Both WaPo and MuskWatch have written about the declaration that former acting Chief of Staff to the then-Acting Social Security Commissioner, Tiffany Flick, submitted in a union lawsuit against the Social Security Agency on Friday. To support a bid for a Temporary Restraining Order arguing, in part, that the way DOGE has handled Social Security data exposes the unions’ members to fraud, Flick described how DOGE boys were given rushed access to the most sensitive kind of Social Security data, including:

The Enterprise Data Warehouse, which houses SSA’s master files and includes extensive information about anyone with a social security number (including names, names of spouses and dependents, work history, financial and banking information, immigration or citizenship status, and marital status);

The Numident file, which contains information about the assignment of social security numbers; and

The Master Beneficiary Record and SSI Record files, which contain detailed information (including medical data) about anyone who applies for or receives Social Security or SSI benefits

While WaPo’s Lisa Rein (who has been covering this particular takeover closely and was cited in the filing) ends her piece quoting Flick saying, “the risk of data leaking into the wrong hands is significant,” neither Rein nor MuskWatch considers the full implications of this. (And to be fair, the union’s lawsuit, which represents general government employees, doesn’t either.)

Though this complaint includes a FISMA component, meaning the unions are arguing, in part, that the government is violating its own cybersecurity rules, it does not and cannot make a national security argument: That treatment of the entire country’s data in this fashion presents enormous national security risks.

As Flick describes, Elon’s DOGE boys came into the Social Security Agency harboring and clinging to conspiracy theories about fraud, even when offered explanations to debunk them.

20. [snip] We proposed briefings to help Mr. Russo and Mr. Bobba understand the many measures the agency takes to help ensure the accuracy of benefit payments, including those measures that help ensure we are not paying benefits to deceased individuals. However, Mr. Russo seemed completely focused on questions from DOGE officials based on the general myth of supposed widespread Social Security fraud, rather than facts.

[snip]

51. Additionally, even with only read access DOGE can, and has already, used SSA data to spread mis/disinformation about the amount of fraud in Social Security benefit programs. The agency can always do more to ensure accurate and timely benefits payments, and it continues to pursue improvements. However, fraud is rare, and the agency has numerous measures in place to detect and correct fraud.

Having nothing more than conspiracy theories, DOGE demanded — and got (partly by replacing the Commissioner with a staffer who had worked with DOGE in advance) — that Akash Bobba be granted access to virtually all of Social Security Agency’s data, immediately. Bobba appears, with description of his access at GSA, in this Wired profile. Bobba got access to that data via a telework option, meaning he was located with a bunch of other people not cleared into this data itself.

22. Throughout this time, Acting Commissioner King requested that Mr. Russo report to her, as the CIO normally would, but he consistently gave evasive answers about his work. It appeared to me that he was actually reporting to DOGE.

23. During the week of February 10, with daily pressure from Mr. Russo, the CIO’s office tried to rapidly train Mr. Bobba to get him access to SSA data systems so he could work on a special project for Mr. Russo at DOGE’s request and so that he could “audit” any of the work of SSA experts.

24. We worked to provide Mr. Bobba with the necessary information and information security training but had to do so in a truncated manner and outside normal processes.

25. Given that, I do not believe Mr. Bobba had a sufficient understanding of the sensitive nature of SSA data or the ways to ensure such data’s confidentiality. These are complicated systems with complex policies governing very large programs, and it simply is not possible to become proficient within a matter of days.

[snip]

28. [snip] I understood that Mr. Bobba was working off-site at OPM while he was analyzing the SSA data. I also understood that other, non-SSA people were with him and may have also had access to the protected information. My understanding is that Mr. Russo approved a telework agreement for Mr. Bobba (while at the same time directing CIO management to work onsite full-time) to allow him to work out of OPM. But our standard telework agreements state that employees need to work in a private location and should be careful to protect systems and data from unauthorized access. Mr. Bobba’s work didn’t seem to align with those requirements.

[snip]

36. It was never entirely clear what systems Mr. Russo wanted Mr. Bobba to have access to, but Mr. Russo reportedly stated that Mr. Bobba needed access to “everything, including source code.”

[snip]

43. But the request to give Mr. Bobba full access to these databases without justifying the “need to know” this information was contrary to SSA’s longstanding privacy protection policies and regulations, and none of these individuals could articulate why Mr. Bobba needed such expansive access. I also understood that Mr. Bobba would not view the data in a secure environment because he was living and working at the Office of Personnel Management around other DOGE, White House, and/or OPM employees.

Even if we could assume these DOGE boys — at least three of whom (Edward “Big Balls” Coristine, Branden Spikes, and Sam Corcos) have been shown to have suspect ties — have no other motive than to spin false claims of fraud, this would still be a massive security risk. But as Flick repeats over and over, these DOGE boys were always evasive about what they were really up to. And as she describes, these boys are working off site, without the kind of confidentiality protections that would apply within SSA.

By handling the data like this, they make it child’s play for adversaries to help themselves as well.

It’s not just that DOGE has found almost nothing while compromising the most sensitive datasets in government. It’s also that the way they’re doing so, driven in significant part by this haste, has made it exceedingly more likely someone else will compromise the data.

The risk is not just fraud (the harm laid out in the lawsuit). It’s spying, on an even greater scale than China achieved with the OPM hack.

And the members of Congress who’re supposed to oversee such issues have done nothing — at least nothing public.

I’ve included contact numbers for the Senate Intelligence Committee (which is the most likely to give a shit about possible compromise like this), as well as the Chair and Ranking members of other committees with jurisdiction. If one of them is your Member of Congress, call and ask why they’re abdicating their duty to protect the country from obvious compromise.

Senate Intelligence Committee

GOP

Tom Cotton (202) 224-2353

Jim Risch (202) 224-2752

Susan Collins (202) 224-2523

John Cornyn (202) 224-2934

Jerry Moran (202) 224-6521

James Lankford (202) 224-5754

Mike Rounds (202) 224-5842

Todd Young (202) 224-5623

Ted Budd (202) 224-3154

Dems

Mark Warner (202) 224-2023

Ron Wyden (202) 224-5244

Martin Heinrich (202) 224-5521

Angus King (202) 224-5344

Michael Bennett (202) 224-5852

Kirsten Gillibrand (202) 224-4451

Jon Ossoff (202) 224-3521

Mark Kelly (202) 224-2235

Senate Homeland Security Committee

Rand Paul (202) 224-4343

Gary Peters (202) 224-6221

House Intelligence Committee

Rick Crawford (202) 225-4076

Jim Himes (202) 225-5541

House Homeland Security Committee

Mark Green (202) 225-2811

Bennie Thompson (202) 225-5876

Yesterday, arguably for (at least) the second time, Trump declared fealty to Vladimir Putin.

As I contemplated the awful but in no way surprising developments (here’s a good podcast, featuring Marc Polymeropoulos, Doug Lute, and Rosa Brooks), I thought about the various ways Trump is sabotaging the United States, based on apparently different motivations.

But we only assume those motivations are different because we (or much of the legacy press, anyway) accept the claimed motivation Trump offers. When you look at all of them together, you simply can’t rule out they’re all part of the same effort to capitulate to Putin.

Project 2025

There’s a consensus that Trump is following the plan mapped out in Project 2025. This Politico report, from early February, laid out how Executive Orders Trump had signed implemented plans to attack diversity and LGBTQ protections, attack migrants, and protect disinformation. It focuses on fossil fuel plans that have mostly defunded renewable energy without raising fossil fuel exploitation (in part because it was already so high under Biden).

Even if that were the only thing going on or if that were really what was going on, it would raise real questions about foreign influence. Last year, Casey Michel mapped out how Viktor Orbán used the Heritage Foundation as a beachhead for his influence peddling in the US (which I discussed in this post on Trump’s attempt to distance himself from Project 2025).

While much attention has understandably focused on Heritage’s so-called “Project 2025,” which provides a roadmap for Trump to seize as much power as he can, such a shift has extended to foreign policy. This has been seen most especially in Heritage leading the effort to gut funding for Ukraine. But it’s also evident in the way Heritage has endeavored to anchor its relations with Orbán, making Budapest once more America’s preferred partner in Europe—regardless of the cost.

Much of that shift is downstream from Heritage’s leadership, overseen by Kevin Roberts. Appointed as Heritage’s president in 2021, Roberts immediately began remaking Heritage’s priorities with a distinctly pro-Orbán bent—and began opening up Heritage as a vehicle for Hungarian influence in the U.S.

Part of that involved things like last week’s confab, one of many meetings between Roberts and Orbán. (After one 2022 sit-down, Roberts—who, among other things, has said he doesn’t think Joe Biden won the 2020 election—posted that it was an “honor” to meet with Orbán, praising his “movement that fights for Truth, for tradition, for families.”) But the relationship is structural as well: Heritage finalized what they refer to as a ‘landmark’ cooperation agreement with the Danube Institute, a Hungarian think tank that appears to exist only to praise Orbán’s government.*

The Budapest-based Danube Institute is largely unknown in the U.S., but it has transformed in recent years into one of the premier mouthpieces for propagating Orbánist policies. While it is technically independent, it is, as Jacob Heilbrunn notes in his new book on the American right’s infatuation with dictators, located “next to the prime minister’s building and funded by Orbán’s Fidesz party.” Indeed, the Hungarian think tank is overseen by a foundation directly bankrolled by the Hungarian state—meaning that the Danube Institute is, for all intents and purposes, a state-funded front for pushing pro-Orbán rhetoric.

A spokesperson for the Heritage Foundation told The New Republic that their arrangements with the Danube Institute is “restricted to carrying out educational research and analysis, as well as related events—none of which involved any financial commitment from either party” and that “at no point did Heritage receive funds from or pass funds to the Danube Institute, the Hungarian government, or the prime minister’s office.”

The Danube Institute claims it is dedicated to “advocat[ing] conservative and national values and thinking,” which almost always ends up with the institute praising Orbán’s pronouncements. It has become, according to Hungarian journalists at Atlatszo, “one of the main tools of the Orbán government’s ideological expansion abroad”—and one of the “main vehicles” to “building a political network in the United States.

Christopher Rufo, the propagandist behind the demonization of trans people, has ties to the Danube Institute.

So even if this was just about implementing Project 2025, that would best be described as replacing American democracy with Orbanist authoritarianism — adopting the model from a key Putin puppet.

DOGE infiltration and destruction of US government

There have been a slew of stories about how DOGE provided cover for Russ Vought and Stephen Miller to implement Project 2025. Wired, for example, described how Stephen and his wife Katie, who is formally on the DOGE team, serve as gatekeepers to Elon and use Elon to carry out their dirty work.

Meanwhile, Stephen Miller has, along with Project 2025 coauthor and Office of Management and Budget director Russell Vought, became one of Musk’s closest allies in the administration, The New York Times reported earlier this month. WIRED has learned that the relationship is far closer, and more complicated, than has been previously known publicly.

In many ways, Musk’s targeting of federal agencies is perfectly in sync with the aims of Miller, who has championed DOGE’s work internally and even helped in making a lot of it possible. (In public, Miller has equated federal workers with “radical left Communists” and “criminal cartels.”) Still, sources tell WIRED that Trumpworld is more comfortable with Musk taking the heat for the recent federal cuts rather than the less famous—and, in their view, far less telegenic—Miller.

Yet through their actions so far, the Millers and Musk have developed a MAGA version of the Pet Shop Boys adage from the song “Opportunities (Let’s Make Lots of Money)”: You’ve got the brawn / I’ve got the brains. Stephen Miller’s knowledge of the federal apparatus, Katie Miller’s contacts on Capitol Hill, and the couple’s good standing among Trump loyalists, coupled with Musk’s relentless ambition and effectively infinite resources, made the scale of the DOGE government takeover possible. Musk is not the independent actor he’s often portrayed as and taken to be, in other words, but is rather carrying out actions essentially in concert with the man to whom the president has delegated much of the day-to-day work of governance.

“Stephen is kind of the prime minister,” one of three Republicans close to Trump and familiar with the situation tells WIRED. Another Republican familiar with the dynamic also used the term “PM” to describe Miller, short for prime minister. The implication is that Miller is carrying out the daily work of governance while Trump serves as head of state, focusing on the fun parts of being president.

But DOGE is going beyond the scope of Project 2025, and in ways that directly harm the United States.

Take the Project 2025 recommendations on USAID, the first target of DOGE. DOGE adopted the general theme of the Project 2025 chapter — that USAID had been used to implement a lot of radical plans. But the virtual elimination of USAID implemented last week goes well beyond Project 2025’s recommended reversal to 2019’s budget of $39.3 billion.

Project 2025 hailed Trump’s use of USAID to push for religious protection for Christians which — as I showed —  got shut down early along with everything else.

It promoted international religious freedom as a pillar of the agency’s work and built up an unprecedented genocide-response infrastructure.

It specifically called for greater reliance on local NGOs — and pointed to PEPFAR as a model.

Streamlining Procurement and Localizing the Partner Base. USAID is a grantmaking and contracting agency that disburses billions of dollars of federal funding in developing countries through implementing partners, such as U.N. agencies, international NGOs, for-profit companies, and local nongovernmental entities. In rare instances, such as in Jordan and Ukraine, the agency provides direct budget support to finance the operations of host-country governments. USAID far more often counts on expensive and ine!ective large contracts and grants to carry out its programs. It justifies these practices based on speed and a lower administrative burden on its institutional capacity.

[snip]

The President’s Emergency Plan for AIDS Relief (PEPFAR) has shown that localization at scale is possible within a short time span. Over the four years of the Trump Administration, the multibillion-dollar program increased the amount of funding disbursed to local entities from about 25 percent to nearly 70 percent with positive overall results. This model should be replicated across all of USAID.

But as declarations in various lawsuits repeat over and over, these local partners are not getting paid, and it’s destroying the credibility of the US (and rule of law).

11. Currently my mission has more than $30 million in unpaid invoices for 2 months of implementing partners’ work, with half of those past Prompt Payment Act due date (30 days) and incurring interest every day. If one were to extrapolate the numbers across all of the missions and USAID/Washington, given that annual USAID appropriation is $40 billion, the total dollar amount of unpaid invoices would certainly surpass $1billion at the most conservative estimate.

