John Durham Says Election-Hack Victims Should Wait Until After the Election to Report Tips

/46 Comments/in , , , /by

Even as Russia assaults a peaceful democracy (which invasion, in a separate filing, Durham calls, “recent world events in Ukraine”), John Durham suggests that a political campaign victimized by Russia should expect to wait until after the election before the FBI opens an investigation into a cybersecurity anomaly potentially implicating her opponent.

Durham even asserts that such a cybersecurity anomaly is not a cybersecurity matter, but instead a political one.

Almost six years after Trump’s request, “Russia are you listening,” was met with a renewed Russian attack on Hillary Clinton, John Durham continues to treat Hillary’s attempts to run a campaign while being attacked as a greater threat than that nation-state attack by Russia.

Durham’s latest contortions come in a response to Micheal Sussmann’s motion to dismiss the indictment.

Sussmann argued that the alleged lie he told (motions to dismiss must accept the alleged facts as true), could not have affected the single decision facing the FBI when he shared information about a DNS anomaly: whether to open an investigation or not.

Following the Supreme Court’s clear instruction in Gaudin, in order to assess the materiality of the false statement that Mr. Sussmann is alleged to have made, this Court must ask what statement he is alleged to have made to the FBI; what decision the FBI was trying to make; and whether the false statement could have influenced that decision. Here, even accepting all the allegations in the Indictment as true—and the evidence would prove otherwise—the only decision the FBI was trying to make was the decision whether or not to commence an investigation into the allegations of suspicious internet data involving the Trump Organization and Russian Bank-1. Ample precedent—and the Special Counsel’s own allegations in this case—make clear that Mr. Sussmann’s purported false statement did not influence, and was not capable of influencing, that decision.

Predictably and reasonably, Durham’s response cited the precedent that leaves it up to juries to determine whether something is material or not.

In any event, the defendant’s arguments on the materiality of his statement are also premature. The Supreme Court in Gaudin held that materiality is an essential element of Section 1001 that must be resolved by a jury.

As I noted back in October, “Prosecutors will argue that materiality is a matter for the jury to decide.”

Prosecutors also noted what I did: a long list of precedents about materiality that Sussmann cited in his motion are all post-trial challenges to materiality, not pretrial motions to dismiss.

The defendant cites to multiple cases where the Supreme Court and Circuit Courts have held that the false statements and misrepresentations at issue were immaterial as a matter of law. See Def. Mot. at 7-10. But critically, all of those cases involved post-conviction appeals or motions to vacate the conviction after the Government presented its case at trial. Accordingly, none of these cases support the defendant’s requested relief here – that is, that the court dismiss the Indictment before trial because it fails to sufficiently allege that the defendant’s false statement is material. What the cases do show is that courts have routinely declined to usurp the jury’s role in making the determination on whether a false statement is material.

For those two reasons, Sussmann’s motion to dismiss is unlikely to succeed, and should instead be viewed as an opening bid to frame his defense and establish issues for appeal.

Those two arguments are all Durham really needed to respond to Sussmann’s motion to dismiss. Instead of leaving it with responsible lawyering, however, Durham instead launches into an illogical attempt to criminalize tip reporting.

Take his attempt to dismiss Rodney Joffe’s real cybersecurity expertise. In the three months since he charged Sussmann, Durham belatedly (at Sussmann’s request) discovered how closely Joffe had worked with the FBI on other investigations. As Sussmann scoffed in an earlier filing, “The notion that the FBI would have been more skeptical of the information had it known of Tech Executive-1’s involvement is, in a word, preposterous.” Now that Durham has discovered the close ties between Joffe and the FBI, he claimed that that history of reliability was itself something the FBI needed to know.

Namely, as the defendant’s motion reveals (Def. Mot. at 18-19, fn. 8), Tech Executive-1 had a history of providing assistance to the FBI on cyber security matters, but decided in this instance to provide politically-charged allegations anonymously through the defendant and a law firm that was then-counsel to the Clinton Campaign. Given Tech Executive-1’s history of assistance to law enforcement, it would be material for the FBI to learn of the defendant’s lawyer-client relationship with Tech Executive-1 so that they could evaluate Tech Executive-1’s motivations. As an initial step, the FBI might have sought to interview Tech Executive-1. And that, in turn, might have revealed further information about Tech Executive-1’s coordination with individuals tied to the Clinton Campaign, his access to vast amounts of sensitive and/or proprietary internet data, and his tasking of cyber researchers working on a pending federal cybersecurity contract.

Durham’s claim that “learning” how much data Joffe had access to (which is something the FBI undoubtedly knew — it is surely the reason why FBI partnered with him, because the volume of data Neustar had made their observations more useful) would make them more skeptical of the DNS tip is nonsensical. In fact, elsewhere (in tracking all the YotaPhone requests in the US over a three year period), Durham treated it as presumptively reliable.

Plus, Durham made no mention here of one of a number of the other things he belatedly learned: that the September 2016 tip Sussmann shared with FBI General Counsel James Baker was not the only one Joffe had shared via Sussmann anonymously. He shared a tip anonymously during this same time period with DOJ IG. Durham has no way of knowing, either, whether those two were the only ones, but his revised theory of materiality depends on an anonymous tip like this one being unique.

Similarly, Durham struggled to explain (including by citing an inapt precedent) why the FBI would need to be told that Sussmann represented Hillary when, in notes of Baker’s retelling of the meeting, Bill Priestap wrote that Sussmann represented the DNC and Clinton Foundation.

As he did with Joffe, Durham tried to flip Sussmann’s expertise, arguing that the former prosecutor’s recognized qualification as a cybersecurity expert, something that would help him assess whether DNS data were anomalous or not, is precisely why the Perkins Coie lawyer needed to disclose he was working for Hillary.

In an effort to downplay the materiality of this false statement, the defendant asserts that the FBI General Counsel was aware that the defendant represented the DNC. See Def. Mot at 18. But the Government expects that evidence at trial will establish that the FBI General Counsel was aware that the defendant represented the DNC on cybersecurity matters arising from the Russian government’s hack of its emails, not that he provided political advice or was participating in the Clinton Campaign’s opposition research efforts. Indeed, the defendant held himself out to the public as an experienced national security and cybersecurity lawyer, not an election lawyer or political consultant. Accordingly, when the defendant disclaimed any client relationships at his meeting with the FBI General Counsel, this served to lull the General Counsel into the mistaken, yet highly material belief that the defendant lacked political motivations for his work.

There are many crazy assumptions built into this statement: that, had Sussmann identified Hillary as his client, it would have required him to reveal her motives as political rather than security-related to the FBI, breaching privilege; that reporting an anomaly potentially involving Trump after Trump had begged Russia to further hack Hillary would not be a sound decision from a cybersecurity standpoint; that researching the context of an anomaly, such as Alfa Bank’s ties to Putin, is not part of cybersecurity. Effectively, Durham has unilaterally decided that pursuing this anomaly was a political act, with no basis in law or fact.

Which is how Durham espoused the claim that the FBI, facing an unprecedented attack by Russia on American elections in 2016, might have delayed investigation of a part of it that might have implicated one of the contestants.

The defendant’s false statement to the FBI General Counsel was plainly material because it misled the General Counsel about, among other things, the critical fact that the defendant was disseminating highly explosive allegations about a then-Presidential candidate on behalf of two specific clients, one of which was the opposing Presidential campaign. The defendant’s efforts to mislead the FBI in this manner during the height of a Presidential election season plainly could have influenced the FBI’s decision-making in any number of ways. The defendant’s core argument to the contrary rests on the flawed premise that the FBI’s only relevant decision was binary in nature, i.e., whether or not to initiate an investigation. But defendant’s assertion in this regard conveniently ignores the factual and practical realities of how the FBI initiates and conducts investigations. For example, the Government expects that evidence at trial will prove that the FBI could have taken any number of steps prior to opening what it terms a “full investigation,” including, but not limited to, conducting an “assessment,” opening a “preliminary investigation,” delaying a decision until after the election, or declining to investigate the matter altogether.

[snip]

Moreover, the Department of Justice and the FBI maintain stringent guidelines on dealing with matters that bear on U.S. elections. Given the temporal proximity to the 2016 U.S. presidential election, the FBI also might have taken any number of different steps in initiating, delaying, or declining the initiation of this matter had it known at the time that the defendant was providing information on behalf of the Clinton Campaign and a technology executive at a private company.

[snip]

And the evidence will show that it would have been all the more material here because the defendant was providing this information on behalf of the Clinton Campaign less than two months prior to a hotly contested U.S. presidential election. [my emphasis]

The first paragraph here is really telling, given Durham’s public complaint that the Crossfire Hurricane team should have opened the investigation as a preliminary investigation, not a full investigation (the investigation into Mike Flynn, specifically, wasn’t opened as a full investigation, but none of the techniques used would have otherwise been unavailable, not least because there was already a full investigation opened on Carter Page). This is an argument Durham may reprise in his report: That it was unreasonable for Hillary Clinton to ask the FBI to inquire into Trump’s campaign after he publicly asked a foreign country for help (even ignoring the tip from Australia).

Durham seems to think Hillary should have had no assistance from law enforcement when her opponent publicly asked Russia to hack her some more if people close to her found more reason to be concerned. He even mocked Sussmann as too powerful to choose to use anonymity.

[W]hile the defendant’s motion seeks to equate the defendant with a “jilted ex-wife [who] would think twice about reporting her ex-husband’s extensive gun-smuggling operation,” this comparison is absurd. Def. Mot. at 24

Far from finding himself in the vulnerable position of an ordinary person whose speech is likely to be chilled, the defendant – a sophisticated and well-connected lawyer – chose to bring politically-charged allegations to the FBI’s chief legal officer at the height of an election season.”

This also betrays pure insanity. The anomaly involving Trump could always have reflected disloyal insiders compromising the candidate, as could the YotaPhones potentially in use in Trump headquarters. In fact, Page did compromise Trump when he went to Russia in December 2016 and tell Russians there that he was representing Trump on matters pertaining to Ukraine, just as Mike Flynn did by selling his access to Trump to Turkey, just as Tom Barrack is accused of doing with the Emirates. The reason why Sussmann was providing this information less than two months before an election is because cybersecurity researchers had gone looking because there was an ongoing multi-faceted cybersecurity attack, one that continued right through the election, one that could have victimized Trump as well as Hillary.

Which brings me to the one point Sussmann made that Durham completely ignored. In his response, Durham’s response uses the word “purported” to describe the DNS allegations from Sussmann five times:

  1. The defendant provided the FBI General Counsel with purported data and “white papers” that allegedly demonstrated a covert communications channel between the Trump Organization and a Russia-based bank
  2. the purported data and white papers
  3. the purported DNS traffic that Tech Executive-1 and others had assembled
  4. the defendant provided data which he claimed reflected purportedly suspicious DNS lookups by these entities of internet protocol (“IP”) addresses affiliated with a Russian mobile phone provider (“Russian Phone Provider-1”)
  5. examine the origins of the purported data

What Durham did not do is ever address this point from Sussmann:

Indeed, the defense is aware of no case in which an individual has provided a tip to the government and has been charged with making any false statement other than providing a false tip. But that is exactly what has happened here.

