After Judge Kimba Wood Rules Any Privilege Fight Would Have to Be Public, Cohen or Trump Withdraw Three Claims of Privilege

/28 Comments/in , /by

When Special Master Barbara Jones first reported privilege designations on matters seized from Michael Cohen on June 4, she found that three of the hard copy documents over which Cohen or Trump had claimed privilege were not.

1. Contents of Eight Boxes of Hard Copy Materials: Out of 639 total items consisting of 12,543 pages, the Special Master agrees with the Plaintiff and/or Intervenors and finds that 14 items are Privileged and/or Partially Privileged. The Special Master also finds that 3 items are not privileged.

Later that week, on June 8, Judge Kimba Wood ruled that if Cohen or Trump wanted to dispute any of Jones’ recommendations (it was Trump, not Cohen, who raised the issue), the legal argument (but not the contested documents) would have to be public.

With respect to the President’s letter dated June 6, 2018, (ECF No. 75), the Court agrees with the Government that Plaintiff and Intervenors’ objections should be filed publicly, except for those portions that divulge “the substance of the contested documents,” (ECF No. 76, at 1), which should be filed under seal and ex parte.

Jones has just submitted an amended report from those same materials, effectively reporting that Cohen and Trump now agree that the three documents are not privileged.

After no objections were filed in response to the Court’s Amended Order dated May 31, 2018 [Dkt. No. 70], and pursuant to the Procedures set forth in the Special Master’s report dated May 29, 2018 [Dkt. No. 65], the Plaintiff and/or Intervenors withdrew certain Privileged designations. Therefore, the Special Master amends its Report and Recommendation dated June 4, 2018 [Dkt. No. 72], and the following designations are being recommended to the Court for its review:

1. Contents of Eight Boxes of Hard Copy Materials: Out of 639 total items consisting of 12,543 pages, the Special Master agrees with the Plaintiff and/or Intervenors and finds that 13 items are Privileged and/or Partially Privileged and one item remains under consideration by the Special Master.

Perhaps it wasn’t the threat of publicity surrounding the privilege claim, but it sure seems likely Trump preferred to have SDNY look at those files than to have to tell the rest of us what they pertained to.

Manafort and His Co-Conspirators Adopt the Communications Habits of David Petraeus and Paula Broadwell

/28 Comments/in , /by

Back in January, I observed with some surprise that Paul Manafort was conducting his ongoing dalliance with Oleg Deripaska’s flunkie Konstantin Kilimnik on a PRISM provider’s server.

Which is why I find it so interesting that prosecutor Greg Andres emphasized Manafort and … he didn’t say whom (at least per the two reports that covered this) were communicating using the “foldering” technique that terrorists and unfaithful CIA Directors have been known to use in the past. Here’s how Josh Gerstein described the exchange:

“This was a sustained campaign over a five-week period,” Andres declared, saying it involved “multiple” phone calls, texts and other messages.

[snip]

The two sides also squared off during the hearing about Manafort’s use of technology. Andres raised a new allegation that Manafort engaged in a practice knows as “foldering,” where two or more people trade messages through draft folders in an email account. The prosecutor provided few details but suggested it was part of “a history of deception on behalf of Mr. Manafort in this case.”

Westling didn’t address that issue, but said prosecutors were going too far in seeing cloak-and-dagger spycraft in Manafort’s use of popular messaging apps, like WhatsApp, that encrypt their contents.

Here’s how CNN’s Marshall Cohen described it.

Prosecutors said Manafort used a method called “foldering” to covertly talk to people. It’s not that complicated: He made an email account and shared the password. He wrote messages but saved them as drafts, never sending actual emails. Other guys open the draft, read it, delete.

For some time, Manafort has known Mueller had obtained a search warrant for this email in August (though I guess he didn’t learn that before being caught emailing Kilimnik in November).

And while it’s unclear, it seems likely, given the context and Andres’ reference to “other messages,” that Manafort adopted the foldering technique (stupidly, given that FBI has been able to catch people using it since David Petraeus got busted this way and CIA long before that) as a way to attempt to continue communications, and that they were used as part of Manafort and Kilimnik’s efforts to reach out to Alan Friedman. Andres seems to have suggested at the hearing that Manafort continues to get new phones.

Here’s the thing, though. While Mueller’s repeated efforts to use Manafort’s ongoing communications with Kilimnik against him have made for amusement. they also seem a good signal to Manafort about what else the government has collected, and not necessarily just with Kilimnik.

Ah well, Manafort now has time on his hands to reflect on what comms that means Mueller has obtained.

Paulie Goes to Prison*

/52 Comments/in , /by

Judge Amy Berman Jackson just sent Paul Manafort to jail to await trial because he violated his release conditions.

The judge said sending Manafort to a cell was “an extraordinarily difficult decision,” but added his conduct left her little choice, because he had allegedly contacted witnesses in the case in an effort to get them to lie to investigators.

“This is not middle school. I can’t take away his cell phone,” she said. “If I tell him not to call 56 witnesses, will he call the 57th?” She said she should not have to draft a court order spelling out the entire criminal code for him to avoid violations.

“This hearing is not about politics. It is not about the conduct of the office of special counsel. It is about the defendant’s conduct,” Jackson said. “I’m concerned you seem to treat these proceedings as another marketing exercise.”

I’m interested in where that leaves him (besides, probably, the jail in Alexandria).

Manafort has a bunch of pending motions in EDVA: one challenging Mueller’s authority that Judge TS Ellis should be set to rule on, as well as a bunch trying to suppress evidence and one asking for a hearing on leaks. But things keep getting delayed in EDVA, which is supposed be a rocket docket but isn’t working out that way for Manafort. For both family reasons and because he had to preside over a spy trial, Ellis moved the hearing for the latter issues to June 29 and moved the trial itself (for which Mueller just got 75 sets of subpoenas) to July 24.

In DC, ABJ laid out this schedule back in March (which I’ll return to). Basically, she envisions two rounds of motions leading towards a trial in September.

Meanwhile, earlier this week, Mueller filed this curious motion in EDVA, asking Ellis to impose this discovery order. The problem Mueller’s team is having is that Manafort won’t respond to any of the requests Mueller’s team has made about a discovery order, going back to February and still, as recently as last week. And while they’ve turned over a ton of stuff, they suggest there’s “additional materials to be produced in this case” that they don’t want to turn over until Manafort is obligated by a discovery order.