[snip]

13. Arbitrary withholding of due payments to U.S. and non-U.S. based partners does grave damage to the reputation and reliability of the U.S. government both domestically and internationally. USAID is a USG Agency which signed the contracts and grants in line with the Code of Federal Regulations and other statutes; USG refusal to pay for the past performed work and non-compliance with the TRO can shatter Americans’ certainty in the rule of law.

Rather than empowering local partners and capabilities, the quick decimation has devastated them — and left Americans still located overseas exposed to backlash.

USAID is just the most substantiated example of the sheer waste DOGE is creating. We’re seeing similarly stupid decisions in the firings of critical personnel (some of whom get hired back), but also the elimination of long-term maintenance or safety programs that will cost far more when those protections are gone.

Project 2025 envisioned stripping civil service protections and politicizing the bureaucracy. But with DOGE cuts, it’s not clear the bureaucracy can be rebuilt, even assuming the Heritage hires knew what they were doing. Meanwhile, the method of those cuts is more likely to elicit a backlash from judges, potentially even from the Supreme Court justices whom right wingers were counting on to bless all this.

And all that’s before you contemplate the possibility that Elon’s DOGE boys are doing something else with the data they’re accessing, or — intentionally or not — setting up backdoors via which adversaries can do so themselves.

Assume you were a true believer in Project 2025 (and not far greater authoritarianism). DOGE puts all that at risk, because by breaking so much so early, it is eliciting backlash and collapse of the economy.

The installation of useful idiots

It’s not just Elon who is making a mess. So are the other unqualified useful idiots Trump has installed — people like Pete Hegseth (who has fired three senior women officers after assuring Joni Ernst he wouldn’t target women) and Tulsi Gabbard (who parroted the same Russian propaganda she partly disavowed to get confirmed yesterday) and RFK Jr (who reneged on his promise not to cut off vaccine programs) and Kash Patel (who reneged on his promise to appoint a career FBI Agent as his Deputy).

These people are doing precisely the affirmative damage to the US that Democrats warned they would do — most obviously in RFK’s initial dismissal of the measles outbreak spreading from Texas to other states. And they’re doing it after years of parroting Russian propaganda.

The personalization of DOJ

We expected DOJ to be politicized in a second Trump term. I was even cynical enough to imagine that he would pardon all the January 6ers. The denialism about both Russia and January 6 were baked right into Project 2025.

• The Federal Bureau of Investigation, knowing that claims of collusion with Russia were false,5 collaborated with Democratic operatives to inject the story into the 2016 election through strategic media leaks, falsified Foreign Intelligence Surveillance Act (FISA) warrant applications, and lied to Congress.6
• Personnel within the FBI engaged in a campaign to convince social media companies and the media generally that the story about the contents of Hunter Biden’s laptop was the result of a Russian misinformation campaign—while the FBI had possession of the laptop the entire time and could have clarified the authenticity of the source.

[snip]

• The FBI engaged in a domestic influence operation to pressure social media companies to report more “foreign influence” than the FBI was actually seeing and stop the dissemination of and censor true information directly related to the 2020 presidential election.11

But the personalization of DOJ, along with Pam Bondi’s orders to stop chasing foreign influence operations, does something more.

It effectively makes foreign bribery — as well as the kind of kickbacks we saw in advance of Trump’s inauguration — legal.

As I noted here, the SEC, for example, has paused its suit against Justin Sun. As Judd Legum describes, this follows the Chinese-linked businessman’s multi-million “investment” in Trump’s crypto currency.

In March 2023, the SEC charged Sun and three of his companies, accusing him of marketing unregistered securities and “fraudulently manipulating the secondary market” for a crypto token. The SEC accused Sun of wash trading, which involves buying and selling a token quickly to fraudulently manufacture artificial interest.

[snip]

Sun’s purchase put millions in Trump’s pocket. WLF was entitled to “$30 million of initial net protocol revenue” in a reserve “to cover operating expenses, indemnities, and obligations.” After the reserve was met, a company owned by Trump would receive “75% of the net protocol revenues.” Sun’s purchase covered the entire reserve. As of December 1, this amounted to $18 million for Trump — 75% of the revenues of all other tokens sold at the time. Sun also joined WLF as an advisor. While the purchase benefited Trump, WLF tokens are essentially worthless for Sun, as they are non-transferable and locked indefinitely.

Nevertheless, Sun has since invested another $45 million in WLF, bringing his total investment to $75 million. This means Sun’s purchases have sent more than $50 million to Trump, Bloomberg reported. Sun has also continued to shower Trump with praise. On January 22, Sun posted on X, “if I have made any money in cryptocurrency, all credit goes to President Trump.”

Once you’ve installed lawyers who publicly represent they are Trump’s lawyers, once you’ve ensured that no one friendly to Trump will be prosecuted for bribery, then Ukraine was bound to lose any negotiation with Russia. Russia has been dangling bribes in front of Trump for years and now they’ll be free to deliver in plain sight.

And Trump has never placed his own self interest behind the interests of the United States.

The capitulation to Russia

Keep all that in mind as you consider Trump’s abject capitulation yesterday.

Keep in mind that even before yesterday’s ambush of Zelenskyy, Pete Hegseth ordered Cyber Command to stand down any targeting of Russia.

Defense Secretary Pete Hegseth last week ordered U.S. Cyber Command to stand down from all planning against Russia, including offensive digital actions, according to three people familiar with the matter.

Hegseth gave the instruction to Cyber Command chief Gen. Timothy Haugh, who then informed the organization’s outgoing director of operations, Marine Corps Maj. Gen. Ryan Heritage, of the new guidance, according to these people, who spoke on the condition of anonymity because of the matter’s sensitivity.

The order does not apply to the National Security Agency, which Haugh also leads, or its signals intelligence work targeting Russia, the sources said.

CISA, too, has taken its focus off of Russia, something that risk grave damage to private companies as well as the government.

Liesyl Franz, deputy assistant secretary for international cybersecurity at the state department, said in a speech last week before a United Nations working group on cybersecurity that the US was concerned by threats perpetrated by some states but only named China and Iran, with no mention of Russia in her remarks. Franz also did not mention the Russia-based LockBit ransomware group, which the US has previously said is the most prolific ransomware group in the world and has been called out in UN forums in the past. The treasury last year said LockBit operates on a ransomeware-as-service model, in which the group licenses its ransomware software to criminals in exchange for a portion of the paid ransoms.

In contrast to Franz’s statement, representatives for US allies in the European Union and the UK focused their remarks on the threat posed by Moscow, with the UK pointing out that Russia was using offensive and malicious cyber-attacks against Ukraine alongside its illegal invasion.

“It’s incomprehensible to give a speech about threats in cyberspace and not mention Russia and it’s delusional to think this will turn Russia and the FSB [the Russian security agency] into our friends,” said James Lewis, a veteran cyber expert formerly of the Center for Strategic and International Studies think tank in Washington. “They hate the US and are still mad about losing the cold war. Pretending otherwise won’t change this.”

The US policy change has also been established behind closed doors.

A recent memo at the Cybersecurity and Infrastructure Security Agency (Cisa) set out new priorities for the agency, which is part of the Department of Homeland Security and monitors cyber threats against US critical infrastructure. The new directive set out priorities that included China and protecting local systems. It did not mention Russia.

A person familiar with the matter who spoke to the Guardian on the condition of anonymity said analysts at the agency were verbally informed that they were not to follow or report on Russian threats, even though this had previously been a main focus for the agency.

The person said work that was being done on something “Russia-related” was in effect “nixed”.

And, again, this happened before the ambush yesterday.

Eight years ago, as Mueller’s prosecutors started to focus on Roger Stone’s possible implication in a hacking conspiracy with Russia, Trump declared that he was going to partner with Putin; Russia and the US would jointly guard things like elections.

Now, Trump has chosen to unilaterally disarm.

Yesterday, Roger Sollenberger unpacked the Gitub of one of Elon’s boys, Jordan Wick.

In addition to his AI start-up, AccelerateX (which Wired wrote about), Wick has been fiddling with:

• Tracking government employees by union status
• Downloading Xitter DMs
• Identifying open source data on submarine cables, ports, and mineral deposits

Sure, the utility of some of that — tracking union status — maps right onto the Project 2025 plans DOGE is purportedly implementing, even if that, plus the DM download, raise grave concerns about privacy.

But the submarine cables too?

Even as Donald Trump has made his fealty to Putin clear, even as his Director of National Intelligence parrots Russian disinformation (protected now by the FBI), Elon Musk has been vacuuming up all the data of all the government. And every claim that he’s been modernizing networks or searching for fraud have fallen apart.

At this point, we simply cannot rule out deliberate wholesale sabotage.

Update: Thought I’d repost what I wrote in December in response to Kimberly Strassel complaining about Trump’s useful idiot picks.

But I don’t doubt that the rat-fucker wing of Trump’s advisory team believes that Bobby and Tulsi do accomplish something. The question is whether some really smart politicos believe it’ll be a good thing to kill children and give dictators America’s secrets and let the richest men in the world destroy America’s banking system and the dollar exchange — whether they believe this will win lasting approval from America’s great disaffected masses. It might well! It certainly will expand the pool of disaffected Americans, and with it, increase the market for a strong man to respond to it all.

Or whether there’s some reason Trump is tempting Republican Senators to defy his plans to do great damage to the United States. Perhaps he intends to dare them to start defying him in bulk.

Or perhaps the rat-fucker wing of Trump’s entourage simply has an unknown reason they want to destroy America. Maybe Trump has other election debts — debts he’d get in more trouble for ignoring — that make him amenable to dropping policy bomb after policy bomb on America’s children.

But that’s sort of the point. You’ve got Kimberly Strassel up in arms because Trump is going to the mat for a conspiracist with a Democratic name who’ll get children killed. But it’s more likely to do with the policy bombs that RFK will help Trump drop than the specific conversations that led Bobby Jr to drop out of the race.

Yesterday, Judge Tanya Chutkan had a Presidents Day hearing on a lawsuit challenging DOGE’s actions. While she reportedly seemed inclined not to grant an emergency restraining order, she did order the government to provide her with two pieces of information: how many people had and were going to be fired, and what Elon Musk’s status is.

In a response and declaration, the government blew off the first question, but on the second, denied that Musk has the power of DOGE. He’s just a senior Trump advisor, one solidly within the White House Office, and so firewalled from the work of DOGE, yet still protected from any kind of nasty disclosure requirements.

But as the attached declaration of Joshua Fisher explains, Elon Musk “has no actual or formal authority to make government decisions himself”—including personnel decisions at individual agencies. Decl. ¶ 5. He is an employee of the White House Office (not USDS or the U.S. DOGE Service Temporary Organization); and he only has the ability to advise the President, or communicate the President’s directives, like other senior White House officials. Id. ¶¶ 3, 5. Moreover, Defendants are not aware of any source of legal authority granting USDS or the U.S. DOGE Service Temporary Organization the power to order personnel actions at any of the agencies listed above. Neither of the President’s Executive Orders regarding “DOGE” contemplate—much less furnish—such authority. See “Establishing and Implementing the President’s Department of Government Efficiency,” Exec. Order No. 14,158 (Jan. 20, 205); “Implementing the President’s ‘Department of Government Efficiency’ Workforce Optimization Initiative,” Exec. Order 14,210 (Feb. 11, 2025).

The statement is quite obviously an attempt to retcon the structure of DOGE [sic], one that Ryan Goodman has already found several pieces of evidence to debunk.

But it is a testament that the suit in question — by a bunch of Democratic Attorneys General, led by New Mexico [docket] — might meet significant success without the retconning of Elon’s role.

Partly for more general benefit, let me talk about the various kinds of lawsuits filed so far against Trump’s attacks.

Kinds of plaintiffs:

• Imminent, individual personal injury: The cases that have had the most success, so far, are examples of individuals who describe a specific imminent injury. The most obvious such example is a number of Trans women prisoners who’ve argued, successfully so far, that they face a very high likelihood of assault and/or rape if they are moved to male prisons.
• Unions or other representatives of federal workers: These lawsuits address the imminent injury of privacy violations or firing and other mistreatment. The most successful (and eye-popping) so far has been the American Foreign Service Association lawsuit challenging the USAID shutdown [docket], in which a Doe employee yesterday provided another horrifying declaration describing another instance of a pregnant woman being deprived of promised medevac, and another from a woman in South Africa running up debt taxpayers will have to pay and about to lose access to electricity on the compound. But there are limits to the recourse that unions can seek on both these theories. For example, while Trump appointed judge Carl Nichols imposed a temporary restraining order on actions targeted at employees oversees, he has not done so for the USAID personnel stuck without the ability to fix anything in DC, because being put on paid leave is not the same kind of injury as being stuck overseas with no access to security warnings.
• States (all with Democratic Attorneys General): The states are arguing a variety of things, both contractual breaches and injuries to their citizens. Contractual challenges may have little ability to halt ongoing destruction.
• Private entities, like corporations or associations: These entities are often arguing contractual breaches, or privacy damages. The latter are likely to have more success than the former because of the way the Privacy Act works.

Kinds of challenges:

• Many of these challenges claim a violation of the Administrative Procedures Act, basically arguing that the government changed the rules without going through the process they are required to use to change the rules.
• Many lawsuits also claim violations of the Privacy Act, which requires that the government follow certain rules if they’re accessing your data in new ways. Thus far, the government has argued that employees have more limited protections than private citizens.
• Underlying many of these suits are claims about the Impoundment Act and Separation of Powers because the government is not spending money the way Congress said it had to, but argued through an APA challenge. These challenges are particularly important because a key project of Project 2025 is to effectively strip Congress of the power of the purse.
• Some lawsuits have tried to get at cybersecurity violations or even hacking (Computer Fraud and Abuse Act) claims, but thus far with little success. In any case, those would pivot on how DOGE [sic] got access to various computer systems, and in most cases, a senior Agency official ultimately relented to give them access.
• This lawsuit, and another similar one brought by 26 anonymous USAID employees, argue that Elon Musk’s role in all this violates the Appointments Clause. This basically argues that Elon is acting as a superior officer, which requires Senate confirmation.

The injury suffered by each set of plaintiffs and legal theory largely limits the ability of judges to weigh in. So, for example, if a suit is arguing only Privacy Act violations, a judge can do no more than limit the dissemination outside of authorized channels of the data of the plaintiffs, something that has been ineffective once agencies started giving DOGE formal authorization to access computer servers. If a suit worries about firings, but the government instead puts tons of people on paid leave (as happened with USAID), then the plaintiffs are not yet suffering an irrevocable injury.