In the fall of 2016, Michael Sussmann, a prominent national security lawyer, voluntarily met with the Federal Bureau of Investigation (“FBI”) to pass along information that raised national security concerns. He met with the FBI, in other words, to provide a tip. There is no allegation in the Indictment that the tip he provided was false. And there is no allegation that he believed that the tip he provided was false. Rather, Mr. Sussmann has been charged with making a false statement about an entirely ancillary matter—about who his client may have been when he met with the FBI—which is a fact that even the Special Counsel’s own Indictment fails to allege had any effect on the FBI’s decision to open an investigation.

[snip]

Again, nowhere in the Indictment is there an allegation that the information Mr. Sussmann provided was false. Nowhere is there an allegation that Mr. Sussmann knew—or should have known—that the information was false. And nowhere is there an allegation that the FBI would not have opened an investigation absent Mr. Sussmann’s purported false statement.

I could fund an entire Special Counsel investigation if I had $5 for every time in this prosecution Durham has used the word “purported.” For almost six months, his entire prosecution has been premised on this anomaly not being “real,” meaning unexplained traffic that might represent something serious.

And yet he has not charged that (though he seems to have bullied April Lorenzen, perhaps because he needs her to be something other than she was). Instead, he just keeps doing the work for which actual evidence is normally required by repeating the word “purported” over and over.

This motion to dismiss will likely fail, because juries get to decide what is material. But contrary to Durham’s claims, unless and until he can prove that Sussmann, Jofffe, and Lorenzen didn’t believe this was a real anomaly worth investigating given all the other attacks that, Sussmann especially, knew were ongoing, then he really will be prosecuting someone for reporting a valid national security concern.

Behind the Arrest of Putin’s Pen-Tester, Vladislav Klyushin

/21 Comments/in , , , /by

There’s a gratuitous passage in the March 20, 2021 complaint charging Vladislav Klyushin, Ivan Yermakov, Igor Sladkov, Mikhail Irzak, and Nikolay Rumyantev with conspiracy to violate the Computer Fraud and Abuse Act. It describes that Klyushin — the guy just extradited to the US on the charges — possessing a picture of Alexander Borodaev and Sergey Uryadov posing in front of Scotland Yard in London.

Thus far, it’s unclear who the guys in the picture are, other than customers of M-13’s “investment services,” for which they paid extortionate 60% commissions to benefit from the insider trading scheme allegedly run by Klyushin and Yermakov. But, in addition to alerting Klyushin to how many of his personal files the FBI has obtained, folks back in Russia will have a taste of the kind of information at risk now that Klyushin is in US custody.

That is, this passage, and a host of others in the charging documents, appear designed to maximize the discomfort of a number of people involved, as much as justifying the arrest and extradition of the guy who led a company that provided services that amount to information operations to Vladimir Putin. As the DOJ presser explained,

M-13’s website indicated that the company’s “IT solutions” were used by “the Administration of the President of the Russian Federation, the Government of the Russian Federation, federal ministries and departments, regional state executive bodies, commercial companies and public organizations.” In addition to these services, Klyushin, Ermakov and Rumiantcev also allegedly offered investment management services through M-13 to investors in exchange for up to 60 percent of the profit

The insider trader scheme works like this: Klyushin (the guy in US custody) and Yermakov (a key person involved in the 2016 DNC hack, described in DOJ’s press release as a “former” GRU officer), along with one other guy from M-13, area accused of hacking at least two US filing agents to obtain earnings reports before they were officially released. They conducted trades for a handful of clients — along with Borodaev and Uryadov, Boris Varshavskiy is mentioned. Klyushin also conducted trades for himself. The three M-13 figures were indicted on conspiracy, hacking, wire fraud, and securities fraud charges on April 6, 2021, an indictment that formalized the extradition request for Klyushin, who had already been arrested in Switzerland.

Then there are two apparent private citizens who live in St. Petersburg, Michail Irzak and Igor Sladkov. They were indicted on May 6, 2021 on conspiracy to hack and hacking charges, along with securities fraud. That indictment (like the complaint) focuses on some different trades than the Klyushin one (and because neither is likely to be extradited anytime soon, the second indictment may shield some portion of evidence from discovery).

Actions attributed elsewhere to Yermakov are attributed to Co-Conspirator 1 in that indictment, and it is on that basis that Irzak and Sladkov are exposed to the hacking charges. Irzak and Sladkov don’t appear to have been paying the extortionate 60% fees that the other M-13 clients were, which makes me wonder whether Yermakov was helping buddies get rich on the side. Worse still, Sladkov had some epically bad operational security; the indictment describes he had in his possession pictures showing:

  • A picture of a black Acer computer, with a blue Russian Olympic Committee sticker over the camera, showing a press release with Snap’s 2017 earnings that was not released publicly until 8 hours later.
  • A picture showing the same Acer computer with the same blue sticker showing his own trading activity on BrokerCreditService on May 2, 2018
  • A picture taken on July 24, 2018 at 2:05PM (ET) showing himself and Irzak sitting at a brown table; Irzak had Facebook running at the time, which showed him to be in the vicinity of Sladkov’s house
  • A picture dated July 25, 2018 showing him trading in a bunch of shares the earnings reports of which had been illegally accessed the day before
  • A picture dated October 14, 2018 showing a hand-written note instructing to “short” three shares, which Irzak did short two days later

In other words, Sladkov documented much of his insider training in photographs (perhaps to share the instructions with Irzak), and left all those photographs somewhere accessible to the US government.

If Yermakov was sharing this information with these guys without permission, then Sladkov’s role in providing the US government really damning information that would form the basis for an arrest warrant for Klyushin, then things might get really hot.

But it’s not like Klyushin or Yermakov did much better. In addition to the pictures of the clients, above, and some screencaps that got sent showing trading activity (though with less obvious evidence of insider trading), there’s a bunch of messaging from both, including an oblique reference to messages Yermakov and Borodaev sent on November 19, 2020 that have nothing to do with the context of the indictment but happens to be after the US election. There are even pictures Klyushin shared with Yermakov, “showing a safe that contained growing stacks of U.S. one hundred dollar bills.”

Yermakov appears to have used one of his messaging accounts via multiple devices, because on December 3, 2018, when he “forgot telephone at work,” he was still able to message Klyushin about closing out a trade. Using the same messaging app across platforms would offer one means of compromise, especially if the FBI had gotten into Yermakov’s device updates. The indictment doesn’t mention a warrant for such messaging that you would expect if it took place on Facebook.

Again, this indictment seems to aim to cause discomfort and recriminations based on information in US possession.

But then there’s the question of how it came about, how it landed in Massachusetts rather than DC (where the lead FBI agent is from) or NY (where the trades get done) or Pittsburgh, where one of the prior indictments against Yermakov was done.

The indictments and complaint base the MA jurisdiction on the fact that the culprits used a VPN that used a server in MA on several occasions. At a presser the other day, Acting US Attorney Nathaniel Mendell suggested the case had been assigned to MA because of its good securities prosecution teams.

As to how it came about, purportedly, the story starts in January 2020, when two filing agents allegedly hacked by the men, FA1 and FA2, reported being hacked at virtually the same time. Someone had used an FA1 employee’s credentials on January 21, 2020 to access the earnings data for IBM, Steel Dynamics, and Avnet before those results were publicly announced the following day, but no similar transaction noted with respect to F2 (indeed, a list of accesses involving F2 have a gap from November 2019 through May 2020). The investigation determined that FA1 had first been hacked by November 2018 and that FA2 had first been hacked by October 2017.

FA1 and FA2 discovered this compromise just months after the third M-13 employee, Rumyantev, was blocked by his Russian-based brokerage account for suspicious transactions. Months after FA1 and FA2 reported their compromise, Rumyantev and Klyushin lied to a Denmark bank that they were working entirely off of public information. By that point, in other words, banks in at least two countries were onto them.

Then, the story goes, the FBI investigated those hacks — through domains hosted by Vultr Holdings to a hosting company in Sweden to a user account under the name Andrea Neumann. From there, the FBI tracked back through some Bitcoin transactions made in October and November 2018 to the IP address for M-13 where they just happened to discover one of the very same hackers that was behind the 2016 hack of the DNC was also behind this hack. Mendell sounded pretty sheepish when he offered that explanation at the press conference.

Perhaps it’s true, but another key piece of evidence dates to actions Yermakov took on May 9, 2018, when he was under very close scrutiny as part of the twin investigations into his role in the hacks of the DNC and doping agencies, but before the first indictment against him was obtained.

Based on a review of records obtained from a U.S.-based technology company (the “Tech Company”), I have learned that on or about May 9, 2018, at 3:44 a.m. (ET), an account linked to ERMAKOV received an update for three native applications associated to the Tech Company. Records show that the May 9, 2018 application updates were associated to IP address 119.204.194.11 (the “119 IP Address”).

Based on my review of a log file from FA 2, I learned that on or about that same day, May 9, 2018, starting at 3:46 a.m. (ET)–approximately two minutes after ERMAKOV received application updates from the Tech Company–the FA 2 employee’s compromised login credentials were used to gain unauthorized access to FA 2’s system from the same 119 IP Address, and to view and/or download earnings-related files of four companies: Cytomx Therapeutics, Horizon Therapeutics, Puma Biotechnology, and Synaptics.7 All four companies reported their quarterly earnings later that day.

It would be rather surprising if the FBI agents investigating the DNC hack had not at least attempted to ID the IP associated with Yermakov’s phone (or other device) back in 2018. Whether or not they watched him engage in insider trading for years after that — all the while collecting evidence from co-conspirators flaunting the proof of their insider trading — we may never learn. The discovery on this case, featuring evidence explaining how the FBI tracked the insider trading of Putin’s pen-tester, will certainly feature a number of law enforcement sensitive techniques that Klyushin would love to bring back to Putin.

But it’s possible these techniques were what the FBI used to target these guys four years ago now, and the insider trading that Yermakov was doing in addition to whatever he spent the rest of his time doing has now provided a convenient way to bring Putin’s pen-tester to the United States for a spell.

Update: Included the pictures of the safe included with his detention memo, as well as earnings reports from Sladkov’s computer. Note the detention memo says the latter came from an ISP.

DOJ’s Ex Parte Classified Plans for Joshua Schulte — and Maybe, Julian Assange

/8 Comments/in , /by

Update: The High Court has overturned Baraitser’s ruling, finding that the US should have had an opportunity to give the assurances it has since given that Assange will not be subjected to solitary confinement. I expect Assange will appeal immediately.

