WikiLeaks and Edward Snowden Champion Sociopathic Liars and Sloppy Thinking

/52 Comments/in , , /by

WikiLeaks boosters have embraced a really bizarre new entry in the propaganda case to support Julian Assange this weekend: An article by two Icelandic journalists that purports to prove that, “The veracity of the information contained [in the June 2020 superseding indictment against Julian Assange] is now directly contradicted by the main witness, whose testimony it is based on.” This is an article about Sigurdur Ingi Thordarson, AKA Siggi, the sociopath that Assange chose to hang out with for a period in 2010 to 2011, who does have a role but by no means the “main” role in the case against Assange. The journalists who wrote the article present as credible Siggi’s claim, from someone that everyone agrees is a pathological liar, that he’s telling the truth now, rather than when he testified to US authorities in 2019.

The journalists who wrote the article and all the WikiLeaks boosters who have embraced it are arguing that the article somehow proves that an avowed liar is telling the truth now about lying in the past. Even as WikiLeaks boosters are pointing to the Icelandic legal judgment that Siggi is a sociopath, they are once again welcoming him into the WikiLeaks fold because the avowed liar claims to have lied.

This is what Assange’s boosters are now staking his defense on: convincing you to accept the words of liars as truth.

Except, Siggi retracts nothing substantive that is alleged in the indictment, so this drama is instead a demand that you accept the word of a liar rather than read the documents to show that the liar’s claims are irrelevant to the charges against Assange.

The article proves it doesn’t understand US law

Before I get into how little of what the article presents even relates to the indictment, let me show how badly the authors misunderstand (or misrepresent) US law. The last eight paragraphs of the article insinuate that, because US prosecutors gave Siggi immunity for testimony in 2019, he exploited that immunity to commit new crimes in Iceland. The suggestion starts by claiming that the outdated NYT Problem remained true in 2017 and parroting the WikiLeaks claim that therefore what must have changed was the appointment of Bill Barr (who was confirmed after the initial complaint and first indictment had already been obtained).

Although the Department of Justice had spent extreme resources attempting to build a case against Julian Assange during the Obama presidency, they had decided against indicting Assange. The main concern was what was called “The New York Times Problem”, namely that there was such a difficulty in distinguishing between WikiLeaks publications and NYT publications of the same material that going after one party would pose grave First Amendment concerns.

President Donald Trump’s appointed Attorney general William Barr did not share these concerns, and neither did his Trump-appointed deputy Kellen S. Dwyer. Barr, who faced severe criticism for politicizing the DoJ on behalf of the president, got the ball rolling on the Assange case once again. Their argument was that if they could prove he was a criminal rather than a journalist the charges would stick, and that was where Thordarson’s testimony would be key.

I don’t fault journalists in Iceland from repeating this bit of propaganda. After all, even Pulitzer prize winning NYT journalists do. But the NYT problem was overcome when WikiLeaks did something in 2013 — help Edward Snowden get asylum in Russia — that the journalists involved at the time said was not journalism. What’s novel about this take, however, is the claim that career prosecutor Kellen Dwyer was “Trump-appointed.” Dwyer has been an EDVA prosecutor through four Administrations, since the George W Bush administration.

I assume that the reason why it’s important for this tale to claim that Dwyer was appointed by Barr is to claim the immunity agreement under which Siggi — and several other known witnesses to this prosecution — testified did something it didn’t.

In May 2019 Thordarson was offered an immunity deal, signed by Dwyer, that granted him immunity from prosecution based on any information on wrong doing they had on him. The deal, seen in writing by Stundin, also guarantees that the DoJ would not share any such information to other prosecutorial or law enforcement agencies. That would include Icelandic ones, meaning that the Americans will not share information on crimes he might have committed threatening Icelandic security interests – and the Americans apparently had plenty of those but had over the years failed to share them with their Icelandic counterparts.

All the agreement does is immunize the witness against prosecution for the crimes they admit during interviews with prosecutors they were part of, so as to avoid any Fifth Amendment problem with self-incrimination. This is not about hiding Siggi’s role in WikiLeaks; it has been public for a decade. Moreover the article even described the US sharing just the kind of security threat information this paragraph claims they did not.

Jónasson recalls that when the FBI first contacted Icelandic authorities on June 20th 2011 it was to warn Iceland of an imminent and grave threat of intrusion against government computers. A few days later FBI agents flew to Iceland and offered formally to assist in thwarting this grave danger. The offer was accepted and on July 4th a formal rogatory letter was sent to Iceland to seal the mutual assistance.

All that immunity did was provide DOJ a way to ask Siggi about his role at the time. It didn’t immunize future crime in Iceland, nor did it give him any incentive to claim Assange asked him to hack things he hadn’t.

That’s the extent to which these journalists are spinning wildly: getting the facts about the prosecutors and the law wrong in a piece claiming to assess how Siggi recanting what they assume he told prosecutors in 2019 would affect the indictment.

Siggi’s purportedly retracted claims in several cases don’t conflict with the indictment

And, even beyond claiming Siggi is the “main witness” against Assange, they seem to misunderstand the indictment, in which Siggi’s actions play a role in a limited set of overt acts in a Computer Fraud and Abuse Act charge. Because there are so many ways that Assange allegedly engaged in a long-ranging effort to encourage hackers, jurors could find Assange guilty even if none of the Siggi events were deemed credible, and he is central (though his testimony may not be) to just a portion of the overt acts in the CFAA charge.

In fact, this piece never once cites the indictment directly.

Instead, they cite Judge Vanessa Baraitser’s ruling on Assange’s extradition. They cite fragments though, not the single paragraph about Siggi’s role in the CFAA charge that is relevant (indeed, was key) to her decision:

100. At the same time as these communications, it is alleged, he was encouraging others to hack into computers to obtain information. This activity does not form part of the “Manning” allegations but it took place at exactly the same time and supports the case that Mr. Assange was engaged in a wider scheme, to work with computer hackers and whistle blowers to obtain information for Wikileaks. Ms. Manning was aware of his work with these hacking groups as Mr. Assange messaged her several times about it. For example, it is alleged that, on 5 March 2010 Mr. Assange told Ms. Manning that he had received stolen banking documents from a source (Teenager); on 10 March 2010, Mr. Assange told Ms. Manning that he had given an “intel source” a “list of things we wanted” and the source had provided four months of recordings of all phones in the Parliament of the government of NATO country-1; and, on 17 March 2010, Mr. Assange told Ms. Manning that he used the unauthorised access given to him by a source, to access a government website of NATO country-1 used to track police vehicles. His agreement with Ms. Manning, to decipher the alphanumeric code she gave him, took place on 8 March 2010, in the midst of his efforts to obtain, and to recruit others to obtain, information through computer hacking. [italics and bold mine]

Baraitser includes the overt acts involving Siggi — that Siggi gave Assange “stolen banking documents,” may have been his source for “a list of things he wanted” including recordings from Parliament, and provided Assange access to an Icelandic police website — not for Siggi’s role in the action, but for Assange’s representations to Chelsea Manning about them. “Mr. Assange told Ms. Manning … Mr. Assange told Ms. Manning … Mr. Assange told Ms. Manning” certain things about Siggi, and what mattered most is that Assange made the claims, not whether what Assange claimed to Manning was true or not, because it was part of getting her to leak more documents.

The two times Stundin does cite Baraitser’s judgment, they cite it misleadingly, particularly with regards any claims made about the indictment. The sole citation to the critical paragraph of Baraitser’s ruling I cited above appears this way:

More deceptive language emerges in the aforementioned judgment where it states: “…he [Assange] used the unauthorized access given to him by a source, to access a government website of NATO country-1 used to track police vehicles.”

This depiction leaves out an important element, one that Thordarson clarifies in his interview with Stundin. The login information was in fact his own and not obtained through any nefarious means. In fact, he now admits he had been given this access as a matter of routine due to his work as a first responder while volunteering for a search and rescue team. He also says Assange never asked for any such access.

As noted above in bold, in the critical paragraph pertaining to Siggi of the ruling, this topic matters solely for how it related to Assange’s interactions with Manning. And where she introduces the allegation earlier in her ruling, Baraitser makes no claim that Siggi’s access was unauthorized, only that Assange’s was.

It is alleged that Mr. Assange kept Ms. Manning informed about these hacking activities: on 5 March 2010, he told her that he had received stolen bank documents from a source (Teenager); on 10 March 2010, he told her that, in response to a “list of things we wanted”, a source had provided him with four months of recordings from phones located within the Parliament of a “NATO country 1”; on 17 March 2010, he told her that he had used the access, given to him by a source, to obtain unauthorised access a government website used to track police vehicles, in “NATO country 1”. [italics and bold mine]

No one is claiming that Siggi obtained the access via nefarious means. Rather, Baraitser claims only that Assange’s — who was not an Icelandic first responder — was unauthorized, to which Siggi’s purported retraction is irrelevant.

And the indictment provides further context — context that addresses another of Stundin’s claims.

41. In early 2010, a source provided ASSANGE with credentials to gain unauthorized access into a website that was used by the government of NATO Country-1 to track the location of police and first responder vehicles, and agreed that ASSANGE should use those credentials to gain unauthorized access to the website.

42. On March 17, 2010, ASSANGE told MANNING that ASSANGE used the unauthorized access to the website of the government of NATO Country-1 for tracking police vehicles (provided to ASSANGE by a source) to determine that NATO Country-1 police were monitoring ASSANGE.

43. On March 29, 2010, WikiLeaks posted to its website classified State Department materials regarding officials in the government of NATO Country-1, which Manning had downloaded on February 14, 2010.

Again, what is key here is that the credentials were unauthorized for Assange (which they were), that Assange went on to tell Manning about it, and that those things happened when Manning was leaking documents pertaining to Iceland as well. Nothing in Siggi’s supposed recantation is even relevant to that.

Similarly, Stundin complains that Baraitser referred to a file from an Icelandic bank as “stolen,” when Siggi says that he understood the file to have been leaked by whistleblowers, not stolen.

One is a reference to Icelandic bank documents. The Magistrate court judgement reads: “It is alleged that Mr. Assange and Teenager failed a joint attempt to decrypt a file stolen from a “NATO country 1” bank”.

Thordarson admits to Stundin that this actually refers to a well publicised event in which an encrypted file was leaked from an Icelandic bank and assumed to contain information about defaulted loans provided by the Icelandic Landsbanki. The bank went under in the fall of 2008, along with almost all other financial institutions in Iceland, and plunged the country into a severe economic crisis. The file was at this time, in summer of 2010, shared by many online who attempted to decrypt it for the public interest purpose of revealing what precipitated the financial crisis. Nothing supports the claim that this file was even “stolen” per se, as it was assumed to have been distributed by whistleblowers from inside the failed bank.

As noted above, in the key paragraph in Baraitser’s judgment, she described that, “Mr. Assange was engaged in a wider scheme, to work with computer hackers and whistle blowers to obtain information for Wikileaks.” The inclusion of whistleblowers here makes it clear that she understood some of this to be leaked rather than hacked.

Moreover, in the indictment, the claim is about how Siggi’s actions tie to requests Assange made of Manning and (presumably) David House (both of whom were also given immunity to testify, though Manning refused to do so), both of whom took steps to access Icelandic files.

35. In early 2010, around the same time that ASSANGE was working with Manning to obtain classified information, ASSANGE met a 17-year old in NATO Country-1 (“Teenager”), who provided ASSANGE with data stolen from a bank.

[snip]

39. On March 5, 2010, ASSANGE told MANNING about having received stolen banking documents from a source who, in fact, was Teenager.

[snip]

44. On July 21, 2010, after ASSANGE and Teenager failed in their joint attempt to decrypt a file stolen from a NATO Country-1 bank, Teenager asked a U.S. person to try to do so. In 2011 and 2012, that individual, who had been an acquaintance of Manning since early 2010, became a paid employee of WikiLeaks, and reported to ASSANGE and Teenager.

The indictment doesn’t source the claim that the file was stolen to Siggi (certainly, the FBI has other ways of finding out what happens to financial files, and in many contexts, a whistleblower leaking them would amount to theft). Nor does it say Siggi stole it. Nor does Siggi’s understanding of whether it was leaked or stolen matter to the conspiracy indictment at hand, not least given its import to Assange and Manning’s alleged attempts to hack a password so she could leak documents, just what Siggi claims he believed bank employees had done. What matters, instead, is the joint shared goal of accessing it. Nothing Siggi says in his supposed recantation of this story undermines that claim.

Stundin’s third specific denial — that Siggi didn’t himself hack the phone recordings of MPs, but instead received them from a third party — is the single denial of a specific claim made in the indictment.

Thordarson now admits to Stundin that Assange never asked him to hack or access phone recordings of MPs. His new claim is that he had in fact received some files from a third party who claimed to have recorded MPs and had offered to share them with Assange without having any idea what they actually contained. He claims he never checked the contents of the files or even if they contained audio recordings as his third party source suggested. He further admits the claim, that Assange had instructed or asked him to access computers in order to find any such recordings, is false.

The indictment does claim that Siggi obtained these files after Assange requested that Siggi hack things.

In early 2010, ASSANGE asked Teenager to commit computer intrusions and steal additional information, including audio recordings of phone conversations between high-ranking officials of the government of NATO Country-1, including members of the Parliament of NATO Country-1.

[snip]

On March 10, 2010, after ASSANGE told Manning that ASSANGE had given an “intel source” a “list of things we wanted” and the source had agreed to provide and did provide four months of recordings of all phones in the Parliament of the government of a NATO Country-1, ASSANGE stated, “So that’s what I think the future is like ;),” referring to how he expected WikiLeaks to operate.

Siggi denies he hacked anything to get these files, but he does say he got them. He got them, instead, from a third party, unasked. Even if that’s true (and even if the third party wasn’t the intel source), the key point here is that Assange enticed Manning to keep providing requested documents by claiming he had successfully requested and obtained the recorded calls.

The specific denials in this story, even if true, don’t actually deny anything of substance and in one case is completely consistent with the indictment. More importantly, none of these denials are relevant to the way in which Baraitser used them, which is to discuss how Assange’s interactions with Siggi, Manning, and House were part of a unified effort; that unified effort is the only reason Iceland (but not Siggi alone) is key.