Prior to the arraignment, on February 27, 2018, the government proposed the attached discovery order to defense counsel. The proposed order tracks the schedule and deadlines in this district’s standard discovery order. As the Court is aware, in addition to a schedule for Rule 16 discovery, the standard discovery order also sets forth deadlines for 404(b), Brady, Giglio, and Jencks material as well as notices for experts, alibis, and stipulations.

The defendant has already received robust discovery in this case and in the parallel District of Columbia prosecution. Indeed, the government has cumulatively made 19 separate productions − each containing a detailed index − in both cases. However, since February 2018 and as recently as last week, the government has been unable to obtain Manafort’s position on the attached proposed discovery order. Accordingly, in order to adequately prepare for trial, reduce discovery litigation, and protect additional materials to be produced in this case, the government respectfully asks this Court to enter the attached proposed discovery order.

Now, most of the obligations in the discovery order are on the prosecution, and given the delay in scheduling they’re not immediately pending in any case. The defense is supposed to tell the government about experts (which might be pertinent in this case since it’s a tax case), but that still wouldn’t be due until mid-July. The most immediate deadline would be if Manafort wanted to offer an alibi, which the standard protection order for EDVA would require by the first week of July; but I can’t imagine any alibi Manafort could offer on the EDVA case.

Now back to the DC case. There’s actually something due there, today (which given past practice will come out late in the day as everyone’s trying to get on with their weekend). Today’s the day the government has to submit their 404(b) notice to Manafort — basically advance warning of any other crimes they want to introduce during trial.

The government’s notice of its intention to introduce evidence under Fed. R. Evid. 404(b) must be filed by June 15, 2018; the opposition will be due on June 29; and the reply will be due on July 9. A hearing on the motion, if necessary, will be held on July 24, 2018 at 9:30 a.m.

Back in January, Mueller had requested delaying this notice until 8 weeks before trial (which would have been early August had ABJ not set the earlier deadline of today). My guess, then, was that they wanted to hold off letting Manafort know about what evidence they had on the case in chief, but that they wanted to introduce at trial.

The government just submitted a request to modify the deadline Judge Amy Berman Jackson set to give Paul Manafort and Rick Gates notice of other crimes or bad acts it will introduce at trial, what is called a Rule 404(b) notice. Currently, they have to provide that notice on April 6, but the judge is now considering a September rather than a May trial date, so prosecutors want to bump the 404 notice back accordingly.

Mueller’s prosecutors don’t want to give Manafort and Gates more than a couple months notice of the other crimes they’re going to unload during the trial. They also note that if they give notice in April, they may have to provide multiple notices as they learn of other bad acts.

Premature disclosure raises issues as well. For example, in declining to require disclosure that is too early, courts have recognized that “the evidence the government wishes to offer may well change as the proof and possible defenses crystallize.”

[snip]

For similar reasons, early disclosure can result in multiple Rule 404(b) notices and multiply the rulings that a court needs to make, thus undermining the efficient use of judicial and party resources.

The government wants to wait until 8 weeks before the trial before giving notice.

At least two things appear to be going on here. First, Mueller doesn’t want to tip his hand to the many crimes it has found Manafort implicated in. Perhaps, he also wants to avoid making other obvious allegations about Manafort and Gates to preserve their credibility when they flip on the President and his family. But it also seems to suggest Mueller expects he’ll be finding other crimes Manafort and Gates committed for the next 8 months.

This conversation with Matt Tait makes me wonder whether they’re trying to keep 404(b) evidence that they might file in NY State under wraps for now, in case Trump pardons Manafort (as he suggests, Manafort’s remaining money laundering properties involve Trump Organization).

So maybe that’s what Mueller’s trying to get Manafort to agree to. The EDVA standard order he’s trying to get him to use would require 404(b) notice by July 17, but permits the government to request avoiding such pretrial notice.

It is further ORDERED that, no later than seven calendar days before trial, the government shall provide notice to the defendant, in accordance with FED. R. EVID. 404(b), of the general nature of any evidence of other crimes, wrongs, or acts of defendant which it intends to introduce at trial, except that, upon motion of the government and for good cause shown, the court may excuse such pretrial notice.

It’s unclear what is operative in the DC case, but clearly the government can continue to file, as noted in January.

Anyway, that’s all just a guess, and we should see what they file for the 404(b) notice in DC this evening. Meanwhile, Paulie will be making himself comfortable in his new cell.

Update: Here’s the 404(b) motion. Mueller wants to introduce three things:

  • Evidence that one reason that Manafort and others arranged for [Skadden Arps] to be retained for the de minimis sum of approximately $12,000—even though they knew at the time that Law Firm A proposed a budget of at least $4 million—was to avoid certain limitations imposed by Ukrainian public procurement law.
  • Evidence that Manafort was treating a NYC apartment as a business property with the IRS but as a personal dwelling with a lender.
  • Evidence that Manafort structured intra-Cypriot funds to hide income.

The first of those two, of course, involve crimes in NY state.

*Technically, Manafort is being sent to jail, not prison. But that doesn’t alliterate so forgive me the error this once, okay?

Shorter Yevgeniy Prigozhin: Don’t Send the PII We Already Stole — Just Send the Intelligence

/34 Comments/in , /by

In this post, I described the Mueller team’s motion for a protective order that would keep sensitive information from the case against Concord Management away from its owner, Vladimir Putin crony Yevgeniy Prigozhin.

Concord’s lawyers have now responded with the performative aspect that has characterized their filings in this case. From a legal standpoint, they argue both that protective orders are an unusual thing (which seems utterly absurd on its face) and that withholding information from a co-defendant who has not presented himself before the court is not supported by case law (a proposition I await Mueller’s answer to judge).

For now, though, note that their demands have actually gotten worse than what, according to Mueller at least, they had already agreed to.

Mueller, as I noted, contended that Concord had agreed to keep all discovery in the United States, but objected to Mueller’s request to withhold it from Prigozhin. The US-restrictions showed up on their protective order this way:

Neither defense counsel nor any person authorized by this Court is permitted at any time to inspect or review Sensitive materials outside of the U.S. offices of Reed Smith LLP, without prior permission from of this Court. Defense counsel or a designated and identified employee of Reed Smith LLP must accompany any person at all times while he or she is reviewing Sensitive materials at U.S. offices of Reed Smith LLP, unless otherwise authorized by this Court.