Per a tweet from Stella Morris, the decision in the appeal of a Vanessa Baraitser’s decision denying the US extradition request for Julian Assange on humanitarian grounds will be announced Friday at 10:15 GMT. Because of something that happened in the High Court extradition hearing, I want to point to some things that happened in the Joshua Schulte docket in recent months.

On August 5, DOJ filed notice of an ex parte classified status letter in the Schulte case.

The Government respectfully submits this letter to provide notice of an ex parte, classified status letter submitted yesterday.

By filing an ex parte classified status letter, the government would have informed the judge (then Paul Crotty but the case has since been reassigned to Judge Jesse Furman) something about the case, without sharing it with Schulte or the public. The letter would have been filed five years to the day after the start date, August 4, 2016, for searches DOJ has described that Schulte did on WikiLeaks, Edward Snowden, and (as described elsewhere) Shadow Brokers.

In addition to the numerous searches for “wikileaks” which commenced on August 4, 2016, SCHULTE also conducted multiple related Searches, including: prior to the March 7, 2017 release of the Classified Information, “assange” (Julian Assange is the founder and “editor-in-chief’ of WikiLeaks.org), “snowden its time,” “wikileaks code,” and “wikileaks 2017”-and after the March 7, 2017 release of the Classified Information, “wikileaks public opinion,” and “officials were aware before the WikiLeaks release of a loss of sensitive information.”

On September 23, the government wrote a letter to Judge Crotty, voicing its support for adjourning Schulte’s trial date — which at that point was scheduled for October 25, two days before Assange’s extradition hearing — and revisiting the schedule after November 1, several days after the extradition hearing.

The Government respectfully submits this letter in response to the defendant’s request to adjourn the trial date, currently scheduled for October 25, 2021. (D.E. 495). As discussed at the pretrial conference held on September 15, 2021, the Government consents to the defendant’s request for an adjournment. We respectfully suggest that the Court enter an order adjourning the trial sine die, and the Government will provide an update with respect to our views on an appropriate trial date by November 1, 2021.

On September 26, Yahoo published a story that made claims about assassination discussions that, the story itself revealed, were overblown. The story debunked WikiLeaks’ claims that the charges against Assange were political retaliation pertaining to the Russian investigation from Trump. It corroborated the obvious temporal link between the initial charge against Assange and a Russian exfiltration attempt. And it provided details of CIA’s clandestine plans to limit the damage of the still (then, and now) unreleased Vault 8 source code of CIA’s hacking tools. There’s reason to believe WikiLeaks has known aspects of those damage mitigation plans for at least two years, via means they do not want to disclose.

Since its publication, WikiLeaks has used the story to try to suggest that the DOJ extradition should not go forward, but the British judges who heard the appeal seemed unimpressed by tales of CIA outrage about WikiLeaks’ hoarding CIA’s hacking tools.

As part of the extradition hearing on October 28, according to the WikiLeaks’ Twitter account, the lawyer representing the US in Assange’s extradition hearing, James Lewis, asserted that if this effort to extradite Assange fails, they can just start again with another extradition request.

Note: I looked for a more credible source for this quotation than WikiLeaks, which has been sowing more propaganda than usual in recent months, but did not find it quoted by other credible journalists. For the purposes of this post, though, I will accept this as accurate. A representative for US DOJ said that if this extradition attempt fails, Lewis seemed to suggest, DOJ can ask the UK to extradite on a different indictment.

Shortly after the extradition hearing, on November 5, in response to an order from Judge Furman, DOJ proposed March 21, 2022 as the earliest feasible trial date, largely because of expected CIPA proceedings, but in part because of whatever DOJ discussed in that August 4 ex parte classified status letter.

Although the Government is available for trial at any time in the first or second quarters of 2022, the Government does not believe it would be practical to schedule the trial prior to March 2022.

[snip]

The proposed trial date also takes into consideration matters discussed in the Government’s ex parte letter submitted on August 4, 2021. Accordingly, in order to afford sufficient time both for the likely upcoming CIPA litigation and for the parties to prepare for trial with the benefit of any supplemental CIPA rulings, the Government believes that the earliest practical trial date for this matter would be March 21, 2022.

March 21 would be two weeks after the five year anniversary of the first publication of Vault 7, the less harmful development notes stolen from the CIA, but with them, the names or pseudos of several colleagues that Schulte allegedly scapegoated. That would be the likely date for any statutes of limitation on another CFAA conspiracy to toll.

That is, this timing would provide DOJ an opportunity to learn the fate of Assange’s first, declassified charges through 2015, in case DOJ wanted to ask for extradition on a second case charging actions since 2015.

Admittedly, one explanation for that August 4 filing could be that DOJ obtained new evidence (though if it is evidence Schulte will ultimately get, it should not be ex parte). But given Lewis’ comment and the timing of DOJ’s various updates about trial schedule, one explanation is that DOJ would ask to extradite Assange for the Vault 7 publications (and related actions that have nothing to do with journalism) if the current extradition effort fails.

Ultimately, Schulte’s decisions have created a further delay than the one the government proposed. Because Schulte’s expert, Steve Bellovin, has limited availability due to his teaching schedule, the trial is scheduled to start on June 13, 2022, more than six years after Schulte allegedly stole the files in question.

Depends on what happens tomorrow, though, we may learn sooner what that ex parte filing was.

DOJ Was Still Working to Access Joshua Schulte’s Phone in September 2019

/33 Comments/in , , , /by

Glenn Greenwald is making factually unsupported defenses of Russia on Twitter again.

Yesterday, he made an argument about what he sees as one of the most overlooked claims in the Yahoo piece suggesting there was an assassination plot against Julian Assange and then, 100-something paragraphs into the thing, admitting that discussions of killing Assange were really regarded in the CIA as, “a crazy thing that wastes our time.”

Glenn doesn’t, apparently, think the overlooked detail is that the timeline in the story describing the changing US government understanding towards Assange, including Edward Snowden’s central role in that, shows that Assange’s defense lied shamelessly about the timeline in his extradition hearing.

Nor does Glenn seem interested that DOJ didn’t charge Assange during the summer of 2017 after Mike Pompeo started plotting against the Australian, but only did so on December 21, 2017, as the US and UK prepared for what they believed to be an imminent exfiltration attempt by Russia.

Intelligence reports warned that Russia had its own plans to sneak the WikiLeaks leader out of the embassy and fly him to Moscow, according to Evanina, the top U.S. counterintelligence official from 2014 through early 2021.

The United States “had exquisite collection of his plans and intentions,” said Evanina. “We were very confident that we were able to mitigate any of those [escape] attempts.”

[snip]

Narvaez told Yahoo News that he was directed by his superiors to try and get Assange accredited as a diplomat to the London embassy. “However, Ecuador did have a plan B,” said Narvaez, “and I understood it was to be Russia.”

Aitor Martínez, a Spanish lawyer for Assange who worked closely with Ecuador on getting Assange his diplomat status, also said the Ecuadorian foreign minister presented the Russia assignment to Assange as a fait accompli — and that Assange, when he heard about it, immediately rejected the idea.

On Dec. 21, the Justice Department secretly charged Assange, increasing the chances of legal extradition to the United States. That same day, UC Global recorded a meeting held between Assange and the head of Ecuador’s intelligence service to discuss Assange’s escape plan, according to El País. “Hours after the meeting” the U.S. ambassador relayed his knowledge of the plan to his Ecuadorian counterparts, reported El País.

What Glenn thinks is important is that, on April 13, 2017, when Mike Pompeo labeled WikiLeaks a non-state hostile intelligence service, the CIA did not yet have proof that “WikiLeaks was operating at the direct behest of the Kremlin,” though of course Glenn overstates this and claims that they had “no evidence.”

Glenn then claimed that CIA’s lack of proof on April 13, 2017 is proof that all claims about Assange’s ties with Russia made in the last five years — that is, from roughly October 7, 2016 through October 12, 2021 — lacked (any!) evidence. In other words, Glenn claims that CIA’s lack of proof, before UC Global ratcheted up surveillance against Assange in June 2017 and then ratcheted it up much more intensively in December 2017, and before US intelligence discovered the Russian exfiltration attempt, and before they had enough evidence to charge Joshua Schulte in 2018, and before they seized Assange’s computer in 2019, and before Snowden wrote a book confirming WikiLeaks’ intent in helping him flee, is proof that they never acquired such proof in the 1600 days since then.

At the time Pompeo made his comments, FBI was just five weeks into the Vault 7 investigation. They were chasing ghosts in the Shadow Brokers case, which also implicated Assange. Robert Mueller had not yet been appointed and, perhaps a month after he was, Andrew Weissmann discovered that, “the National Security Division was not examining what the Russians had done with the emails and other documents they’d stolen from those servers.” Pompeo’s comments came four months before Mueller obtained the first warrant targeting Roger Stone. They came seven months before Mueller obtained a warrant targeting Assange’s Twitter account. They came sixteen months before Mueller obtained a warrant describing a hacking and foreign agent investigation into WikiLeaks and others. They came 25 months before Mueller released his report while redacting the revelation that multiple strands of the investigation into Stone were ongoing (though also stating they did not have enough admissible evidence to prove Assange knew that Russia continued to hack the DNC). They came three years before DOJ kept the warrants reflecting the foreign agent investigation into WikiLeaks and others largely redacted, presumably because that investigation remained ongoing. They came three and a half years before the government withheld almost all of WikiLeaks lawyer Margaret Kunstler’s two interviews with Mueller’s team because of an ongoing investigation.

And all that’s separate from the long-standing WikiLeaks investigation at EDVA that led to Assange’s charges, which Rod Rosenstein has said never fully moved under Mueller.

On April 13, 2017, the investigation into Assange’s activities in 2016 had barely begun. Yet the fact that CIA couldn’t prove Assange was a Russian agent before most investigation into these things had started, Glenn claims, is proof that Assange is not a Russian agent.

It’s a logically nonsensical argument, but because certain gullible WikiLeaks boosters don’t see the flaws in the argument, I’d like to point to something fascinating disclosed just recently in the Joshua Schulte case: as late as September 2019, DOJ was still trying to get a full forensic image of the the phone Schulte was using when he was first interviewed on March 15, 2017.

That was revealed in the government’s response to a Schulte motion to suppress evidence from the Huawei he used at the time, in the early stages of the FBI’s investigation. We saw many of these warrants from Schulte’s first attempt to get these early warrants suppressed (in which his attorney noted that the government got a second device-specific warrant). But Schulte is challenging the search on a basis that even Sabrina Shroff didn’t raise two years ago.

As the government tells it, FBI agents used a subpoena to get Schulte to hand over his phone during the interview on March 15 before they all returned to his apartment where they had a warrant for all his devices, then got a separate warrant at 1:26AM that night to search the phone specifically. They were unable to do so because it was locked, so in an interview on March 21 — at which time the search warrant was still valid — they got Schulte to open his phone (something his attorney at the time boasted he did voluntarily during a 2017 bail hearing).