The story is silent about or confirms the more serious allegations about Siggi

And the parts of the indictment where Siggi’s role is key, which pertain to Assange’s alleged entry into a conspiracy with Lulzsec to hack Stratfor and to hack a Wikileaks dissident, are unaddressed in this story. For example, Stundin describes reading chat logs Siggi provided — which is not the full set of chatlogs available to the US government, though Stundin claims they must be comprehensive — and finding no proof in the chatlogs that anyone at Wikieaks ordered him to ask other hackers to hack websites. But their focus is on why Siggi asked other hackers to hack Icelandic sites. There’s no mention of hacking US sites.

The chat logs were gathered by Thordarson himself and give a comprehensive picture of his communications whilst he was volunteering for Wikileaks in 2010 and 11. It entails his talks with WikiLeaks staff as well as unauthorized communications with members of international hacking groups that he got into contact with via his role as a moderator on an open IRC WikiLeaks forum, which is a form of live online chat. There is no indication WikiLeaks staff had any knowledge of Thordarson’s contacts with aforementioned hacking groups, indeed the logs show his clear deception.

The communications there show a pattern where Thordarson is constantly inflating his position within WikiLeaks, describing himself as chief of staff, head of communications, No 2 in the organization or responsible for recruits. In these communications Thordarson frequently asks the hackers to either access material from Icelandic entities or attack Icelandic websites with so-called DDoS attacks. These are designed to disable sites and make them inaccessible but not cause permanent damage to content.

Stundin cannot find any evidence that Thordarson was ever instructed to make those requests by anyone inside WikiLeaks. Thordarson himself is not even claiming that, although he explains this as something Assange was aware of or that he had interpreted it so that this was expected of him. How this supposed non-verbal communication took place he cannot explain. [my emphasis]

More bizarre still, Stundin describes Siggi admitting that “Assange was aware of or that he had interpreted it so that this was expected of him.” This actually confirms the most important key allegation pertaining to Lulzsec, that when Siggi was negotiating all this, he claimed to DOJ and still claims now, Assange knew and approved of it. And in fact the indictment alleges that Siggi proved to Topiary he was working with Assange by filming himself sitting with Assange, a non-verbal communication that — because Siggi deleted it — would not have been included in the chatlogs that Stundin insists had to be comprehensive.

To show Topiary that Teenager spoke for WikiLeaks so that an agreement could be reached between WikiLeaks and LulzSec, Teenager posted to YouTube (and then quickly deleted) a video of his computer screen that showed the conversation that he was then having with Topiary. The video turned from Topiary’s computer screen and showed ASSANGE sitting nearby.

In fact, the only specific denial regarding LulzSec in this piece pertains to Sabu, not any of the people that Siggi is alleged to have spoken with.

Thordarson continued to step up his illicit activities in the summer of 2011 when he established communication with “Sabu”, the online moniker of Hector Xavier Monsegur, a hacker and a member of the rather infamous LulzSec hacker group. In that effort all indications are that Thordarson was acting alone without any authorization, let alone urging, from anyone inside WikiLeaks.

There’s no allegation in the indictment pertaining to Siggi’s conversations with Sabu. It alleges he was part of the conspiracy, but not that he spoke with Siggi.

Finally, the one other key allegation involving Siggi in the indictment — that Assange asked him to hack a WikiLeaks dissident — is actually sourced independently to an Assange comment. Nothing in this article denies it specifically, but it’s not even necessarily sourced to Siggi.

There’s no there there in this article. Moreover, all the claims in it — most notably, that Siggi is a sociopath and a liar — have been long known. What the article misunderstands is where Siggi’s testimony may be important, where it served to explain existing documentary files, and the many ways in which DOJ ensured it didn’t rely on such an easily discredited witness. The article also doesn’t understand how co-conspirator statements — statements that have already been made — get entered at trial.

You go to trial with the sociopaths that a target like Julian Assange has chosen to associate with, not with the Boy Scouts you’d like to have as witnesses. But this indictment relies on that sociopath far less than Stundin would have you believe, and Siggi’s purported retractions do very little to rebut the indictment or Baraitser’s ruling about the case. More importantly, the article claims that the DOJ’s purported reliance on a sociopath is fatal, but their argument is based on the claims of that same sociopath.

WikiLeaks boosters claim it exonerates Julian Assange that someone they claim is a liar claims he lied

Admittedly, this is what WikiLeaks always does with their shoddy propaganda claims. They did it with their misrepresentations about a pardon dangle delivered by suspected Russian asset Dana Rohrabacher, they did it with the admission that former Sputnik employee Cassandra Fairbanks personally ferried non-public information about Assange’s prosecution from Don Jr’s best friend to Assange, and they did it with unsupported allegations about UC Global.

They don’t care what the actual evidence is or supports, so long as they have a shiny object that their army of boosters can point to to claim the indictment says something other than it does.

But this one is particularly remarkable because of shit like this.

Edward Snowden, who explained his theft of vast swaths of secret documents based on a claim that he had the judgment to know what he was seeing was abuse, claims to believe that this article “is the end of the case against Julian Assange.” That is, Ed Snowden has displayed for all the world that his critical reasoning skills are so poor that he doesn’t understand that — even if every single thing Siggi is reported to say in this article were true (including his claim that Assange knew and approved of his efforts to forge ties with LulzSec) — it would do little damage to the indictment against Julian Assange.

It amounts to Ed Snowden putting up a sign saying, “Oh sure, I knew better than the entire NSA, but I have such poor critical thinking skills I can’t read through a misleading headline.”

Worse still, what Ed Snowden is telling you to do is to trust the word of someone that — everyone agrees! — is a lying sociopath!! Ed and the entire WikiLeaks booster community here are endorsing the truth claims of someone they acknowledge in the same breath is a liar and a sociopath. What matters for them is not any critical assessment of whether Siggi could be telling the truth, but that the liar is saying what will help them.

Finally, the craziest thing is that Edward Snowden, who not only is personally named in five of the fifty CFAA overt acts, but whose own book confirms key allegations in those five overt acts, pretends that someone else is the star witness. Snowden’s own book, itself, could result in a guilty verdict on the CFAA claim, and the only way to prevent his book from serving that role is for Ed Snowden to claim he himself is a liar. This indictment could only be “poisoned top-to-bottom with false testimony” if Snowden came out tomorrow and claimed he was lying in his own book.

Ed Snowden’s own claim to be telling the truth distinguishes him as a whistleblower rather than a spy. But here, he affirmatively asks you to believe someone everyone agrees is a liar. And based on the belief that that liar was this time telling the truth, Ed asserts that an indictment that implicates his own truth claims is “poisoned top-to-bottom with false testimony.”

Update: One more thing I didn’t stress enough. This story doesn’t claim that prosecutors lied to the UK. Rather, they claim (without evidence about the full set of witnesses and evidence that DOJ relied on), that Siggi misled DOJ about two claims that don’t affect most of the CFAA charge.

Update: I’ve added language making it clear that the claim that Assange knew Siggi was negotiating ties with Lulzsec is still apparently based on what Siggi told DOJ and what he maintains now. That overt act is not the only one showing Assange entering into an agreement before they hacked Stratfor though.

Update: Subtropolis has convinced me to drop the references to Siggi as a child rapist, as he was underage too at the time.

Update: Corrected that the W administration was four Administrations ago.

The Crimes of Violence Ashli Babbitt’s Mob Allegedly Committed

/45 Comments/in , /by

In the Oversight Hearing on January 6 the other day, Paul Gosar suggested that Ashli Babbitt, who was shot while jumping through the last door protecting House members, had been executed.

Paul Gosar: Do you know who executed Ashli Babbitt? … The Capitol Police officer that did that shooting, Ashli Babb — appeared to be hiding, lying in wait, and he gave no warning before killing her.

As it happens, the day after Gosar made these comments, yet another insurrectionist who was standing with Babbitt when she was killed, Kurt Peterson, was arrested in Abraham Lincoln’s birthplace of Hodgenville, KY. According to his arrest warrant, prior to the insurrection, Peterson had accused Democratic lawmakers of treason that should be penalized with death. Peterson claimed to have been at the insurrection with three former Special Forces guys, all in their sixties.

After the insurrection, on January 10, Peterson posted an account on Facebook almost certainly intended to minimize his actions. He claimed, for example, to have entered through a back door that had been opened, and further claimed that when he entered, he told people not to hurt anyone or anything. (He recorded this on voice recognition software so the bracketed corrections are my own.)

When at the back door that we were at open[ed] and there and there were no police to restrain the crowd many people entered at that time. I stood at the door and told everyone that we were not there to hurt anybody or damage anything but as a show of solidarity to right the wrongs of the past election.

In fact, a video cited in his arrest warrant shows someone the government alleges to be him breaking an exterior window to the Capitol screaming, “This is our house. Let us in.”

Peterson is accused of breaking that window, which cost $2,700 to repair. Causing more than $1,000 of damage under 18 U.S.C. §1361 can (and has been invoked to, in this investigation) carry a terrorism enhancement under 18 U.S.C. §2332(b)(g)(5). While it’s unlikely the government will do so with Peterson (they have done so primarily with militia members), given his politicized threats of violence in advance of the insurrection, Peterson could be charged with terrorism for breaking that window.

In the same self-serving account of the day, Peterson gave this account of witnessing Ashli Babbitt’s death.

I did stop men from trying to break down the large wooden doors to the house chamber. Then I saw chairs being brought into the corridor going to the speaker’s lobby. They also grabbed a large sign with a heavy metal base stating no photography. I pushed into the corridor yelling for them to stop trying to break through the doors into the speaker’s lobby. The woman who was shot used the leg of a chair to hit a glass panel on in the door. There were numerous police officers in the stair tower and hallway that I was in.

Before I could get to her the shot rang out from behind the doors in the speaker’s lobby through the glass which shattered hitting many [police] officers and people there. It was a young man in a suit who was supposedly a bodyguard for Chuck [S]chumer.

The bullet hit the woman in the neck which caused her to fall backwards [im]mediately. It could have hit numerous [police] officers that were there. Non lethal force could have been use[d] with out the lethal shot that was made by this body guard in the speaker’s lobby.

I had my 1st aid [gear] with me and asked numerous times to be allowed to render 1st aid to this woman. I was told that they were waiting for the fire department to [respond] and they would not let me give her 1st aid. She died on the floor within 10 minutes of the shot being made.

On the John Sullivan video, there’s no sound of Peterson warning anyone. Rather, there are cries of “Break it down!” with multiple calls before the shot that there was a gun just behind the door the mob was threatening to break down. Everyone in the front line, including Babbitt, should have heard warnings about, if not seen, the gun carefully aimed at the mobsters at the door.

Had non-lethal force been used, the mob might have become more inflamed than they already did. Indeed, many January 6 defendants excuse their behavior, including multiple people accused of assault, as retaliation to the use of non-lethal force.

Peterson suggests that police attending to Babbitt weren’t already giving her First Aid even as they were trying to clear the mob. It appears that another of the rioters, someone with a camera, responded even more quickly than Peterson, along with some of the cops. It is true that Peterson fumbled in his chest as if grabbing for gear. It’s also true that even before that, police were yelling at him to clear out so first responders could get to her. Another video shows that even more closely — as a long line of rioters were clearing a path, Peterson kept talking to the cops.

If the government’s accusations are true, one of the people accusing cops was, himself, dramatically understating his own involvement that day, including his alleged assault on the Capitol that could be (but has not) charged as terrorism.

Breaking down the door

But Peterson is not the only one. While DOJ has thus far charged only a relative handful of people who made up the mob screaming “Break it down!” who were present when Babbitt died, those present range from people accused of trespass to others whose damage to the Capitol could be charged with a terrorism enhancement.

Zach Alam: Zach Alam was the most determined of several men who broke the glass in the door through which Babbitt was trying to enter. Like Peterson, he is accused of damaging the building and obstructing the vote count. In addition, he is charged with assaulting police and civil disorder. A filing opposing his pre-trial release describes his action of the day as “agitated” and rightly notes he stood out among the mob during multiple confrontations with police (including one minutes earlier at the doors to the House Chamber). The video from the Speaker’s Lobby door shows him punching and then kicking the door, then using Christopher Grider’s helmet to hit the panes.

Alam went on the run after January 6 because — as he told a family member — he didn’t want to go back to jail again (he has some recent arrests in DC). During this period on the lam, Alam used at least one assumed name, stolen license plates, and false identification.

Lawfully obtained records show that the defendant has provided multiple false names to service providers, including at least one false name – “Zachary Studabaker” – for services since the events of January 6, 2021.

In addition, according to the government’s information, the defendant was at the time of his arrest driving a vehicle that he had purchased around September 2020 but never registered, and for which the defendant had used multiple license plates, including in recent months. These include a Washington, D.C. license plate, found inside the defendant’s vehicle in Pennsylvania, which was reported stolen in 2018 by an individual who indicated that the front license plate was taken off his vehicle while parked in Northwest D.C. D.C. traffic cameras captured a black Chevy truck matching the description of the defendant’s vehicle bearing this license plate as recently as January 4, 2021. Moreover, when agents located the defendant at the motel in Pennsylvania, they observed the defendant’s black Chevy truck parked outside and noted that it bore Pennsylvania license plates for a Mazda vehicle.

Upon arrest, moreover, the defendant had multiple identification cards in his wallet, including a D.C. driver’s license and a D.C. identification card for one male, a Permanent Resident card for a second male, and University student identification card for a female. Among the items agents seized from the defendant’s motel room nightstand, moreover, were two mobile phones – a Verizon flip phone as well as an iPhone.

Per the same filing, Pennsylvania state authorities are also investigating Alam in conjunction with the January 29, 2021 burglary of an antique store.

This is the kind of defendant whose violence Babbitt was part of. Had Babbitt survived, she might have been on the hook for abetting Alam’s actions at the Speaker’s Lobby.

Chad Jones: Along with Alam, Chad Jones helped to break the panes of the Speaker’s Lobby door. In his case, he hit the window with a flag pole holding a wrapped up Trump flag. Jones was charged with resisting officers and civil disorder on top of the damage to the door.