Here’s how the Appointments Clause theory, arguing that Elon is exercising powers that need to be created by Congress and confirmed by them, looks in the complaint.

64. Although he occupies a role President Trump—not Congress—created and even though the Senate has never voted to confirm him, Mr. Mr. Musk has and continues to assert the powers of an “Officer[] of the United States” under the Appointments Clause. Indeed, in many cases, he has exceeded the lawful authority of even a principal officer, or of the President himself.

65. As explained below, Mr. Musk: (1) has unprecedented and seemingly limitless access across the federal government and reports solely to President Trump, (2) has asserted significant and sweeping authority across a broad swath of federal agencies, and (3) has engaged in a constellation of powers and activities that have been historically associated with an officer of the United States, including powers over spending and disbursements, contracts, government property, regulations, and agency viability.

66. In sum, Mr. Musk purports to exercise and in fact asserts the significant authority of a principal officer on behalf of the United States. Yet, he does not occupy an office created by Congress and has not been nominated by the President or confirmed by the Senate. As a result, all of Mr. Musk’s actions are ultra vires and contrary to law.

You can see why the White House has decided that Elon is boxed away inside the White House with no direct control over the dismantling of government bureaucracy. The retconning of his role is all the more obvious when you understand that the right wing judges on SCOTUS feel very strongly about the Appointments Clause. And Trump is on the record relying on it, most spectacularly in convincing Aileen Cannon that Jack Smith had to be confirmed by the Senate before he could indict Trump.

In practice, Trump is saying Elon can dismantle entire agencies without Senate confirmation, but Jack Smith couldn’t prosecute him as a private citizen without it.

Or he was. Now he’s arguing that all this is happening without Elon’s personal direction.

There is plenty in the complaint already that debunks this, not least the narrative of how Elon started disappearing USAID even before, by his own description, Trump approved.

93. With a budget of over $40 billion, USAID accounts for more than half of all U.S. foreign assistance. USAID has missions in over 100 countries. As of January 2025, USAID had a workforce of over 10,000, with approximately two-thirds serving overseas.

94. On Saturday, February 1, 2025, a group of about eight DOGE personnel entered the USAID building and demanded access to every door and floor, despite only a few of them having the requisite security clearance.34 The areas to which they sought access included a sensitive compartmented information facility—commonly known as a SCIF—an ultra-secure room where officials and government contractors take extraordinary precautions to review highly classified information. DOGE personnel, aided by phone calls from Mr. Musk, had pressured USAID officials for days to access the secure facility and its contents.35

95. When USAID personnel attempted to block access to some areas, DOGE personnel, including Mr. Musk, threatened to call federal marshals. Under threat, the agency personnel acquiesced, and DOGE personnel were eventually given access to the secure spaces.

96. Later that day, top officials from USAID and the bulk of the staff in USAID’s Bureau for Legislative and Public Affairs were put on leave. Some of them were not notified but had their access to agency terminals suspended. USAID’s security official was also put on leave.36 97. Within hours, USAID’s website vanished. It remains inoperative.37

98. On Sunday, February 2, 2025, Mr. Musk tweeted, “USAID is a criminal organization. Time for it to die.”

38 Later, he tweeted, “We spent the weekend feeding USAID into the woodchipper.”39

99. Mr. Musk provided no support for his claim that USAID is a criminal organization. 100. On Monday, February 3, 2025, Mr. Musk stated that he was in the process of closing the agency, with President Trump’s blessing. Mr. Musk stated: “I went over it with him [President Trump] in detail, and he agreed that we should shut it down. And I actually checked with him a few times [and] said ‘are you sure?’ The answer was yes. And so we’re shutting it down.”40

Now, before DOJ gave this answer and blew off Judge Chutkan’s order to provide details of the ongoing firing spree, she seemed inclined not to grant a restraining order to stop all this.

It’s unclear whether this defiance will change that. Or, at the very least, whether it will lead to more questions about whether White House wrote any of this down.

What is clear is that the White House recognizes a real risk if Elon is held accountable for all the things Elon has done.

The other day, Pete Hegseth capitulated to Vladimir Putin, dealing away Ukraine’s future and leverage, making Neville Chamberlain look not only stronger, but better dressed, by comparison.

He tried to walk back his capitulation the next day.

Everything is on the table in his conversations with Vladimir Putin and Zelenskyy. What he decides to allow or not allow is at the purview of the leader of the free world of President Trump. So I’m not going to stand at this podium and declare what President Trump will do or won’t do, what will be in or what will be out, what concessions will be made or what concessions are not made.

Remember, in response to questions from Tammy Duckworth, Hegseth confessed he had never been part of international negotiations. In his first day and second days learning on the job, he failed every rule of negotiation.

I may return to Pete Hegseth’s predictable failures.

For now, though, I want to note all the things put in place before Trump seemingly turned on a dime, effectively demoting his Ukraine negotiator Keith Kellogg in favor of Marco Rubio, John Ratcliffe, Mike Waltz, and Steve Witkoff (who has been liaising with people like Mohammed bin Salman and — reportedly, Kirill Dmitriev from Mueller Report fame) and taking a much more pro-Russian stance in this negotiation.

Between Trump, Attorney General Pam Bondi, and DHS Secretary Kristi Noem, they have protected precisely the kind of interference and corruption with which Russia kicked off Trump’s political career ten years ago. These moves have been covered already (see this post from Casey Michel and this from Cyberscoop). But I want to look at the kinds of DOJ and CISA actions against which Trump’s team may be reacting, not least because this pivot from Trump did not happen until they were all in place.

Non-prosecution of FCPA: Start with the decision to first limit (in Bondi’s adoption) and then pause (in Trump’s adoption, in a later Executive Order) prosecution of the Foreign Corrupt Practices Act, a law that prohibits businesses with a presence in the United States from engaging in bribery. Bondi actually put this provision in a memo otherwise eliminating approval requirements for investigations and prosecutions targeting trafficking, and with regards to FCPA, simply made using FCPA against traffickers the priority.

Foreign Corrupt Practices Act. The Criminal Division’s Foreign Corrupt Practices Act Unit shall prioritize investigations related to foreign bribery that facilitates the criminal operations of Cartels and TCOs, and shift focus away from investigations and cases that do not involve such a connection. Examples of such cases include bribery of foreign officials to facilitate human smuggling and the trafficking of narcotics and firearms.

Trump, on the other had, halted its use for six months and then maybe another six months.

Most coverage of this move noted its use, under Trump, to penalize Goldman Sachs for bribing Malaysia’s 1MDB sovereign wealth fund, an investigation the aftermath of which sucked in Trump associate Elliott Broidy before Trump pardoned him. But it might be better to consider how such bribery statutes limit transnational investment companies like Trump’s own and Jared Kushner’s. That is, Trump’s intervention in FCPA might be personal to Trump.

Elimination of KleptoCapture Task Force: In the same memo, buried under a shift of focus for Money Laundering cases to traffickers and away from Trump’s buddies, Bondi also included this language about the KleptoCapture program that has been a key prong of Joe Biden and Merrick Garland’s response to the Ukraine invasion.

Money Laundering and Asset Forfeiture. The Criminal Division’s Money Laundering and Asset Recovery Section shall prioritize investigations, prosecutions, and asset forfeiture actions that target activities of Cartels and TCOs.

Task Force KleptoCapture, the Department’s Kleptocracy Team, and the Kleptocracy Asset Recovery Initiative, shall be disbanded. Attorneys assigned to those initiatives shall return to their prior posts, and resources currently devoted to those efforts shall be committed to the total elimination of Cartels and TCOs.

It’s not yet clear whether this means DOJ will start giving yachts back to the sanctioned Russian oligarchs that Biden seized them from.

But what this does imply is that the sanctioned oligarchs who had invested in property and other facilities in the US — people like Oleg Deripaska and Andrii Derkach, both of whom were identified to have ties to Russian influence operations in election years — might be free to invest in the US again.

Shift away from FARA: Buried in Section IV of a different memo innocuously titled “General policy regarding charging, plea negotiations, and sentencing,” are two paragraphs describing changes in the National Security Division’s focus.

Shifting Resources in the National Security Division. To free resources to address more pressing priorities, and end risks of further weaponization and abuses of prosecutorial discretion, the Foreign Influence Task Force shall be disbanded. Recourse to criminal charges under the Foreign Agents Registration Act (FARA) and 18 U.S.C. § 951 shall be limited to instances of alleged conduct similar to more traditional espionage by foreign government actors. With respect to FARA and § 951, the Counterintelligence and Export Control Section, including the FARA Unit, shall focus on civil enforcement, regulatory initiatives, and public guidance.

The National Security Division’s Corporate Enforcement Unit is also disbanded. Personnel assigned to the Unit shall return to their previous posts.

Let’s take them in reverse order. The FARA statement basically says that only people akin to spies will be charged criminally with it; everyone else will be subject to the same civil sanctions DOJ used before the Paul Manafort case. That of course means Manafort’s ongoing work is in the clear (a point that Ken Vogel makes in a column hilariously titled, “Moves by Trump and Bondi Raise Hopes of Those Accused of Foreign Corruption“). It also makes things far easier for Pam Bondi’s former colleagues at Ballard Partners, the most powerful foreign influence peddlers under the first and undoubtedly the second Trump term. This will save Bondi’s friends a whole lot of money in compliance worries.

But here’s the problem with this move: Most of the people DOJ has charged with criminal FARA in recent years were being handled by foreign spies. FARA, as it was used under Mueller and since, was a way to neutralize people for being in the pay of foreign spies without having to prove — or having to declassify evidence to show — that they were themselves spies. It was a way to disable spying, even or especially if people receiving foreign money didn’t know they were being handled by spies.

But Bondi just said she won’t use that tool.

Elimination of FITF: I might have written this post weeks ago, except I keep staring at Bondi’s claim that the Foreign Influence Task Force (the website for which has been taken down) led to “abuses of prosecutorial discretion.” Now, Bondi often parrots the stupidest bullshit that Jim Jordan has floated (which includes a lot of false claims made by Matt Taibbi), and this may be an example — because FITF would not lead to prosecution of a US person, as I tried to lay out in this table (which first appeared in this post).

What the FITF did was to identify attempts by foreigners to clandestinely influence Americans (not just during elections). It played a key role in funneling intelligence to the private sector, especially social media companies. While the government has charged foreigners involved in such operations (such as the Iranians who hacked Trump’s campaign), Americans would almost always be victims.

Based on that assumption, I can only imagine Bondi’s reference to “abuses of prosecutorial discretion” pertains to one of three possible prosecutions:

• The prosecution of Douglass Mackey for duping Hillary Clinton voters into “texting” their vote rather than voting in person, a prosecution that in later years might have arisen out of election protection efforts (the second row in this table) put in place in the wake of 2016.
• A warning about the Andrii Derkach influence operation in 2020, which was managed by FITF, and which led the FBI to shut down some informants sharing information on Hunter Biden. Importantly, the entire right wing believes that a FITF staffer, Laura Dehmlow, should have breached the confidentiality of a non-public investigation in 2020 and told Facebook that the hard drive shared with New York Post derived from a Hunter Biden laptop in the FBI’s possession was “real” (notwithstanding that the FBI had not, and still has not, done the most basic things to test if it was packaged up). So it’s possible that Bondi believes, like Jim Jordan does, that the outcome of the Hunter Biden investigation would have been different if they could have relied more on the laptop.
• The Tenet operation, in which the RT funded right wing propagandists Dave Rubin, Tim Pool, and Benny Johnson. The operation was exposed with an indictment of foreigners shortly before the pre-election halt to such actions, but not even Canadian Lauren Chen has been charged, much less the right wing bros. That indictment, for money laundering and FARA, might not be viable under Bondi’s new restrictions on other prosecutorial focus.

But there are a whole bunch of things you throw out with that bathwater. If the FITF is disbanded, then social media companies might not have discovered that Iran was adopting the identities of the Proud Boys to suppress turnout among people of color. There’s the ongoing Doppelganger effort to create counterfeit versions of real US and European media outlets to spread disinformation — such as an attack on USAID that Elon Musk spread just days ago.

Or there’s the multiple influence operations that Jack Posobiec has been party to, starting with PizzaGate (the weaponization of the Podesta emails stolen by the GRU), the GRU MacronLeaks operation, as well as a more recent FSB campaign. Posobiec’s centrality to all this — as well as his involvement in other kinds of rat-fucking — is particularly pertinent because Pete Hegseth at least invited Jack Posobiec to travel with him to the Munich Security Conference where he sold Ukraine out.

Trump administration officials at the Pentagon invited a far-right activist, Jack Posobiec, to participate in Defense Secretary Pete Hegseth’s first trip overseas, according to a planning document obtained by The Washington Post and people familiar with the decision, triggering alarm among U.S. defense officials worried about the military being dragged into partisan warfare.

Posobiec was in Ukraine yesterday — it’s not yet clear whether he traveled to Europe with the Defense Secretary.

The most charitable explanation for Bondi’s decision to shut down FITF is that she’s suffering from delusions that Jim Jordan passed on. But if she really understands what this program did, then she has deliberately chosen to make it easier for hostile countries, especially Russia, China, and Iran, to affect US elections.

Administrative Leave of CISA Election Security Staff: Which brings me to the most recent effort to help foreign adversaries, something done by Kristi Noem, not Pam Bondi. On Monday, 17 of the people who were involved in keeping the 2024 election secure were put on leave, citing a focus on election disinformation.

In recent days, 17 employees of the U.S. Cybersecurity and Infrastructure Security Agency who have worked with election officials to provide assessments and trainings dealing with a range of threats — from cyber and ransomware attacks to physical security of election workers — have been placed on leave pending a review, according to a person familiar with the situation who was not authorized to speak publicly.

Ten of those employees are regional election security specialists hired as part of an effort to expand field staff and election security expertise ahead of the 2024 election. The regional staffers were told the internal review would examine efforts to combat attempts by foreign governments to influence U.S. elections, duties that were assigned to other agency staff, according to the person.

All were former state or local election officials who were brought in to build relationships across all 50 states and the nation’s more than 8,000 local election jurisdictions. They spent the past year meeting with election officials, attending conferences and trainings, and ensuring officials were aware of the agency’s various cybersecurity and physical security services.