Someone must have lost their job at FBI, though, because after Schulte opened the phone, it rebooted, preventing them from obtaining a full forensic copy of the device.

On March 20 and 21, 2021, the defendant, accompanied by his attorneys, was interviewed by the Government and law enforcement agents at the U.S. Attorney’s Office. At the interview on March 21, 2021, the defendant, in the presence of counsel, consented to a search of the Cellphone and entered his password to unlock it. (Id. ¶ 13(b)). When the Cellphone was unlocked, however, it rebooted, and FBI was able to obtain only a logical copy of the Cellphone rather than a complete forensic image. (Id. ¶ 13(c)).

However, in its response to Schulte, the government is relying on two documents that it released for the first time. First, a location warrant/pen register targeting three different phones, which the government submitted to show that Schulte’s Google history obtained on March 14 showed that he searched for ways to delete files in the time period he is accused of stealing the CIA files and deleting evidence of doing so. The affidavit is useful for explaining how Schulte was using phones in that period of 2017. In addition to the Huawei, for example, Schulte had a phone with a Virginia number he used to call at least one of his CIA colleagues between March 7 and when he canceled the phone on March 12. Then, after he gave the FBI his Huawei phone, he bought one that night he used to call Bloomberg (his employer), and another on March 17.

More importantly, the government released the affidavit and warrant from September 9, 2019, providing more explanation why they weren’t able to fully exploit the phone in 2017.

After Schulte unlocked the phone, FBI personnel attempted to forensically image the Subject Device so that the FBI could review its contents. However, because the Subject Device rebooted during that process, the FBI was able to obtain only a logical forensic image of the Subject Device (the “Logical Forensic Image”). Although the Logical Forensic Image contains some content from the Subject Device, the Logical Forensic Image does not contain all data that may be on the Subject Device, including deleted information and data from applications. The data and information from the Subject Device that is missing from the Logical Forensic Image would likely be captured on a complete forensic image of the phone (“Complete Forensic Image”). However, in March 2017, the FBI was unable to obtain a Complete Forensic Image of the Subject Device because the Subject Device locked after it rebooted and the FBI did not know the password to unlock the phone again to attempt to obtain a Complete Forensic Image.

On or about August 12, 2019, FBI personnel involved in this investigation successfully unlocked the Subject Device using a portion of a password identified during the course of the investigation (“Password-1”). Forensic examiners with the FBI believe that they will be able to obtain a Complete Forensic Image of the Subject Device using Password-1.

After unlocking the Subject Device using Password-1, an FBI agent promptly contacted the Assistant United States Attorneys involved in this investigation to inform them of this development, and the decision was made to seek a warrant to search the Subject Device for evidence, fruits, and instrumentalities of the Subject Offense.

The affidavit explains, among other things, that Schulte first obtained the phone on September 21, 2016 and logged into Google right away (somewhere in the vast paperwork released in the case, Schulte admitted that Google was his big weakness — and how!).

In the government response, they describe that the government did search the phone. They say the phone contains images of a woman Schulte lived with that he was charged, in Virginia, with assaulting in 2015.

The FBI searched the Cellphone pursuant to that warrant. The Cellphone contains, among other things, images of an individual identified as Victim-1 in the Government’s prior filings.

It’s an interesting defense of the import of the warrant. As the government explained in 2017 when it first informed Judge Paul Crotty of the Virginia assault charge, the incriminating photos had already been found on one of Schulte’s phones (it’s unclear whether these were found on the Huawei or the phone shut down on March 12), so the State of Virginia presumably doesn’t need any images discovered after 2019 to prosecute him on the assault charge.

As relevant here, the Government discussed several photographs recovered from the defendant’s cellphone that depicted an unknown individual using his hands to sexually assault an unconscious female woman (the “Victim”). (See Exhibit A, Aug. 24, 2017 Tr. at 12-13). At the time, the Government was aware that the Victim knew the defendant and had lived in his apartment as a roommate in the past. (Id.) Magistrate Judge Henry B. Pitman, who presided over the presentment, did not consider the information proffered by the Government regarding the Victim, explaining that “facts have [not] been proffered that . . . tie Mr. Schulte to the conduct in that incident.” (Id. at 48-89). Nevertheless, Judge Pitman detained the defendant concluding that the defendant had not rebutted the presumption that he was a danger to the community. (Id. at 47-49).

[snip]

On or about November 15, 2017, the defendant was charged in Loudoun County Virginia with two crimes: (i) object sexual penetration, a felony, in violation Virginia Code Section 18.2-67.2; and (ii) the unlawful creation of an image of another, a misdemeanor, in violation of Virginia Code Section 18.2-386.1. The Government understands that these charges are premised on the photographs of the Victim. Specifically, the Loudoun County Commonwealth’s Attorneys Office has developed evidence that the defendant was the individual whose hands are visible in the photographs sexually penetrating the Victim.

But whatever they found on the phone, the government made an effort to make clear that even this 2019 search — which might have obtained deleted WhatsApp or Signal texts, both of which Schulte has used — was covered by a search warrant, something Schulte is currently trying to suppress only on a poison fruit claim.

This wasn’t the only evidence the government obtained years after Schulte became the primary suspect, though. They didn’t obtain full cooperation from Schulte’s closest buddy from when he was at the CIA, Michael, until January 2020, just before his first trial (which is one of the reasons the government provided fatally late notice to Schulte that the friend had been placed on leave at CIA). Michael helped Schulte buy the disk drives the government seems to suspect Schulte used in the theft, he also knew of Schulte’s gaming habits, and the CIA believed he might know more about Schulte’s theft from CIA.

So it’s clear that for most of the time that Glenn says the investigation as it stood in April 2017 must reflect all the evidence about Schulte, Assange, and Russia, the government continued to investigate.

None of that says DOJ obtained information from Schulte in that time implicating Assange in ties with Russia (though, as I’ve noted, someone close to WikiLeaks told me Schulte reached out to Russia well before ambiguous references to Russia showed up at Schulte’s trial). But to suggest all the evidence the government might now have was already in their possession on April 13, 2017, requires ignoring everything that has happened since that time.

Timeline

October 7, 2016: In statement attributing DNC hack to Russia, DHS and ODNI include documents released by WikiLeaks; an hour later WikiLeaks starts Podesta release

January 6, 2017: Intelligence Community Assessment assesses, with high confidence, that GRU released stolen documents via exclusives with WikiLeaks

March 7, 2017: First Vault 7 release, including unredacted names of key CIA developers

March 13, 2017: Affidavit supporting covert warrant approving search of Schulte’s apartment, including the devices found there

March 14, 2017: Affidavit supporting overt warrant approving search of Schulte’s apartment, including devices

March 14, 2017: Search warrants for Schulte’s Google account and other electronic accounts

March 15, 2017: 302 from interview with Schulte and testimonial subpoena and cell phone subpoena handed to him at interview

March 16, 2017: Affidavit supporting search warrant authorizing search of Schulte’s Huawei smart phone

March 31, 2017: Warrant and pen register for three different Schulte phones — one serviced by Sprint that he had used through all of 2016 but canceled on March 12, 2017, one he obtained after his phone was seized on March 15, 2017 serviced by Virgin, another he bought on March 17, 2017 serviced by AT&T

April 13, 2017: Mike Pompeo declares WikiLeaks a non-state hostile intelligence service

May 17, 2017: Robert Mueller appointed

August 7, 2017: Mueller obtains first warrant targeting Stone, covering hacking

August 23, 2017: Schulte charged with possession of child pornography

September 6, 2017: Schulte indicted on child pornography charges

September 26, 2017: Roger Stone testifies before HPSCI, lies about source for advance knowledge

October 19, 2017: Stone falsely claims Credico is his intermediary with WikiLeaks

November 6, 2017: Mueller obtains warrant targeting Assange’s Twitter account, citing hacking, conspiracy, and illegal foreign political contribution

November 8, 2017: Schulte claims to have been approached by foreign spies on Subway between his house and court appearance

November 9, 2017: WikiLeaks releases source code, billing it Vault 8

November 14, 2017: Assange invokes CIA’s source code (Vault 8) in suggesting Don Jr should get him named Ambassador to the US

November 16, 2017: Schulte tells FBI story about approach on Subway, accesses Tor

November 17, 2017: Schulte accesses Tor

November 26, 2017: Schulte accesses Tor

November 30, 2017: Schulte accesses Tor

December 5, 2017: Schulte accesses Tor

December 7, 2017: Schulte detained pursuant to charges of sexual assault in VA and violating release conditions

December 12, 2017: Randy Credico invokes the Fifth

December 21, 2017: Assange first charged with CFAA charge

March 6, 2018: Assange indicted on single CFAA charge

June 18, 2018: Superseding Schulte indictment adds Vault 7 leak charges

June 19, 2018: WikiLeaks links to Schulte diaries

August 20, 2018: Mueller obtains warrant describing investigation of WikiLeaks and others into conspiracy, hacking, illegal foreign contribution, and foreign agent charges

September 25, 2018: Schulte posts diaries from jail

October 31, 2018: Second Schulte superseding indictment adds charges for leaking from MCC

April 11, 2019: Assange seized from Embassy

May 23, 2019: Superseding Assange indictment adds Espionage Act charges

August 16, 2019: After FBI interview, CIA places Schulte buddy, “Michael” on leave

September 9, 2019: Affidavit in support of warrant authorizing search of Huawei phone

February 4, 2020: Schulte trial opens

February 12, 2020: Schulte attorneys reveal “Michael” was put on paid leave in August 2019

March 6, 2020: In effort to coerce Jeremy Hammond to testify, AUSA twice tells Hammond that Julian Assange is a Russian spy

March 9, 2020: Judge Paul Crotty declares mistrial on most counts in Schulte case

April 28, 2020: DOJ continues to redact Foreign Agent warrants targeting WikiLeaks and others because of ongoing investigation

June 8, 2020: Third superseding Schulte indictment adds clarification to the charges

June 24, 2020: Second superseding Assange indictment extends CFAA conspiracy through 2015, citing efforts to use Snowden to recruit more leakers

November 2, 2020: BuzzFeed FOIA reveals that Mueller referred “factual uncertainties” regarding possible Stone hacking charge to DC US Attorney for further investigation, but also finding that it did not have admissible evidence that Assange knew Russia continued to hack the DNC

September 3, 2021: Schulte submits motion to suppress cell phone content

September 31, 2021: Schulte’s motion to suppress docketed

October 1, 2021: Government response to Schulte motion to suppress

At Lunchtime on March 15, 2017, Joshua Schulte Went Home and Got His Passport[s]

/22 Comments/in , , /by

“Whoever committed the leak” of CIA hacking tools Joshua Schulte stands accused of, Schulte said in his first FBI interview on March 15, 2017, “was guilty of espionage and deserved to be executed.”