Christopher Grider: Like Alam, Christopher Grider ran to the Speaker’s Lobby after being turned back at the House Chamber. Like Alam, he is charged helping to break through the Speaker’s Lobby doors through which Babbitt jumped. He handed Alam his own helmet, which Alam used to continue beating on the doors. Even after handing Alam the helmet, Grider allegedly pushed and kicked on the doors himself.

Grider backed away from the door when people started to call out about the gun. But like Peterson, he didn’t leave the scene to let officers respond.

Grider is charged for the destruction to the door, obstruction, and trespassing.

Assault

Brian Bingham: Brian Bingham was arrested June 22 in Alabama (which is neither of the states in which he was known to be living in his arrest warrant, Florida and New Jersey). He had been IDed by people who knew him from the Army with days after the insurrection and posted this photo from minutes after Babbitt’s death to his Facebook account (it’s unclear from the arrest warrant how Bingham’s attempts to shut down his Facebook account failed; possibly they obtained a preservation order).

Bingham appears to have been loitering around the East door as if knowing it would open before it did.

Minutes after Babbitt’s shooting, Bingham got in a tussle with two cops trying to expel him (the best footage of which was captured from another rioter’s phone, which may explain the delay in arresting him).

He yelled at them,

“You won’t hurt ANTIFA, but you’ll murder innocent girls!” “Where do you want me to move? Push me again!”

He bragged about the interaction later in the day.

Individual-5: Are you ok?

BINGHAM: I got to manhandl[e] 5 cops and live to tell

Individual-5: Lol… All of this does not surprise me! Stay safe. Trump2020

Bingham is not charged with obstructing the vote (which is surprising for a number of reasons, but may be consistent with an approach of undercharging those present at Babbitt’s death). But he is charged for the interaction with police.

Obstruction

Alex Sheppard: Like many others, Alex Sheppard ran from the stand-off at the House Chamber to the Speaker’s Lobby door, where he was picked up on Sullivan’s video. Presumably because he explained on social media he was driving from Ohio to DC to protest the RIGGED election, he was also charged with obstruction.

Trespass

Most of the others who directly witnessed Babbitt’s death have been charged with trespass, even though several badgered cops in ways that has gotten others charged with civil disorder or took affirmative steps to halt the vote count that has gotten others charged with obstruction.

Thomas Baranyi: Unlike some others, Thomas Baranyi (who was standing just behind her when she died) admitted that Babbitt died while attempting to breach a heavily guarded door.

We had stormed into the chambers inside and there was a young lady who rushed through the windows. A number of police and Secret Service were saying get down, get out of the way. She didn’t heed the call and as we kind of raced up to try to grab people and pull them back, they shot her in the neck, and she fell back on me.

Like many of the people at the door of the Speaker’s Lobby, he had recently been part of a mob that tried to storm the House side itself, only to try the Speaker’s Lobby next. Baranyi is charged with misdemeanor trespassing.

Ryan Bennett: Bennett was shouting “Break it down” while live-streaming the event as Babbitt was shot.

In Live Video 2, shot from inside the Capitol Building, at approximately the 1:40 minute mark, Bennett seemingly yells “no!” in the direction of a banging noise. In Live Video 4, Bennett seemingly yells “no destruction!” at approximately the 0:40 second mark when someone is seen kicking a door. However, in Live Video 3, Bennett seemingly chants “break it down!” along with the crowd at approximately the 2:47 and 3:54 minute marks. Based on my knowledge of the investigation and the events at the Capitol building, I believe the “break it down” chant was in relation to a door located in the Speaker’s Lobby that was barricaded by USCP and where a woman was later shot. A gunshot can be heard at approximately the 2:42 minute mark of Live Video 4.

Though he wore a Proud Boys hat the day of the riot, which was found when the FBI searched his home, he was charged only with misdemeanor trespass.

Phillip Bromley: According to his arrest affidavit, Bromley witnessed the shooting, and then appeared in a video posted to Parler describing it and stating he was 8 feet away.

In his narrative of events on Video 1, BROMLEY states: “listen…everybody needs to know the truth.” BROMLEY proceeds to describe how he “breached the right side,” “went in,” and “came to two large glass doors.” When he reached the doors, BROMLEY continues by stating he was talking with SWAT officers and reminding them “of their oath,” at which time “a gunshot went off” and a woman was “shot her in the neck.” BROMLEY continues by stating it “did not look like a survivable wound” and that “she [the woman who was shot] was eight feet in front of me on a line.” BROMLEY further describes the clothing he observed the woman to be wearing when she was shot and states “they shot her and she is dead.”

He was charged with misdemeanor trespass.

David Mish: David Mish called cops himself, on January 7, to describe what he knew about Babbitt’s shooting.

According to Mish, Babbitt was telling the cops to open the door before she died.

On approximately January 7, 2021, David Mish contacted the Washington, D.C. Metropolitan Police Department (“MPD”) stating that he had information to provide about the fatal shooting of Ashli Babbitt, who was shot inside the U.S. Capitol during the civil unrest. On January 8, 2020, Detective John Hendrick of the MPD contacted MISH by phone and recorded the ensuing conversation regarding the Babbitt shooting. MISH stated that he, together with several others, had entered the United States Capitol on January 6, 2021. MISH asked “[b]ecause I entered the Capitol Building are you guys gonna take me to jail? I didn’t break anything. . . . I went in, yes.”

[snip]

In his interview with Detective Hendrick, MISH stated that a group of several individuals went into a bathroom adjacent to the Speaker’s Lobby and he objected when one of the group broke a mirror, stating, “we’re trying to get to the politicians because we wanna voice our . . . we wanna voice to ‘em.” MISH described Babbitt saying to the officer who was at the doorway, “Just open the door. They’re not gonna stop,” or words to that effect, referring to the crowd gathered at the doorway. MISH further stated that he had used his cell phone to record some of the activity that occurred within the United States Capitol. MISH told the detective, “from my video you can tell that I was one of the, I was the first group of people to hit that doorway,” referring again to the locked doorway leading to the Speaker’s Lobby that the rioters were attempting to breach.

That said, perhaps because he reached out to cops himself, perhaps because he claims to have tried to talk others out of damaging the Capitol, DOJ only charged Mish with misdemeanor trespass.

The videographers

Brian McCreary: Brian McCreary self-reported his presence in the riot by sharing video he had taken of the day, including from the Babbitt shooting.

After taking this picture; I decided to leave the building. Walking around the building, found a place to take a nice overhead shot of the crowd. Shortly after I made my way there and managed to take one clip of the crowd; people broke into that very side – so I followed them to see what they were doing. -Clip 20210106_144223 Following said crowd. -Clip 20210106_144434 Crowd breaks glass to Speakers Library, hear a shot fired. -Clip 20210106_144544 Crowd begins a game of telephone with Shot and killed a girl over here. At that point; I decided to leave the site. Walked to parking garage; jumped in my car and drove home. Im now just noticing that I am limited to 4 uploads; I will call and follow-up to provide the rest.

Perhaps because he reentered the building after leaving once, the government charged him with obstruction as well as trespassing.

Sam Montoya: Like John Sullivan, Infowar’s Sam Montoya’s video leads up to the Babbitt shooting. Like John Sullivan, Montoya eggs on the crowd as he films it. “We have had enough! We’re not gonna take your fucking vaccines! We’re not gonna take all your bullshit! The people are rising up!” But unlike Sullivan (and perhaps because of his tie to an actual media outlet), Montoya was charged only with misdemeanor trespass.

John Earle Sullivan: John Sullivan, whose name came up in texts between his brother and Rudy Giuliani, is the most enigmatic of January 6 defendants. Banned by lefty activists as a provocateur in the months leading up to the insurrection, Sullivan showed up on January 6 and caught key confrontations on video, while he could be heard egging on rioters in his own recording. At first, he was charged with trespass and civil disorder. His first indictment added obstruction and abetting. A second indictment enhanced his charges for carrying a knife during the protest (which he repeatedly asserted on his own video), false statements for denying it to the FBI, and a forfeiture allegation tied to the $90K he made by selling his video of the day (including Babbitt’s shooting). While Sullivan has been given a damage estimate in discovery — possibly tied to a window he seems to describe himself breaking in an office — he has not yet been charged for doing that damage.

The defendant approaches a window and states, “We did this shit. We took this shit.” The defendant also appears to break a window and says, “I broke it. My bad, my apologies. Well they already broke a window, so, you know, I didn’t know I hit it that hard. No one got that on camera.”

Sullivan used his knife — which the government claims he showed publicly in the mob before the House Chamber — both in that mob and later the Speaker’s Lobby to get others to let him up near the front of the mob.

In the moments before Babbitt’s shooting, Sullivan was, just as Babbitt was, cajoling the police to step away from their posts.

After Babbitt’s death, according to the government’s support of seizure of Sullivan’s funds, Sullivan repeatedly boasted both of riling up the mob and of having video he could — and in fact did — monetize.

The defendant also spoke to someone on speakerphone, stating, “I brought my megaphone to instigate shit. I was like, guys we’re going inside, we’re fucking shit up…. I’m gonna make these Trump supporters f—all this shit up…. But I mean you’ll see. I have it all, I have everything, everything on camera, everything I just told you, and I mean everything. Trust me when I say my footage is worth like a million of dollars, millions of dollars. I’m holding on to that shit.”

So while Sullivan has not been charged for breaking a window — which if he were, would make a fifth person present who could be charged with a terrorism enhancement — he was charged with wielding a knife, lying about it, and inciting those around him to riot.

Update, June 24: I’ve added Bingham.

Charlie Savage’s Obfuscations in the Service of Claiming Julian Assange Is a Journalist

/21 Comments/in , , , /by

Everyone is fighting for press freedoms again, and therefore lots of people are misrepresenting the facts about Julian Assange’s prosecution in purported defense of press freedom again.

These are the paragraphs with which UK Judge Vanessa Baraitser distinguished what Julian Assange is accused of from what “ordinary investigative journalists” entitled to protection in the UK or European Union do.

99. As part of his assistance to Ms. Manning, [Assange] agreed to use the rainbow tools, which he had for the purpose of cracking Microsoft password hashes, to decipher an alphanumeric code she had given him. The code was to an encrypted password hash stored on a Department of Defence computer connected to the SIPRNet. It is alleged that had they succeeded, Ms. Manning might have been able to log on to computers connected to the network under a username that did not belong to her. This is the conduct which most obviously demonstrates Mr. Assange’s complicity in Ms. Manning’s theft of the information, and separates his activity from that of the ordinary investigative journalist.

100. At the same time as these communications, it is alleged, he was encouraging others to hack into computers to obtain information. This activity does not form part of the “Manning” allegations but it took place at exactly the same time and supports the case that Mr. Assange was engaged in a wider scheme, to work with computer hackers and whistle blowers to obtain information for Wikileaks. Ms. Manning was aware of his work with these hacking groups as Mr. Assange messaged her several times about it. For example, it is alleged that, on 5 March 2010 Mr. Assange told Ms. Manning that he had received stolen banking documents from a source (Teenager); on 10 March 2010, Mr. Assange told Ms. Manning that he had given an “intel source” a “list of things we wanted” and the source had provided four months of recordings of all phones in the Parliament of the government of NATO country-1; and, on 17 March 2010, Mr. Assange told Ms. Manning that he used the unauthorised access given to him by a source, to access a government website of NATO country-1 used to track police vehicles. His agreement with Ms. Manning, to decipher the alphanumeric code she gave him, took place on 8 March 2010, in the midst of his efforts to obtain, and to recruit others to obtain, information through computer hacking.

101. Mr. Assange, it is alleged, had been engaged in recruiting others to obtain information for him for some time. For example, in August 2009 he spoke to an audience of hackers at a “Hacking at Random” conference and told them that unless they were a serving member of the US military they would have no legal liability for stealing classified information and giving it to Wikileaks. At the same conference he told the audience that there was a small vulnerability within the US Congress document distribution system stating, “this is what any one of you would find if you were actually looking”. In October 2009 also to an audience of hackers at the “Hack in the Box Security Conference” he told the audience, “I was a famous teenage hacker in Australia, and I’ve been reading generals’ emails since I was 17” and referred to the Wikileaks list of “flags” that it wanted captured. After Ms. Manning made her disclosures to him he continued to encourage people to take information. For example, in December 2013 he attended a Chaos computer club conference and told the audience to join the CIA in order to steal information stating “I’m not saying don’t join the CIA; no, go and join the CIA. Go in there, go into the ballpark and get the ball and bring it out”.

Assange is not an “ordinary investigative journalist,” according to the judge who ruled that his extradition would not violate journalistic protections, because he allegedly:

  • Tried to help Manning hack a password
  • Solicited hacks of Iceland
  • Identified a vulnerability in a US server and encouraged people to use it
  • In a speech invoking WikiLeaks’ role in helping Edward Snowden to flee to what ended up being Russia, allegedly encouraged people to join the CIA with the express intent of stealing files from it

A key point for Baraitser is this was all happening at the same time, Assange was allegedly soliciting hacks in Iceland even as he attempted to help Manning crack a password, and Manning knew about the other hacking.

Charlie Savage mentions none of this in a story explaining that Julian Assange’s extradition and prosecution, “raised the specter of prosecuting reporters.” He doesn’t even mention the second superseding indictment at all, the one that lays out (among other things) the allegation that Assange entered in a conspiracy to hack Stratfor, a hack that at least six people on both sides of the Atlantic already did time for.

But the specter of prosecuting reporters returned in 2019, when the department under Attorney General William P. Barr expanded a hacking conspiracy indictment of Julian Assange, the WikiLeaks founder, to treat his journalistic-style acts of soliciting and publishing classified information as crimes.