[snip]

Sensitive materials shall not be viewed or stored on any device that is connected to or accessible from the Internet.

Sensitive materials may under no circumstances be transported or transmitted outside the United States.

But Concord has now changed its mind about the US restrictions.

Further, the Special Counsel attests to the Court that the defense has agreed “on many procedures designed to enable the government to turn over discovery,” Mot. at 2, while failing to tell the Court the truth; that any such concessions were made as part of a concerted effort by undersigned counsel to reach a stipulated agreement of this issue, and absent that stipulation there is in fact no agreement at all. Despite this fact, and as a courtesy to the Court only, Defendant Concord represents that it is willing to accept the draft protective order attached hereto as Exhibit A, which will permit it to protect its constitutional rights in defending this criminal case.

It calls the requirement that discovery remain in the US (it doesn’t address the demand that it remain firewalled from the Internet) a hostage situation.

The Special Counsel seeks the unprecedented process of prohibiting defense counsel from sharing or discussing any discovery with any co-defendant—including the only person affiliated with Concord named in the Indictment—unless those individuals come to the United States to become hostages in this political game of tit-for-tat. See ECF 24-1, proposed Protective Order at ¶ 2.

Perhaps even more interesting, having been told that Mueller will hand over everything because it is too unwieldy to strip Personal Identifying Information of victims and others, Concord not only says they don’t want it (though they caveat about whether they’ll eventually release it at trial), but that they refuse to accept it.

Not yet ashamed, the Special Counsel plays the personal identifying information (“PII”) card. See Mot at p. 9. However, undersigned counsel has already advised the Special Counsel that Defendant does not seek any personal identifying information that is irrelevant to the defense. The Special Counsel stated to undersigned counsel that it would not be possible to remove any such information from the discovery. But that is the Special Counsel’s problem, not Concord’s. And undersigned counsel will not accept any such information unless the Special Counsel can demonstrate that, in fact: 1) it is relevant to the defense of the case; 2) the Special Counsel intends to use the item in its case-in-chief at trial; or 3) the information was obtained from or belongs to Defendant. See Fed. R. Crim. P. 16(a)(1)(E). The Special Counsel’s reliance on the out of circuit case United States v. Johnson, 191 F. Supp. 3d 363 (M.D. Pa. 2016) provides no cover. To the contrary, Johnson, a drugs and firearms case, returns to the concept of an umbrella protective order that is unheard of in published opinions in this district, and further addresses PII which we are not seeking unless it is relevant to the defense.7

7 The Special Counsel’s description of the PII to undersigned counsel makes it difficult to understand how it could be relevant to the defense. The Special Counsel generally noted that some of the discovery contains financial account numbers of innocent individuals. As noted above, undersigned counsel refuses to accept or be responsible for any such irrelevant data. As to names, addresses and other personal information of the same or other individuals, undersigned counsel has no intention of making any such information public prior to trial.

Of course, Russia has already stolen a lot of this PII.

So effectively, what Prigozhin is saying is that he doesn’t want any of the PII he already stole; he just wants the intelligence showing what the US government knows about how he stole it.

Don’t get me wrong: the underlying legal issues here will be an interesting question. But the message — don’t send the PII we already stole, just send the intelligence — is quite simple.

Update: In a hearing on Friday, Friedrich expressed impatience that discovery hadn’t begun yet, but generally showed great deference to the government’s concerns about security. She set a deadline for the parties to agree on a protective order, but if the interim one she drew up until they agree on something is any indication, the Mueller team will generally get what they want. In particular, she prohibited the sharing of discovery with anyone not in Concord’s law firm, meaning they can’t share it with Prigozhin.

Pursuant to this interim order, the government shall initially produce the materials to defense counsel. In the first instance, and unless and until further order from this Court, defense counsel shall not further disclose the materials or their contents directly or indirectly to anyone except defense counsel, as defined above.

And she required sensitive materials to be firewalled from the Internet, and prohibited sensitive materials being transmitted outside the US.

The government shall provide Sensitive materialsto defense counsel in a password protected, electronic format. Sensitive materials shall not be copied or reproduced without prior permission from this Court, except that defense counsel may make copies for use exclusively by defense counsel in connection with this criminal case. Sensitive materials shall be maintained in a locked room at Reed Smith’s offices within the United States, when they are not in the actual possession of defense counsel. Sensitive materials shall not be viewed or stored on any device that is connected to or accessible from the Internet.

Sensitive materials may under no circumstances be transported or transmitted outside the United States.

She also endorsed the idea of a firewall counsel who could raise objections on sharing, and even suggested a special master for discovery here.

Update: Fixed protection for protective. h/t mw.

Ty Cobb’s Claim about White House Counsel Recusal Can Only Be Narrowly True

/47 Comments/in , /by

Politico has a story that has generated favorable press for White House Counsel Don McGahn. He had his entire office recuse from the Russia investigation, it claims, basing the claim on public comments by Ty Cobb.

White House Counsel Don McGahn recused his entire staff last summer from working on the Russia investigation because many of his office’s lawyers played significant roles in key episodes at the center of the probe, former White House attorney Ty Cobb said on Wednesday.

McGahn made the decision to halt his staff’s interactions with Special Counsel Robert Mueller because many of his own attorneys “had been significant participants” surrounding the firings of national security adviser Michael Flynn and FBI Director James Comey, Cobb said.

[snip]

While it’s been widely known that McGahn handed over day-to-day responsibilities to Cobb when he started working in the White House last July, neither of the Trump lawyers had ever specified that the entire White House legal office had been recused from the Russia probe in its entirety.

The story explains something I’ve long been struck by — the claim in a John Dowd document from January that eight members of the White House Counsel underwent voluntary interviews with Mueller’s team.

Over 20 White House personnel (not including Campaign team members) voluntarily gave interviews; including 8 people from the White House Counsel’s Office.

Two-fifths of those Mueller interviewed by January were personnel from the White House Counsel’s Office?!?!

Perhaps it’s better to say that this new Ty Cobb story is best explained by that factoid: The White House Counsel’s office was a subject of real scrutiny for Mueller.

After all, public reporting makes it clear that Ty Cobb did not take over all Russian investigation matters, at least not immediately. He was hired by July 14. As late as mid-September, he was publicly bitching about tensions with McGahn and making it clear McGahn was withholding probably responsive documents.

