John Durham’s Irregular Now-Sealed Timeline

As I noted here, John Durham claimed to attempt to file a bunch of confidential Fusion emails under seal.

Whether intentionally or not, he failed, at first, but has now closed the barn doors after voluntarily publishing damning evidence (much of it true!) against the purported victims he claims to be avenging.

By publishing these emails on the docket, Durham has revealed that his exhibit has irregularities in the emails pertaining to a key issue: whether Fusion sent out a link to April Lorenzen’s i2p site before Mark Hosenball sent it to them.

This shows up in the timestamps. In the exhibit, the lead email for each appearance appears to be set to UTC, whereas the sent emails included in any thread appear to be set to ET.

For example, in this screencap, the time shown for Mark Hosenball’s response to Peter Fritsch (the pink rectangle) is 1:35 PM, which is presumably Eastern Time.

In this screencap, the very same response appears to be sent at 5:36PM, which is presumably UTC.

Both instances of Peter Fritsch’s email (the green rectangle), “that memo is OTR–tho all open source,” show at 1:33PM, again, Eastern Time.

To be clear: this irregularity likely stems from Fusion’s email system, not DOJ’s. It appears that the email being provided itself is rendered in UTC, while all the underlying emails are rendered in the actual received time.

But given that these emails are being submitted to Judge Cooper in regards to a privilege claim, the fact that DOJ has made no effort to fix — or at least call attention to — the anomaly, it makes the exhibit affirmatively misleading with regards to perhaps the most important detail in the exhibit.

As I note in the timeline below, this obscures the order in which Fusion received and passed on a link to the mediafire package introducing Tea Leaves’ DNS allegation package — precisely the issue (and, it is now clear, the specific communication) about which Alfa Bank had confusion in their lawsuit. I explained the import of these communications here.

Given the selection of emails included here (not even all from this time period  are included as primary emails, which is what makes the anomaly misleading, and one involving Mark Hosenball — in the italicized email, he references having sent a summary to Fritsch —  appears to be entirely missing), Fusion’s public explanation — that they received this link and then passed it on — cannot be proven or disproven. But it is clear that after Fritsch got the mediafire link, he sent it to Lichtblau, which I’ve bolded below. And by context, it appears that Laura Seago had already figured out that the mediafire package was first posted on Reddit.

(I’ll have to check but given what Perloth told me, this may not actually be how NYT first got this data.)

Update, May 19: I’ve added emails from trial.

October 5 emails:

1:31PM: [not included] Fritsch to Hosenball email with Alfa Group overview

1:32PM: Fritsch sends Isikoff the September 1, 2016 Alfa Group overview (full report included in unsealed exhibit)

1:33PM [not included] Fritsch to Hosenball, “that memo is OTR — tho all open source”

1:35/1:36PM: Hosenball replies, “yep got it, but is that from you all or from the outside computer experts?”

1:37PM: Fritsch responds,

the DNS stuff? not us at all

outside computer experts

we did put up an alfa memo unrelated to all this

1:38PM: [not included] Hosenball to Fritsch:

is the alfa attachment you just sent me experts or yours ? also is there additional data posted by the experts ? all I have found is the summary I sent you and a chart… [my emphasis]

1:41PM: [not included] Fritsch to Hosenball:

alfa was something we did unrelated to this. i sent you what we have BUT it gives you a tutanota address to leave questions.  1. Leave questions at: [email protected]

1:41PM: [not included] Hosenball to Fritsch:

yes I have emailed tuta and they have responded but haven’t sent me any new links yet. but I am pressing. but have you downloaded more data from them ?

1:43PM: [not included] Fritsch to Hosenball, “no”

1:44PM: Fritsch to Lichtblau:

fyi found this published on web … and downloaded it. super interesting in context of our discussions

[mediafire link] [my emphasis]

2:23PM: [not included] Lichtblau to Fritsch, “thanks. where did this come from?”

2:27PM: [not included] Hosenball to Fritsch:

tuta sent me this guidance

[snip]

Since I am technically hopeless I have asked our techie person to try to get into this. But here is the raw info in case you get there first. Chrs mh

2:32PM: Fritsch to Lichtblau:

no idea. our tech maven says it was first posted via reddit. i see it has a tutanota contact — so someone anonymous and encrypted. so it’s either someone real who has real info or one of donald’s 400 pounders. the de vos stuff looks rank to me … weird

3:27PM: [not included] Fritsch to Hosenball cc Simpson: “All same stuff”

3:58PM: [not included] Hosenball to Fritsch, asking, “so the trumpies just sent me the explanation below; how do I get behind it?”

4:28PM: [not included] Fritsch to Hosenball, “not easily, alas”

4:32PM: Fritsch to Hosenball, cc Simpson:

Though first step is to send that explanation to the source who posted this stuff. I understand the trump explanations can be refuted.

5:23PM (could be 1:23?): Seago to Fritsch, Is this safe?

6:33PM (likely 2:33PM): Fwd Alfa

6:57PM (like 2:57PM): Re Alfa

7:02PM (likely 3:02): Seago to Fritsch re Alfa