From there, Charlie tells a narrative that WikiLeaks has been pushing as part of Assange’s extradition defense, a claim that because DOJ Public Affairs head Matthew Miller said, in November 2013, that DOJ could not distinguish Julian Assange from what the NYT does, that means that the Obama Administration continued to face that challenge for the remaining three years of the Obama Administration, long after Miller left, and right through the time WikiLeaks played a key role in a Russian intelligence-led attack on American democracy. As Charlie presents it — citing no sources or public records, and I asked him if he was relying on any and he didn’t respond — the decision to prosecute Julian Assange arose not so much from a subsequent investigation that came to distinguish Assange’s actions from those of journalists, but instead because the Trump Administration “was undeterred” about the prospect of damaging “mainstream news outlets.”

Obama-era officials had weighed charging Mr. Assange for publishing leaked military and diplomatic files, but worried about establishing a precedent that could damage mainstream news outlets that sometimes publish government secrets, like The Times. The Trump administration, however, was undeterred by that prospect.

For now, the First Amendment issues are on hold as Mr. Assange fights extradition from Britain. Soon after the Biden administration took office, the Justice Department pressed forward with that extradition effort in British court, leaving the charges in place.

But that was before Mr. Garland was sworn in — and before the latest uproar about the escalating aggression of the Justice Department’s leak investigation tactics prompted him to focus on drafting a new approach that, he testified, will be “the most protective of journalists’ ability to do their jobs in history.”

It’s Trump’s doing, not the result of further investigation, Charlie reports, as news.

The WikiLeaks narrative that Charlie repeats unquestioningly is inconsistent with an April 2017 report — one Assange’s journalism professor expert witness claims to have been unable to find with the magic of Google — that what came to distinguish Assange from other journalists was his role in helping Edward Snowden.

The US view of WikiLeaks and Assange began to change after investigators found what they believe was proof that WikiLeaks played an active role in helping Edward Snowden, a former NSA analyst, disclose a massive cache of classified documents.

We now know, four years later, that not just DOJ but even “mainstream news outlets” considered what WikiLeaks did to help Snowden something other than journalism.

Bart Gellman’s book (which was published before the most recent superseding indictment) not only lays out how WaPo’s lawyers told Gellman that he and Laura Poitras could not safely, under the law, play the role (which is referenced in the superseding indictment against Assange that Charlie doesn’t mention) that WikiLeaks would end up playing, helping Snowden get asylum in what ended up be an adversarial nation. Gellman even cites communications he and Poitras sent to Snowden in real time explaining that taking steps to help Snowden get asylum in what might be, and as it happens turned out to be, a hostile country was not journalism.

We had lawyered up and it showed. “You were clear with me and I want to be equally clear with you,” I wrote. “There are a number of unwarranted assumptions in your email. My intentions and objectives are purely journalistic, and I will not tie them or time them to any other goal.” I was working hard and intended to publish, but “I cannot give you the bottom line you want.”

Poitras wrote to him separately.

There have been several developments since Monday (e.g., your decision to leave the country, your choice of location, possible intentions re asylum), that have come as a surprise and make [it] necessary to be clear. As B explained, our intentions and objectives are journalistic. I believe you know my interest and commitment to this subject. B’s work on the topic speaks for itself. I cannot travel to interview you in person. However, I do have questions if you are still willing to answer them. [my emphasis]

In other words, WaPo’s own lawyers made it clear that helping an intelligence source obtain asylum in another country is not journalism and might, instead, be viewed by the US government as abetting espionage.

Given Charlie’s focus on the transition from the Trump to Biden Administration, there’s something else glaringly absent from his story: the official record on the government response to WikiLeaks’ role in the 2016 election attack. Admittedly, great swaths of that discussion remain redacted (which suggests there’s stuff we may not know), but the Senate Intelligence Committee’s report the Obama Administration’s response to the 2016 Russian interference campaign discussed how part of that process involved “develop[ing] a complete understanding of WikiLeaks.”

The executive branch struggled to develop a complete understanding of WikiLeaks. Some officials viewed WikiLeaks as a legitimate news outlet, while others viewed WikiLeaks as a hostile organization acting intentionally and deliberately to undermine U.S. or allies’ interests.

In other words, in 2016 — three years after the Miller quote that WikiLeaks has trained obedient journalists to parrot unquestioningly — the government came to some new “complete” understanding of WikiLeaks. One of the most important players in this process was then White House Homeland Security Advisor, Lisa Monaco. Her interview with the committee is cited repeatedly in the unredacted passages of the report.

Admittedly, Monaco’s views on how or whether her own understanding of WikiLeaks changed as part of that process do not appear in the report. The SSCI report redacts what those Obama officials came to understand about WikiLeaks in the waning days of the Obama Administration. But, in a story presented as “news,” it seems important to consider how that process might influence Monaco’s understanding of the case against Assange, given that one of the last things she did when last in government was struggle to respond to an attack on American democracy in part because the government treated WikiLeaks as a journalistic outlet for far too long during the attack. Whatever she believes, Monaco knows far more than Matthew Miller, or us, for that matter. We might not agree with her thus far non-public understanding of WikiLeaks, but even the four year old understanding of WikiLeaks she brought to her position as Deputy Attorney General surely will have a bigger influence on DOJ’s decisions about Assange going forward than what the Public Affairs guy said eight years ago.

It’s not that I disagree that some of the charges against Assange — particularly for publishing the names of US and Coalition informants — present a dangerous precedent. They do, and those risks are important to talk about, accurately and honestly. On that note, though, it’s again worthwhile to see how Baraitser distinguishes Assange (note, the circumstances of the release of the informant names is the area where Assange presented the most evidence to challenge the government’s evidence).

The defence submits that, by disclosing Ms. Manning’s materials, Mr. Assange was acting within the parameters of responsible journalism. The difficulty with this argument is that it vests in Mr. Assange the right to make the decision to sacrifice the safety of these few individuals, knowing nothing of their circumstances or the dangers they faced, in the name of free speech. In the modern digital age, vast amounts of information can be indiscriminately disclosed to a global audience, almost instantly, by anyone with access to a computer and an internet connection. Unlike the traditional press, those who choose to use the internet to disclose sensitive information in this way are not bound by a professional code or ethical journalistic duty or practice. Those who post information on the internet have no obligation to act responsibly or to exercise judgment in their decisions. In the modern era, where “dumps” of vast amounts of data onto the internet can be carried out by almost anyone, it is difficult to see how a concept of “responsible journalism” can sensibly be applied.

[snip]

Free speech does not comprise a ‘trump card’ even where matters of serious public concern are disclosed (see Stoll above), and it does not provide an unfettered right for some, like Mr. Assange, to decide the fate of others, on the basis of their partially informed assessment of the risks.

[snip]

The New York Times published the following condemnation on 25 July 2012:

“The Times and the other news organizations agreed at the outset that we would not disclose —either in our articles or any of our online supplementary material — anything that was likely to put lives at risk or jeopardize military or antiterrorist operations. We have, for example, withheld any names of operatives in the field and informants cited in the reports. We have avoided anything that might compromise American or allied intelligence-gathering methods such as communications intercepts. We have not linked to the archives of raw material. At the request of the White House, The Times also urged WikiLeaks to withhold any harmful material from its Web site.”

This is a distinctly European decision. That’s true because in Europe, unlike the US, such protections are tied to being a journalist. Plus Baraitser argued that under EU law, Assange’s release violated privacy protections that simply don’t exist in the US. Mind you, it’s one thing to say the NYT won’t publish details that might endanger military operations and another thing to say such revelations shouldn’t be protected by the First Amendment. Even if WikiLeaks is a “hostile organization acting intentionally and deliberately to undermine U.S. or allies’ interests,” (as SSCI described), that should not, itself, surpass the First Amendment consideration.

But it underscores the point. There are First Amendment problems with the publication charges and, to a lesser extent, the other Manning-focused ones. But Assange actually wouldn’t be the first person extradited from the UK significantly for publication activities, the same thing happened to Minh Quang Pham for the few months he spent as AQAP’s graphic designer. That precedent has not only gone virtually unnoticed, but did little to harm the press freedom of others in the US. Not only are the First Amendment risks of Assange’s prosecution not tied to whether or not Assange is a journalist, but the effort to reinvent both the history of his prosecution and what he is accused of to turn him into a journalist has led a bunch of journalists and press freedom advocates to violate the principles that are supposed to distinguish journalism.

Joshua Schulte Attempts to Hack the Court System

/24 Comments/in /by

Joshua Schulte attempted to complete a hack of the court system yesterday.

I don’t mean that Schulte used computer code to bring down the court systems. His laptop doesn’t connect to the Internet, and so he does not have those tools available. Rather, over the 3.5 years he has been in jail, he has tested the system, figured out which messages can be used to distract adversaries, and which messages have an effect that will lead the system to perform in unexpected ways. He identified vulnerabilities and opportunities — SDNY arrogance, the pandemic and related court delays, Louis DeJoy’s postal system, and even the SAMs imposed on him — and attempted to exploit them.

As a reminder, a jury hung on the most serious charges against Schulte in March 2020. Afterwards, the government moved to retry Schulte quickly, but his defense attorneys said they needed more time, in part because their expert, Steve Bellovin, was for health reasons unwilling to serve as an expert during COVID. Last November, Judge Paul Crotty scheduled a trial to start June 7, 2021, which would have been a week ago Monday. In March, Schulte’s superb attorney, Sabrina Shroff, moved to delay the trial once more, to October, still citing Bellovin’s withdrawal.

Meanwhile, starting in January, Schulte started submitting pro se filings, some filed through Shroff, and some sent directly. The government responded to a motion for habeas corpus (basically, to point out he needs to file suit against the Warden of MCC, not the prosecution), but did not respond to his motion to suppress evidence seized from the MCC jail. When Schulte filed to request direct access to Lexus Nexis, the government responded, in part, by asking Judge Crotty to force Schulte to decide whether he was representing himself, pro se, or, if not, then to solely allow Shroff and her team to make filings on his behalf.

The defendant’s request appears to be an attempt to further his pattern of engaging in inappropriate, quasi-pro se litigation. The Court should not consider the defendant’s instant letter for that reason. “A defendant has a right either to counsel or to proceed pro se, but has no right to ‘hybrid’ representation, in which he is represented by counsel from time to time, but may slip into pro se mode for selected presentations.” United States v. Rivernider, 828 F.3d 91, 108 (2d Cir. 2016). Although the Court has “discretion to hear from a represented defendant personally,” id. at 108 n.5, “the interests of justice will only rarely be served by a defendant’s supplementation of the legal services provided by his . . . counsel,” United States v. Swinton, 400 F. Supp. 805, 806 (S.D.N.Y. 1975). To the extent the defendant has any colorable claims for relief, his attorneys can present them to the Court, and the Court should reject the defendant’s attempts to “slip into pro se mode,” Rivernider, 828 F.3d at 108, whenever it suits him. See, e.g., United States v. Crumble, No. 18 Cr. 32 (ARR), 2018 WL 3112041, at *4 (E.D.N.Y. June 25, 2018) (“As Markus has not elected to represent himself, he does not have a right to make a motion on his own behalf, nor does he have a right to insist that the district court hear his applications. While I have previously exercised my discretion to entertain Markus’s pro se submissions, I will do so no longer. If Markus wishes to file any further motions, he is directed to ask his trial counsel—or appellate counsel— to adopt this motion. I trust that assigned counsel will file any motions that they do not view as frivolous on Markus’s behalf. Any pro se motions made by Markus, however, will be summarily denied.” (cleaned up)).

In any event, even if the Court considers the defendant’s submission, it is without merit. As his letter acknowledges, he has access to legal databases (a fact confirmed by the volume of his recent pro se filings), but additionally he demands special access to “filings, briefs, modern search, and the ability to print.” The defendant’s claims about the purported deficiencies of the databases to which he does in fact have access do not support such demands or establish a basis for relief. “[A]n inmate cannot establish relevant actual injury simply by establishing that his prison’s law library or legal assistance program is subpar in some theoretical sense.” Lewis v. Casey, 518 U.S. 343, 351 (1996). The defendant identifies no reason he should be afforded special access beyond that which the facility provides in the normal course, and at bottom, he is represented by counsel who have the ability to make well-researched and thoroughly prepared legal claims on his behalf.

Crotty denied Schulte’s request for Lexus Nexis, but didn’t address the pro se request.

Meanwhile, two of the three prosecutors on the team, Matthew LaRoche and Sidhardha Kamaraju, withdrew from the case, both because they’ve left government. LaRoche was involved in a prosecution that collapsed because the government committed a Brady violation, but Kamaraju was not. Kamaraju, however, probably has the most computer expertise of the original three.

Yesterday there was a remarkable status hearing. Crotty started by asking the remaining prosecutor, David Denton, when replacement prosecutors will file an appearance. Imminently, Denton said, though it sounded like he didn’t believe that.

Crotty asked whether Shroff has found an expert. Curiously, she explained that Bellovin still can’t do it, even with the waning risk of COVID, because of his schedule at Columbia University. Crotty noted that it is her responsibility to find an expert (she had said in a November status conference that it would amount to ineffective assistance not to have one).

But the real stunner came at the end, when Shroff said that Schulte wanted her to tell the court that he had told the government back in November that he was proceeding pro se. Denton responded that this was the first he had heard of such a thing, and Shroff responded that he was incorrect; Schulte had informed the government in November.

The hearing ended with a commitment to brief whether Schulte can proceed pro se.

It is almost without exception an insanely bad idea for a defendant to represent themselves, and this is probably not that exception. Still, there are advantages that Schulte would get by representing himself. He’s brilliant, and clearly has been studying the law in the 3.5 years he has been in prison (though he has made multiple errors of process and judgment in his own filings). He has repeatedly raised the Sixth Amendment problems with Special Administrative Measures, notably describing how delays in receiving his mail make it impossible for him to respond to legal developments in timely fashion. So I imagine he’d prepare a Sixth Amendment challenge to everything going forward. He’d be able to demand access to the image of the server he is alleged to have hacked himself. By proceeding pro se, Schulte could continue to post inflammatory claims to the docket for sympathetic readers to magnify, as happened with a filing he submitted earlier this year. And after the government has made clear it will reverse its disastrous strategy from the first trial of making the trial all about Schulte’s conflicts with the CIA, by questioning witnesses himself, Schulte would be able to make personality conflicts central again, even against the government’s wishes. Plus, by not replacing Bellovin, Schulte would serve as expert himself. In that role, Schulte would present the false counter story he has been telling since he was jailed, but in a way that the government couldn’t cross-examine him. So it would probably be insanely detrimental, but less so than for most defendants that try it. It certainly would provide a way to mount the defense that Schulte clearly wants to pursue.