The debate in Mr. Trump’s West Wing has pitted Donald F. McGahn II, the White House counsel, against Ty Cobb, a lawyer brought in to manage the response to the investigation. Mr. Cobb has argued for turning over as many of the emails and documents requested by the special counsel as possible in hopes of quickly ending the investigation — or at least its focus on Mr. Trump.

Mr. McGahn supports cooperation, but has expressed worry about setting a precedent that would weaken the White House long after Mr. Trump’s tenure is over. He is described as particularly concerned about whether the president will invoke executive or attorney-client privilege to limit how forthcoming Mr. McGahn could be if he himself is interviewed by the special counsel as requested.

The friction escalated in recent days after Mr. Cobb was overheard by a reporter for The New York Times discussing the dispute during a lunchtime conversation at a popular Washington steakhouse. Mr. Cobb was heard talking about a White House lawyer he deemed “a McGahn spy” and saying Mr. McGahn had “a couple documents locked in a safe” that he seemed to suggest he wanted access to.

[snip]

Complicating the situation is that Mr. McGahn himself is a likely witness. Mr. Mueller wants to interview him about Mr. Comey’s dismissal and the White House’s handling of questions about a June 2016 meeting between Donald Trump Jr. and a Russian lawyer said to be offering incriminating information about Hillary Clinton.

Mr. McGahn is willing to meet with investigators and answer questions, but his lawyer, Bill Burck, has asked Mr. Cobb to tell him whether the president wants to assert either attorney-client or executive privilege, according to lawyers close to the case. Mr. McGahn could face legal jeopardy or lose his law license should he run afoul of rules governing which communications he can divulge. He did not respond to requests for comment.

Unless NYT’s reporting — and Cobb’s public blabbing — was entirely wrong, then Cobb can only mean McGahn later recused (or recused sometime just before the Fall Equinox last year, so technically still summer). It’s possible this incident precipitated McGahn’s recusal — not to mention made Mueller even more interested in interviewing him. More likely, the discovery that McGahn could be interviewed — including about his transparently bad defense of the Mike Flynn firing — led Trump to decide that White House Counsel staffers had to be totally recused from matters that pertained to his legal exposure (though if that’s true, I wonder what Emmet Flood is doing).

Alternately, it’s possible that McGahn recognized that his continued exposure to Trump’s obstruction in conjunction with the Russia investigation exposed him to legal jeopardy. If that’s the case, his recusal wasn’t about ethics, it was about self-preservation.

Update: LemonSlayer noted on Twitter there’s a much later indication of the purported recusal McGahn has adopted: collaborating with the Devin Nunes effort.

Nunes, meanwhile, has purposefully not been talking to Trump, to avoid accusations that he is providing sensitive information to the president, according to these people. Instead, Nunes has been relaying the status of his battle with the Justice Department to White House Counsel Donald McGahn.

The Decline and Recent Fall of Manafort’s Hapsburg Empire

/10 Comments/in , /by

It turns out the government was telling the truth (not that I doubted it) when they told Judge Amy Berman Jackson they’ve only just put together the evidence that Paul Manafort violated bail by trying to suborn perjury from Alan Friedman and Eckart Sager, the two flacks who set up the Hapsburg Group for Manafort back in 2012. That’s made clear by comparing the materials submitted back on May 25 asking for leave to object to Manafort’s then just finalized bail proposal and the materials — particularly the declaration from FBI Agent Brock Domin — released in conjunction with Mueller’s motion to revoke or revise bail.

For example, whereas the later Domin declaration notes that Friedman and Sager (identified as Person D1 and D2) “provided the content of the text messages described below in May 2018,” Domin’s earlier declaration provides the specific dates.

Person D1 provided the text messages described below on May 12, 2018, and Person D2 provided the content of the text messages described below on May 21, 2018.

And while the earlier declaration relies on statements from Friedman,

Documents produced by Persons D1 and D2, statements made by Person D1 to the government, and documents recovered pursuant to a court-authorized search of Manafort’s iCloud account evidence that Manafort,

The later declaration refers to statements from Sager, too.

Documents produced by Persons D1 and D2, statements made by Persons D1 and D2 to the government, telephone records obtained by the government, and documents recovered pursuant to a court-authorized search of Manafort’s iCloud account evidence that Manafort,

So Sager must have been interviewed between May 25 and June 4.

A filing submitted last night, providing even more detail describing why Manafort should have his bail revoked includes this great quote from Sager, though it’s unclear when he gave it.

Manafort’s references to the Hapsburg member’s “role” and the “EP” refer to that Hapsburg member’s position as a representative of the European Parliament and the parallel actions of the European Parliament and the United States Senate regarding Tymoshenko’s imprisonment in 2012. That characterization is consistent with Person D2’s description, during a meeting with the government, of that Hapsburg member’s role as Manafort’s “spy and mouthpiece.”

And, as reflected both in the passage cited above and by comparing the two communication logs, the government did not reference toll records from Manafort in the May 25 filing but did in the June 4 one, suggesting that along with a Sager interview, they obtained the toll records after May 25.

Which raises two interesting questions for me: first, had the government interviewed Friedman and Sager before Manafort tried to suborn their perjury? If Mueller’s team hadn’t, it makes his effort all the more interesting, as if he somehow knew that. And also, did the government obtain proof of these communications (likely, via monitoring Manafort’s iCloud account) before reaching out to Friedman and Sager, whether anew or for the first time?

Interestingly, the earlier Domin declaration makes it clear Friedman took screen caps of the WhatsApp comms he had with Manafort contemporaneously, so even if he weren’t backing up his super secret obstruction of justice to Apple’s cloud, he’d have been fucked.

Person D1 has provided the government screen shots that Person D1 took contemporaneously of these messages.

That suggests it’s possible that Friedman contacted (possibly recontacted) the government to let them know this. But that doesn’t explain the two and a half month delay between the time Manafort tried to suborn perjury and the time the government actually chased this detail down.

Mueller to Yevgeniy Prigozhin: Sure You Can Have Discovery … If You Come to the United States to Get It

/25 Comments/in , , , /by

This Concord Management filing, from Mueller’s team, is attracting a lot of attention because Mueller predictably asked for a protective order and said Russians are still engaging in information operations (so are we!!). Since we covered the certainty that there’d be a protective order in this case over a month ago, I’m going to focus on some other interesting tidbits about this filing.

