC they were doing so, they could even keep conversations between Americans identified “incidentally” in this data.

I still don’t think giving the CIA and FBI (and 14 other agencies) access to NSA’s bulk SIGINT data with so little oversight is prudent.

But one of the only beneficial aspects of such sharing might be if, before Trump inevitably uses bulk SIGINT data to persecute his political enemies, CIA and FBI use such bulk data to chase down any Russian spies that may have had a role in defeating Hillary Clinton.

And while the expansion had been in the works for years, it is definitely true that both James Clapper and Loretta Lynch signed off on the sharing after the time Obama ordered a more detailed review of Russia’s role in the election. Indeed, Lynch signed off on it the day after FBI found Mike Flynn’s conversations with Sergey Kislyak showing Flynn telling the Ambassador not to worry about Obama’s new Russian sanctions. It is even possible that the sharing made available intercepts involving some of the Trump aides the FISC hadn’t approved for surveillance.

But Breitbart relies on a PJ Media piece instead, which falsely claims Flynn was targeted in the wiretaps of Kislyak and describes it as an expansion of NSA powers rather than an expansion of FBI and CIA access. Breitbart then concludes that “new powers, and reduced protections, could make it easier for intelligence on private citizens to be circulated improperly or leaked.” The guidelines do aspire to prevent that kind of abuse, but the protections against such abuse are far too weak.

For what it’s worth, I think that 12333 sharing is part of what the NYT reported on, the distribution of information around government. Whereas on January 2, only NSA might have had raw intercepts targeting Russians that might involve Trump aides, on January 3, CIA and FBI (and Treasury, which is also part of this inquiry) might have gotten their own copies, with FBI’s likely stored in an ad hoc database connected with the investigation (and therefore harder to find outside of the CI team investigating it). Nevertheless, the NYT story certainly suggests that Obama’s Administration worked to ensure that Trump couldn’t easily dismantle the investigation into his associates, while hiding the names of Russian spies and other informants. The question is whether it is appropriate to protect an ongoing investigation like that.

Breitbart gets an important detail wrong, however.

It treats the preservation of evidence — something more closely tied to the 12333 sharing and the investigation into people like Manafort and Carter Page — as part of the Jeff Sessions story. It is true that NYT ultimately added the Sessions story to its evidence preservation story, but that was added almost two hours after the story was first posted, to match the WaPo story.

Nevertheless, Breitbart, in a piece written by Trump’s campaign biographer in the rag until recent run by Trump’s consigliere Steve Bannon, links the two, tying this preservation of the ongoing investigation to the events that led to Sessions’ recusal.

Trump goes batshit in response Sessions’ recusal and then reads a misleading story placed in Bannon’s rag

All this is noteworthy because Trump was apparently already lashing out because Sessions recused himself.

Mr. Trump’s mood was said to be explosive before he departed for his weekend in Florida, with an episode in which he vented at his staff. The president’s ire was trained in particular on Donald F. McGahn, his White House counsel, according to two people briefed on the matter.

Mr. Trump was said to be frustrated about the decision by Jeff Sessions, his attorney general, to recuse himself from participating in any investigations of connections between the Trump campaign and Russia. Mr. Trump has said there were no such connections.

It’s particularly interesting that Trump attacked McGahn, because after what may have been a significant delay this week, he told White House staffers to retain records that may be relevant to the investigation. In addition, Sessions had informed McGahn he was recusing even as Trump was publicly claiming there was no reason to do so.

That’s the backdrop for the moment when Trump read the Breitbart article (I wonder who put it in his hands? Robert Costa reported that Bannon “is working closely with Trump on combating what he calls the ‘deep state’ in intel comm, per multiple people at WH”) and went on a Twitter rant complaining. The rant starts with the same projection he engaged in last night, suggesting Democratic meetings with Sergey Kislyak (about which no one lied about under oath) were just as damning as Sessions’ failure to disclose his own meetings with the Russian Ambassador.

He then immediately transitioned back and forth between the confused allegations from the original Mensch piece to Sessions again.

Which Trump then expands to suggest something even Breitbart did not — that Obama himself ordered the wiretap on Trump.

Trump’s accusations have led a range of sources to deny that Obama ordered the wiretap in both the NYT,

One former senior law enforcement official who worked under Mr. Obama said that it was “100 percent untrue” that the government had wiretapped Mr. Trump, and that the current president should be pressed to offer any evidence for his assertion.

Ben Rhodes, a former top national security aide to Mr. Obama, said in a Twitter message directed at Mr. Trump on Saturday that “no president can order a wiretap” and added, “Those restrictions were put in place to protect citizens from people like you.”

And in WaPo,

Kevin Lewis, a spokesman for Obama, said in a statement early Saturday afternoon: “A cardinal rule of the Obama Administration was that no White House official ever interfered with any independent investigation led by the Department of Justice. As part of that practice, neither President Obama nor any White House official ever ordered surveillance on any U.S. citizen. Any suggestion otherwise is simply false.”

Why do people believe Trump on Twitter?

In spite of the fact that Trump’s information can be pretty clearly attributed to the Breitbart piece, and the allegations about Trump Tower in it can be pretty clearly shown to be unsubstantiated, both the right and the left took Trump’s tirade to be some kind of confirmation, as if he just got briefed by the spooks that they’ve been listening in on this calls.

Trump hasn’t been bugged. It’s quite likely a number of Trump’s close associates are, after incriminating information showed up about or involving them on other wiretaps. There’s zero reason to believe Obama ordered them, not least because everyone involved believed Obama was responding too nonchalantly to the Russian accusations.

Trump’s associates are bugged, to the extent one or more of them are directly targeted rather than being collected incidentally, because they’re suspected of being Russian assets. That’s one of the key points of FISA, to use it to investigate possible spies working for foreign governments.

But because of the frenzy caused by Trump’s response to the Breitbart story, people are taking as true Trump’s claim he has been bugged, with Democrats claiming this is proof that Trump himself is in the crosshairs and normally surveillance loving Republicans suggesting using FISA to do what FISA is supposed to do is an abuse.

Remember, at least according to Sessions, he had decided to recuse before the WaPo disclosures on his ties with Kislyak. Whether or not that’s true, Trump is furious that Sessions recused even after a clear conflict became known.

And in response he tried — with a great deal of success — to discredit the very notion of this investigation.

Update: NYT updated their piece to reveal that WHCO Don McGahn is chasing down the purported FISA order covering Trump and his associates.

But a senior White House official said that Donald F. McGahn II, the president’s chief counsel, was working on Saturday to secure access to what the official described as a document issued by the Foreign Intelligence Surveillance Court authorizing surveillance of Mr. Trump and his associates. The official offered no evidence to support the notion that such a document exists; any such move by a White House counsel would be viewed at the Justice Department as a stunning case of interference.

Based on the assumption there is a FISA order covering at least some of his close associates, but probably not one covering him, understand what has happened here:

1. Trump’s Attorney General, who claims he had already decided to recuse, recused after his nomination lies were exposed, meaning he no longer controls the investigation into his boss
2. A misleading article written in response to that recusal led Trump to claim he was being targeted
3. Based on the claim, Trump sent out his WHCO to find a FISA order probably not targeting him but probably targeting his aides
4. Having just been deprived of visibility and control over the investigation, Trump is forcibly obtaining another way to control it