Schulte submitted the 302 from that interview to accompany a motion to suppress the initial search of his cell phone (remember, he went pro se last month, so he’s formulating this defense himself, and this challenge not one the supremely competent Sabrina Shroff mounted when she was in charge of his defense). Schulte based his motion to suppress on a claim that the FBI used a subpoena, not a warrant, to authorize the seizure of his phone.

Schulte’s challenge is, from a legal standpoint, transparent garbage. He claims that the FBI seized his phone with a subpoena. That’s not what the record he submits shows. It shows, instead, that the FBI handed him a subpoena for both grand jury testimony and his phone, then walked back to his apartment with him, then executed a search warrant that included his electronic devices among the items to be searched.

[Schulte, referred to as KP, for either Kinetic Panda or Kinetic Piranha] was presented with a subpoena to appear at a grand jury hearing, scheduled to occur on March 17, 2017. KP was also served with a subpoena, authorizing the FBI to seize KP’s phone. From PERSHING SQUARE, the interviewing Agents and KP walked to KP’s residence, 200 East 39th Street, Apartment 8C, New York, New York, where FBI personnel executed a search warrant.

[snip]

SSA HUI thereafter served KP with a subpoena to appear at a grand jury hearing on March 17, 2017 and a subpoena that authorized the FBI to seize KP’s phone. SSA HUI also stated the FBI would soon execute a search warrant at KP’s residence. KP read the documents and stated he did not know what it all meant. KP was told by the interview Agents that he had every right to seek legal counsel. KP was also told by the interview Agents that he could return to the residence and be present during the search. KP voluntarily agreed to return to the residence and provide access to the search team.

The FBI obtained two warrants to search items including Schulte’s electronic devices first one permitting a covert search and then a second one that permitted that overt search. He knew of the warrant before the search of the phone occurred.

Which means the other details of the 302, which don’t help Schulte but which provide new insight on him and the investigation, are the most interesting details of this new release.

Consider his comment that the leaker should be executed. In the interview, he places blame on “Karen,” for lax security. “KP stated he didn’t want to place blame on anyone in terms of being negligent, but her approach to security was lax.” Trial testimony makes it clear this is a reference to the second-level supervisor he blamed for being disciplined at CIA. So from the very first moment, he seemed to frame Karen as a target of a ruthless Espionage investigation. He would continue from jail, suggesting the “Information War” he launched from a jail cell was actually continuous with an earlier effort to blame Karen, contrary to what Schulte argued at his first trial.

Just as interesting, the comment claiming such a leaker would be guilty of espionage matches something he said to his co-worker, “Jeremy Weber” (whom he also tried to blame for the leak) in conversations about Edward Snowden.

Q. You don’t remember him ever discussing leakers with you?

A. I, I do remember talking about leakers.

Q. Okay. What do you recall?

A. There was discussion around Snowden.

Q. Okay. And?

A. Schulte felt that Snowden was a — had betrayed his country.

Q. That doesn’t, you know, he seems to have strong opinions on everything. You sure he didn’t say more?

A. He probably would have call him a traitor. Said he should be executed for sure. I don’t remember specific verbiage, but he did express his typical strong opinions.

Schulte made those comments to Weber, even though the government claims to have chat logs in which Schulte said that Snowden, unlike Chelsea Manning, didn’t endanger anyone with his leaks.

More recently, Schulte has been fighting to have a home server, including a selection of Snowden files on it, returned to him.

But I’m particularly interested in the comments Schulte made about his planned trip to Cancun.

KP advised that he planned to travel to Cancun, Mexico on Thursday, March 16, 2017 with his brother who lived in Dallas, Texas. KP stated he has three younger brothers who all lived in Texas. KP had discussed moving back to Texas at some point and running a business with his brother in Dallas. KP stated the trip cost him approximately $1,200.00 and they planned to stay at a resort. KP stated he had no plans to meet up with anyone other than his brother during the trip, and he planned to return to the U.S. on March 20, 2017. KP stated he and his brother wanted to take a trip to either Cancun or Denver, Colorado, but they ultimately chose Cancun.

KP stated he returned to his residence during lunchtime earlier in the day to retrieve his passport so he could check-in online. KP said his passport was currently located inside his backpack, which was on the floor next to KP at PERSHING SQUARE. KP said he printed out his travel documents earlier. (Agent Note. KP reached inside his backpack and showed SA DONALDSON the documents he printed for the Cancun trip.)

KP said he understood how his potential travel abroad could cause angst at high levels of government; however, KP said if he was guilty, then he would have already left the country. KP stated he booked the Cancun trip prior to the WIKILEAKS publication. [my emphasis]

According to the trial interview of Robert Evanchec, one of the agents who conducted this investigation, they already knew of this trip when then went to interview him (indeed, they included it in the warrant affidavits). “[W]e learned that within a week’s time he was planning to travel, for the second time in his life, outside the United States.” As described in that testimony, it was why they chose to interview Schulte so early in the investigation.

Q. I think you said earlier that early in the investigation, you learned that the defendant was traveling or planning to travel?

A. That’s correct.

Q. Where was he planning to travel to?

A. To Cancun, Mexico.

Q. When was the defendant scheduled to travel?

A. He was scheduled to depart on March 16, 2017.

Q. How, if at all, did that impact your investigation?

A. It accelerated our need to quickly understand what this defendant had done, and what his intentions were in traveling to Cancun. As I said earlier, it was only the second time in his life that he left the United States. And certainly his departure this close to the WikiLeaks release was of concern to us, and necessitated that we escalate our investigation and look into other ways to find out why he was traveling.

Q. What did you do as a result of that?

A. As a result of that, we had planned and actually ended up interviewing the subject Mr. Schulte.

While the 302 doesn’t record it, according to Evanchec’s testimony, after telling the FBI he had gone home at lunch to retrieve “his passport,” Schulte then told FBI Agents his diplomatic passport was back at his apartment.

Q. Did the defendant say anything about a diplomatic passport at the residence?

A. He did.

Q. What did he say about that?

A. He indicated that he had retained a diplomatic passport from his time at the CIA that he had not returned that was inside of his residence.

Schulte accompanied the FBI back to the apartment, let them in, hung around for a bit, then returned to Bloomberg, staying longer than he told them he would.

While he was at Bloomberg, FBI got far enough in their search of Schulte’s apartment to determine that the diplomatic passport was not there.

Q. You testified that the defendant told you that that diplomatic passport was in his apartment; is that correct?

A. That’s correct, sir.

Q. Was the diplomatic passport found in his apartment?

A. It was not.

When Schulte didn’t return when he said he would, Evanchec intercepted Schulte again as he was about to leave Bloomberg. The 302 redacts the reference to the FBI telling him they did not find his diplomatic passport at the apartment.

As Evanchec testified, when they intercepted Schulte on his way out, he admitted that he had stashed his diplo passport at his work station at Bloomberg, and they all went to his workstation and got both passports.

A. I believe it was just after midnight, around 12:15 p.m. We observed him again in the lobby of the Bloomberg building at 120 Park Avenue.

Q. Did you approach him?

A. We did.

Q. Who was with you at that time?

A. At the time it was myself, Special Agent Gary Ido, and Special Agent John Summers.

Q. What, if anything, did you say to the defendant at that time?

A. We indicated to him that we had obtained classified information or found classified information in his residence. And we also indicated that we had not recovered his diplomatic passport.

Q. What, if anything, did the defendant say in response?

A. He indicated the diplomatic passport was actually in his office at Bloomberg.

Q. Did he go anywhere after that?

A. Yes, he escorted us along with a security official from Bloomberg to his desk where we took possession of the diplomatic passport.

Q. Did you take possession of any other passport at that time?

A. Yes.

Q. What passport?

A. His personal passport.

Now, virtually all of this has previously been made public (presumably, Evanchec reviewed the 302s before testifying at the trial).

What’s new is that, at least per Schulte, he went home in the middle of the day to get his passport(s). His excuse for doing so might make sense — he was trying to check in online, which you can only do a day in advance. He might have been able to check in from his house, at lunch, unless he tried and discovered he could only check in 24-hours before his flight (he was scheduled to leave work before the end of the day on March 16).

Except none of that would require Schulte to bring two passports back to work, his regular passport and his diplomatic passport (the latter of which he should have but did not turn in when he left the CIA the previous November). Indeed, given the scrutiny Schulte had to have known he would be under, flying under the diplo passport would provoke alarm all by itself, so presumably he was checking in with his regular passport.

What I find particularly interesting, however, is the timing.

That’s because sometime between 10:50 AM and 3:30 PM that same day, Trump said the following in a recorded interview with Tucker Carlson, leaking classified information that would have alerted Schulte, if he had a way to hear it, that the government had determined that “a lot of things were taken” from the CIA under Obama, not under Trump.

Trump: Because I don’t want to do anything that’s going to violate any strength of an agency. You know we have enough problems. And by the way, with the CIA, I just want people to know, the CIA was hacked and a lot of things taken. That was during the Obama years. That was not during, us, that was during the Obama situation. Mike Pompeo is there now, doing a fantastic job. But we will be submitting certain things, and I will be perhaps speaking about this next week. But it’s right now before the Committee, and I think I want to leave it at that. I have a lot of confidence in the committee.

If Schulte had some way of seeing this, then, he would have been alerted that FBI had learned enough to know that he was a likely culprit for the leak.

Around the time Trump said this, Schulte (by his own telling) left work and got the passport he needed to check in for his second-ever flight out of the country — he reserved the flight on February 27. He never showed which passport he had in his bag to the FBI Agents, so it’s possible he also got the diplo passport he shouldn’t have even had, much less needed to check in for a flight.

For what it’s worth, it doesn’t seem possible that Schulte would have gotten advance notice he was the suspect for the leak from Trump’s blabbing to Tucker Carlson. I’ve not found any evidence that that interview played live; rather, it appears to have first aired at 9PM, by which point Schulte would have already been intercepted by FBI Agents in the Bloomberg lobby as he left from work.

But the 302 shows that, at around the same time that Trump was blabbing non-public details of the investigation into Schulte to a cable TV personality, Schulte left work and got his passport, possibly even the diplomatic passport he shouldn’t have had.

More on Joshua Schulte’s Attempted Hack of the Justice System

/23 Comments/in , /by

A few weeks ago, I described what I believed was an attempt by Joshua Schulte to hack the judicial system — not by using computer code, but by exploiting legal code. In a status hearing, he claimed that he had informed prosecutors that he wanted to proceed pro se (representing himself). The sole remaining member of the prosecution team, David Denton, said he hadn’t heard of it.

A letter submitted by Denton and AUSA Michael Lockard today, who has joined the team, explains why: after they reviewed one of many appeals Schulte had filed (this one a demand for the judge in this case to recuse), he actually informed of his purported decision Judge Paul Crotty ex parte, before he sent a contrary filing, also ex parte. Crotty, having gotten no unequivocal indication that Schulte intended to proceed pro se, did nothing, which is part of the basis for Schulte’s mandamus filing.