But I think that’s just Schulte’s fall-back plan.

I think his current plan is to argue that, because anything his attorneys did in his name after he purportedly informed prosecutors he was proceeding pro se would be a legal nullity, then two things have happened since that allegedly occurred that will permit him to demand immediate release. First, if his attorneys’ agreements to exclude time from the Speedy Trial clock were not valid, then it would mean the government has run out of time to prosecute Schulte. Additionally, if a request that Shroff made in March to reschedule the trial was not valid, then the trial would have still been scheduled for last week. I suspect Schulte will try to argue that the government forgot to hold their trial and so must be released.

Mind you, there’s no evidence in the docket that Schulte informed prosecutors, much less the court, that he was proceeding pro se. There’s a filing he made in April 2020 that claimed he had no lawyers and made requests as if he was proceeding pro se, one that everyone ignored. But according to Shroff, that’s not the notice; the notice took place in November. Still, given how Schulte has carefully tested how the mail system works with SAMs and COVID, I don’t rule out him sending a letter directly to prosecutors.

The other problem with his claim to be proceeding pro se is that in a May filing, Schulte referred to the October trial (meaning, he recognizes the validity of both that request and Shroff’s exclusion of time under the Speedy Trial Act) and complained that his attorney-client mail was being opened. If he were proceeding pro se without Crotty formally appointing Shroff as standby counsel, their communications would have no privilege. So he has said two things in a pro se filing that are inconsistent with really proceeding pro se.

Certainly, Shroff has said things — in multiple venues — that indicate she believed she remained Schulte’s lawyer.

Given that Schulte claims everything his legal team has done since November was done without his sanction, though, the government would seem to have cause to ask Crotty to assign entirely different lawyers to serve as Schulte’s stand-by counsel, if indeed he does proceed pro se going forward. Which would make his plan for the actual trial, if it ever happens, untenable.

To be sure, I’m not saying this is going to work. But the government — what’s left of the prosecution team, anyway — had better understand that Schulte has been treating the court system with the same adversarial approach as he allegedly did the CIA’s servers. Schulte is claiming to have entered a command into his prosecution back in November that hacked the system, effectively changed the effect of everything that has happened since. Just trusting that such a possibility cannot happen under the legal system is probably a bad idea given where the CIA’s trust that Schulte wouldn’t hack the system turned out.

Update: Via InnerCity Press, there’s the transcript of the hearing.

April 12, 2020: Schulte claims he has no attorneys, claims only a few months remain on Speedy Trial

May 31, 2020: Shroff asks for a week extension to respond to government scheduling motion

June 8, 2020: Schroff requests a status conference for August or September 2020, acting as if Schulte’s request did not exist

June 15, 2020: Shroff initiates White Plains grand jury challenge

June 19, 2020: SDNY extends Speedy Trial to July 1, 2020

July 16, 2020: Shroff informs Judge Crotty Schulte will not reply to Rule 29 motion

July 27, 2020: Shroff asks for extension on grand jury challenge

July 28, 2020: Shroff asks for ESXi server (basically a repeat of Schulte’s April request)

July 30, 2020: Shroff asks for two week delay on status hearing citing (in part) Steve Bellovin’s withdrawal

August 14, 2020: Shroff asks for two week extension on reply to request for ESXi server

September 15, 2020: Shroff reply on ESXi laptop

September 16, 2020: SDNY proposes schedule, with January 2021 trial date

September 21, 2020: SDNY responds to Bellovin submission of ex parte declaration

October 14, 2020: SDNY asks for 30 day exclusion

October 30, 2020: Shroff requests Schulte appear remotely

November 4, 2020: Status conference, trial set for June 7, 2021, with time excluded; Shroff maintains it would be ineffective counsel to go to trial without expert

THE COURT: Are you entitled to an expert?

MS. SHROFF: In a case like this, yes. I’m quite certain I’m entitled to an expert. I think it would be clear error and ineffective assistance of counsel to try this case without an expert, without a doubt.

November 16, 2020: Shroff-submitted motion to dismiss on White Plains grand jury

November 19, 2020: Shroff submits request for VTC meeting with Schulte’s family

January 1, 2021: Schulte motion to suppress MCC evidence (docketed February 24)

January 7, 2021: Shroff requests 2 week extension on White Plains grand jury reply

January 19, 2021: Shroff files Schulte pro se motion for writ of habeas corpus regarding SAMs, dated December 25, 2020

January 22, 2021: Shroff requests two week extension on January 21 deadline for reply on White Plains grand jury reply

January 22, 2021: Shroff requests funds for new laptop for Schulte

January 27, 2021: Civil Division AUSA asks Crotty to dismiss motion for writ so it can be refiled naming Warden as defendant

February 22, 2021: Shroff submits reply on White Plains grand jury challenge

February 24, 2021: Schulte files motion to reconsider decision on habeas (docketed March 4)

March 19, 2021: Schulte calls on Crotty to decide his motion to suppress on the merits, given government non-response (docketed April 5)

March 22, 2021: Shroff moves, with consent of Schulte, to reschedule trial to last quarter of 2021

March 24, 2021: Crotty denies motion to dismiss; Crotty reschedules trial for October 25, excludes time

April 12, 2021: Schulte asks for Lexus Nexis (docketed April 29)

May 5, 2021: Schulte complains about mail delays (docketed May 19); among other things it reflects an October trial date and references attorney-client mail

May 7, 2021: Matthew LaRoche withdraws

May 11, 2021: SDNY submits opposition to Lexus Nexis request, including request for order that Schulte not submit pro se

June 3, 2021: Sidhardha Kamaraju withdraws

June 7, 2021: Date of trial scheduled in November 2020

June 15, 2021: Status hearing at which Schulte claims to have been representing himself pro se since November

Carter Page Believed James Wolfe Was Ellen Nakashima’s Source Disclosing His FISA Application Less than a Month After the Story

/15 Comments/in , /by

According to the Statement of Offense to which James Wolfe — the former Senate Intelligence Committee security official convicted of lying about his contacts with journalists — allocuted, Carter Page suspected Wolfe was the source for Ellen Nakashima’s story revealing Page had been targeted with a FISA order. When the former Trump campaign staffer wrote Nakashima to complain about the story less than four weeks after Washington Post published it, Page BCCed Wolfe. [Nakashima is Reporter #1 and Ali Watkins is Reporter #2.]

On May 8, 2017, MALE-1 emailed REPORTER #1 complaining about REPORTER #1’s reporting of him (MALE-1). According to the metadata recovered during the search of Wolfe’s email, Wolfe was blind-copied on that email by MALE-1.

That unexplained detail is important — albeit mystifying — background to two recent stories on leak investigations.

First, as reported last month, Nakashima was one of three journalists whose call records DOJ obtained last year.

The Trump Justice Department secretly obtained Washington Post journalists’ phone records and tried to obtain their email records over reporting they did in the early months of the Trump administration on Russia’s role in the 2016 election, according to government letters and officials.

In three separate letters dated May 3 and addressed to Post reporters Ellen Nakashima and Greg Miller, and former Post reporter Adam Entous, the Justice Department wrote they were “hereby notified that pursuant to legal process the United States Department of Justice received toll records associated with the following telephone numbers for the period from April 15, 2017 to July 31, 2017.” The letters listed work, home or cellphone numbers covering that three-and-a-half-month period.

The scope of the records obtained on the WaPo journalists last year started four days after the Page story, so while some May 11, 2017 emails between Nakashima and Wolfe would have been included in what got seized last year, any contacts prior to the FISA story would not have. And the public details on the prosecution of Wolfe show no sign that Nakashima’s records were obtained in that investigation (those of Ali Watkins, whom Wolfe was in a relationship, however, were). Indeed, the sentencing memo went out of its way to note that DOJ had not obtained deleted Signal texts from any journalists. “The government did not recover or otherwise obtain from any reporters’ communications devices or related records the content of any of these communications.”

That said, Nakashima’s reporting was targeted in two different leak investigations, covering sequential periods, three years apart.

It’s not clear how quickly the Page investigation focused on Wolfe. But it may have outside help. A CBP Agent unconnected to the FBI investigation grilled Watkins on her ties with Wolfe in June 2017.

The Sentencing Memorandum on Wolfe suggests the FBI came to focus on him — and excused their focus — after having learned of his affair with Watkins. They informed Richard Burr and Mark Warner, and obtained the first of several warrants to access his phone.

At the time the classified national security information about the FISA surveillance was published in the national media, defendant James A. Wolfe was the Director of Security for the SSCI. He was charged with safeguarding information furnished to the SSCI from throughout the United States Intelligence Community (“USIC”) to facilitate the SSCI’s critical oversight function. During the course of the investigation, the FBI learned that Wolfe had been involved in the logistical process for transporting the FISA materials from the Department of Justice for review at the SSCI. The FBI also discovered that Wolfe had been involved in a relationship with a reporter (referred to as REPORTER #2 in the Indictment and herein) that began as early as 2013, when REPORTER #2, then a college intern, published a series of articles containing highly sensitive U.S. government information. Between 2014 and 2017, Wolfe and REPORTER #2 exchanged tens of thousands of telephone calls and electronic messages. Also during this period, REPORTER #2 published dozens of news articles on national security matters that contained sensitive information related to the SSCI.

Upon realizing that Wolfe was engaged in conduct that appeared to the FBI to compromise his ability to fulfill his duties with respect to the handling of Executive Branch classified national security information as SSCI’s Director of Security, the FBI faced a dilemma. The FBI needed to conduct further investigation to determine whether Wolfe had disseminated classified information that had been entrusted to him over the past three decades in his role as SSCI Director of Security. To do that, the FBI would need more time to continue their investigation covertly. Typically, upon learning that an Executive Branch employee and Top Secret clearance holder had potentially been compromised in place – such as by engaging in a clandestine affair with a national security reporter – the FBI would routinely provide a “duty-to-warn” notification to the relevant USIC equity holder in order to allow the intelligence agencies to take mitigation measures to protect their national security equities. Here, given the sensitive separation of powers issue and the fact that the FISA was an FBI classified equity, the FBI determined that it would first conduct substantial additional investigation and monitoring of Wolfe’s activities. The FBI’s executive leadership also took the extraordinary mitigating step of limiting its initial notification of investigative findings to the ranking U.S. Senators who occupy the Chair and Vice Chair of the SSCI.2

The FBI obtained court authority to conduct a delayed-notice search warrant pursuant to 18 U.S.C. § 3103a(b), which allowed the FBI to image Wolfe’s smartphone in October 2017. This was conducted while Wolfe was in a meeting with the FBI in his role as SSCI Director of Security, ostensibly to discuss the FBI’s leak investigation of the classified FISA material that had been shared with the SSCI. That search uncovered additional evidence of Wolfe’s communications with REPORTER #2, but it did not yet reveal his encrypted communications with other reporters.

This process — as described by Jocelyn Ballantine and Tejpal Chawla, prosecutors involved in some of the other controversial subpoenas disclosed in the last month — is a useful lesson of how the government proceeded in a case that likely overlapped with the investigation into HPSCI that ended up seizing Swalwell and Schiff’s records. Given that Swalwell was targeted by a Chinese spy, it also suggests one excuse they may have used to obtain the records: by claiming it was a potential compromise.

Still, by the time FBI first informed Wolfe of the investigation, in October 2017, they had obtained his cell phone content showing that he was chatting up other journalists, in addition to Watkins — and indeed, he continued to share information on Page. By the time the FBI got Wolfe to perjure himself on a questionnaire about contacts with journalists in December 2017, they had presumably already searched Watkins’ emails going back years. Wolfe was removed from his position and stripped of clearance, making his indictment six months later only a matter of time.

All that said, the government never proved that Wolfe was the source for Nakashima. And Ballantine’s subpoena for HPSCI contacts, weeks later after FBI searched Wolfe’s phone, may have reflected a renewed attempt to pin the leak on someone, anyone (though it’s not clear whether investigators looked further than Congress, or even to Paul Ryan, who has been suspected of tipping Page off.

If the James Wolfe investigation reflects how they might have approached the HPSCI side, there’s one other alarming detail of this: The FBI alerted someone in Congress of the search, the Chair and Ranking Member of the Committee. But in HPSCI’s case, Schiff was the Ranking Member. Meaning it’s possible that, by targeting on Schiff, FBI gave itself a way to consult only with the Republican Chair of the Committee.

James Wolfe (and the investigation of Natalie Sours Edwards, who was sentenced to six months in prison last week) are an important lesson in leak investigations that serves as important background for Joe Biden’s promise that reporters won’t be targeted anymore. The way you conduct a leak investigation in this day and age is to seize the source’s phone, in part because that’s the only way to obtain Signal texts.

Timeline

March 2017: Exec Branch provides SSCI “the Classified Document,” which includes both Secret and Top Secret information, with details pertaining to Page classified as Secret.

March 2, 2017: James Comey briefs HPSCI on counterintelligence investigations, with a briefing to SSCI at almost the same time.

March 17, 2017: 82 text messages between Wolfe and Watkins.

April 3, 2017: Watkins confirms that Carter Page is Male-1.

April 11, 2017: WaPo reports FBI obtained FISA order on Carter Page.

June 2017: End date of five communications with Reporter #1 via Wolfe’s SSCI email.

June 2017: Using pretext of serving as a source, CBP agent Jeffrey Rambo grills Watkins about her travel with Wolfe.

October 2017: Wolfe offers up to be anonymous source for Reporter #4 on Signal.

October 16, 2017: Wolfe Signals Reporter #3 about Page’s subpoena.

October 17, 2017: NBC reports Carter Page subpoena.

October 24, 2017: Wolfe informs Reporter #3 of timing of Page’s testimony.

October 30, 2017: FBI informs James Wolfe of investigation.

November 15, 2017: 90 days before DOJ informs Ali Watkins they’ve seized her call records.

December 14, 2017: FBI approaches Watkins about Wolfe.