[snip]

The other staffers placed on leave are current or former members of the agency’s Election Security and Resilience team, who were told the review was looking into agency efforts to combat misinformation and disinformation campaigns, according to the person familiar with the situation. The 10 election security specialists who worked with state and local election officials reported to a different team at CISA, the field operations division.

Now, the rationale offered for this decision is a review of CISA’s involvement in warnings about mis- and disinformation. As noted above, that’s not what CISA does. To the extent it shares information with social media companies, it is to provide correct information to make it easier for people to get quality information on voting.

But consider something that these 17 people might have been involved in: the effort, in real time, to respond to bomb threats called into electoral precincts in Democratic areas, many of which were sourced to Russian email domains. (Remember that Ohio Governor Mike DeWine attributed the bomb threats in Springfield — threats ginned up with the significant involvement of Jack Posobiec — to overseas actors.)

We still don’t know whether the bomb threats targeting Springfield and voting locations actually were Russian operations or whether they were funneled through Russia by American actors to obscure their origin. We still don’t have a report from the FBI explaining what happened.

And with the decision to shut down both the FITF and to pause CISA’s election protection work, we may never get it now. We may never learn whether Democratic precincts had to shut down due to Russian involvement or that of people laundering their work through Russia.

In the wake of Trump’s victory, key Putin advisor Nikolai Patrushev claimed that, to win, Trump “relied on certain forces to which he has corresponding obligations.”

In his future policies, including those on the Russian track US President-elect Donald Trump will rely on the commitments to the forces that brought him to power, rather than on election pledges, Russian presidential aide Nikolay Patrushev told the daily Kommersant in an interview.

“The election campaign is over,” Patrushev noted. “To achieve success in the election, Donald Trump relied on certain forces to which he has corresponding obligations. As a responsible person, he will be obliged to fulfill them.”

He agreed that Trump, when he was still a candidate, “made many statements critical of the destructive foreign and domestic policies pursued by the current administration.”

“But very often election pledges in the United States can iverge from subsequent actions,” he recalled.

When he gave that ominous warning, I concluded that Trump would soon sell out Ukraine and the rest of Europe. But that didn’t happen right away. Rather, for months, Trump feigned a hardline stance against Russia, all while teasing the number of calls he was having with Putin.

Until this week.

Trump didn’t move to “fulfill” the “corresponding obligations” he made to get help in the election, if indeed he did get help, until Pam Bondi instructed DOJ not to look for such things.

According to the currently operative story, Marko Elez — the DOGE [sic] boy who had source code for Treasury’s payments system — resigned in response to a query from WSJ reporter Katherine Long about his social media posts in support of

A key DOGE staff member who gained access to the Treasury Department’s central-payments system resigned Thursday after he was linked to a deleted social-media account that advocated racism and eugenics.

Marko Elez, a 25-year-old who is part of a cadre of Elon Musk lieutenants deployed by the Department of Government Efficiency to scrutinize federal spending, resigned after The Wall Street Journal asked the White House about his connection to the account.

“Just for the record, I was racist before it was cool,” the account posted in July, according to the Journal’s review of archived posts.

“You could not pay me to marry outside of my ethnicity,” the account wrote on X in September. “Normalize Indian hate,” the account wrote the same month, in reference to a post noting the prevalence of people from India in Silicon Valley.

After the Journal inquired about the account, White House spokesperson Karoline Leavitt said that Elez had resigned from his role.

But that belief is only based on correlation, not any proof of causation. Long asked about posts that are in no way exceptional for the far right boys Elon has infiltrated into the government. And Elez resigned that same day.

Sure, Elon implied that Elez quit because the boy’s far right ideology was exposed — he led a campaign for his reinstatement. That campaign — and JD Vance’s support for it — similarly led a lot of people to believe that Elez had been reinstalled at Treasury. But multiple court filings claim that Elez resigned and never came back, at least not to Treasury.

In fact, there are two things that might provide better explanations than the discovery that like Elon himself, Elez is a racist.

As WSJ itself notes, Elez resigned the same day that Colleen Kollar-Kotelly ordered that Elez, then still identified as a Special Government Employee, be granted only read-only access to Treasury’s networks. Once Elez no longer worked for the defendants in that case — starting with Scott Bessent — then any access he had would be exempted from the order.

More importantly, as a court filing submitted yesterday reveals, Elez’ resignation happened the same day that Treasury discovered Elez’s Bureau laptop, “had mistakenly been configured with read/write permissions instead of read-only.” The filing is a declaration from Joseph Gioeli, who has been employed as the “Deputy Commissioner for Transformation and Modernization in the Bureau of the Fiscal Service” since 2023 and is a civil servant first hired in the first year of Trump’s first term.

His declaration describes how the 4-6 week “payment process engagement plan” initiated (per Thomas Krause) on January 26 required giving Elez risky access to payment systems. Gioeli describes how they tried to mitigate those risks.

11. The scope of work as envisioned in the engagement plan required access to Fiscal Service source code, applications, and databases across all these Fiscal Service payment and accounting systems and their hosting environments. This broad access presented risks, which included potential operational disruptions to Fiscal Service’s payment systems, access to sensitive data elements, insider threat risk, and other risks that are inherent to any user access to sensitive IT systems. In light of these risks, BFS and Treasury Departmental Office employees developed mitigation strategies that sought to reduce these risks.

12. These measures included the requirement that Mr. Elez be provided with a BFS laptop, which would be his only method of connecting to the Treasury payments systems, both in connecting with the source code repository and for his read-only access of the systems. He had previously been provided a Treasury laptop from the Department shortly after he onboarded, but due to Bureau security policy, that device was restricted from accessing the BFS systems and services he had requested. BFS used several cybersecurity tools to monitor Mr. Elez’s usage of his BFS laptop at all times and continuously log his activity. Additionally, the Bureau enabled enhanced monitoring on his laptop, which included the ability to monitor and block website access, block the use of external peripherals (such as USB drives or mass storage devices), monitor any scripts or commands executed on the device, and block access to cloud-based storage services. Additionally, the device contained data exfiltration detection, which alerts the Bureau to attempts to transmit sensitive data types. The laptop is also encrypted in accordance with Bureau policy, which, if the laptop were stolen or lost, would prevent unauthorized users from accessing data contained within the laptop.

13. Additional mitigation measures that were adopted included that Mr. Elez would receive “read-only” access to the systems, and that any reviews conducted using the “read-only” access would occur during low-utilization time periods, to minimize the possibility of operational disruptions. While providing a single individual with access to multiple systems and data records accessed here was broader in scope than what has occurred in the past, this read-only approach is similar to the kind of limited access the Bureau has provided to auditors for other Treasury non-payment systems, though even in those scenarios the availability of production data was significantly limited. [my emphasis]

Gioeli goes on to describe how, starting on February January 28, the Bureau gave Elez source code in a sandbox environment.

16. On January 28, 2025, the Bureau provided Mr. Elez with the Bureau laptop and with copies of the source code for PAM, SPS, and ASAP in a separate, secure coding environment known as a “secure code repository” or “sandbox.” Mr. Elez could review and make changes locally to copies of the source code in the cordoned-off code repository; however, he did not have the authority or capability to publish any code changes to the production system or underlying test environments. This repository was separate from Fiscal Service’s typical code development environment, and unlike the usual code development environment, this new repository was segmented, to ensure that no changes to the operative source code could be made. [my emphasis]

Then, six days after giving him that sandbox access, using the same laptop, they gave him read-only access to first two and then one more systems.

17. On February 3, 2025, consistent with the engagement plan and mitigation measures developed, Mr. Elez was provided with read-only access, through his Bureau laptop, to the certain BFS systems. The read-only access that Mr. Elez was provided gives the user the ability to view and query information and data but does not allow for any changes to that information and data within its source system. While this reduces risk, it does not fully eliminate the risks identified in the assessment (for example, the risk of overburdening the system with a complex read-only query). Specifically, Mr. Elez was provided read-only access to the Payment Automation Manager (PAM) Database, Payment Automation Manager (PAM) File System, and, subsequently on February 5, the Secure Payment System (SPS) Database.

After he got that access, per a review of the logs, Elez copied some files from the active database onto his Bureau laptop, on which he had the source code.

18. ISS configured his network access and assisted him in setting up the necessary tools to connect to the PAM database on February 3. His access was closely monitored by multiple BFS administrators throughout the process on February 3. That same day, he received a “walk-through” demonstration of two BFS payment systems, the PAM database and the PAM file system (the system that controls the payment file “landing zone” discussed above), to see how the systems worked. He logged in with his read-only access to these systems on February 3 during this “walk-through” demonstration. The Bureau is in the process of reviewing the logs of Mr. Elez’s activity on his Bureau laptop, and this review remains ongoing. Based on the preliminary log reviews conducted to date, it appears that on February 3, Mr. Elez copied two USAID files directly from the PAM database to his BFS laptop; on February 4 and 5, Mr. Elez accessed the PAM file system; and on February 5, Mr. Elez accessed the PAM payment processing database. These activities are consistent with the read-only access that Mr. Elez was provided and did not change or alter any BFS payment system or record within their source systems. As noted, reviews of Mr. Elez’s work are still actively occurring; I do not have any more detail to provide at this time about his activities with respect to PAM. [my emphasis]

Then, on February 5, Elez got access to the payment system itself — again, with the same laptop on which he had source code.

19. Due to scheduling constraints, Mr. Elez was unable to meet with Bureau personnel to set up his access to the SPS database until February 5. On that date, lSS held a virtual walk-through session to help him to connect to the SPS database. He accessed this database exclusively under the supervision of Bureau database administrators in a virtual walkthrough session. According to the preliminary review of logs the Bureau has conducted to date, it appears Mr. Elez accessed the SPS database only once during that walk-through demonstration on February 5. It does not appear that he accessed the database again. As part of the ongoing review, additional log reviews are currently underway to confirm this. Mr. Elez never logged into ASAP, CARS, or ITS.gov, as technical access to those systems was never established for him. [my emphasis]

The next day, “it was discovered” (Gioeli does not say by whom, which means we’re not seeing a declaration from that person) that Elez actually “had mistakenly been configured” with read/write access, rather than “read only.”

20. On the morning of February 6, it was discovered that Mr. Elez’s database access to SPS on February 5 had mistakenly been configured with read/write permissions instead of read-only. A forensic investigation was immediately initiated by database administrators to review all activities performed on that server and database. The initial investigation confirmed that all of Mr. Elez’s interactions with the SPS system occurred within the supervised, walk-through session and that no unauthorized actions had taken place. His access was promptly corrected to read-only, and he did not log into the system again after his initial virtual over-the-shoulder session on February 5. To the best of our knowledge, Mr. Elez never knew of the fact that he briefly had read/write permissions for the SPS database, and never took any action to exercise the “write” privileges in order to modify anything within the SPS database—indeed, he never logged in during the time that he had read/write privileges, other than during the virtual walk-through – and forensic analysis is currently underway to confirm this. [my emphasis]

Throughout his declaration, Gioeli stresses that they’re still investigating whether Elez did something unauthorized with his access.

21. As noted above, the Bureau used several cybersecurity tools to monitor Mr. Elez’s usage and continuously log his activity. While forensic analysis is still ongoing, Bureau personnel have conducted preliminary reviews of logs of his activity both on his laptop and within the systems and at this time have found no indication of any unauthorized use, of any use outside the scope that was directed by Treasury leadership, or that Mr. Elez used his BFS laptop to share any BFS payment systems data outside the U.S. Government.

And his declaration stops short of saying that some mitigation techniques were used. For example, Gioeli says that the enhanced monitoring on Elez’ Bureau laptop had the ability to “block the use of external peripherals (such as USB drives or mass storage devices)” and access to the cloud, but it doesn’t say whether those functionalities was used.

Plus, Gioeli’s declaration makes it clear that they have’t involved Elez in any review of his access. No one has asked Elez, for example, whether he knew he had write access to the payment system.

Similarly, in an earlier declaration submitted in the parallel DC case, Thomas Krause gave a very couched answer about whether Elez had has any ongoing access.

I currently have no reason to believe Mr. Elez retains access to any BFS payment data, source code, or systems.”

Did anyone think to ask the guy? Does anyone know where that guy is? Are you going to interview him? Or is someone deliberately trying to keep him from being questioned further?

Worse still, Thomas Krause declaration submitted in the NY case doesn’t even say that Elez has left Treasury — only that he has resigned from the role of, “working closely with engineers at the Bureau of the Fiscal Service (BFS) on information technology (IT) matters in service of BFS’s mission to promote financial integrity and operational efficiency of the federal government through accounting, financing, collection, payment, and other relevant BFS services.”

On February 6, 2025, Mr. Elez submitted his resignation from this role. On that same day, he turned in his Treasury laptop, BFS laptop, access card, and other government devices; his BFS systems access was terminated; and he has not conducted any work related to the BFS payment systems since that date.

Elez was made a Treasury employee — contrary to early reports, he was not a SGE. That may make it easier to shuffle him off somewhere else.

What Gioeli describes is the panic that ensues when a guy who had high level access quits unexpectedly. And to date, we’ve never been given a formal explanation of why he quit — or whether he was asked to do so. We certainly can’t reconcile the claims that he has been reinstated with claims that he’s not doing what he was doing at Treasury.

Everyone has always assumed that Elez quit because his racism was discovered. But given the timeline, we can’t rule out that he quit because of the access concerns (and ongoing investigation) at Treasury.

Timeline

January 21: Elez hired.

January 23: Krause hired.

January 26: Treasury focuses on USAD. Treasury also adopts a 4-6 week engagement plan.

January 28: Bureau provides Elez with Bureau laptop copies of the source code for PAM, SPS, and ASAP in sandbox.

January 31: Treasury focuses on TAS codes; Elez assists in “automating” manual review of payments. “A high-ranking career official at Treasury also raised the issue of risks from DOGE access in a memo to Treasury Secretary Scott Bessent.”

February 3: Treasury gives Elez access to PAM. Booz threat contractor delivers report warning of grave insider threat.

February 5: Treasury gives Elez access to SPS, the payment system.

February 6 (afternoon): Elez resignation.

February 7: Treasury flags but then approves four payments. WaPo publishes story about Booz report and Booz contractor is fired.

February 8: Paul Engelmeyer limits Krause’s access.