On June 9, 2021, the defendant filed a pro se petition for a writ of mandamus in the Second Circuit seeking to recuse the District Court, claiming, among other things, that the defendant “petitioned [the Court] to represent himself in multiple letters throughout November 2020,” and that the Court “did not hold a Faretta hearing as required by law.” In Re: Joshua Schulte, 21-1445, Dkt. 1 at 10 (2d Cir. 2021). At the status conference in this matter on June 15, 2021, the Government noted that no such request appeared on the docket for this case, and that the Government was not aware of the defendant expressing “an unequivocal intent to forego the assistance of counsel.” Williams, 44 F.3d at 100. At the conference, defense counsel, at the defendant’s apparent request, stated that this was incorrect, and the defendant did wish to proceed pro se. Following the conference, defense counsel forwarded the Government a copy of a letter dated November 6, 2020, in which the defendant indicated his desire to proceed pro se, and informed the Government that the request had been submitted by the defendant to the Court ex parte. Defense counsel further explained that, in subsequent ex parte communication with the Court following the defendant’s November 2020 letter, defense counsel had advised the Court that the defendant intended to continue with counsel.

Much of the letter submitted today is routine process for when a defendant claims to want to represent himself. Among the precedents the government cites are two (one in this circuit) holding that a defendant cannot be co-counsel with his defense attorney, which is effectively what Schulte has done.

(4) a defendant who elects to proceed pro se “has no constitutional or statutory right to represent himself as co-counsel with his own attorney,” United States v. Tutino, 883 F.2d 1125, 1141 (2d Cir. 1989); see also Schmidt, 105 F.3d at 90 (“[T]here is no constitutional right to hybrid representation.”).

And while at the hearing Sabrina Shroff had suggested she and Deborah Colson serve as stand-by counsel, the government rightly notes that in his mandamus petition, Schulte raised conflicts reviewed before his first trial, which is something amounting to advice from Shroff that Schulte write down everything he wanted to leak in his prison notebook. They’re using that to ask that Crotty appoint someone besides Shroff (though they don’t name her) as standby counsel.

With regard to the appointment of standby counsel, the Government notes that the defendant’s recently filed pro se mandamus petition reiterates his prior claims that he wishes to call as witnesses certain of his prior and current counsel from the Federal Defenders of New York, although that claim is framed in the context of arguing that the Court’s prior rulings on this issue demonstrate bias that requires the Court’s recusal, rather than seeking relief from the Court’s orders themselves. See In Re: Joshua Schulte, 21-1445, Dkt. 1 at 4-9 (2d Cir. 2021). Accordingly, in order to avoid later claims alleging any purported conflict-of-interest, the Government respectfully suggests that it would be prudent for the Court to appoint as standby counsel one of the defendant’s current or former attorneys not implicated in the defendant’s claims asserting conflict or implicating the attorney-witness rule.

So the letter explains what, in a normal court room, is going on. But I maintain that Schulte is (and has been, for some time) attempting to do what he did with CIA’s computer systems: send a bunch of conflicting messages to get the machine to operate in a way entirely unexpected. Indeed, one tactic he’s using is one he used several times at CIA, the same tactic small children use when one parent gives them a response they don’t like: Schulte is bypassing his criminal docket (both through the use of the ex parte letters and the non-associated dockets, to ensure the government didn’t learn of this ploy until all the Speedy Time would, if the ploy is successful, have elapsed).

If I were the government I’d have some good hacking investigators review the docket to try to understand it all from a hacker’s brain. Because, at the very least, I suspect Schulte plans to claim that the government simply forgot to hold his second trial.

Snowden

Insurance File: Glenn Greenwald’s Anger Is of More Use to Vladimir Putin than Edward Snowden’s Freedom

/105 Comments/in , , , , /by

Glenn Greenwald risks making his own anger more valuable to Vladimir Putin than Edward Snowden’s freedom.

When WikiLeaks helped Snowden flee Hong Kong eight years ago, both WikiLeaks and Snowden had the explicit goal of using Snowden’s successful flight from prosecution to entice more leakers.

In his book, Snowden described that Sarah Harrison and Julian Assange’s goal in helping him flee Hong Kong was to provide a counterexample to the draconian sentence of Chelsea Manning.

People have long ascribed selfish motives to Assange’s desire to give me aid, but I believe he was genuinely invested in one thing above all—helping me evade capture. That doing so involved tweaking the US government was just a bonus for him, an ancillary benefit, not the goal. It’s true that Assange can be self-interested and vain, moody, and even bullying—after a sharp disagreement just a month after our first, text-based conversation, I never communicated with him again—but he also sincerely conceives of himself as a fighter in a historic battle for the public’s right to know, a battle he will do anything to win. It’s for this reason that I regard it as too reductive to interpret his assistance as merely an instance of scheming or self-promotion. More important to him, I believe, was the opportunity to establish a counterexample to the case of the organization’s most famous source, US Army Private Chelsea Manning, whose thirty-five-year prison sentence was historically unprecedented and a monstrous deterrent to whistleblowers everywhere. Though I never was, and never would be, a source for Assange, my situation gave him a chance to right a wrong. There was nothing he could have done to save Manning, but he seemed, through Sarah, determined to do everything he could to save me. That said, I was initially wary of Sarah’s involvement. But Laura told me that she was serious, competent, and, most important, independent: one of the few at WikiLeaks who dared to openly disagree with Assange. Despite my caution, I was in a difficult position, and as Hemingway once wrote, the way to make people trustworthy is to trust them.

[snip]

It was only once we’d entered Chinese airspace that I realized I wouldn’t be able to get any rest until I asked Sarah this question explicitly: “Why are you helping me?”

She flattened out her voice, as if trying to tamp down her passions, and told me that she wanted me to have a better outcome. She never said better than what outcome or whose, and I could only take that answer as a sign of her discretion and respect.

It’s not just Snowden’s impression, though, that WikiLeaks intended to make an example of him. The superseding indictment against Assange cites several times when Assange invoked WikiLeaks’ role in Snowden’s successful escape to encourage others (including CIA Systems Administrators like Joshua Schulte, who had a ticket to Mexico when the FBI first interviewed him and seized his passports) to go do what Snowden did. British Judge Vanessa Baraitser even included one of those speeches in paragraphs distinguishing what Assange is accused of from legal journalism. And as early as 2017, public reporting said that WikiLeaks’ assistance to Snowden was what changed how DOJ understood WikiLeaks and why it began to consider prosecuting Assange. It wasn’t Trump that led DOJ to stop treating Assange as a journalist, it was Snowden.

According to Snowden’s own words, he shared WikiLeaks’ goal of setting an example to inspire others. In an email that Snowden must have sent Bart Gellman weeks before the exchange between him and Harrison above, Snowden described steps he took to give other leakers (this may be Gellman’s paraphrase), “hope for a happy ending.”

In the Saturday night email, Snowden spelled it out. He had chosen to risk his freedom, he wrote, but he was not resigned to life in prison or worse. He preferred to set an example for “an entire class of potential whistleblowers” who might follow his lead. Ordinary citizens would not take impossible risks. They had to have some hope for a happy ending.

To effect this, I intend to apply for asylum (preferably somewhere with strong internet and press freedoms, e.g. Iceland, though the strength of the reaction will determine how choosy I can be). Given how tightly the U.S. surveils diplomatic outposts (I should know, I used to work in our U.N. spying shop), I cannot risk this until you have already gone to press, as it would immediately tip our hand. It would also be futile without proof of my claims—they’d have me committed—and I have no desire to provide raw source material to a foreign government. Post publication, the source document and cryptographic signature will allow me to immediately substantiate both the truth of my claim and the danger I am in without having to give anything up. . . . Give me the bottom line: when do you expect to go to print?

Citizenfour also quotes Snowden describing how he hoped that proof that his “methods work[]” would encourage others to leak.

If all ends well, perhaps the demonstration that our methods worked will embolden more to come forward.

Snowden’s “methods” don’t work — they certainly haven’t for Daniel Hale, Reality Winner, or Joshua Schulte. But for each, Snowden played at least some role (there is ambiguity about how Schulte really felt about Snowden) in inspiring them to ruin their lives with magical thinking and inadequate operational security.

One of Snowden’s “methods” appears to entail quitting an existing job and then picking another at an Intelligence Community contractor with the intent of obtaining documents to leak. Snowden did this at Booz Allen Hamilton, and his book at least suggests the possibility he did that with his earlier job in Hawaii.

The government justified the draconian sentence that it had negotiated with Winner’s lawyers, in part, by claiming that she premeditated her leak.

Around the same time the defendant took a job with Pluribus requiring a security clearance in February 2017, she was expressing contempt for the United States, mocking compromises of our national security, and making preparations to leak intelligence information

Along with evidence Winner researched The Intercept’s SecureDrop before starting at her new job, the government supported this claim by pointing to three references Winner made to Snowden as or shortly after she started at Pluribus, including texts in which Winner told her sister she was on Assange and Snowden’s side the day the Vault 7 leak was revealed. That was still two months before she took the files she would send to The Intercept.

Had Hale gone to trial, the government would have shown that Hale discussed serving as a source for Jeremy Scahill by May 30, 2013, the day before he left NSA, and discussed Snowden — and hanging out with the journalists reporting on him — the day Snowden came forward on June 9. Then, on July 25, Hale sent Scahill a resume showing he was looking for counterterrorism or counterintelligence jobs. In December, Hale started the the job at Leidos where he would print out the files he sent to The Intercept.

You can think these leaks were valuable and ethical without thinking it a good idea to leave a months-long trail of evidence showing premeditation on unencrypted texts and social media.

Similarly, one of Snowden’s “methods” was to claim he had expressed concerns internally, but was ignored, a wannabe whistleblower stymied by America’s admittedly failed support for whistleblowers, especially those at contractors.

In the weeks before Snowden left NSA, he made a stink about some legal issues and NSA’s training programs (about how FISA Section 702 interacted with EO 12333) that he subsequently pointed to as his basis for claiming to be a whistleblower. The complaint was legit, and one NSA department actually did take notice, but it was not a formal complaint; indeed, it was more a complaint about US law. But his complaint had nothing to do with the vast majority of the documents that have been published based off his files, to say nothing of the far greater set of documents he took. And he made the complaint long after having prepared for months to steal vast amounts of files.

Similarly, Joshua Schulte wrote two emails documenting purported concerns about CIA security, one to a colleague less than a month before he left, which he didn’t send, and then, on his final day, one to CIA’s Inspector General that he falsely claimed was unclassified, a copy of which he was seen taking with him when he packed up. In the first search warrant for Schulte’s house obtained on March 13, 2017, less than a week after the initial Vault 7 release, the FBI had already found those emails and deemed Schulte’s treatment of them as suspect. And when they found a copy of the classified letter to the IG stashed in his headboard, it gave them cause to seize Schulte’s passports on threat of arrest. Snowden’s “methods” didn’t deliver Schulte a “happy ending;” they made Schulte’s apprehension easier.