Prior to December 15, 2017 interview: Wolfe writes text message to Watkins about his support for her career.

December 15, 2017: FBI interviews Wolfe.

January 11, 2018: Second interview with Wolfe, after which FBI executes a Rule 41 warrant on his phone, discovering deleted Signal texts with other journalists.

February 6, 2018: Subpoena targeting Adam Schiff and others.

February 13, 2018: DOJ informs Watkins they’ve seized her call records.

June 6, 2018: Senate votes to make official records available to DOJ.

That the Chairman and Vice Chairman of the Senate Select Committee on Intelligence, acting jointly, are authorized to provide to the United States Department of Justice copies of Committee records sought in connection with a pending investigation arising out of allegations of the unauthorized disclosure of information, except concerning matters for which a privilege should be asserted.

June 7, 2018: Grand jury indicts Wolfe.

June 7, 2018: Richard Burr and Mark Warner release a statement:

We are troubled to hear of the charges filed against a former member of the Committee staff. While the charges do not appear to include anything related to the mishandling of classified information, the Committee takes this matter extremely seriously. We were made aware of the investigation late last year, and have fully cooperated with the Federal Bureau of Investigation and the Department of Justice since then. Working through Senate Legal Counsel, and as noted in a Senate Resolution, the Committee has made certain official records available to the Justice Department.

June 13, 2018: Wolfe arraigned in DC. His lawyers move to prohibit claims he leaked classified information.

The [Thus Far] Missing Seth DuCharme Emails Pertaining to Rudy Giuliani’s Russian Disinformation

/24 Comments/in , , /by

As I’ve been harping of late, Billy Barr and Jeffrey Rosen went to great lengths to protect Rudy Giuliani’s efforts to obtain and disseminate what the Intelligence Community already knew was Russian-backed disinformation laundered through Andrii Derkach. That effort included the following:

  • For whatever reason, not warning Rudy that the Intelligence Community knew Russia was targeting him for an information operation before he traveled to his December 2019 meeting with Derkach
  • Prohibiting SDNY from expanding its existing investigation into Rudy’s foreign influence peddling to include his efforts with Derkach by making EDNY a gate-keeper for any such decisions
  • Asking Pittsburgh USA Attorney Scott Brady to accept the information that the IC already knew was Russian disinformation from Rudy
  • Doing nothing while Rudy continued to share information the IC already knew was Russian disinformation during an election
  • After belatedly opening an investigation into the Derkach effort that the IC had known was Russian disinformation for a year, opening it at EDNY and scoping it to ensure that Rudy’s own actions would not be a subject of the investigation

As a result of this remarkable effort, led by the Attorney General and Deputy Attorney General, to protect Russian disinformation, DOJ willingly ingested a bunch of Russian disinformation and used it to conduct an investigation into the son of the President’s opponent.

Last year, when it was disclosed that Barr had directed Brady to willingly accept this Russian disinformation, American Oversight FOIAed and then sued for the paper trail of the effort, submitted as four separate FOIAs:

  1. [To OIP and USAPAW] “Brady Order and Written Approval” — which specifically asked for “two readily-identifiable, specific documents” — described as:
    • The written approval of the Attorney General or Deputy Attorney General authorizing U.S. Attorney for the Western District of Pennsylvania (USAPAW) to create and/or administer a process for receiving purported investigatory information from Rudy Giuliani concerning matters that relate to former Vice President Biden
    • A copy of the Attorney General’s order directing USAPAW to conduct an evaluation, review, probe, assessment, “intake process,” preliminary investigation
  2. [To OIP and USAPAW] “Giuliani Directives, Guidance, & Communications,” described as:
    • All directives or guidance provided to USAPAW regarding an evaluation, review, probe, assessment, “intake process,” preliminary investigation, or other investigation of any information received from Rudy Giuliani, including information that may concern former Vice President Biden
    • All records reflecting communications between (1) the Office of the Attorney General or the Office of the Deputy Attorney General and (2) USAPAW regarding an evaluation, review, probe, assessment, preliminary investigation, or other investigation of any information received from Rudy Giuliani
    • All records reflecting communications within the OAG or the ODAG regarding any evaluation, review, probe, assessment, “intake process,” preliminary investigation, or other investigation of any information received from Rudy Giuliani, including information which may concern former Vice President Biden
  3. [To USAPAW] “Brady-Giuliani Communications,”described as all records reflecting communications between (1) USAPAW in the course of any evaluation, review, probe, assessment, “intake process,” preliminary investigation, or other investigation of any information received from Rudy Giuliani and (2) Rudy Giuliani, or any of Mr. Giuliani’s personal assistants or others communicating on his behalf, including but not limited to Jo Ann Zafonte, Christianne Allen, or Beau Wagner
  4.  [To USAPAW] “Brady-White House Communications,” described as any communications between (1) USAPAW in the course of any evaluation, review, probe, assessment, “intake process,” preliminary investigation, or other investigation of any information received from Rudy Giuliani and (2) anyone at the White House Office

Before American Oversight filed the lawsuit, the Trump Admin did two things that will have an effect on what we’re seeing. First, DOJ combined requests one and two above; as we’ll see, that had the effect of hiding that Barr didn’t put anything in writing. In addition, USAPAW told American Oversight that they were going to refer the request for such an order to Main Justice for referral.

While the lawsuit was filed under the Trump Administration, the substantive response to it started in February. The FOIA is a way to understand more about this effort — both how willing Barr’s DOJ was to put this scheme in writing, as well as the volume of paper trail that it generated.

The first status report, submitted on February 22, revealed the following based on an initial search:

  1. “Brady Order and Written Approval” and “Giuliani Directives, Guidance, & Communications” (aggregated) at Main DOJ: 8,851 items
  2. “Giuliani Directives, Guidance, & Communications” and “Brady-Giuliani Communications” at USAPAW: 1,400 pages
  3. “Brady-White House Communications:” none

The second status report, submitted on April 1, reported that of the initial search, the following was deemed potentially responsive:

  1. “Brady Order and Written Approval” and “Giuliani Directives, Guidance, & Communications” (aggregated) at Main DOJ: 30 pages referred
  2. “Giuliani Directives, Guidance, & Communications” and “Brady-Giuliani Communications” at USAPAW, of 272 pages reviewed so far:
    • 3 pages released in full
    • 189 pages referred to other agencies for consultation
    • 83 duplicates or non-responsive

Here is the USAPAW production.

The third status report, submitted on May 3, reported the following:

  1. “Brady Order and Written Approval” and “Giuliani Directives, Guidance, & Communications” (aggregated) at Main DOJ:
    • 18 pages released in partly redacted form
    • 4 pages withheld entirely under b5 deliberative exemption
    • 6 pages awaiting a response from some other component
  2. “Giuliani Directives, Guidance, & Communications” and “Brady-Giuliani Communications” at USAPAW, of 263 pages reviewed this month:
    • 5 pages released, 3 of which include b6, b7A and b7C redactions
    • 14 pages referred to another component
    • 244 pages non-responsive or duplicates

Here is the USAPAW production and here is the Main DOJ production.

Here’s what has currently been provided to American Oversight (go here for live links).

Note, this may be clarified in upcoming dumps, but for now, there appears to be something very irregular with the OIP response. At first, DOJ said there were up to 8,851 items that were responsive to American Oversight’s request. But with the next status report, DOJ said there were just 30 pages. The most recent release claimed to account for 28 of those 30 pages.

In the second joint status report, OIP stated that it had completed its search and its initial responsiveness and deduplication review of potentially responsive documents and identified approximately 30 pages of material likely responsive to Plaintiff’s request. See ECF No.7, ¶ 2. OIP further stated that it had sent these records out for consultation pursuant to the Department’s regulations, 28 C.F.R. § 16.4(d), and expected to be able to provide its first response to Plaintiff on or around April 29, 2021. Id. On April 29, 2021, OIP made its first interim response. It released 18 pages in part with portions redacted pursuant to Exemptions 5 and/or 6 and withheld four pages in full pursuant to Exemption 5. OIP is awaiting responses from other components on the remaining six pages.

The math looks like this:

18 pages released

4 pages withheld under b5 exemption*

6 pages referred to another component

Total: 28 pages

Remaining: 2 pages

That’s a problem because there are at least two pages of emails that were part of the USAPAW response that must have had a counterpart at DOJ, as well as one missing from both (though USAPAW has 1000 pages to release):

  • A January 3, 2020 email from Seth DuCharme to Scott Brady asking, “Scott do you have time for a quick call today in re a possible discreet assignment from OAG and ODAG?” (Brady’s response, which includes DuCharme’s original, is included in both, but the copy released by OIP was printed out from Brady’s account, not DuCharme’s).
  • A February 11, 2020 email from Brady to DuCharme, asking “Seth, do you have a few minutes to catch up today?” The email should exist in both accounts, and should be included in both OIP and USAPAW’s response.
  • A March 5, 2020 email from Brady to DuCharme, asking “Seth: do you have 5 minutes to talk today?”

Brady resigned effective February 26 and DuCharme resigned effective March 19. At the time he resigned, DuCharme was supervising an investigation into this Derkach stuff, one that excluded Rudy as a subject.

I assume this will become more clear with further releases (indeed, American Oversight may have the next installment already). Perhaps there’s a sound explanation. But thus far, it looks like only the Brady side of exchanges between him and DuCharme have been provided in response.

* The response letter to Jerry Nadler was two pages long, and the draft was sent twice (or there were two drafts), so those probably account for the 4 pages withheld on b5 exemptions.

OpSec Confusion on the Oath Keeper Conspiracy

/36 Comments/in , /by

I write a lot about the comms the Oath Keepers used to plan insurrection. There was the post about how they figured out, too late, not to plan an insurrection on Facebook; of the five counts of obstruction on the Oath Keeper indictment released Sunday, two pertain to Facebook. Then there was the post where I cataloged how many social media platforms were described in the last iteration of the indictment against them.

  • A leadership list on Signal they appear to have obtained from either Watkins and/or Kelly Meggs
  • Open channels on Zello, possibly separate ones for each large event
  • Telephony chats and texts, including during January 6
  • MeWe accounts
  • Way too much blabbing on Facebook, followed by a foolish belief they could delete such content
  • Parler for further blabbing
  • Stripe for payment processing (possibly for dues)
  • GoToMeeting for operational planning

The remaining three obstruction charges pertain to this social media activity, one — for Joshua James — specifically describing his attempt to delete and burn the “[S]ignal comms about the op.”

Add hand-written ProtonMail attachments to the toolchest

It turns out I should have included ProtonMail in that list, because both the addresses to which Laura Steele sent her vetting application to join the Oath Keepers on January 3 were ProtonMail addresses, but the government only laid that out in their unsuccessful bid to keep her detained, in an attempt to use its encryption to ascribe to her that operational security.

On the evening of January 3, 2021, Defendant Steele emailed a membership application and vetting form to the Oath Keepers of Florida.4 She copied Defendant Young on the email, and wrote: “My brother, Graydon Young told me to submit my application this route to expedite the process.” Under the section for “CPT Skill Sets (Community Preparedness Team) Experience or Interests,” she checked “Security.” Under “Skillsets,” she wrote: “I have 13 years of experience in Law Enforcement in North Carolina. I served as a K-9 Officer and a SWAT team member. I currently work Private Armed Security for [company name redacted]. I am licensed PPS through the North Carolina Private Protective Services.”

Within 10 minutes, Defendant Steele sent another email, this one directly to Defendant Kelly Meggs’s email account at Proton Mail, again copying Defendant Young. She again attached her application and vetting form, and wrote: “My brother, Graydon Young told me to send the application to you so I can be verified for the Events this coming Tuesday and Wednesday.”

The following day (January 4), Defendant Steele sent the same materials to yet another Oath Keepers email address at Proton Mail. On her email, she copied co-defendants Kelly Meggs and Graydon Young.

4 The email recipient was actually a Florida Oath Keepers account at “protonmail.com.” Proton Mail is housed overseas (in Switzerland) and offers end-to-end encryption. “Even the company hosting your emails has no way of reading them, so you can rest assured that they can’t be read by third parties either.” Mindaugas Jancis, ProtonMail review: have we found the most secure email provider in 2021?, CyberNews, Mar. 4, 2021, at https://cybernews.com/secure-email-providers/protonmail-review.

But Proton is not going to help if one side of a communication is on Gmail or some other email service on which FBI can serve a subpoena. Which may explain how the government obtained this email from the newly indicted Joseph Hackett in the latest superseding.

41. On December 19, 2020, HACKETT sent an email to YOUNG with a subject line “test.” The body of the email stated: “I believe we only need to do this when important info is at hand like locations, identities, Ops planning.” The email had a photo attached; the photo showed cursive handwriting on a lined notepad that stated: “Secure Comms Test. Good talk tonight guys! Rally Point in Northern Port Charlotte at Grays if transportation is possible. All proton mails. 7 May consider [a rally point] that won’t burn anyone. Comms – work in progress. Messages in cursive to eliminate digital reads. Plans for recruitment and meetings.”

7 Based on the investigation, “proton mails” appears to refer to the company “ProtonMail,” which offers encrypted email services.

I’ve not seen anything that suggests the government has obtained Proton Mails from the Oath Keepers conducted entirely on the platform; that may have to wait until someone involved decides to cooperate. But I’m not sure how writing the most sensitive messages on what sounds like dead tree paper before sending it adds to the security.

DOJ’s selective understanding of encryption

One of the more aggravating pieces of confusion in the new indictment, however, comes not from the alleged conspirators but from the government.

The last item in a list of Manner and Means employed in the conspiracy is the use of “secure and encrypted communications.”

Using secure and encrypted communications applications like Signal3 and Zello4 to develop plans and later communicate during the January 6 operation.

The first overt act describes Stewart Rhodes laying out what I am calling the “Antifa foil” on a GoToMeeting meeting.

At a GoToMeeting5 held on November 9, 2020, PERSON ONE told those attending the meeting, “We’re going to defend the president, the duly elected president, and we call on him to do what needs to be done to save our country. Because if you don’t guys, you’re going to be in a bloody, bloody civil war, and a bloody – you can call it an insurrection or you can call it a war or fight.”