February 10: Millenium Challenge Corporation submits, but then requests not to process, a payment.

Documents

Opposition to Stay

Thomas Krause Declaration: Describing the plan to use technology to provide more oversight over payments (citing three Biden-era GAO reports, not anything DOGE has discovered).

Vona Robinson Declaration: Describing that the only payment that has been intercepted at Treasury was a payment to the Millenium Challenge Corporation.

Michael Wenzler Declaration: Describing the hiring, employment status, revisions thereof, of Thomas Krause and Marko Elez, and also confirming Elez’ resignation from Treasury.

Joseph Gioeli Declaration: Describing the circumstances of Elez’ access and the investigation into what he did with it.

For some time, we’ve all been assuming that Trump will defy court orders reining in his assault on the government. And then, in the wake of Judge Paul Engelmayer’s order enjoining Scott Bessent from altering Treasury’s payment system before Friday, JD Vance ran his mouth, convincing everyone that that moment is already here.

Overnight, filings in at least two of the lawsuits against Trump’s attacks suggests that Trump is, at least for now, complying.

• In the Rhode Island case in which states enjoined OMB from withholding government grants the government filed a response describing, among other things, how they’ve worked to ensure payments to Oregon continue.
• In the New York lawsuit, also brought by states, DOJ asked for clarification of the scope of Engelmeyer’s order and opposed the breadth of it (noting, that there were contractors who did work on the system and also listing some senior Treasury officials, political appointees, who needed access). With that, Thomas Krause submitted a declaration saying he’s the only Special Government Employee who currently has permission to access the system (meaning they’re also complying with Colleen Kollar-Kotelly’s order in DC), but also revealing that Marko Elez — the DOGE boy who was included in Kollar-Kotelly’s order — has not returned to Treasury. Krause even notes (as I did) that the order to destroy what Elez has done likely conflicts with the order Kollar-Kotelly issued.

DOJ is pushing at the terms of the orders limiting government actions. But it at least claims it is complying.

There is other conflicting evidence about implementation. I have also seen reports that USAID people stationed overseas were having their access to communications systems restored, in compliance with Carl Nicoles’ order. But WaPo reports that the Administration continues to process resignations in potential defiance of George O’Toole’s order halting the Fork in the Road program.

I don’t doubt that at some point Trump will defy the courts. But for a number of reasons, I suspect they won’t outright defy judges yet.

One main reason is obvious: Trump and Russ Vought want John Roberts to grant him the authority to — basically — neutralize Congress’ power of the purse. To do that, he needs a clean appellate record. So he has to go through the process of engaging in good faith (even while arguing, as he did in his response to the Engelmeyer order, for a maximal theory of Executive power).

Another reason likely has to do with Pam Bondi. She has her own malign goals for DOJ, such as a likely assault on medical abortion pills, both between and within states. Plus, she is pursuing Trump’s attacks on sanctuary states.

But to use DOJ for these policy purposes, there has to be a DOJ, with attorneys more competent and experienced in Federal litigation than Ed Martin, the Acting US Attorney in DC. With the possible exception of the birthright citizenship defense, DOJ has real AUSAs fighting these cases, AUSAs who are going to be unwilling to risk their bar license on frivolous legal arguments or lies.

Finally, I think DOJ is in a risky situation in its confrontation with attorneys and FBI personnel. Ben Wittes noted recently, the Administration needs the FBI, in ways it doesn’t need USAID personnel, at least not in the same potentially catastrophically visible way they need the FBI.

The FBI rank and file have power in this equation that other agencies, such as USAID, for example, do not have. The Trump administration does not need USAID. It wants to eliminate foreign aid anyway, so if the personnel at the aid agency get uppity, who cares? And if they quit? All the better.

The FBI is not that simple. For one thing, the administration does need law enforcement. If there’s a terrorist attack, and there will be, and the FBI is not in a position to prevent it or investigate it quickly and effectively, the administration will take the blame.

This administration also draws its legitimacy from backing the blue. Even in their war on the intelligence community, Donald Trump and his people always tried to distinguish between the rank and file and the “bad apples” who were running things. Waging a full-scale war against the nation’s premier law enforcement agency, a war that is all about targeting street agents for having done their jobs, is a dangerous game—far different from sacking an FBI director, or even two, who went to some elite law schools and served at the upper levels of the Justice Department.

Then there’s the problem of capacity. FBI agents are actually very hard to replace—good ones are, anyway. The physical demands are significant. Most have specialized education of one sort or another. And while people often imagine FBI agents as glorified cops who kick doors down, the truth is that a lot of agents have exquisitely specialized expertise. The training of a good counterintelligence agent takes many years. Some agents have specialized scientific training. There are even agents who specialize in art theft. Take out a thousand FBI personnel for political reasons, and you destroy literally centuries of institutional capacity. A good FBI agent is much harder to create than, say, a good assistant U.S. attorney.

The confrontation with FBI has allowed accidental hero, Brian Driscoll (who is only serving as Acting Director as opposed to Acting Deputy Director because the White House made an error), has played this well, including by raising his own profile and the successes of the FBI.

That hasn’t stopped DOJ from demanding loyalty pledges, in the form of treating the mob that violently attacked cops and the Capitol as more patriotic than the cops themselves or the Members of Congress who did their duty — effectively (though WaPo doesn’t make this clear) forcing FBI agents to disavow treating a violent attack as a crime. But that, in turn, risks real backlash.

To be sure, there’s a lot of garbage that’s being dealt here. DOJ told Colleen Kollar-Kotelly that DOGE at that point only had read-only access to Treasury data (which Anna Bower recognized as an attempt to parse). But a footnote in the overnight filing in New York confesses that’s false.

Since January 20, 2025, one other Treasury employee—Marco Elez—had “read only” access to or copies of certain data in BFS payment systems, subject to restrictions, and access to a copy of certain BFS payments systems’ source code in a “sandbox” environment. Krause Decl. ¶ 11. Mr. Elez resigned on February 6, 2025 and returned all Treasury and BFS equipment and credentials the same day. Id.

That footnote cites Krause’s declaration. But the bit about the sandbox copy is not in the cited paragraph.

Since January 20, 2025, one other Treasury non-career employee—Marko Elez—had access to BFS payment systems and payment data covered by the order. Mr. Elez resigned on February 6, 2025, and returned all Treasury and BFS equipment and credentials the same day. Treasury staff have quarantined and disabled access to all devices and accounts used by this individual, which can now only be accessed by civil servants with a need for access to perform their job duties within the BFS who have passed all background checks and security clearances and taken all information security training called for in federal statutes and Treasury Department regulations. Further, based on technical controls in place, BFS oversight of Mr. Elez’s work, instructions provided to Mr. Elez regarding proper data handling, and subsequent technical review of his activities, I currently have no reason to believe Mr. Elez retains access to any BFS payment data, source code, or systems. I am concerned that deleting the contents of these accounts and devices would violate Treasury’s document preservation duties in connection with related litigation entitled Alliance for Retired Americans, et al. v. Bessent, et al., Civil Action No. 25-0313 (CKK) (D.D.C.).

Similarly, an OPM suit may well prove that DOJ has misrepresented other claims to courts. And as the FBI lawsuits hung overnight, DOJ forced Driscoll to provide names of all the FBI Agents who worked on January 6 cases.

But these discrepancies may well be useful. At the very least, it provides cause for the AGs to insist that Krause appear before Judge Jeannette Vargas, the judge assigned to the case (who ordered the parties to try to clarify Saturday’s order) to explain what Elez was doing with his sandbox and why anyone should believe he hasn’t been rehired, somewhere, to play in his sandbox some more. That, in turn, would support the very cybersecurity arguments that various lawyers are trying to make. And it’ll advance the reporting already going on.

JD Vance might well like to simply ignore Engelmeyer’s order. Mike Davis might want Trump to appeal this immediately to SCOTUS. Trump might want to start siccing his mob on judges.

But there are good reasons to believe that that won’t happen, yet — at least not until Trump gets a few more of his national security and DOJ nominees through the Senate.

And until then, this legal process is a tool — a tool that can be used to buy time, but also a tool to use to hem in Trump’s mob.

Update: In RI, John McConnell issued what is likely the first, “no really, you have to follow my orders” order.

Update: DOJ has appealed McConnell’s order, even though it is not ripe.

Meanwhile DOJ has filed really long filings in DC in an attempt to persuade Carl Nichols to reverse his TRO in the USAID example, basically slandering unnamed professionals left and right. Things do look more dire, because Trump is basically refusing to fund blue states until SCOTUS tells him to–and maybe even not then. Meanwhile, Senate Republicans have simply capitulated to Trump’s insane nominees.

Update: Above I noted that DOJ needs career AUSAs to make these arguments, at least for a while.

Well, in the USAID case, those career AUSAs just had to cop to two, um, errors. The bigger one was the central dispute at the hearing last week: Whether USAID had only frozen prospective contracts, or all of them

Additionally, although Secretary Rubio’s January 24, 2025 directive only froze future contract obligations, id. ¶ 3, payments on existing contracts were paused as well as part of efforts by agency leadership to regain control of the organization’s spending and conduct a comprehensive review of its programs. See id. ¶¶ 5–10. Counsel for Defendants was unaware of this development prior to the hearing. [my emphasis]

This implies that Peter Marocco froze existing contracts without the authority of Marco Rubio. And he’s accusing USAID personnel of being insubordinate.

The big news overnight in the legal fight to rein in DOGE is that SDNY Judge Paul Engelmayer has ordered Treasury to stop letting Elon Musk’s DOGE [sic] boys to snoop in Treasury’s payment system and destroy any copies of records already made from it. [docket]

the defendants are (i) restrained from granting access to any Treasury Department payment record, payment systems, or any other data systems maintained by the Treasury Department containing personally identifiable information and/or confidential financial information of payees, other than to civil servants with a need for access to perform their job duties within the Bureau of Fiscal Services who have passed all background checks and security clearances and taken all information security training called for in federal statutes and Treasury Department regulations; (ii) restrained from granting access to all political appointees, special government employees, and government employees detailed from an agency outside the Treasury Department, to any Treasury Department payment record, payment systems, or any other data systems maintained by the Treasury Department containing personally identifiable information and/or confidential financial information of payees; and (iii) ordered to direct any person prohibited above from having access to such information, records and systems but who has had access to such information, records, and systems since January 20, 2025, to immediately destroy any and all copies of material downloaded from the Treasury Department’s records and systems, if any;

This order comes on top of Judge Colleen Kollar-Kotelly’s order limiting access to Treasury’s payment system to normal employees and two DOGE [sic] employees, but the latter for read-only access [docket]:

Mr. Tom Krause, a Special Government Employee in the Department of the Treasury, as needed for the performance of his duties, provided that such access to payment records will be “read only”;

Mr. Marko Elez, a Special Government Employee in the Department of the Treasury, as needed for the performance of his duties, provided that such access to payment records will be “read only”;

Anna Bower parsed how DOJ substantiated (or not) that this was really “read only” access. Which was part of what a bunch of Democratic Attorneys General, led by Tish James, pointed to to claim they still needed a TRO, over and above the one issued by Kollar-Kotelly.

The temporary restraining order entered yesterday by the D.C. District Court in Alliance for Retired Americans v. Bessent, No. 1:25-cv-313 (D.D.C.) (“ARA”), does not change this conclusion. That order continues to permit two SGEs affiliated with DOGE to have access to the BFS payment records and payment systems, restricts their access to “read only” just for payment records and not payment systems, and does not direct that any copies of data from the systems made since the Agency Action took effect be destroyed. ARA, Dkt No. 13.

Now, I’m somewhat skeptical that Engelmeyer’s order, as issued, is sustainable. He issued the order in advance of the assigned judge on the case, Jeannette Vargas, and before the government had a chance to respond to the lawsuit.

But the lawsuits to enjoin DOGE [sic] are playing catch-up to the known facts.

And the known facts get us much closer to the being able to prove that Elon and his DOGE [sic] boys are altering code, if not hacking it, rather than simply reviewing its data.

The suit and TRO before Judge Kollar-Kotelly, filed by several unions, is entirely privacy focused.

The state AGs’ suit and TRO, which establish standing by pointing to the billions of dollars of payments they get from the Feds, argues that Elon is attempting to intercept payments to entities Trump doesn’t like. It asserts a claim repeatedly backed in public reporting, but affirmatively denied before Kollar-Kotelly: that the DOGE boys — here, self-proclaimed eugenicist Mark Elez, have altered code.

5. As of February 2, 2025, the President and Treasury Secretary, directed Treasury to grant expanded access to BFS payment systems to political appointees and “special government employees” for reasons that have yet to be provided, although one apparent purpose, upon information and belief. Upon information and belief, one purpose is to allow DOGE to advance a stated goal to block federal funds from reaching beneficiaries who do not align with the President’s political agenda. For example, DOGE was tasked with freezing payments issued by the U.S. Agency for International Development (“USAID”) and sought access to BFS payment systems to accomplish that goal.5 Virtually unfettered access to BFS payment systems was granted to at least one 25-year-old DOGE associate, Mark Elez, who, on information and belief, had the authority to view or modify numerous critical files.6 Indeed, reports indicate that Elez had administrative privileges over the BFS payment system’s code, giving him the ability to alter user permissions and “read and write” code—even if the associate had “read-only” access to the system’s data.7 Elez has since resigned from DOGE after being linked to racist social media posts.8

6. Around the same time that DOGE associates were unlawfully granted access to BFS systems, Mr. Musk began publicly stating his intention to recklessly freeze streams of federal funding without warning. On February 2, 2024, Mr. Musk posted on X (formerly Twitter), an online social media platform, that DOGE is “rapidly shutting down” various “illegal payments” made by the government to grant recipients, including payments to Lutheran Family Services to provide services to migrant children.9 That same day, Mr. Musk posted that his team “spent the weekend feeding USAID into the wood chipper.” Since then, Mr. Musk has unambiguously called for the cancellation of various streams of federal funding. For instance, on February 6, 2025, he alleged: “Billions of taxpayer dollars to known FRAUDULENT entities are STILL being APPROVED by Treasury. This needs to STOP NOW!”10 Mr. Musk has also made wild, unsubstantiated claims about the BFS payment system and suggested putting it on the blockchain.11

6 A 25-Year-Old With Elon Musk Ties Has Direct Access to the Federal Payment System | WIRED

7 https://www.wired.com/story/elon-musk-associate-bfs-federal-payment-system/

8 DOGE Staffer Resigns Over Racist Posts

9 Elon Musk on X: “The @DOGE team is rapidly shutting down these illegal payments” / X

10 Elon Musk on X: “Billions of taxpayer dollars to known FRAUDULENT entities are STILL being APPROVED by Treasury. This needs to STOP NOW!” / X

11 Fatima Hussein, “Elon Musk’s task force has gained access to sensitive Treasury payment systems, sources say,” PBS News, Feb. 2, 2025, https://www.pbs.org/newshour/politics/elon-musks-task-force-hasgained-access-to-sensitive-treasury-payment-systems-sources-say; Billy Bambrough, “‘This Needs To Stop Now’—Elon Musk Confirms Radical Doge U.S. Treasury Plan,” Forbes, Feb. 2, 2025, https://www.forbes.com/sites/digital-assets/2025/02/02/this-needs-to-stop-now-elon-musk-confirmsradical-doge-us-treasury-plan/.