To the extent Schulte could be shown to be following Snowden’s “methods” (again, that question was not resolved at his first trial) it would be a fairly damning indictment of those methods, since this effort to create a paper trail as a whistleblower was such an obvious attempt to retroactively invent cover for leaks for which there was abundant evidence Schulte’s motivation was spite and revenge. Maybe that’s why someone close to Assange explicitly asked me to stop covering Schulte’s case.

Had Daniel Hale gone to trial, the government undoubtedly would have used the exhibits showing that Hale had never made any whistleblower claims in any of the series of government jobs where he had clearance as a way to push back on his claim of being a whistleblower, though Hale was outspoken about his criticisms of the drone program before he took most of the files he shared with The Intercept. Indeed, given the success of Hale’s earlier anti-drone activism, his case raises real questions about whether leaking was more effective than Hale’s frank, overt witness to the problems of the drone program.

Worse still, Snowden’s boasts about his “methods” appear to have made prosecutions more likely. An early, mostly-sealed filing in Hale’s case, reveals that the government set out to investigate whether Hale was The Intercept’s source because they were trying to figure out whom Snowden had “inspired” to leak.

Specifically, the FBI repeatedly characterized its investigation in this case as an attempt to identify leakers who had been “inspired” by a specific individual – one whose activity was designed to criticize the government by shedding light on perceived illegalities on the part of the Intelligence Community.

That explains why the government required Hale to allocute to being the author of an essay in a collection of Hale’s leaked documents involving Snowden: by doing so, they obtained sworn proof that Hale is the person Snowden and Glenn Greenwald were discussing, while the two were sitting in Moscow, in the closing sequence of Citizenfour. In the scene, Glenn flamboyantly wrote for Snowden how this new leaker and The Intercept’s journalist were communicating, what appears to be J-A-B-B-E-R. That stunt for the camera would have tipped the government off, in cinema release just two months after they had raided Hale’s home, to look for and reconstruct Hale’s Jabber communications with Jeremy Scahill, which they partly succeeded in doing.

Rather than being means to a “happy ending,” then, prosecutors have found Snowden’s “methods” useful to pursuing increasingly draconian prosecutions of people inspired by him.

And now, after Snowden and Greenwald failed to persuade Trump to pardon Snowden, Assange — and in a secondary effort — The Intercept’s sources (perhaps, like Assange, they find the association with Schulte counterproductive, because they didn’t even try to get him pardoned, even though Trump himself almost bolloxed that prosecution), Snowden is left demanding pardons on Twitter for the people he set out to convince leaking could have a “happy ending.”

By associating these leaks with someone being protected by Russia so that — in Snowden’s own words — he could encourage more leaks, Snowden only puts a target on these people’s back, making a justifiable commutation of Winner’s sentence less likely (Winner is due to get out on November 23, two days before the most likely time for Joe Biden to even consider commuting her sentence).

I’m grateful for Snowden’s sacrifices to release the NSA files, but his efforts to lead others to believe that leaking would be easy was bound to, and has, ended badly.

If Vladimir Putin agreed to protect Snowden in hopes that he would inspire more leakers to release files that help Russia evade US spying (as Schulte’s leak did, at a time when the US was trying to understand the full scope of what Russia had done in 2016), the US prosecutorial focus on Snowden-related leakers undermines his value to Putin, probably by design. As that happens, Snowden might reach the moment that observers of his case have long been dreading, the moment when Putin’s utilitarian protection of Snowden will give way to some other equally utilitarian goal.

This is all happening as Putin adjusts to dealing with Joe Biden rather than someone he could manipulate by (at the very least) feeding his narcissism, Donald Trump. It is happening in the wake of new sanctions on Russia, in response to which Putin put US Ambassador John Sullivan on a plane to deliver some message, in person, to Biden. It is happening as Biden’s response to the Colonial Pipeline attack, in which ransomware criminals harbored by Putin shut down US critical infrastructure for fun and profit, includes noting that he and Putin will meet in person soon, followed by the unexplained disabling of the perpetrators in the wake of the attack.

Meanwhile, even as Snowden is of less and less use to Putin, Glenn Greenwald’s utility continues to grow. Snowden, for example, continues to speak out about topics inconvenient to Putin, like privacy. The presence in Russia of someone like Snowden with his own platform and international credibility may become increasingly risky for Putin given the success of protests around Alexei Navalny.

Greenwald, by contrast, seems to have dropped all interest in surveillance and has instead turned many of his grievances — even his complaint that former NSA lawyer Susan Hennessey will get a job in DOJ’s National Security Division, against whom one can make a strong case on privacy grounds — into a defense of Russia. Greenwald spends most of his time arguing that a caricature that he labels “liberals” and another caricature that he labels “the [American] Deep State,” followed closely by another caricature he calls “the  [non-right wing propaganda] Media,” are the most malignant forces in American life. In his rush to attack “liberals,” “the Deep State,” and “the Media,” Greenwald has coddled the political forces that Putin has found useful, including outright racists and other right wing extremists. By the end of the Trump presidency, Greenwald was excusing virtually everything Trump did, up to and including his attempted coup based on the utter denigration of democratic processes. In short, Greenwald has become a loud and important voice in support of the illiberalism Putin favors, to say nothing of Greenwald’s use of a rhetoric unbound by facts.

That Greenwald spends most of his days deliberately inciting Twitter mobs is just an added benefit, to those who want to weaken America, to Greenwald’s defense of fascists.

Most of us who used to know Greenwald attribute his Russian denialism and his apologies for Trump at least partly to his desire to free Snowden from exile. Yet Greenwald’s tantrums, because of their value to Putin, may have the opposite effect.

Stoking Greenwald’s irrational furor over what he calls “liberals” and “the Deep State” and “the Media” would actually be a huge incentive for Putin to deal Snowden to the US, in maximally symbolic fashion. There is nothing that could light up Greenwald’s fury like Putin bringing Snowden to a summit with Biden, wrapped up like a present, to send back on Air Force One. (That’s an exaggerated scenario, but you get my point.)

Plus, if Putin played it right, such a ceremonial delivery of Snowden might just achieve the completion of the Snowden operation, the public release of all of the files Snowden stole, not just those that one or another journalist found to have news value.

The Intelligence Community has, over the years, said a bunch of things about Snowden that were outright bullshit or, at least, for which they did not yet have evidence. But one true thing they’ve said is that Snowden took a great many files that had no imaginable privacy value. Even from a brief period working in the full archive aiming to answer three very discrete questions about FISA, I believe that to be true. While some (including Assange) pressured Snowden and others to release all these files, Snowden instead ensured that journalists would serve a vetting role, and after some initial fumbling, The Intercept did a laudable job of keeping those files safe. So up to now, the fact that Snowden took far more files than any privacy concern — even privacy concerns divorced from all question of nationality — could justify may not have mattered.

But as far as I know there are still full copies out there and Russia would love to spin up Glenn Greenwald’s fury so much he would attempt to burn down his caricature of “The Deep State” in retaliation — much like Schulte succeeded in badly damaging the CIA — by releasing his set.

I believe Russia has been trying to do this since at least 2016.

To be very clear, I’m not claiming that Greenwald is taking money from or is any way controlled by Russia. I am very much not claiming that, in part because it wouldn’t be necessary. Why pay Greenwald for what you can get him to do for free?

And while I assume Greenwald would respect Snowden’s stated wishes and protect the files, like Trump, Greenwald’s narcissism and resentment are very, very easy buttons to push. Greenwald has been heading in this direction without pushing. It would be child’s play to have people friendly to Russia’s illiberal goals (people like Steve Bannon or Tucker Carlson) exacerbate Greenwald’s anger at “the Deep State” to turn it into the frenzy it has become.

Meanwhile, custody of Edward Snowden would be a very enticing dangle for Putin to offer Biden as a way to reset Russia’s relationship with the US. One cannot negotiate with Putin, one can only adjust the points of leverage over each other and hope to come to some stable place, and Snowden has always been at risk of becoming a bargaining chip in such a relationship. By turning Snowden over to the US to be martyred in a high profile trial, Putin might wring the last bit of value out of Snowden. All the better, from Putin’s standpoint, if Greenwald were to respond by releasing the full Snowden set.

For the past four years, Greenwald seems to have believed that if he sucked up to Putin and Trump, he’d win Snowden’s freedom, as if either man would ever deal in good faith. Instead, I think, that process has had the effect of making Greenwald more useful to Russia than Snowden is anymore. And at this point, Greenwald seems to have lost sight of the likelihood that his belligerent rants may well make Snowden less safe, not more.

Update: According to the government sentencing memo for Hale, they didn’t write up the statement of offense, Hale did.

Hale pled guilty without any plea agreement, and submitted his own Statement of Facts. Def.’s Statement of Facts, Dkt. 197 (“SOF”).

Peter Debbins Claims He Stopped Spying for Russia in 2011

/11 Comments/in /by

The government has submitted its sentencing memorandum for Peter Debbins, the former Special Forces guy who pled guilty to spying for Russia’s GRU last November. They are asking for 17 years, arguing that gives him a slightly favorable sentence because he admitted to the spying, but one in line with other recent sentences for people who spied for foreign countries.

The memorandum provides more specifics about where Debbins was assigned and deployed when, how many of his colleagues he IDed to GRU as potential recruiting targets, and what was the security violation that got his clearance suspended in 2005 (he moved his wife to Azerbaijan and gave her a US government phone). It describes how, in spite of that past violation, he was still granted at TS/SCI clearance in 2010, shortly before (according to Debbins’ admissions) he stopped spying.

In January 2010, the U.S. Army notified Debbins via letter that he had been granted a TS/SCI security clearance. Id. ¶ 54. The letter, however, noted concerns about his business connections and father-in-law, and his prior relief of command in Azerbaijan. Id. It cautioned that a foreign intelligence service could exploit such situations and emphasized his “responsibilities for reporting any possible contact by representatives or citizens of foreign countries.”

An appendix includes a picture they found of Debbins wearing a Russian military uniform in 1994.

DOJ notes that Debbins claims he quit spying in 2011.

Debbins has claimed that his conspiracy with the Russian intelligence agents did not continue past January 2011.

But it’s clear they don’t believe him.

For example, they describe how one GRU officer used his business activities as cover for spying and then lay out how Debbins was discussing “business” with that person in 2010, shortly before he claims to have quit spying for Russia.

During this time, Debbins knew that RIS 7 used business affiliations as a cover for Russian intelligence activities. In either the 2008 or 2010 meetings, “RIS 7 provided [Debbins] with the name of his cover company and gave [Debbins] his contact information.” Id. ¶ 46. “RIS 7 instructed [Debbins] to tell his family that he was working with the cover company to explain any calls that he might have with the Russian intelligence service.” Id.

After Debbins returned to the United States from Russia in September 2010, he began exchanging a series of emails with the Russian National. See id. ¶ 60. Many of the emails referenced, at least on their face, the infrastructure project or other business projects.4 See id.