As a result, the following footnotes appear on the bottom of the same page.

3 Signal is an encrypted messaging service.

4 Zello is an application that emulates push-to-talk walkie-talkies over cellular telephone networks. Zello can be used on electronic communication devices, like cellular telephones and two-way radios.

5 GoToMeeting is an online meeting site that allows users to host conference calls and video conferences via the Internet in real time.

Start with Zello: It can be secure. But it wasn’t, as used by the Oath Keepers, the day of the insurrection, because it was an open channel. Indeed, the reason we know about it is because journalist Micah Loewinger was following along in real time. Plus, anything saved onto a phone will be accessible once the phone is compromised, just like Signal will. (From the discovery letters shared with the Oath Keepers — the most recent of which is over a month old — the government appears to have initially relied on WNYC’s published versions of the Zello chats. But this superseding indictment includes time stamps from Watkins’ Zello exchanges, which suggests they’ve obtained a more reliable copy since then.

Signal, DOJ says, is encrypted. I have no problem with that. But they started compromising the Signal chats as soon as they exploited Jessica Watkins’ phone. And the latest indictment seems to rely on the exploitation from another of the more involved participants — it’s where the new details on the Quick Reaction Force come from (here’s my rough capture of the communications we’ve seen referenced to date).

What I find annoying is that, after treating Signal and Zello as super spooky applications, DOJ then treats GoToMeeting like a normal tool, just “an online meeting site that allows users to host conference calls and video conferences via the Internet in real time.”

But it is also end-to-end encrypted and has a number of other security features that are necessary for its use by mainstream businesses and health care providers. That said, it is centralized and probably responds eagerly to legal process, which is the distinction DOJ really intends by this. That is, it’s not encryption that makes the use of these apps a useful marker of a conspiracy, it’s decentralized security, security that the Oath Keepers didn’t use with Zello the day of the insurrection. Plus, for a conspiracy indictment, as opposed to other criminal charges, the use of G2M suggests a bureaucratization that should be more useful to prove the case.

In any case, with this fourth indictment, DOJ added content from G2M that was probably meant to be secure: Stewart Rhodes’ “Antifa foil” comments. An initial production of G2M had been provided to defendants by April 9, with a second attempt on April 23. So it may be that it has taken some time to reconstruct whatever full production they might receive from the various Oath Keeper accounts.

The money is the metadata

That said, it is amusing seeing the conspirators try to add a layer of security to the already secure ProtonMail while they’re laying a trail of travel plans that knots them all up into a network. Here are just some of the fleshed out details from the indictment:

79. On January 4, 2021, HARRELSON and DOLAN departed Florida together in a vehicle rented by DOLAN and traveled to the Washington, D.C., metropolitan area.

[snip]

82. On January 4, 2021, PERSON TEN checked into the Hilton Garden Inn in Vienna, Virginia. The room was reserved and paid for using a credit card in PERSON ONE’s name.

[snip]

85. On January 5, 2021, PERSON ONE and MINUTA separately traveled to the Washington, D.C., metropolitan area and checked into the Hilton Garden Inn in Vienna, Virginia.

[snip]

90. KELLY MEGGS paid for two rooms, each for two people, at the Comfort Inn Ballston from January 5-6, 2021. The rooms were reserved under the name of PERSON THREE.

90. KELLY MEGGS paid for two rooms, each for two people, at the Comfort Inn Ballston from January 5-6, 2021. The rooms were reserved under the name of PERSON THREE.

91. KELLY MEGGS also booked two rooms at the Hilton Garden Inn in Washington, D.C., from January 5-7, 2021. KELLY MEGGS paid for both of the rooms, using two different credit cards.

[snip]

93. HACKETT paid for a room at the Hilton Garden Inn in Washington, D.C., from January 5-7, 2021. The room was booked in the name of PERSON SIXTEEN.

[snip]

95. MINUTA, using his personal email address and his personal home address, reserved three rooms at the Mayflower Hotel in Washington, D.C., under the names of MINUTA, JAMES, and PERSON TWENTY. A debit card associated with PERSON FIFTEEN was used to pay for the room reserved under MINUTA’s name. A credit card associated with JAMES was used to pay for the room reserved under JAMES’s name.

Kelly Meggs, by paying for what appears to be the QRF room and another for Person 3 to tend the weapons, would tie the Floridians staying in the DC Hilton Garden with a group coming from at least three states at the Ballston Comfort Inn (and that’s before you consider the surveillance footage that shows others dropping off weapons). Minuta, by reserving three rooms at the Mayflower, would tie Joshua James, Person Twenty, and Person Fifteen to the group, including Minuta, staying at the Vienna Hilton Garden, which includes Rhodes and Person Ten. And there’s at least one known payment — from some unidentified person to James’ wife — that doesn’t show up here.

Post 9/11, it’s hard to hide hotel travel, especially retroactively, after engaging in a terrorist attack, but it doesn’t help that the Oath Keepers didn’t compartment their network at all. So all the encrypted messaging and meeting apps in the world could not hide that this was a network that spanned (thus far, but I’m holding out hope they’ll roll out the first Mississippi defendants any day!) at least seven states.

Update: I’ve taken out a reference to the Ohioans walking Isaacs back to a hotel in DC. They did separate early but it was not to take him back. Thanks to Benny Bryant for the correction.

Latex Gloves Hiding Evidence of Conspiracies: On the Unknown Adequacy of the January 6 Investigation

/27 Comments/in , /by

Since I’ve acquired new readers with my January 6 coverage and since the financial stress of COVID is abating for many, it seems like a good time to remind people this is not a hobby: it is my day job, and I’d be grateful if you support my work.

Update, 6/2: As this post lays out, Hodgkins’ plea was indeed just a garden variety plea. During the hearing he explained the latex gloves. He carries a First Aid kit around all the time and saw Joshua Black’s plastic bullet wound (though he didn’t know Black and didn’t name him in the hearing) and put gloves on in preparation to provide medical assistance. After Black declined his help, he took the latex gloves off.

On Wednesday, June 2, insurrectionist Paul Allard Hodgkins will plead guilty, becoming just the second of around 450 defendants to publicly plead guilty (particularly given the number of people involved, there may be — and I suspect there are — secret cooperation pleas we don’t know about).

NOTICE OF HEARING as to PAUL ALLARD HODGKINS: A Plea Agreement Hearing is set for 6/2/2021, at 11:00 AM, by video, before Judge Randolph D. Moss. The parties shall use the same link for connecting to the hearing.(kt)

This could be the first of what will be a sea of plea deals, people accepting some lesser prison time while avoiding trial by pleading out. But there’s one detail that suggests it could be more, that suggests Hodgkins might have knowledge that would be sufficiently valuable that the government would give him a cooperation deal, rather than just a plea to limit his prison time.

Hodgkins is one of the people who made it to the Senate floor and started rifling through papers there, which by itself has been a locus of recent investigative interest. But he is an utterly generic rioter, wearing a Trump shirt and carrying a Trump flag. According to an uncontested claim in his arrest affidavit, he told the FBI he traveled to the insurrection from Florida alone, by bus. Because the only challenge he made to his release conditions — to his curfew — was oral, and because the prosecutor in his case hasn’t publicly filed any notice of discovery (which would disclose other kinds of evidence against him), there’s nothing more in his docket to explain who he is or what else he did that day, if anything.

But one thing sticks out about him: before he started rifling through papers in the Senate, he put on latex gloves.

It’s not surprising he had gloves. During the pandemic, after all, latex gloves have been readily available, and I’ve wandered around with gloves in my jacket pocket for weeks. But he did show the operational security to put them on, when all around him people were just digging in either bare-handed or wearing the winter or work gloves they had on because it was a pretty cold day.

There’s just one other instance I know of where someone at the insurrection showed that kind of operational security (though there is one person identified by online researchers by the blue latex gloves he wore while playing a clear organizational role outside the Capitol). When one of the guys that Riley June Williams was with started to steal Nancy Pelosi’s laptop, Williams admonished him, “dude, put on gloves” and threw black gloves (which may or may not be latex) onto the table for him to use.

There’s no reason to believe there’s a tie (as it happens, Williams had a status hearing last week where her conditions were loosened so she can look for work). There is a cybersecurity prosecutor, Mona Sedky, who is common to both cases, which sometimes indicates a tie, but she is also on cases against defendants who have no imaginable tie to Williams. But Hodgkins exhibited the kind of operational security that, otherwise, only other people who seemed to be operating from some kind of plan exhibited.

My point is not that there’s a tie, but that we don’t know whether there’s something more interesting about Hodgkins, and we might not even learn whether there is on Wednesday, in significant part because if there is one, prosecutors may not want to share that information publicly.

And I think, particularly in the wake of Republicans’ successful filibuster of a January 6 Commission and discussions of whether there will be any real accountability, that’s a useful illustration about the limits of our ability to measure the efficacy of the investigation right now. Paul Hodgkins could be (and probably is) just some Trump supporter who hopped on a bus, or his latex gloves could be the fingerprint of a connection to more organized forces.

With that said, I’d like to talk about what we can say about the investigation so far, and where it might go.

Last week, when I read this problematic and in several areas factually erroneous attempt to describe the attack in military terms, I realized that readers new to my work may not understand what I do.

I cover a range of things, but when I cover a legal case, I cover the legal case as a means to understand what prosecutors are seeing. That’s different than describing the alleged crime itself; particularly given the flood of defendants, I’m not, for example, reading through scraped social media accounts from before the attack to understand what was planned in the semi-open in advance. But reading the filings closely is one way to understand where the criminal investigation might go and the chances it will be successfully prosecuted and if so how broadly the prosecution will reach.

I’m not a lawyer, though I’ve got a pretty decent understanding of the law, especially the national security crimes I’ve covered for 17 years. But my background in corporate documentation consulting and comparative literature (plus the fact that I don’t have an editor demanding a certain genre of writing) means I approach legal cases differently than most other journalists. For the purposes of this post, for example, my academic expertise in narrative theory makes me attuned to how prosecutors are withholding information and focalizing their approach to preserve investigative equities (or, at times, hide real flaws in their cases). Prosecutors are just a special kind of story-teller, and like novelists and directors they package up their stories for specific effects, though criminal law, the genre dictated by court filings, and prohibitions on making accusations outside of criminal charges impose constraints on how they tell their stories.

One of the tools prosecutors use, both in a legal sense and a story-telling one, is conspiracy. The problematic military analysis, linked above, totally misunderstood that part of my work (as have certain Russian denialists looking for a way to attack that doesn’t involve grappling with evidence): when I map out the conspiracies we’re seeing in January 6, I’m not talking about the overarching conspiracy that made it successful, how the entire event was planned. Rather, I’m observing where prosecutors have chosen to use that tool — by charging four separate conspiracies against Proud Boys that prosecutors are sloppily treating as one, and charging (as of yesterday) sixteen members of the Oath Keepers in a single conspiracy — and where they haven’t, yet — for a set of guys who played key roles in breaching the East door and the Senate chamber who armed themselves and traveled together. As that set of guys shows, prosecutors aren’t limited to using conspiracy with organized militias, and I expect we’ll begin to see some other conspiracies charged against other networks of insurrectionists. It’s virtually certain, for example, that we’ll see some conspiracies charged against activists who first organized together in local Trump protests; I expect we’ll see conspiracies charged against other pre-existing networks (like America First or QAnon or even anti-vaxers who used those pre-existing networks to pre-plan their role in the insurrection).

Conspiracies are useful tools for prosecutors for several purposes. For example, a conspiracy charge can change what you need to prove: that the conspiracy was entered into and steps taken, some criminal, to achieve the conspiracy, rather than the underlying crime. It can used to coerce cooperation from co-conspirators and enter evidence at trial in easier fashion. And it’s the best way to hold organizers accountable for the crimes they recruit others to commit.

If Trump, or even his flunkies, are going to be held accountable for January 6, it will almost certainly be through conspiracy charges built up backwards from the activities at the Capitol. I am agnostic on whether they will be, but it’s not as far a reach as some might think. This handy guide to conspiracy law that Elizabeth de la Vega laid out during the Mueller investigation provides a sense of why that is.

Conspiracy Law – Eight Things You Need to Know.

One: Co-conspirators don’t have to explicitly agree to conspire & there doesn’t need to be a written agreement; in fact, they almost never explicitly agree to conspire & it would be nuts to have a written agreement!

Two: Conspiracies can have more than one object- i.e. conspiracy to defraud U.S. and to obstruct justice. The object is the goal. Members could have completely different reasons (motives) for wanting to achieve that goal.

Three: All co-conspirators have to agree on at least one object of the conspiracy.

Four: Co-conspirators can use multiple means to carry out the conspiracy, i.e., releasing stolen emails, collaborating on fraudulent social media ops, laundering campaign contributions.

Five: Co-conspirators don’t have to know precisely what the others are doing, and, in large conspiracies, they rarely do.

Six: Once someone is found to have knowingly joined a conspiracy, he/she is responsible for all acts of other co-conspirators.

Seven: Statements of any co-conspirator made to further the conspiracy may be introduced into evidence against any other co-conspirator.

Eight: Overt Acts taken in furtherance of a conspiracy need not be illegal. A POTUS’ public statement that “Russia is a hoax,” e.g., might not be illegal (or even make any sense), but it could be an overt act in furtherance of a conspiracy to obstruct justice.

We know that Trump and his flunkies shared the goal of the conspiracies that have already been charged: to prevent the certification of the vote. Trump (and some of his flunkies) played a key role in one of the manner and means charged in most of the conspiracies: To use social media to recruit as many people as possible to get to DC. Arguably, Mike Flynn played another role, in setting the expectation of insurrection.