It cites Elon’s insane rants on Xitter as well.

In addition to the privacy concerns addressed in the union lawsuit, the AGs’ lawsuit raises concerns about appropriations (and separation of powers), but also cybersecurity, something not included in the union lawsuit.

139. The conduct of DOGE members presents a unique security risk to States and State residents whose data is held by BFS, given that DOGE employees have already reportedly set up an unauthorized commercial server at another federal agency without a privacy impact assessment as required by the 2002 E-Government Act. Access by DOGE employees to BFS is likely to present even greater risks to the security and privacy of States’ and their residents’ data.

140. Unsecure data is susceptible to cyber attacks and identity theft. Identity theft has a significant impact on States, beyond the financial well-being of its residents. It strains law enforcement resources, damages state economies through lost productivity and consumer confidence, and raises costs for the state to redress fraudulent claims made from stolen identities for unemployment and healthcare benefits. [my emphasis]

The AGs’ suit actually doesn’t cite a source for the claim that DOGE set up a commercial server at another agency. But I think the claim comes from a lawsuit Kel McClanahan filed against Office of Personnel Management, aiming to require it to stop the all-government email DOGE [sic] set up to offer its “Fork in the Road” severance offer. McClanahan first sued, with two plaintiffs who worked at government agencies, on January 27, for a violation of the E-Government Act. [docket]

In response, the government claimed that the main theory of injury, that the government had set up the all-government email without first doing a privacy assessment didn’t apply for employees, and was moot because it had since done one, which it included here. The privacy assessment claimed this was just a Office365 account.

1.3. Has a system security plan been completed for the information system(s) supporting the project? The Office 365 mailbox has been granted an Authorization to Operate (ATO) that includes a system security plan. The government computer storing the data is subject to standard security requirements, including limited PIV access.

And it claimed that the account included only employee data.

2.1. Identify the information the project collects, uses, disseminates, or maintains. GWES collects, maintains, and uses the names and government email addresses of federal government employees. GWES also collects and redistributes responses to emails sent to those addresses, which are limited to short, voluntary, non-identifying information. Specifically, GWES contains the following:

• Employee Contact Data: GWES collects, maintains, and uses the names and government email addresses of federal government employees. Other identifying information is not used.
• Employee Response Data: After an email is sent using Employee Contact Data, GWES collects, maintains, and redistributes short, voluntary responses.

It largely ignored McClenahan’s claim (based largely on Reddit posts) that DOGE had installed a separate server.

But other than speculation on social media, Plaintiffs provide no evidence that OPM took any of the actions that would trigger the PIA requirement under sections 208(b)(1)(A)(i)-(ii) of the E-Government Act. Moreover, Plaintiffs disregard entirely the fact that the E-Government Act does not require a PIA when an agency is seeking to collect information about “agencies, instrumentalities, or employees of the Federal Government.”

Since then, McClanahan filed an amended complaint, which added five more plaintiffs, none of whom are Executive Branch employees (for example, one works for the Library of Congress; another is a contractor), substantiating that some of the DOGE emails went to people outside the Executive Branch, and provided additional substantiation of the Reddit claims (including raising questions about whether this could even be Microsoft365).

30. Furthermore, prior to 20 January 2025, OPM lacked the technical capacity to send direct communications to all Executive Branch employees: But just days before President Donald Trump’s inauguration, OPM did not have the capability to send a mass email of that scale, according to a person familiar with the matter. To send mass emails, the agency had used govDelivery, a cloud communications service provided by public sector IT company Granicus, a different person familiar said. The govDelivery contract had restrictions on the volume of emails available to send without incurring added costs, and the agency would not have been able to reach 2.3 million people, the approximate number of all civilian federal employees, the second person added. David DiMolfetta, OPM’s new email system sparks questions about cyber compliance Nextgov/FCW (Jan. 28, 2025), available at https://www.nextgov.com/digitalgovernment/2025/01/opms-new-email-system-sparks-questions-about-cybercompliance/402555/ (last accessed Feb. 3, 2025).

31. Additionally, OPM has used Microsoft Office 365 since at least 2021, including Outlook 365 for email. OPM, Privacy Impact Assessment for OPM – Microsoft Office 365 (May 13, 2021), available at https://www.opm.gov/information-management/privacy-policy/privacypolicy/office-365-pia.pdf (last accessed Feb. 3, 2025). Outlook 365 cannot send more than ten thousand emails per day. See Microsoft, Exchange Online limits (Dec. 11, 2024), at https://learn.microsoft.com/en-us/office365/servicedescriptions/exchange-online-servicedescription/exchange-online-limits#sending-limits-1 (last accessed Feb. 3, 2025).

32. According to the FedNews Message, “Instead [of using the normal channels], an on-prem (on-site) email server was setup [sic]. Someone literally walked into our building and plugged in an email server to our network to make it appear that emails were coming from OPM. It’s been the one sending those various ‘test’ message[s] [discussed below].” FedNews Message.

33. This statement is supported by recent reporting:

A new server being used to control these [OPM] databases has been placed in a conference room that Musk’s team is using as their command center, according to an OPM staffer. The staffer described the server as a piece of commercial hardware they believed was not obtained through the proper federal procurement process.

Caleb Ecarma & Judd Legum, Musk associates given unfettered access to private data of government employees Musk Watch (Feb. 3, 2025), at https://www.muskwatch.com/p/muskassociates-given-unfettered (last accessed Feb. 3, 2025).

34. Upon information and belief, this server and/or other systems linked to it are retaining information about every individual with a Government email address.

The amended complaint argues that the privacy impact was factually and legally insufficient.

39. Neither Biasini nor Hogan were OPM employees prior to 20 January.

40. Biasini worked at the Boring Company prior to 20 January. It is not currently known if he still works there.

41. Hogan worked at Comma.ai prior to 20 January. It is not currently known if he still works there.

42. The GWES PIA was both factually inaccurate and legally inadequate.

[snip]

54. Upon information and belief, OPM has not ensured review of a PIA for any of these systems by any legally sufficient Chief Information Officer or equivalent official.

55. OPM has not published a legally sufficient PIA or made such an assessment available for public inspection for any of these systems.

In other words, as these twin lawsuits against Treasury get closer to arguing that Elon is not looking for savings but instead altering the payment system, McClanahan continues to chase proof that Elon’s DOGE [sic] boys have added their own server which, by dint of sending emails to everyone (including people not employed by the Executive branch) with a .gov address, is collecting information on everyone with a .gov address.

Meanwhile, several other developments get closer to showing that Elon is hacking the government, not assessing it.

First, late this week, OPM removed access by some DOGE [sic] boys to more sensitive OPM systems.

Directives from the agency’s interim leadership issued late this week indicated that DOGE representatives should be withdrawn from two principal systems containing personally identifiable information for millions of federal employees, according to communications reviewed by The Post and people familiar with the developments who spoke on the condition of anonymity because of the matter’s sensitivity.

Those systems are called Enterprise Human Resources Integration and Electronic Official Personnel Folder. They hold sensitive information about employees of most federal agencies, including addresses, demographic profiles, salary details and disciplinary histories.

The Post reported Thursday morning that DOGE agents had gained access to those systems along with “administrative” access to OPM computer systems. That allowed them sweeping authority to install and modify software on government-supplied equipment and, according to two OPM officials, to alter internal documentation of their own activities.

Meanwhile, both Wired and WaPo have stories describing how a Booz Allen analyst described the DOGE [sic] access as an ““unprecedented insider threat risk;” the analyst was promptly fired.

The review, delivered Monday to Treasury officials by a contractor that runs a threat intelligence center for Treasury’s Bureau of the Fiscal Service, said that DOGE’s access to the payment network should be “immediately” suspended. It also urged Treasury to scour the payments system for any changes approved by affiliates of DOGE, which is overseen by billionaire Elon Musk, the correspondence shows. DOGE stands for Department of Government Efficiency.

A Treasury employee told The Post that the threat center is run by Booz Allen Hamilton, a large federal contractor. The company confirmed it runs the threat center, which it said is embedded within Treasury.

Late Friday, after this article appeared, Booz Allen said it had “removed” a subcontractor who wrote the warning and would seek to retract or amend it. “The draft report was prepared by a subcontractor to Booz Allen and contained unauthorized personal opinions that are not factual or consistent with our standards,” company spokesperson Jessica Klenk said. Booz Allen won more than $1 billion in multiyear U.S. government contracts last year.

In a separate communication a week ago, a high-ranking career official at Treasury also raised the issue of risks from DOGE access in a memo to Treasury Secretary Scott Bessent, including the potential breach of information that could lead to exposure of U.S. spies abroad, according to five people with knowledge of the matter, who spoke on the condition of anonymity to reflect government deliberations. The memo included recommendations to mitigate risks, which Bessent approved, said another person familiar with the matter, who also spoke on the condition of anonymity.

And while the focus at Treasury has been on eugenicist Marko Elez, whom Elon has pushed to be reinstated, closer scrutiny into Edward “Big Balls” Coristine — who is at OPM and possibly HHS — has described he has ties to hackers. Brian Krebs, who was targeted by some people in that crowd, described screen shots that suggest Coristine may have been fired for leaking internal documents to a competitor.

Wired noted that Coristine only worked at Path for a few months in 2022, but the story didn’t mention why his tenure was so short. A screenshot shared on the website pathtruths.com includes a snippet of conversations in June 2022 between Path employees discussing Coristine’s firing.

According to that record, Path founder Marshal Webb dismissed Coristine for leaking internal documents to a competitor. Not long after Coristine’s termination, someone leaked an abundance of internal Path documents and conversations. Among other things, those chats revealed that one of Path’s technicians was a Canadian man named Curtis Gervais who was convicted in 2017 of perpetrating dozens of swatting attacks and fake bomb threats — including at least two attempts against our home in 2014.

And Krebs provides chatlogs showing some of Coristine’s former associates are taking notice.

The Com is the English-language cybercriminal hacking equivalent of a violent street gang. KrebsOnSecurity has published numerous stories detailing how feuds within the community periodically spill over into real-world violence.

When Coristine’s name surfaced in Wired‘s report this week, members of The Com immediately took notice. In the following segment from a February 5, 2025 chat in a Com-affiliated hosting provider, members criticized Rivage’s skills, and discussed harassing his family and notifying authorities about incriminating accusations that may or may not be true.

Bloomberg matched Krebs’ reporting on the reason for Coristine’s firing from Path.

“Edward has been terminated for leaking internal information to the competitors,” said a June 2022 message from an executive of the firm, Path Network, which was seen by Bloomberg News. “This is unacceptable and there is zero tolerance for this.”

A spokesperson for the Arizona-based hosting and data-security firm said Thursday: “I can confirm that Edward Coristine’s brief contract was terminated after the conclusion of an internal investigation into the leaking of proprietary company information that coincided with his tenure.”

Afterward, Coristine wrote that he’d retained access to the cybersecurity company’s computers, though he said he hadn’t taken advantage of it.

“I had access to every single machine,” he wrote on Discord in late 2022, weeks after he was dismissed from Path Network, according to messages seen by Bloomberg. Posting under the name “Rivage,” which six people who know him said was his alias, Coristine said he could have wiped Path’s customer-supporting servers if he’d wished. He added, “I never exploited it because it’s just not me.”

Bloomberg tied Coristine’s past even more closely to organized abuse campaigns.

JoeyCrafter was a member of Telegram groups called “Kiwi Farms Christmas Chat” and “Kiwi Farms 100% Real No Fake No Virus,” both referencing an online forum known for harassment campaigns. Typically, the site has been used to share the personal information of a target, encouraging others to harass them online, in-person, over the phone or by falsely alerting police to a violent crime or active shooter incident at their home.

This is the kind of DOGE boy Elon has thrown at government networks — and thus far, Republicans don’t seem to give a damn that Trump has given these DOGE [sic] boys access to data on virtually all Americans, employee or no.

One thing is clear, however: There’s not a shred of evidence these boys are doing what Elon claims they’re doing.

Most of these new facts — the seeming proof that OPM isn’t doing what it claimed, the insider threat warning, the ties to hackers — are not in the AGs’ suit. And by the time the suits catch up to the facts, the complaints may look quite different.

Update: Corrected that none of the OPM plaintiffs are employees of US Courts (though they did get an email).

On January 27th, an AP story appeared on the news website Military.com with the headline “Intelligence Sharing by the US and Its Allies Has Saved Lives. Trump Could Test Those Ties.” On the surface, it reads like one of those analysis pieces that come out when the White House changes from one party to the next, with the added twist of knowing what the first Trump administration was like.

The Associated Press spoke with 18 current and former senior European and U.S. officials who worked in NATO, defense, diplomacy or intelligence. Many raised questions and concerns about Trump’s past relationship with America’s spies and their ability to share information at a time of heightened terror threats and signs of greater cooperation between U.S. adversaries.

The importance of trust

The U.S. and its allies routinely share top-secret information, be it about potential terror threats, Chinese cyberattacks or Russian troop movements. America’s closest intelligence partners are New Zealand, Australia, Canada and Britain, and it often shares with other nations or sometimes even adversaries when lives are at stake.

[snip]

Cooperation particularly between the U.S. and the U.K. is “strong and robust enough to withstand some turbulence at the political level,” said Lord Peter Ricketts, former U.K. national security adviser and current chair of the European Affairs Committee of the upper chamber of the British Parliament.