As a reminder, Concord Management is a company owned by close Putin ally Yevgeniy Prigozhin. Concord is accused in the Internet Research Agency indictment of funding the troll operation.

Defendants CONCORD MANAGEMENT AND CONSULTING LLC (Конкорд Менеджмент и Консалтинг) and CONCORD CATERING are related Russian entities with various Russian government contracts. CONCORD was the ORGANIZATION’s primary source of funding for its interference operations. CONCORD controlled funding, recommended personnel, and oversaw ORGANIZATION activities through reporting and interaction with ORGANIZATION management.

[snip]

To conceal its involvement, CONCORD labeled the monies paid to the ORGANIZATION for Project Lakhta as payments related to software support and development. To further conceal the source of funds, CONCORD distributed monies to the ORGANIZATION through approximately fourteen bank accounts held in the names of CONCORD affiliates, including Glavnaya Liniya LLC, Merkuriy LLC, Obshchepit LLC, Potentsial LLC, RSP LLC, ASP LLC, MTTs LLC, Kompleksservis LLC, SPb Kulinariya LLC, Almira LLC, Pishchevik LLC, Galant LLC, Rayteks LLC, and Standart LLC.

The indictment accuses Prigozhin of supervising the operation closely enough to have been saluted by troll operations in the US.

PRIGOZHIN approved and supported the ORGANIZATION’s operations, and Defendants and their co-conspirators were aware of PRIGOZHIN’s role.

For example, on or about May 29, 2016, Defendants and their co-conspirators, through an ORGANIZATION-controlled social media account, arranged for a real U.S. person to stand in front of the White House in the District of Columbia under false pretenses to hold a sign that read “Happy 55th Birthday Dear Boss.” Defendants and their co-conspirators informed the real U.S. person that the sign was for someone who “is a leader here and our boss . . . our funder.” PRIGOZHIN’s Russian passport identifies his date of birth as June 1, 1961.

When Concord moved to defend itself, it presented the possibility that it and Prigozhin would obtain discovery, and via Prigozhin, everyone else in Russia who was part of this operation, up to and including Putin. Indeed, the Mueller filing makes it quite clear that is the intent of the defense attorneys. They explicitly asked to share information with co-defendants that serve as officers of Concord, which can only mean they want to share information with Prigozhin.

In its initial proposed protective order, the government proposed a complete prohibition on sharing discovery with any co-defendant charged in this criminal case, whether individual or organizational. Defense counsel proposed that they be permitted to share discovery with a codefendant if that co-defendant is an officer or employee of Concord Management. To the government’s knowledge, the only charged defendant in this category is Yevgeniy Viktorovich Prigozhin, who was charged individually for conspiring to defraud the United States, in violation of 18 U.S.C. § 371.

So this dispute over the protective order is an effort to continue with the prosecution, while ensuring that Russia doesn’t obtain important information on the investigation into the operation by doing so.

Before I get into how Mueller’s team proposes to resolve the dispute, it’s worth reviewing the data in question, because that’s actually one of the most interesting parts of this filings. Apparently, the government used no classified information in the investigation of social media trolling (or parallel constructed whatever they did use).

As described further in the government’s ex parte affidavit, the discovery in this case contains unclassified but sensitive information that remains relevant to ongoing national security investigations and efforts to protect the integrity of future U.S. elections. [my emphasis]

Later, the filing makes it clear that much of the evidence in the case came from US providers — surely Facebook and Twitter and others.

The evidence includes data related to hundreds of social media accounts, as well as evidence obtained from email providers, internet service providers, financial institutions, and other sources. Additionally, the need to produce much of the data in its original format (formats that include, for example, Excel and HTML files) makes it infeasible to make certain redactions without compromising expeditious review of the data.

These two details confirm a point I made in March: this indictment really doesn’t rely on information as secret as many reporters claimed. It relies on stuff you get from social media providers.

And contrary to what NBC says about the heavy reliance, in the Internet Research Agency indictment, “on secret intelligence gathered by the CIA, the FBI, the National Security Agency (NSA) and the Department of Homeland Security (DHS),” it really wasn’t all that sophisticated from a cybersecurity standpoint. Especially not once you consider the interesting forensics on it (aside from IDing the IRA’s VPNs) would have come from Facebook and Twitter.

That detail — that much of this indictment comes from the social media providers that Russia exploited in 2016 — is important background to this passage (this is the one that has gotten all the press), which asserts that Russia continues to do what Prigozhin’s trolls did in 2016.

Public or unauthorized disclosure of this case’s discovery would result in the release of information that would assist foreign intelligence services, particularly those of the Russian Federation, and other foreign actors in future operations against the United States. First, the substance of the government’s evidence identifies uncharged individuals and entities that the government believes are continuing to engage in interference operations like those charged in the present indictment. Second, information within this case’s discovery identifies sources, methods, and techniques used to identify the foreign actors behind these interference operations, and disclosure of such information will allow foreign actors to learn of these techniques and adjust their conduct, thus undermining ongoing and future national security investigations.

And that, in turn, explains much of the logic for the larger protective order request: the government is trying to prevent Prigozhin and through him Putin from learning what the US is doing to counter its information operations.

The government’s description of what it considers “sensitive” information that it wants to require a special review before sharing with foreign nationals reveals it is also trying to prevent Prigozhin and others from learning about the status of the investigation and its targets.

a. Witness statements provided pursuant to 18 U.S.C. § 3500;

b. Information that could lead to the identification of potential witnesses, including civilian, foreign and domestic law enforcement witnesses and cooperating witnesses;

c. Information related to ongoing investigations, including information that could identify the targets of such investigations; and

d. Information related to sensitive law enforcement or intelligence collection techniques.

Finally, the government is trying to hide what it knows about relationships between parties involved in this operation and “other uncharged foreign entities and governments.”

At a high level, the sensitive-but-unclassified discovery in this case includes information describing the government’s investigative steps taken to identify foreign parties responsible for interfering in U.S. elections; the techniques used by foreign parties to mask their true identities while conducting operations online; the relationships of charged and uncharged parties to other uncharged foreign entities and governments; the government’s evidence-collection capabilities related to online conduct; and the identities of cooperating individuals and, or companies. Discovery in this case contains sensitive information about investigative techniques and cooperating witnesses that goes well beyond the information that will be disclosed at trial. [my emphasis]

So one thing the government wants to protect is what it knows about the relationship between Prigozhin and Putin, and the Russian government’s involvement in this trolling operation more generally.