What’s currently missing is proof (in court filings, as opposed to the public record) that people conspiring directly with Trump were also conspiring directly with those who stormed the Capitol. But we know the White House had contact with some of the conspirators. We know that organizers like Ali Alexander and Alex Jones likewise had ties to both conspirators and Trump’s flunkies (an Alex Jones producer has already been arrested). We know that Flynn had other ties to QAnon (which is why I’ll be interested if the government ever claims QAnon had some more focused direction with respect to January 6). Most of all, Roger Stone has abundant ties with people already charged in the militia conspiracies, and was at the same location as some of the Oath Keepers before they raced to the Capitol in golf carts to join the mob. If Trump or his flunkies are held accountable, I suspect it will go through conspiracies hatched in Florida, and the overlap right now between the Oath Keeper and Proud Boys conspiracies are in Floridians Kelly Meggs and Joe Biggs. But if they are held accountable, it will take time. It’s hard to remember given the daily flow of new defendants, but complex conspiracies don’t get charged in four months, and it will take some interim arrests and a number of cooperating witnesses to get to the top levels of the January 6 conspirators, if it ever happens.

This post, which is meant to be read in tandem with this one, assesses developments in the last week or so in the Oath Keepers conspiracy case.

The Rudy Giuliani Warrants Likely Go Up To the Andrii Derkach Meeting

/in , , , /by

For a variety of reasons, I’d like to look at the probable scope of the Rudy Giuliani warrants. I believe the warrant obtained on April 21 probably goes up to, but not far beyond, the meeting Rudy had with Andrii Derkach on December 5, 2019.

This post is based in part on what Rudy Giuliani, Victoria Toensing, and Lev Parnas have telegraphed about these warrants. None of these people are reliable, but Rudy and Toensing, at least, are clearly trying to share information with potential co-conspirators and therefore would want to be accurate. And whether or not the redaction fail in Parnas’ letter was intentional, I believe Parnas was trying to maximize the discomfort that these warrants might pose to powerful people (Parnas knows the targets and dates of the warrants, but it’s not clear whether he knows the date ranges). The post also includes claims from the government response to Parnas’ request for access to the Rudy and Toensing content; the government is reliable but still obviously hiding stuff.

Per Parnas, he knows of three warrants targeting Rudy:

  • A November 4, 2019 warrant targeting Rudy’s iCloud and email accounts
  • An April 13, 2021 warrant obtaining historical and prospective cell site information from Rudy (and Toensing)
  • An April 21, 2021 warrant targeting what ended up being 18 devices from Rudy

Here’s what these letters claim about the warrants:

  • The November 4, 2019 warrant “commences when Mayor Giuliani began to represent Donald Trump”
  • The start date of the November 4, 2019 warrant was “the commencement of Giuliani’s representation of former President Donald Trump”
  • Rudy believes the iCloud warrant obtained “communications with, and on behalf of, the sitting President, containing material relating to the impending impeachment”
  • The date range for the April 21, 2021 warrant began “three months later than the iCloud account”
  • The end date for the April 21, 2021 warrant went “56 days” later than the iCloud warrant
  • The warrant required Apple turn over “subscriber and payment information, device information and settings, transactional records, address book information, call history and voicemails, text message content, email content, photos and videos, documents, search and web histories, third-party application data, location date and iOS device backups” (this is boilerplate, but most people don’t understand how comprehensive a cloud warrant, to Apple or Google, can be)
  • The government showed probable cause that the iCloud account included evidence of “22 USC §§612 and 618 [FARA], 18 USC §951 [Foreign Agent], 18 USC §2 [Abetting], and 18 USC §371 [Conspiracy to defraud the US]”
  • Two days after the warrants targeting Rudy and Toensing, SDNY obtained a warrant targeting Yuri Lutsenko; later warrants targeted two other Ukrainians, Roman Nasirov and Alexander Levin
  • The treatment of information pertaining to someone Toensing represents (possibly, but not definitely, Dmitro Firtash) was more limited in her later warrant
  • Parnas believes that some of the information (though he doesn’t specify whether from the November 2019 or the April 2021 search) would include information “that may have been deleted”
  • Parnas believes that the warrants obtained “the communications immediately following the defendants’ arrest” on October 10, 2019
  • The 2019 returns do not contain any evidence relating to Parnas’ campaign finance charges and no non-duplicative statements from Parnas about Fraud Guarantee

Particularly given the way DOJ removed Parnas and Igor Fruman’s influence peddling for Yuri Lutsenko in their September 17, 2020 superseding indictment, it is virtually certain that this investigation involves, at a minimum, the ultimately successful Lutsenko-backed efforts to get Marie Yovanovitch fired in 2019.

This JustSecurity timeline is enormously helpful for reviewing the entanglements between Parnas and Fruman with Lutsenko (as well as the other events that SDNY is likely interested in). Rudy formally became Trump’s lawyer in April 2018, though there were discussions about him (and Toensing and her spouse Joe DiGenova) joining the team in March 2018, after John Dowd quit. Parnas and Fruman made their first pitch to Trump to fire Yovanovitch on April 30, 2018. In May and June, Parnas and Fruman heavily lobbied Pete Sessions to help get Yovanovitch fired. Then in August 2018, Fraud Guarantee hired Rudy. That puts the likely start dates of Rudy’s warrants sometime between March 20 and April 17, 2018 (for the iCloud warrant), and between mid-June and July or August 2018 (for the device warrant).

Depending on how narrowly the investigation is scoped on Yovanovitch, there are three likely end dates for the iCloud warrant: sometime between April 25 and May 6, 2019, when the effort to fire Yovanovitch succeeded, on October 10, when Parnas and Fruman are arrested, or on November 4, or whatever “present” day Apple complied with the warrant (the gag was issued days later so there may have been a delay in obtaining that approval).

I think one of the later dates is far more likely. That’s because Rudy continued to chase the same effort in Ukraine after Yovanovitch was fired. Plus, the most likely explanation for how SDNY was able to get warrants and a non-disclosure order for the November 2019 warrants against Rudy and Toensing is that they had proof, obtained on October 21, 2019, that Parnas had unsuccessfully attempted to delete information from his own iCloud account. And Rudy, who knows the date ranges of the warrant, claims that it obtained information, “containing material relating to the impending impeachment,” which, if true, would entirely rule out a May 6 end date.

Parnas believes the first warrant extended beyond his October 10 arrest. But it’s not entirely clear whether he knows the date range of the warrants. The government response explained they gave him material from him they had been withholding under a non-disclosure order relating to the investigation in which Rudy is a subject (that is, the Lutsenko campaign) on January 28. But in response to Parnas’ request for materials “immediately following” his arrest, the government got coy about whether they exist in the November 2019 returns (the only ones they have reviewed yet).

For similar reasons, the request for communications by Giuliani and Toensing “immediately following the defendants’ arrests” and “subsequent to” Parnas’s provision of information to the House Intelligence Committee are not subject to disclosure. (Def. Letter at 3.) Not only do these communications have nothing to do with the Government’s case-in-chief, but even if Parnas was entitled to discovery relating to his selective prosecution claim—and he plainly is not—these communications would not even be relevant to such a defense because, to the extent they exist, they post-date the defendants’ arrest.

Besides, there’s a more logical reason to expect that the November 2019 warrants ended on the day of Parnas’ arrest, October 10: because that’s consistent with SDNY’s investigation being limited to its original scope and the entirety of the investigation into Andrii Derkach being at EDNY, as NYT reported is the case.

On December 3, 2019, Rudy met in Budapest with Lutsenko. On December 4, he flew to Kyiv to meet with Derkach, the meeting that begins the relationship that EDNY has ownership of.

A 56-day extension on an end date in response to a November 4 warrant would be December 31, a logical end date for a warrant, but one that would encompass the aftermath of the Derkach meeting scoped to EDNY. Whereas a 56-day extension to an October 10 end date would take you to December 5: through the Derkach meeting associated with the Lutsenko one, but not any further.

That would also be inclusive of communications relating to the pending impeachment (which Rudy says would have been included in the iCloud return), but would be more protective of Rudy’s conversations with Trump as impeachment drew nearer.

Lev Parnas Failed to Delete His iCloud Content Just before DOJ Got a Secret Warrant for Rudy Giuliani’s iCloud Content

/9 Comments/in , , , /by

The government has known that Lev Parnas attempted to delete some or all of his iCloud content since shortly after October 21, 2019 — 2 weeks before it obtained covert warrants for Rudy Giuliani and Victoria Toensing’s iCloud accounts.

On January 17, 2020 (note the date on the letter has the wrong year) — the same day Jeffrey Rosen issued a memo prohibiting any DOJ personnel from expanding the scope of any investigation involving Ukraine without his and Richard Donoghue’s approval — Parnas asked to modify his protective order so he could share materials seized from his iCloud on that October date with the House Intelligence Committee for their impeachment investigation.

In a memo objecting to that request, the government noted that Parnas was perfectly free to download his own iCloud and share it with HPSCI — and asserted he had already done so.

Additionally, to the extent Parnas seeks to produce his own texts, emails, photographs or other materials, he should have access to the content stored on his iCloud account through other means: he can simply download his own iCloud account and produce it to HPSCI (and in fact, it appears he has already done so)

Parnas needed to ask the government, however, because he had deleted some of the material after the government had already obtained a preservation order for his account, meaning the government had the content but Parnas no longer did.

The materials at issue include records that, as far as the Government knows, were never in Parnas’s possession. For instance, the data produced by Apple includes deleted records (which may only exist because of the Government’s preservation requests), account usage records, and other information to which a subscriber would not necessarily have access.

The government asked for Parnas to identify the previously deleted chats he wanted to share with Congress so his co-defendants could raise privilege concerns.

To the extent that Parnas has deleted materials from his iCloud account, the Government is willing to work with counsel to ensure that Parnas can produce his own materials that are responsive to the Congressional request to HPSCI. To that end, the Government respectfully submits that Parnas’s counsel should identify for the Government any specific chats, emails, photographs, or other content Parnas is unable to access from his iCloud currently, but which exist within the discovery that has been produced to him and in his view are responsive to the Congressional subpoena. Requiring Parnas to specifically identify these materials would also permit his co-defendants to raise any concerns with respect to their privilege or privacy interests prior to the materials’ release.

“Tell us which of these texts you attempted to delete you think are the most incriminating to Rudy,” they effectively invited Parnas to explain back in early 2020, as the filter team would have just started wading through Rudy’s already seized iCloud content.

Parnas’ failed attempt to delete sensitive content that would be pertinent to the impeachment inquiry puts Rudy’s wails of outrage that the government successfully persuaded Judge Paul Oetken that if they didn’t obtain this content covertly, it might get deleted in a very different light.

In addition, in the original warrant for the iCloud account, there is a nondisclosure order based upon an allegation made to the issuing Court, that if Giuliani were informed of the existence of the warrant, he might destroy evidence or intimidate witnesses. Such an allegation, on its face, strains credulity. It is not only false, but extremely damaging to Giuliani’s reputation.

Indeed, DOJ may well have been seeking information that Parnas had successfully deleted elsewhere. Parnas seems to think that’s what happened. In his request to get access to the stuff seized from Rudy’s phone, he states that the newly disclosed materials “likely” include communications involving him “that may have been deleted.”

The seized evidence will also likely contain a number and variety of communications between Giuliani and Toensing and Parnas that are directly discoverable under Fed. R. Crim. P. 16, evidence of any conversations between Giuliani, Toensing, and others, including Parnas, that may have been deleted, communications between Giuliani, Toensing and others about the defendants and how to address their prior relationships, the arrests, and the unfolding investigation, communications between Giuliani and Toensing and others with potential Government witnesses, including communications about the defendants, the offenses charged, and the witnesses’ potential disclosures and characterizations of alleged fraud-loss computations.

Meanwhile, the government made an interesting observation in their original request for a Special Master.

Based on the Government’s investigation to date, given the overlap in date range and because certain materials, including certain emails and text messages, were backed up to the iCloud accounts that were searched pursuant to these prior warrants, the Government expects that some, but not all, of the materials present on the electronic devices seized pursuant to the Warrants could be duplicative of the materials seized and reviewed pursuant to the prior warrants.

After admitting the government expects significant overlap between what they got in 2019 and what they got in April because “certain materials” were backed up to the cloud, the government notes that “not all” of what they expect to be on the devices will be duplicative. Some of the new material will pertain to a slightly different date range on the searches. But another cause would be if Rudy and Toensing deleted stuff that could be obtained from their phone.

The investigative team has gotten deep enough in the iCloud material seized in 2019 to identify files that they know existed but were deleted from the iCloud backup, which might be recoverable from a device.

Rudy, in a “doth protest too much” theme in his letter insists he didn’t delete anything but if he did he wasn’t under subpoena anyway.

Despite these two warnings that the SDNY was seeking permission to apply for a search warrant for his electronic devices and because he had no guilty conscience, Giuliani took no steps to destroy evidence or wipe the electronic devices clean. Since Giuliani was not under subpoena, he had no legal obligation to preserve that evidence, but he did so because he is an innocent man who did nothing wrong.

[snip]

Again, all of this took place without Mayor Giuliani or his counsel having any idea that a year and a half prior, the Giuliani iCloud was the subject of a warrant. Giuliani and his counsel were both aware, because of the prominent leaks to the media, of the failed attempts in November of 2020 and again in January of 2021, to gain the required Justice Department permission to search a lawyer’s office and residence. If Giuliani was inclined, there was ample notice and time to destroy evidence.

Aside from mentioning the basis for the covert warrants, Toensing didn’t address whether any data got destroyed.

Whatever exigent circumstances the Government asserted to instead justify covert and overt search warrants in this instance were satisfied when the information was secured and preserved. The information should now be returned to Ms. Toensing and her counsel for a privilege and responsiveness review under the supervision of a Special Master. Moreover, the Government should disclose what seized information it has already reviewed and whether and what information it has provided to the case team.

She just wants everything back so she can restart the process, along with some kind of indication of what the government has already seen.

Rudy, similarly, wants to know what the government knows.

Lastly, Giuliani is entitled to the production of Apple’s entire search warrant return production, as well as the material previously deemed non-privileged and responsive and relevant to the 2019 Search Warrant by the “filter” team.

But Judge Paul Oetken, who found cause for the non-disclosure order back in 2019, was thoroughly unimpressed with all these claims about whether things might have been deleted. As he noted, the search is done.

Moreover, the review of the 2019 warrant returns is now largely complete. And any pre-indictment suppression motion would be premature at this juncture.

Rudy and Toensing can complain if they get charged.