Through these emails, Debbins kept the Russian National apprised of his efforts to move from Minnesota to the Washington, D.C. area. In early November 2010, the Russian National emailed Debbins and stated that he had not heard from him in a long time. See id. ¶ 61. The Russian National specifically noted that “Ivan”—the first name of RIS 7—sent his greetings, see id., an apparent effort to prompt a response from Debbins. Sure enough, Debbins responded to the Russian National three days later, noting that he was about to move to “the capital.” See id. ¶ 62. Then, on January 3, 2011, Debbins emailed the Russian National, informing him that he had moved to “the capital” and that he was working on their business matter. See id. ¶ 63.

The sentencing memo describes how Debbins moved to DC without a job, and only then — in the wake of these conversations about “business” with a known GRU officer — applied to (but didn’t get) a bunch of agency positions, before he settled for military intelligence.

During this time, Debbins moved from Minnesota to Northern Virginia and began applying for positions in the U.S. intelligence community. He moved first to Virginia Beach in December 2010 and then to Manassas in January 2011. See Ex. A, ¶ 34. On or about December 17, 2010, Debbins applied for four positions at the Central Intelligence Agency (CIA). See id. ¶¶ 9-10(a). The following month, Debbins applied for seventeen positions at the National Security Agency. See id. ¶ 11. Debbins did not obtain any of these positions. See id. ¶ 10-11.

Debbins ultimately secured a position with an intelligence branch of the U.S. Army

[snip]

Throughout this period from 2011 to 2019, Debbins also applied unsuccessfully for numerous other positions in the U.S. intelligence community. As detailed in the attached declaration, he unsuccessfully applied for positions at the CIA and DIA. See Ex. A, ¶¶ 10, 12. In 2015, he applied to be a Special Agent at the FBI but later withdrew his name from consideration. See id. ¶ 13. After the 2016 presidential election, Debbins even applied to the White House, seeking to obtain a position on the National Security Council. See id. ¶ 14.

The sentencing memo doesn’t say it — but WaPo has reported that he had ties to both Mike Flynn and Erik Prince, who were being cultivated by Russia at the time he applied for the NSC job, and in the job he would have played a key Russian policy role in the Administration that Russia helped get elected.

Debbins was a graduate of and teacher at the D.C.-based Institute of World Politics, a small but influential school in conservative foreign policy circles. Former Trump national security adviser Michael Flynn and military contractor Erik Prince both have ties to the school.

In early 2017, according to emails reviewed by The Washington Post, Debbins told a friend that he was a candidate for a position on the National Security Council, “specifically Special Assistant to the President and Senior Director for Russia and Central Asia.”

The sentencing memo even describes how, for the entire time Debbins claims to have quit, he was still a security risk because of his past spying.

To make matters worse, Debbins lied about and concealed his contacts with the Russian intelligence agents for nearly a quarter of a century, even after the alleged conspiracy. By deliberately concealing the contacts during background investigations (when he had a legal obligation to report them), Debbins was able to obtain employment in sensitive positions in the U.S. intelligence community, with access to highly classified information, from April 2011 until July 2019. Debbins, a serious security vulnerability considering his history of espionage activity, put national security further at risk by lying and deceiving his way into those positions. Debbins did not reveal his contacts with the Russian intelligence agents to law enforcement until after he failed a polygraph as part of a security clearance reinvestigation in early July 2019.

A person does not harbor (as the sentencing memo describes) an ideological affinity for Russia and only quit spying once he restores his TS/SCI clearance.

And if the government, at any time over the next seventeen years (or however long his sentence) finds evidence to prove that he kept spying, then the boilerplate in his plea deal will mean they only need to prove by a preponderance of evidence that he was lying when he claimed to have quit spying to declare the deal void and sentence him to life in prison. And if that happened, that would make it easy to prosecute him for sharing what presumably would have been Top Secret information without having to risk that Top Secret information at trial.

Peter Debbins claims he quit spying in 2011. But if DOJ ever obtains proof he did not, then his lenient seventeen year sentence would very quickly become a life sentence.

Treasury States as Fact that Konstantin Kilimnik Shared Polling Data with Russian Intelligence

/81 Comments/in , , /by

Today, the Biden Administration rolled out a package of new sanctions against Russia. The package includes new authorities, including limitations on doing business with Russia’s Sovereign Debt. It sanctions some companies with ties to Russian intelligence, including for their role in the Solar Winds breach, which is the kind of precedent that may backfire against the US. As Russia expands its military presence in or just outside Ukraine, it imposes sanctions on Russians involved in Crimea. It expands sanctions for disinformation, targeting both Yevgeniy Prigozhin’s fronts and his money laundering vehicles as well as a GRU front.

A number of those measures will be controversial. And the imposition of sanctions on Prigozhin without an accompanying criminal complaint (as happened under Trump) may suggest a change of strategy.

But one of the bigger pieces of news is that the Treasury press release states as fact that Konstantin Kilimnik shared the polling data that Paul Manafort gave to him (or had Rick Gates pass on) with unnamed Russian intelligence.

Konstantin Kilimnik (Kilimnik) is a Russian and Ukrainian political consultant and known Russian Intelligence Services agent implementing influence operations on their behalf. During the 2016 U.S. presidential election campaign, Kilimnik provided the Russian Intelligence Services with sensitive information on polling and campaign strategy. Additionally, Kilimnik sought to promote the narrative that Ukraine, not Russia, had interfered in the 2016 U.S. presidential election. In 2018, Kilimnik was indicted on charges of obstruction of justice and conspiracy to obstruct justice regarding unregistered lobbying work. Kilimnik has also sought to assist designated former President of Ukraine Viktor Yanukovych. At Yanukovych’s direction, Kilimnik sought to institute a plan that would return Yanukovych to power in Ukraine.

Kilimnik was designated pursuant to E.O. 13848 for having engaged in foreign interference in the U.S. 2020 presidential election. Kilimnik was also designated pursuant to E.O. 13660 for acting for or on behalf of Yanukovych. Yanukovych, who is currently hiding in exile in Russia, was designated in 2014 pursuant to E.O. 13660 for his role in violating Ukrainian sovereignty. [my emphasis]

This comes just one month after the Intelligence Community associated Kilimnik with FSB rather than GRU, as had previously been alleged.

This announcement could be particularly interesting for pardoned Trump campaign manager Paul Manafort. As Andrew Weissmann pointed out at the time, Manafort’s pardon only includes the stuff he was convicted of, arguably leaving open the possibility of prosecution even for stuff he admitted but was not convicted of.

But Manafort’s role in feeding Russia information that was useful for their election operation in 2016 was only ever addressed in Manafort’s plea breach hearing. He was never charged for his lies to protect Kilimnik during the period he was supposed to be cooperating. Just as interesting, around the time (in June and August of last year) that FBI was offering $250,000 for information leading to Kilimnik’s arrest and adding him to their Most Wanted list, a lawsuit by media outlets for Manafort’s breach filings died out with no explanation. One possible explanation for that (it’s not the only one) is that DOJ weighed in and said those filings could not be released because of the ongoing investigation that would lead Treasury to have more confidence about what Kilimnik did with that information.

Yes, it’s interesting that the government now seems to have more clarity about what Russian agency Kilimnik worked for and what he did with Trump campaign information. But it may be acutely interesting for Paul Manafort.

Grits: The Difference between Joshua Schulte’s Complaints about SAMs and Those of His Attorneys

/2 Comments/in , /by

Accused Vault 7 leaker Joshua Schulte got himself back in the news with a challenge to the Special Administrative Measures he has been under since he tried to leak information from jail in October 2018.

His latest complaints closely mirror those he made in a separate lawsuit in April 2019 (though in the earlier one, Schulte claimed that Chapo Guzmán was one of the few people on the same floor, not like that should have mattered).

You can tell this one is self-indulgent from Schulte’s claim that there’s no legitimate reason to require his meetings with his family be monitored.

There is no “legitimate governmental objective” to denying a pre-trial detainee the ability to see both his parents at once, to have a contact visit with them, to visit with them in private, or to contact them as often as other inmates. The government has never charged Mr. Schulte with disclosure of classified information through social visits or phone calls. Regardless, the government cannot take a preventative measure of limiting free speech to stop future potential crimes.

Not only did Schulte share protected information via his family in the past, but he was caught sharing information he recognized was protected (which the government suggests may have been classified) on a phone with someone appearing to be a journalist. Sure, he wasn’t charged for that. The government waited until he did it again, this time using ProtonMail, before charging him.

Plus, some of his complaints really address the sheer arbitrariness of prison life, not SAMs per se.

The MCC bans 10S inmates from equal commissary. These randomly banned items include mouthwash, vitamin E, a book light, a bowl, a radio, earbuds, composition notebooks, reading glasses, honey, A&D ointment, artificial tears, gas relief tabs, prilosec tabs, Tylenol, mirrors, dish soap, pens, albums, Sudoku puzzles, mugs, socks, shorts, V05 body soap, suave lotion, herbal essence shampoo, bagels, BBQ sauce, grits, salt and pepper, honey buns, jolly ranchers, shabangs, combs, sharp cheddar cheese, crackers, soy sauce, wheat thins, assorted tea, and coffee, among many, many more items. It’s so random that “raisin brand” cereal is allowed, but “cheerios” cereal is banned (sold in same bag).

One can best measure of the merit of Schulte’s claim, however, by comparing that April 2019 complaint with what his attorneys submitted in a formal challenge to his SAMs shortly thereafter.

B. The SAMs are unconstitutional.

i. The SAMs unconstitutionally punish Mr. Schulte because they are not rationally related to the legitimate governmental interests underlying 28 C.F.R. § 501.

ii. The SAMs impose restrictions on Mr. Schulte’s defense counsel and attorney-client communications in violation of the Sixth Amendment.

C. Limitation on the “dissemination” of communications.

a. Restrictions on third-party communications.

D. Overall chilling effect on defense counsel.

E. The SAMs violate Mr. Schulte’s First Amendment rights by prohibiting non-legal contact with anyone who is not an immediate family member.

That filing, written by experienced defense attorneys who understand the real difference between Schulte’s treatment and that of other defendants, focused on his ability to defend himself and maintain as much contact with his family as possible.

Judge Paul Crotty, in an August 2019 response to Schulte’s lawyers’ motion, upheld most of the SAMs but modified both his contact with lawyers and his family slightly. There’s no reason to believe Crotty will be more amenable to changing the SAMs now, not least given another Schulte filing that suggests his cell may have been raided back on March 8, on a day he would have had contact with the public at his trial. The government claims the officers in question did no more than deliver him to and from the loading dock that day. A separate judge instructed him to refile the complaint by December 23, but any response has yet to appear on the docket.

SAMs are undoubtedly onerous and some of Schulte’s complaints go to the core of whether such restrictions are humane.

But he also has demonstrated repeatedly that he’s a shameless liar aiming to try his case in public.