However, any strong intelligence relationship is underpinned by trust, and what if “trust isn’t there?” Ricketts said.

Ricketts’ question is no longer a hypothetical. This is the reality faced by intelligence services who in the past have been friendly with the US intelligence community. The AP put out their story on January 27th, and that seems like years ago. Today this reads like a warning.

The takeover of USAID that has played out this past week is *not* just a battle over who runs offices in DC. The bulk of USAID’s staff work overseas, alongside their local partners. When phone calls from these overseas missions back to DC go unanswered, and when US staffers abroad are told to stand down, all those local partners are going to get very, very nervous, and not just because their paychecks stop. They’re going to talk to others in their government, trying to find out what it going on. At the same time, they will be providing input (either directly or indirectly) to their own country’s intelligence service, as their spooks add it to whatever they are learning from elsewhere. In the US, folks worry about those who are losing their jobs; overseas, these fights will result in people dying, like those who don’t get the clean water, medical care, or disease prevention measures like malaria nets. Those other countries are watching with horror the stories of Musk’s minions breaking into sensitive databases, over the objections of trusted career people, and wonder what of their own information is now in the hands of a privateer, and if the same this is (or will be) going on at the CIA, DIA, and other US intelligence agencies.

I guarantee you that all these other countries are watching the battle over USAID much more carefully than folks in the US.

Or look at the targeting of General Mark Milley, widely respected by his counterparts among our allies and within their intelligence services. OK, Biden pardoned him to protect him, but Trump withdrew his security clearance, and also his personal security detail. On January 29th, newly confirmed Secretary of Defense Pete Hegseth launched a process to investigate Milley, seeking to strip him of at least one star, cut his retirement pay, and punish him further. Given what the US attorney for DC is doing by going after DOJ attorneys for investigating the rather noticeable break-in of the US Capitol on January 6, 2021, it’s not hard to imagine that Hegseth’s henchmen will be rather thorough in their work and ruthlessly push aside anyone who gets in their way.

Now imagine you are a member of a foreign intelligence service — perhaps the head, or perhaps a mid-level staffer whose specialty is the US. You see the USAID invasion. You see the public decapitation of the FBI. You see the targeting of career DOJ officials. You see Hegseth paint a target on the back of Milley (and others, like John Bolton and John Brennan). You see all this, much of it in the bright light of public reporting. You hear more from your contacts, who paint more detailed pictures of these purges and fights. You see all this, and you ask yourself two questions, over and over again.

1) Are the things we shared with the US intelligence community in the past safe from being revealed in public, and thus causing us harm?
2) Can we trust the US intelligence community with information we might share with them in the future?

Given what we’ve seen over the last week, the answers to these questions are becoming more and more clear: 1) no and 2) no.

I haven’t talked to those “18 current and former senior European and U.S. officials who worked in NATO, defense, diplomacy or intelligence” to whom the AP spoke. The AP headline was hypothetical – “Trump could test those ties” – but now on February 3rd, it’s real. Trump has been f’ing around with those intelligence service ties, and he’s about to find out what happens.

The short answer is becoming clear, as Trump’s vision of America First becomes America Alone.

Trump’s Executive Order stripping 51 former spooks of clearance for writing a true letter expressing their opinion that Rudy Giuliani’s claims to have Hunter Biden’s emails “has all the classic earmarks of a Russian information operation” has led to inevitable false claims about the hard drive people falsely call a laptop.

Shockingly, it comes from Shane Harris, who at least while at WaPo would not make the kinds of errors he makes in this piece.

Harris states as fact that the 51 spooks were “embarrassingly wrong” and as proof, asserts that “the emails really did turn out to belong to Hunter Biden.”

But they were wrong. Embarrassingly wrong. The emails really did turn out to belong to Hunter Biden, and they raised legitimate concerns that he was trying to profit from his father’s political position. No evidence ever surfaced that Russia had played a role in bringing the emails to light. Intelligence experts sometimes make bad calls. This was one of those times.

[snip]

Some of the signatories still defend their work by noting, correctly, that they said the emails might be part of some Russian trick, not that they definitely were. That too-cute defense does not absolve them of bad judgment.

Except, as John Brennan noted in an interview on MSNBC, one thing they posited in the letter is that the information might be “accurate information,” noting that Russia did just that in the 2016 presidential election.

Such an operation would be consistent with some of the key methods Russia has used in its now multi-year operation to interfere in our democracy – the hacking (via cyber operations) and the dumping of accurate information or the distribution of inaccurate or misinformation. Russia did both of these during the 2016 presidential election. [my emphasis]

Harris knows this stuff! While the Guccifer 2.0 persona altered some of the documents stolen from the DNC and misrepresented others and Yevgeniy Prigozhin’s trolls engaged in outright fabrication, the emails stolen from John Podesta were authentic. The operation nevertheless succeeded in sucking up all the attention in the last several weeks of the election, with scandals manufactured out of inconclusive emails, just like the ones used in the NYPost story.

So claiming that the spooks were wrong because the emails really did turn out to be Hunter’s simply misrepresents both the letter and the mechanism of information operations.

As for Harris’ claim that, “No evidence ever surfaced that Russia had played a role in bringing the emails to light”?

Even ignoring Lev Parnas’ testimony that Rudy was offered a laptop hacked with the assistance of Russian spies in 2019 (while unverified, that is evidence, and Mykola Zlochevsky got the legal relief from Trump’s DOJ that Parnas claimed Rudy was offering at the time), the available record shows that the FBI didn’t do the most basic work they would have had to do to check for such evidence.

Remember, the currently operative story is that someone claimed to be Hunter Biden dropped off three devices at John Paul Mac Isaac’s store in April 2019. JPMI kept one to made a copy of the data. But no one ever retrieved the laptop or a hard drive on which JPMI stored the data. So after snooping through it all, months later, JPMI’s father offered up the laptop to the FBI. In December 2019 — days after Rudy traveled to Kyiv to meet with Andrii Derkach and the same month when DOJ shut down an investigation into Mykola Zlochevsky — FBI obtained both the hard drive and a laptop using a subpoena referencing a money laundering investigation that is not referenced in the warrant from the known tax investigation.

But there’s little evidence that the FBI checked that story. Indeed, the public evidence suggests there’s something fishy about the hard drive, which was the basis for all the other copies, including the one Rudy got.

• Mac Isaac’s own description of his actions does not match that of the FBI. On top of timeline discrepancies (including about whether FBI accessed the device before obtaining the known warrants), that includes misidentifying the devices dropped off at his shop and falsely claiming the laptop ultimately turned over to FBI did not have a removable hard drive (which was JPMI’s explanation for why he copied the laptop in the way he did).
• A March 31, 2020 email documented concerns, “about quality and completeness of imaged/recovered information from the hard drive” that “for a variety of reasons [USAO] thought they needed to keep it from the agents” who might testify at trial.
• Ten months after obtaining the laptop, the FBI had never checked the creation date of the files on it and the FBI never indexed the laptop (nor did it Bates-stamp the files they used at trial).
• Hunter Biden’s laptop data was not introduced at trial via an expert witness. Rather, a summary witness introduced the data, and she clearly testified she had not been asked to check for signs of tampering. The only things she mentioned at trial that validated the laptop is that the laptop matched subpoena information for Hunter’s iCloud (which may mean no more than that it accessed the account) and Hunter’s publicly available iCloud email account had received an email from John Paul Mac Isaac. Those sworn claims were far short of the things investigators had earlier claimed tied Hunter to the laptop: an exchange of calls, a local purchase, and “other intelligence.”
• The expert validation used in lieu of expert testimony does not identify the device(s) it validated and only refers to a single extraction report even though two separate extractions (one of the hard drive, another of the laptop) were done.
• According to prosecutors, the Cellebrite report of the hard drive from which (according to JPMI) all subsequent copies were made is 62% larger, by page count, than the Cellebrite report of the laptop itself.

FBI’s thin validation of the laptop could not rule out involvement of others, not least because of Hunter’s otherwise erratic behavior in the period.

• At least seven different laptops had accessed Hunter’s iCloud account in the years leading up to Mac Isaac obtaining it; Zoe Kestan testified that Hunter would do business from her laptop and she had access to his bank account via that laptop.
• Kestan also testified that Hunter would give her and his drug dealers one time codes so they could access his bank accounts.
• In January 2019, Hunter claimed that his Russian drug dealer had stolen a laptop (this may actually have been an iPad) from him in August 2018; this was the same period when new devices accessed Hunter’s Venmo account from two different cities within 12 minutes of each other. David Weiss appears to have made an error in the Tax Indictment about a closely related Venmo transaction.
• The access to the laptop in FBI custody does not match Hunter’s normal pattern after obtaining a new device of logging into his iCloud account and at least one of his Google accounts in fairly quick succession.
• The days before Hunter bought the laptop that would eventually end up in Fox News pundit Keith Ablow’s custody, he paid a Slavic sex worker over $8,000 via four different transactions and different bank accounts, an outlier both in amount and the multiple payment methods.
• The laptop itself has an inexplicable collection of data, much of which is unavailable from the iCloud backups obtained with warrants in 2019.

Hunter Biden was an addict. As such he had almost no control over his own devices, and both Kestan’s testimony and his own memoir describe that he routinely lost devices. Particularly given the known access he provided others and the number of devices that accessed his iCloud account, it would be child’s play for nefarious actors to package up Hunter’s data on a laptop.

And, at least as late as David Weiss made that error in the tax indictment, no one at FBI or DOJ appears to have tried to check what happened to Hunter Biden’s devices (I think the Kestan testimony may have been based on interviews just before the June gun trial). By all appearances, DOJ had no plan to use evidence from the laptop had the tax case gone to trial.

In his testimony for Jim Jordan’s investigation regarding the letter, James Clapper repeatedly said he’d like a statement about the FBI’s forensic analysis of the laptop. At Kristin Wood’s interview by the Committee, Trump’s OMB Deputy designee (and then Congressman) Dan Bishop said, “If, in fact, the FBI has not conducted a forensic investigation, or has conducted a forensic investigation and has suppressed the results, should the American people continue to defer to the FBI?” Yet when I tried to liberate that forensic report last year, DOJ successfully fought its release.

I’m not saying that this was a Russian operation. I’m saying that, based on the public record, the FBI did scandalously little to even test whether it could be; there’s no evidence they took the steps they would have needed to rule it out and plenty of reason to believe they did not.

The FBI never even indexed the laptop, not over the course of four years of reliance on it. They’re in no position to make claims about its provenance.

And so, Shane Harris is in no position to lecture spooks about them being “embarrassingly wrong.”

When I saw the news that Trump is planning a rally at Madison Square Garden — as the Nazis did in 1939 — I checked the date to see whether that was before or after Steve Bannon gets out of prison.

Bannon is due to get out on October 29; the rally is two days earlier, on October 27. On the current schedule, Bannon will be released nine days before the election, but not soon enough to attend what will undoubtedly be a larger version of the Nazi rant that Trump put on in Aurora the other day. Unless something disrupts it, Bannon will start trial for defrauding Trump supporters on December 9, days before the states certify the electoral vote.

This is the kind of timing I can’t get out of my head. According to FiveThirtyEight, Kamala Harris currently has a 53% chance of winning the electoral college. That’s bleak enough. But based on everything I know about January 6, I’d say that if Trump loses, there’s at least a 10% chance Trump’s fuckery in response will have a major impact on the transfer of power.

Experts on right wing extremism are suggesting the same thing. Here’s an interview Rick Perlstein did with David Neiwert back in August on the political violence he expects. Here’s a report from someone who infiltrated the 3 Percenters, predicting they would engage in vigilanteism.

Will Jack Smith unveil charges about inciting violence amid election violence?

As I wrote in this post, I suspect that Jack Smith considered, but did not, add charges when he decided to supersede Trump’s January 6 indictment. As I wrote, there is negative space in Smith’s immunity filing where charges on Trump’s funding for January 6 (and subsequent suspected misuse of those funds) might otherwise be.

More tellingly, there are four things that indicate Jack Smith envisioned — but did not yet include — charges relating to ginning up violence. As Smith did in a 404(b) filing submitted in December, he treated Mike Roman as a co-conspirator when he exhorted a colleague, “Make them riot” and “Do it!!!” Newly in the immunity filing, he treated Bannon as a co-conspirator, providing a way to introduce Steve Bannon’s prediction, “All Hell is going to break loose tomorrow!” shortly after speaking with Trump on January 5.  But Smith didn’t revise the indictment to describe Roman and Bannon as CC7 and CC8; that is, he did not formally include these efforts to gin up violence in this indictment. What appears to be the same source for the Mike Roman detail (which could be Roman’s phone, which was seized in September 2022; in several cases it has taken a year to exploit phones seized in the January 6 investigation) also described that Trump adopted the same tactic in Philadelphia.

The defendant’s Campaign operatives and supporters used similar tactics at other tabulation centers, including in Philadelphia, Pennsylvania,21 and the defendant sometimes used the resulting confrontations to falsely claim that his election observers were being denied proper access, thus serving as a predicate to the defendant’s claim that fraud must have occurred in the observers’ absence.22

Even more notably, after saying (in that same December 404(b) filing) that he wanted to include Trump’s endorsement and later ratification of the Proud Boys’ attack on the country to “demonstrate[] the defendant’s encouragement of violence,” Smith didn’t include them in the immunity filing whatsoever — not even in the section where the immunity filing described Trump’s endorsement of men who assaulted cops. If I’m right that Smith held stuff back because SCOTUS delayed his work so long it butted into the election season, it would mean he believes he has the ability to prove that Trump deliberately stoked violence targeting efforts to count the vote at both the state and federal level, but could not lay that out until after November 5, after which Trump may be in a position to dismiss the case entirely.

And the two Stephens — Bannon, whose War Room podcast would serve to show that Trump intended to loose all Hell on January 6, and Miller, who added the finishing touches to Trump’s speech making Mike Pence a target for that violence — appear to have a plan to do just that, working in concert with Elon Musk.

The two Stephens say Trump must be able to stoke violence with false claims as part of his campaign

As I laid out in June, just as Bannon was reporting to prison, both Stephens were arguing that they had a right to make false claims that had the effect of fostering violence.

Bannon filed an emergency appeal aiming to stay out of prison arguing he had to remain out so he could “speak[] on important issues.”