And to do that, the government is demanding the ability to prohibit Concord’s lawyers from sharing information with Prigozhin (or any other defendant) without prior court review.

Notwithstanding the previous categories of authorized persons, no co-defendant charged in this criminal case, whether individual or organizational, shall be deemed an authorized person for purposes of discovery until the co-defendant appears before this Court. Defense counsel shall not disclose or discuss the material or their contents to any co-defendant charged in this criminal case, whether individual or organizational, until the co-defendant appears before this Court unless otherwise directed by this Court. If defense counsel, after reviewing discovery in this matter, believes it necessary to seek to disclose or discuss any material with a co-defendant who has not appeared before this Court, counsel must first seek permission from this Court and a modification of this Order.

Perhaps more interesting, it is demanding that Concord’s lawyers keep anything deemed sensitive in the US, firewalled from the Internet.

Neither defense counsel nor any person authorized by this Court is permitted at any time to inspect or review Sensitive materials outside of the U.S. offices of Reed Smith LLP, without prior permission from of this Court. Defense counsel or a designated and identified employee of Reed Smith LLP must accompany any person at all times while he or she is reviewing Sensitive materials at U.S. offices of Reed Smith LLP, unless otherwise authorized by this Court.

[snip]

Sensitive materials shall not be viewed or stored on any device that is connected to or accessible from the Internet.

Sensitive materials may under no circumstances be transported or transmitted outside the United States.

The logic here is nifty: even if they lose on the ability to protect all materials from Prigozhin, they’ve already succeeded in requiring that he come to the US if he wants to read it. At which point, he’d be met by authorities at customs and promptly put in custody.

On one point I was mistaken. I thought there would be classified discovery of some sort, that would require the use of the Classified Intelligence Protection Act procedures. It will apparently never get to that. The government will either win on this protective order, which will largely moot much of the logic for Concord to contest the case, or it will lose, which will likely lead it to dismiss the indictment against Concord.

Update: Fixed protective for protection, h/t mw.

The Crimes with which NSD Envisions Charging Those Attacking Elections

/14 Comments/in , , /by

The Senate Judiciary Committee had a hearing on how to protect our elections today. Among others, Deputy Assistant Attorney General Adam Hickey from DOJ’s National Security Division testified. He gave a list of some of the crimes he thought might be used to charge people who tampered with elections.

Foreign influence operations, though not always illegal, can implicate several U.S. Federal criminal statutes, including (but not limited to) 18 U.S.C. § 371 (conspiracy to defraud the United States); 18 U.S.C. § 951 (acting in the United States as an agent of a foreign government without prior notification to the Attorney General); 18 U.S.C. § 1001 (false statements); 18 U.S.C. § 1028A (aggravated identity theft); 18 U.S.C. § 1030 (computer fraud and abuse); 18 U.S.C. §§ 1343, 1344 (wire fraud and bank fraud); 18 U.S.C. § 1519 (destruction of evidence); 18 U.S.C. § 1546 (visa fraud); 22 U.S.C. § 618 (Foreign Agents Registration Act); and 52 U.S.C. §§ 30109, 30121 (soliciting or making foreign contributions to influence Federal elections, or donations to influence State or local elections).

In their testimony, Ken Wainstein (someone with extensive experience of national security prosecutions, but less apparent focus on the available evidence in this investigation) and Ryan Goodman (who doesn’t have the prosecutorial experience of Wainstein, but who is familiar with the public facts about the investigation) also list what crimes they think will get charged.

I find a comparison of what each raised, along with what has already been charged, to be instructive. I believe that comparison looks like this:

I’m interested, in part, because Hickey, who likely has at least a sense of the Mueller investigation (if not personal involvement), sees the case somewhat differently than two differently expert lawyers. Two charges — agent of a foreign power (basically, being a foreign spy in the US not working under official cover) and CFAA (hacking) seem obvious to both National Security Division prosecutors, but have not yet been publicly charged. Illegal foreign contributions seems obvious to those paying close attention, but also has not been charged. We might expect to see all three charges before we’re done.

Neither Wainstein nor Goodman mentioned false statements, but of course that’s what we’ve seen charged most often so far.

Then there are the two crimes Hickey mentions that the others don’t, but that have not yet been charged (both have been alleged as overt acts in the Internet Research Agency indictment): Visa fraud (alleged against the trolls who came to the US to reconnoiter in 2014) and destruction of evidence (again, alleged against IRA employees destroying evidence after Facebook’s role was discovered). Mueller also described George Papadopoulos destroying evidencec when he deleted his Facebook account, but like the Russian trolls, he didn’t get charged for it. Visa fraud, in particular, is something that multiple figures might be accused of — Alexander Torshin and others reaching out via NRA, Natalia Veselnitskaya, and even Brits who worked illegally during the election for Cambridge Analytica.

I confess I’m most interested in Hickey’s mention of destruction of evidence, though. That’s true, in part, because SDNY seems to think Michael Cohen might destroy evidence.

Hope Hicks, too, reportedly thought about hiding evidence from authorities. Then there’s the report that Mueller is checking encrypted messaging apps as people turn in phones when they arrive for interviews.

Huckey seems to think some of the people being investigated — beyond Papadopoulos and IRA troll Viktorovna Kaverzina — may have been destroying evidence.

I wonder if he has reason to suspect that.

The New Cyber Sanctions

/27 Comments/in , , /by

Even as Trump was working hard to get Russia admitted back into the G-7, Treasury was preparing new cyber sanctions against a number of “Russian” entities. This appears to be an effort to apply sanctions for activities exploiting routers and other network infrastructure (activities that the US and its partners engage in too) that US-CERT released a warning about in April.

One of the designated entities in controlled by and has provided material and technological support to Russia’s Federal Security Service (FSB), while two others have provided the FSB with material and technological support.  OFAC is also designating several entities and individuals for being owned or controlled by, or acting for or on behalf of, the three entities that have enabled the FSB.

[snip]

Examples of Russia’s malign and destabilizing cyber activities include the destructive NotPetya cyber-attack; cyber intrusions against the U.S. energy grid to potentially enable future offensive operations; and global compromises of network infrastructure devices, including routers and switches, also to potentially enable disruptive cyber-attacks.  Today’s action also targets the Russian government’s underwater capabilities.  Russia has been active in tracking undersea communication cables, which carry the bulk of the world’s telecommunications data.