There is also a strong public interest in Mr. Bannon remaining free during the run-up to the 2024 presidential election. The government seeks to imprison him for the four-month period immediately preceding the November election—giving an appearance that the government is trying to prevent Mr. Bannon from fully assisting with the campaign and speaking out on important issues, and also ensuring the government exacts its pound of flesh before the possible end of the Biden Administration.

No one can dispute that Mr. Bannon remains a significant figure. He is a top advisor to the President Trump campaign, and millions of Americans look to him for information on matters important to the ongoing presidential campaign. Yet from prison, Mr. Bannon’s ability to participate in the campaign and comment on important matters of policy would be drastically curtailed, if not eliminated. There is no reason to force that outcome in a case that presents substantial legal issues.

That claim came just after he had given a “Victory or Death” speech at a Turning Point conference.

In the same period, Stephen Miller attempted to intervene in Jack Smith’s efforts to prevent Trump from making false claims that the FBI tried to assassinate him when they did a search of his home governed by a standard use-of-force policy, knowing full well he was gone. (Aileen Cannon rejected Miller’s effort before she dismissed the case entirely.)

Miller argued that the type of speech that Smith wanted to limit — false claims that have already inspired a violent attack on the FBI — as speech central to Trump’s campaign for President.

The Supreme Court has accordingly treated political speech—discussion on the topics of government and civil life—as a foundational area of protection. This principle, above all else, is the “fixed star in our constitutional constellation[:] that no official, high or petty, can prescribe what shall be orthodox in politics[ or] nationalism . . . or force citizens to confess by word or act their faith therein.” W. Va. State Bd. of Educ. v. Barnette, 319 U.S. 624, 642 (1943) (Jackson, J.). Therefore, “[d]iscussion of public issues and debate on the qualifications of candidates” are considered “integral” to the functioning of our way of government and are afforded the “broadest protection.” Buckley, 424 U.S. at 14.

Because “uninhibited, robust, and wide-open” debate enables “the citizenry to make informed choices among candidates for office,” “the constitutional guarantee has its fullest and most urgent application precisely to the conduct of campaigns for political office.” Id. at 14-15 (citations omitted). Within this core protection for political discourse, the candidates’ own speech—undoubtedly the purest source of information for the voter about that candidate—must take even further primacy. Cf. Eu v. S.F. Cnty. Democratic Cent. Comm., 489 U.S. 214, 222-24 (1989) (explaining that political speech by political parties is especially favored). This must be especially true when, as here, the candidate engages in a “pure form of expression involving free speech alone rather than expression mixed with particular conduct.” Buckley, 424 U.S. at 17 (cleaned up) (contrasting picketing and parading with newspaper comments or telegrams). These principles layer together to strongly shield candidates for national office from restrictions on their speech.

Miller called Trump’s false attack on the FBI peaceful political discourse.

Importantly, Miller dodged an argument Smith made — that Trump intended that his false claims would go viral. He intended for people like Bannon to repeat his false claims. In disclaiming any intent to incite imminent action, Miller ignored the exhibit showing Bannon parroting Trump’s false claim on his War Room podcast.

It cannot be said that by merely criticizing—or, even as some may argue, mischaracterizing—the government’s actions and intentions in executing a search warrant at his residence, President Trump is advocating for violence or lawlessness, let alone inciting imminent action. The government’s own exhibits prove the point. See generally ECF Nos. 592-1, 592-2. 592-3, 592-5.

Note, Bannon did this with Mike Davis, a leading candidate for a senior DOJ position under Trump, possibly even Attorney General, who has vowed to instill a reign of terror in that position.

But that was the point — Jack Smith argued — of including an exhibit showing Bannon doing just that.

Predictably and as he certainly intended, others have amplified Trump’s misleading statements, falsely characterizing the inclusion of the entirely standard use-of-force policy as an effort to “assassinate” Trump. See Exhibit 4.

Back in June, Bannon said he had to remain out of prison because he played a key role in Trump’s campaign. And Miller said that even if Bannon deliberately parroted Trump’s false incendiary claims, that was protected political speech as part of Trump’s campaign.

Miller helps eliminate checks on disinformation and Nazis on Xitter

But this effort has been going on for years.

A report that American Sunlight released this week describing how systematically the right wing turned to dismantling the moderation processes set up in the wake of the 2016 election points to Miller’s America First Legal’s role in spinning moderation by private actors as censorship. Miller started fundraising for his effort in 2021.

[F]ormer Trump Senior Advisor Stephen Miller[] founded America First Legal (AFL). 6 An unflinchingly partisan organization, the home page of AFL’s website claims its mission is to “[fight] back against lawless executive actions and the Radical Left,” 7 which it accomplishes through litigation. AFL has, to date, engaged in dozens of efforts to silence disinformation research through frivolous lawsuits and collaboration with Jordan and the House Judiciary Committee’s harassment of researchers. In a digital age where social media is more prevalent than ever and social media platforms have more power than ever, AFL’s efforts to politicize legitimate efforts to combat disinformation – by social media platforms and independent private-citizen researchers – have significantly damaged the information environment. To fully realize these efforts and their impacts, we explore the founding and operations of AFL.

[snip]

After its launch in early 2022, AFL began its line of litigation with a series of FOIA requests relating to the State Department’s Global Engagement Center (GEC) and the Cybersecurity and Infrastructure Security Agency (CISA). These requests marked a noticeable uptick in conservative claims about censorship. AFL’s FOIA requests alleged these government agencies improperly partnered with social media platforms and asked for content around Hunter Biden’s laptop to be removed. 22 In its FOIA request to CISA, AFL writes 23 :

On March 17, 2022, the New York Times revealed that “[Hunter] Biden’s laptop was indeed authentic, more than a year after … much of the media dismissed the New York Post’s reporting as Russian disinformation.” When the story was first accused of being disinformation, X/Twitter suspended the New York Post’s account for seven days, and Facebook “’reduc[ed]’ the story’s distribution on its platform while waiting for third-party fact checkers to verify it.” This was just one of many instances where social media companies censored politically controversial information under the pretext of combatting MDM even when the information later became verified.

Then, as now, AFL offered no evidence to support its claim that any federal agency coerced, pressured, or mandated that social media platforms remove any such laptop-related content. As this report will cover in depth, social media platforms have their own, robust content moderation policies in regards to false and misleading content; as private companies, they implement these policies as they see fit.

The American Sunlight report describes how some of the key donations to AFL were laundered so as to hide the original donors (and other of its donations came from entities that had received the funds Trump raised in advance of January 6).

But as WSJ recently reported, Musk started dumping tens of millions into Miller’s racist and transphobic ads no later than June 2022.

In the fall of 2022, more than $50 million of Musk’s money funded a series of advertising campaigns by a group called Citizens for Sanity, according to people familiar with his involvement and tax filings for the group. The bulk of the ads ran in battleground states days before the midterm elections and attacked Democrats on controversial issues such as medical care for transgender children and illegal immigration.

Citizens for Sanity was incorporated in Delaware in June 2022, with salaried employees from Miller’s nonprofit legal group listed as its directors and officers.

There are questions of whether Miller grew close to Musk even before that.

In the lead-up to Musk’s purchase of Xitter, someone — there’s reason to believe it might be Stephen Miller — texted Musk personally to raise the sensitivities of restoring Trump, whom the person called, “the boss,” to Xitter.

And one of Musk’s phone contacts appears to bring Trump up. However, unlike others in the filings, this individual’s information is redacted.

“It will be a delicate game of letting right wingers back on Twitter and how to navigate that (especially the boss himself, if you’re up for that),” the sender texted to Musk, referencing conservative personalities who have been banned for violating Twitter’s rules.

Whoever this was — and people were guessing it was Miller in real time — someone close enough to Elon to influence his purchase of Xitter was thinking of the purchase in terms of bringing back “right wingers,” including Trump.

Yesterday, the NYT reported on how the far right accounts that Musk brought back from bannings have enjoyed expanded reach since being reinstated. Some of the most popular accounts have laid the groundwork for attacking the election.

As the election nears, some of the high-profile reinstated accounts have begun to pre-emptively cast doubt on the results. Much of the commentary is reminiscent of the conspiracy theories that swirled after the 2020 election and in the lead-up to the Jan. 6 riot.

Since being welcomed back to the platform, roughly 80 percent of the accounts have discussed the idea of stolen elections, with most making some variation of the claim that Democrats were engaged in questionable voting schemes. Across at least 1,800 posts on the subject, the users drew more than 13 million likes, shares and other reactions.

Some prominent accounts shared a misleading video linked to the Heritage Foundation, a conservative think tank, that used shaky evidence to claim widespread voter registration of noncitizens. One of the posts received more than 750,000 views; Mr. Musk later circulated the video himself.

But it’s more than just disinformation. Xitter has played a key role in stoking anti-migrant violence across the world. In Ireland, for example, Alex Jones’ magnification of Tommy Robinson’s tweets helped stoke an attack on a shelter for migrants.

As with mentions of Newtownmountkennedy, users outside of Ireland authored the most posts on X mentioning this hashtag, according to the data obtained by Sky News. 57% were posted by accounts based in the United States, 24.7% by Irish users. A further 8.8% were attributed to users based in the United Kingdom.

While four of the top five accounts attracting the most engagement on posts mentioning this hashtag were based in Ireland, the fifth belongs to Alex Jones, an American media personality and conspiracy theorist. Jones’s posts using this hashtag were engaged with 10,700 times.

Jones continued to platform Robinson as he stoked riots in the UK.

Several high-profile characters known for their far-right views have provided vocal commentary on social media in recent days and have been condemned by the government for aggravating tensions via their posts.

Stephen Yaxley-Lennon, who operates under the alias Tommy Robinson, has long been one of Britain’s most foremost far-right and anti-Muslim activists and founded the now-defunct English Defence League (EDL) in 2009.

According to the Daily Mail, Robinson is currently in a hotel in Cyprus, from where he has been posting a flurry of videos to social media. Each post has been viewed hundreds of thousands of times, and shared by right-wing figures across the world including United States InfoWars founder Alex Jones.

And Elon Musk himself famously helped stoke the violence, not just declaring civil war to be “inevitable,” but also adopting Nigel Farage’s attacks on Keir Starmer.

On Monday, a spokesperson for UK Prime Minister Keir Starmer addressed Musk’s comment, telling reporters “there’s no justification for that.”

But Musk is digging his heels in. On Tuesday, he labeled Starmer #TwoTierKier in an apparent reference to a debunked claim spread by conspiracy theorists and populist politicians such as Nigel Farage that “two-tier policing” means right-wing protests are dealt with more forcefully than those organized by the left. He also likened Britain to the Soviet Union for attempting to restrict offensive speech on social media.

In the UK, such incitement is illegal. But it is virtually impossible to prosecute in the United States. So if Elon ever deliberately stoked political violence in the US, it would be extremely difficult to stop him, even ignoring the years of propaganda about censorship and the critical role some of Musk’s companies play in US national security.

Bannon’s international fascist network

The ties to Nigel Farage go further than Xitter networks.

In a pre-prison interview with David Brooks (in which Brooks didn’t mention how Bannon stands accused of defrauding Trump’s supporters in his New York case), Bannon bragged about turning international fascists into rocks stars.

STEVE BANNON: Well, I think it’s very simple: that the ruling elites of the West lost confidence in themselves. The elites have lost their faith in their countries. They’ve lost faith in the Westphalian system, the nation-state. They are more and more detached from the lived experience of their people.

On our show “War Room,” I probably spend at least 20 percent of our time talking about international elements in our movement. So we’ve made Nigel a rock star, Giorgia Meloni a rock star. Marine Le Pen is a rock star. Geert is a rock star. We talk about these people all the time.

And in August, Bannon’s top aide, Alexandra Preate, registered as a foreign agent for Nigel Farage. She cited arranging his participation in:

• A March 2023 CPAC speech
• Discussions, as early as August 2023, about a Farage speech at RNC
• A January 2024 pitch for Farage to speak at a Liberty University CEO Summit that was held last month
• Talks at “Sovereignty Summits” in April through July
• April arrangements for a May 1 talk at Stovall House in Tampa, Florida
• Discussions in May about addressing CPAC in September
• May 2024 media appearances on the Charlie Kirk Show, Fox Business Larry Kudlow show, Bannon’s War Room, Seb Gorka Show, Newsmax, WABC radio
• More discussions about Farage’s attendance at the RNC
• Early August discussions about an upcoming trip to the US

That is, Preate retroactively registered as Farage’s agent after a period (July to August) when he was spreading false claims that stoked riots in his own country.

Preate also updated her registration for the authoritarian Salvadoran President, Nayib Bukele (which makes you wonder whether she had a role in this fawning profile of Bukele).

Miller serves as opening act for Trump’s Operation Aurora

Before Trump’s speech in Aurora, CO the other day — at which he spoke of using the Alien and Sedition Act against what he deemed to be migrants — Stephen Miller served as his opening act, using the mug shots of three undocumented immigrants who have committed violent crimes against American women to rile up the crowd, part of a years-long campaign to falsely suggest that migrants are even as corrupt as violent as white supremacists.

Stephen Miller started laying the infrastructure to improve on January 6 from shortly after the failed coup attempt (and he did so, according to the American Sunlight report, with funds that Trump may have raised with his Big Lie). In recent weeks, Trump — with Miller’s help — has undermined the success of towns in Ohio and Colorado with racial division and has led his own supporters hard hit by hurricanes to forgo aid to which they’re entitled with false claims that Democrats are withholding that aid.

By targeting people like North Carolina Governor Roy Cooper and Kamala Harris, Trump is targeting not just Democrats, but also people who play a key role in certifying the election.

If Cooper and Harris were incapacitated before they played their role in certifying the election, they would be replaced by Mark Robinson and whatever president pro tempore a Senate that is expected to have a GOP majority after January 4 chooses, if such a choice could be negotiated in a close Senate in a few days.

And all the while, the richest man in the world, who claims that he, like Steve Bannon and Donald Trump, might face prison if Vice President Harris wins the election, keeps joking about assassination attempts targeting Harris.

We have just over three weeks to try to affect the outcome on November 5 — to try to make it clear that Trump will do for America what he has done in Springfield, Aurora, and Western North Carolina, deliberately made things worse for his own personal benefit. But at the same time, we need to be aware of how those efforts to make things worse are about creating a problem that Trump can demand emergency powers to solve.