I’ve included the entire list of sanction targets below.

On paper, at least, it looks like Treasury is sanctioning:

  • An entity, Divetechnoservices, that helps Russia tap into submarine cables along with three of its employees (another thing our spooks do, but one the US and especially UK have been increasingly worried about from Russia); the Treasury release notes that Divetechnoservices got the contract for a FSB submersible craft way back in 2011
  • An entity, Kvant Scientific Research Institute, that has been a research institute for FSB since August 2015 and, since April 2017, the prime contractor on an FSB project
  • An entity, Digital Security, that as of 2015 worked on a project that would expand Russia’s offensive cyber capabilities; the sanctions also include two companies the release claims are Digital Security subsidiaries, both which have US and Israeli locations

All of these were sanctioned under E.O. 13694, which, as amended, included attacks on election processes; given the dates, they might be implicated in the election year hacks, or might just be deemed a threat to national security. Just Kvant was also sanctioned under CAATSA, which is the more general sanctions program forced onto Trump by Congress. I’ve also put the language for the two of those below.

And, as Lorenzo F-B notes, the heads of two of the sanctioned alleged subsidiaries of Digital Security, ERPScan and Embedi, say they have nothing to do with the company.

But one of the security companies named in the new sanctions, ERPScan, denied having anything to do with the Russian government in an email to Motherboard.

“The only issue is that I and some of my peers were born in Russia, oh, cmon, I’m sorry but I can’t change it,” ERPScan’s founder Alexander Polyakov told me. “We don’t have any ties to Russian government.”

ERPScan is mostly known for its product that hunts for vulnerabilities in companies’ systems provided by SAP, a popular German enterprise software maker. Cyber Defense Magazine gave ERPScan an award this year for “best product” in its artificial intelligence and machine learning category.

[snip]

Polyakov, however, claimed that as of 2014, ERPScan is a “private company registered in the Netherlands” and that it has no connections “with other companies listed in this document.”

[snip]

“The news came to us as an unpleasant surprize. We never worked for Russian government, but indeed we have some former Russian researchers in our Research Team (some of them are former employees of Digital Security),” Alex Kruglov, Embedi’s head of marketing, told Motherboard in an email. “It is the only reason we can figure out to be added to a sanctions list.”

And they’re both legit cybersecurity companies, which at the very least raises questions (as the Kaspersky targeting did) about whether this is just infosec protectionism. If these protestations are correct, however, it renews real questions about the accuracy of sanction claims made under Treasury Secretary Steve Mnuchin.

The first indication that Mnuchin’s Treasury Department was offering bullshit to fulfill Congress’ demand for sanctions came when Treasury released a list of Russian oligarchs in January that was basically just the Forbes list of richest Russians, including a number that oppose Putin.

President Trump’s Treasury Department releaseda list of prominent Russian political figures and business leaders who have prospered while Vladimir Putin has led Russia.

The list features 210 people, including politicians such as Prime Minister Medvedev and Minister of Defense Sergey Shoygu. Also on the list are 96 “oligarchs.” Within hours of the list’s posting , media organizations began pointing out the similarity between the 96 billionaires listed and the Russians that appear on Forbes’ 2017 list of the World’s Billionaires.

Forbes went through the lists and confirmed that indeed the Treasury Department’s list is an exact replica of the Russians on the 2017 billionaires list.

For a bit, I thought the list released in March, which added a few new GRU officers, might have reflected new knowledge about GRU officers involved in the targeting of the DNC. Except it turned out those officers were just people readily identifiable off public GRU records. Treasury basically could have gotten them from a spook phone book.

Treasury did better with non-cyber Ukraine-related sanctions in April. It actually named several figures — most obviously Oleg Deripaska and Alexander Torshin — suspected of having played key roles in the election interference. Since then, Deripaska and his aluminum company Rusal have pursued financial games to shield Rusal from sanctions. He’s doing this with the help of Mercury Public Affairs — the Vin Weber lobbying group that shows up in a lot of Manafort’s indictments — and former Trump aide Brian Lanza, who now works there. So it’s not clear whether Deripaska will be significantly impacted.

With that history in mind, it’s worth asking whether Treasury simply can’t do cyber sanctions well, both because it’s hard to distinguish infosec from hacking (it would be equally difficult to do so for any of a number of contractors with close ties to FBI, the analogue of the companies that got sanctioned yesterday), and perhaps because Treasury doesn’t have good intelligence on who is hacking for Russia. Or perhaps Mnuchin is just obstinate.

But thus far, the history of Treasury’s selections on Russian related cyber sanctions leaves quite a bit to be desired.

Today’s action includes the designation of five Russian entities and three Russian individuals pursuant to E.O. 13694, as amended, as well as a concurrent designation pursuant to Section 224 of CAATSA.

Digital Security was designated pursuant to E.O. 13694, as amended, for providing material and technological support to the FSB.  As of 2015, Digital Security worked on a project that would increase Russia’s offensive cyber capabilities for the Russian Intelligence Services, to include the FSB.

ERPScan was designated pursuant to E.O. 13694, as amended, for being owned or controlled by Digital Security.  As of August 2016, ERPScan was a subsidiary of Digital Security.

Embedi was designated pursuant to E.O. 13694, as amended.  As of May 2017, Embedi was owned or controlled by Digital Security.

Kvant Scientific Research Institute (Kvant) was designated pursuant to E.O. 13694, as amended, and Section 224 of CAATSA for being owned or controlled by the FSB.  In August 2010, the Russian government issued a decree that identified Kvant as a federal state unitary enterprise that would be supervised by the FSB.

Kvant was also designated pursuant to E.O. 13694, as amended, for providing material and technological support to the FSB.  As of August 2015, Kvant was a research institute with extensive ties to the FSB.  Furthermore, as of April 2017, Kvant was the prime contractor on a project for which the FSB was the end user.

Divetechnoservices was designated pursuant to E.O. 13694, as amended, for providing material and technological support to the FSB.  Since 2007, Divetechnoservices has procured a variety of underwater equipment and diving systems for Russian government agencies, to include the FSB.  Further, in 2011, Divetechnoservices was awarded a contract to procure a submersible craft valued at $1.5 million for the FSB.

Aleksandr Lvovich Tribun (Tribun) was designated pursuant to E.O. 13694, as amended, for acting for or on behalf of Divetechnoservices.  As of December 2017, Tribun was Divetechnoservices’ General Director.

Oleg Sergeyevich Chirikov (Chirikov) was designated pursuant to E.O. 13694, as amended, for acting for or on behalf of Divetechnoservices.  As of March 2018, Chirikov was Divetechnoservices’ Program Manager.

Vladimir Yakovlevich Kaganskiy (Kaganskiy) was designated pursuant to E.O. 13694, as amended, for acting for or on behalf of Divetechnoservices.  As of December 2017, Kaganskiy was Divetechnoservices’ owner.  Previously, Kaganskiy also served as Divetechnoservices’ General Director.

EO 13694 as amended

E.O. 13694 authorized the imposition of sanctions on individuals and entities determined to be responsible for or complicit in malicious cyber-enabled activities that result in enumerated harms that are reasonably likely to result in, or have materially contributed to, a significant threat to the national security, foreign policy, or economic health or financial stability of the United States.  The authority has been amended to also allow for the imposition of sanctions on individuals and entities determined to be responsible for tampering, altering, or causing the misappropriation of information with the purpose or effect of interfering with or undermining election processes or institutions.

CAATSA Section 224

IN GENERAL.—On and after the date that is 60 days after the date of the enactment of this Act, the President shall— (1) impose the sanctions described in subsection (b) with respect to any person that the President determines— (A) knowingly engages in significant activities undermining cybersecurity against any person, including a democratic institution, or government on behalf of the Government of the Russian Federation; or (B) is owned or controlled by, or acts or purports to act for or on behalf of, directly or indirectly, a person described in subparagraph (A);

[snip]

SIGNIFICANT ACTIVITIES UNDERMINING CYBERSECURITY DEFINED.—In this section, the term ‘‘significant activities undermining cybersecurity’’ includes— (1) significant efforts— (A) to deny access to or degrade, disrupt, or destroy an information and communications technology system or network; or (B) to exfiltrate, degrade, corrupt, destroy, or release information from such a system or network without authorization for purposes of— (i) conducting influence operations; or (ii) causing a significant misappropriation of funds, economic resources, trade secrets, personal identifications, or financial information for commercial or competitive advantage or private financial gain; (2) significant destructive malware attacks; and (3) significant denial of service activities.

Revisiting Trump’s Joint Defense Agreement

/17 Comments/in , /by

Betsy Woodruff has a story reminding us that Trump has a joint defense agreement with some of the other people caught up in Mueller’s probe.

The president’s personal lawyers have teamed up with attorneys for other individuals embroiled in special counsel Bob Mueller’s probe, multiple sources tell The Daily Beast. For a while, the president’s lawyers even had regular conference calls with other attorneys to discuss the Mueller investigation, according to one source familiar with the calls.

The arrangement is known as a joint defense agreement, and it allows the lawyers to share information—without violating attorney-client privilege. It’s a common strategy when multiple defendants are dealing with the same prosecutor on the same matter.

I say “reminding us,” because this is not news. When Mike Flynn flipped, the first notice came when he alerted this very same joint defense agreement he could no longer share information (as the story itself notes).

The story doesn’t even describe, generally, who is included in it, which might help observers understand the dynamics we’re watching. The closest hint of that is the observation that Paul Manafort might be going to jail on Friday.

This week is poised to be less-than-harmonious for at least one person in Mueller’s sights: Paul Manafort, who will appear in court on Friday for a hearing where a judge will decide whether or not to revoke his bail.

The article doesn’t even confirm that Manafort is part of the defense agreement. But Trump was bragging, back in January, that he had “decided that a key witness in the Russia probe, Paul Manafort, isn’t going to ‘flip’ and sell him out, friends and aides say.” That’s the kind of thing Trump might have assurance about if Manafort were part of a joint defense agreement, particularly if — as has subsequently been reported — John Dowd offered Manafort a pardon (through one of his lawyers, in the kind of discussion lawyers might assume were shielded by a joint defense agreement) last year.

The pardon discussion with Mr. Manafort’s attorney, Reginald J. Brown, came before his client was indicted in October on charges of money laundering and other financial crimes. Mr. Manafort, the former chairman of Mr. Trump’s presidential campaign, has pleaded not guilty and has told others he is not interested in a pardon because he believes he has done nothing wrong and the government overstepped its authority. Mr. Brown is no longer his lawyer.

Mind you, now we know that Mueller knows about such offers (because it’s one of the questions they posed to Trump in March). That makes Trump’s legal impunity for offering such pardons at least slightly more sketchy, particularly if he’s pardoning someone so obviously corrupt as Paul Manafort. Add in the fact that Jared Kushner sold out Flynn last fall (which is reportedly what led him to flip), and Manafort may be less certain about Trump’s reliability, even in spite of Trump’s Tweets suggesting FBI should have prevented him from hiring someone they were investigating back in 2016, posted — with remarkable prescience! — on the eve of the latest setback in Manafort’s case.

Still, the reminder that Trump and a number of subjects of this investigation have been comparing notes explains a lot we’ve seen since. It explains, for example, why Manafort has made such a diligent effort to get the court to disclose information to him– such as the substance of warrant affidavits to seize up to four other people’s AT&T phone information, or the other bullet points in Rod Rosenstein’s August 2, 2017 memo laying out the scope (at that point) of the investigation — that affects others likely covered by the defense agreement. It explains one advantage to Manafort of insisting on being charged in two jurisdictions: because it gives him two bites at an attempt to challenge Mueller’s jurisdiction.

The joint defense agreement also explains several other things we’ve seen, such as the coordinated messaging — particularly the planted narrative about Spygate — best explained by the coordination of Victoria Toensing armed with information only legally available to Trump.

Finally, it explains the delay in any charges related to the conspiracy between Trump and the Russians: once Mueller charges those issues, he will have to provide discovery about what he knows, which will then get shared back with others involved in the conspiracy. It appears he’s primarily sharing that information (aside from in the form of questions to witnesses who appear before the grand jury) with those who’ve flipped. Even the questions he has posed to Trump are probably sharply limited to hide the main thrust of the conspiracy investigation.

That’s why the stakes for Friday are so high (and the timing of this reminder that there’s a joint defense agreement). Mueller still won’t need to provide Manafort the evidence he has about his role in the conspiracy, though the indictment of Kilimnik gets far closer to that. But it raises the cost on Manafort for sustaining a joint defense, minimizes his value to the others, all while the crimes charged could still be refiled in a VA state court.