Posts

The Visibility of FBI’s Close Hold: John Durham Will Blame Michael Sussmann that FBI Told Alfa Bank They Were Investigating

/86 Comments/in , , /by

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs of transcripts. But if you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations. This coverage reflects the culmination of eight months work. 

According to an exchange at the end of they day yesterday, John Durham’s team plans to introduce “a hundred” exhibits through their paralegal acting as a summary witness today.

My understanding is that the defense objects to the PowerPoint presentation style of the process. But, again, we think it just streamlines it in terms of — the alternative is to have to put literally a hundred exhibits in through Ms. Arsenault one at a time.

Given the exhibits from Monday, I assume Durham will throw a bunch of Fusion documents at the jury in an attempt to insinuate, once again, that Michael Sussmann shared with the press that the FBI was investigating the Alfa Bank anomaly.

The coming onslaught of Fusion documents

I say that because Mark Hosenball wrote the FBI for comment at 1:33PM on October 5, 2016, attaching the Mediafire package, asking for comment and noting that, “it has been suggested to me that this information and scenario is under careful investigation by the FBI.”

Hosenball’s email to the FBI puts it right at the beginning (in red, below) of the known universe of Fusion emails we’ve seen from that day, the timestamps of which Durham has repeatedly tried to obscure. (Maybe while paralegal Kori Arsenault is on the stand, Sussmann’s team can ask her why Durham’s exhibits misleadingly don’t correct for UTC.)

That said, there’s still a Hosenball email unaccounted for in which he shared one of the publicly available links to Tea Leaves packaged data. It’s quite possible that email precedes Seago’s question to Fritsch, which is currently the earliest email in the list, asking whether one of the i2p sites hosting the data was safe. See this post for background.

5:23PM (likely 1:23?): Seago to Fritsch, Is this safe?

1:31PM: [not included] Fritsch to Hosenball email with Alfa Group overview

1:32PM: Fritsch sends Isikoff the September 1, 2016 Alfa Group overview (full report included in unsealed exhibit)

1:33PM: Hosenball to FBI, “careful investigation by the FBI”

1:33PM [not included] Fritsch to Hosenball, “that memo is OTR — tho all open source”

1:35/1:36PM: Hosenball replies, “yep got it, but is that from you all or from the outside computer experts?”

1:37PM: Fritsch responds,

the DNS stuff? not us at all

outside computer experts

we did put up an alfa memo unrelated to all this

1:38PM: [not included] Hosenball to Fritsch:

is the alfa attachment you just sent me experts or yours ? also is there additional data posted by the experts ? all I have found is the summary I sent you and a chart… [my emphasis]

1:41PM: [not included] Fritsch to Hosenball:

alfa was something we did unrelated to this. i sent you what we have BUT it gives you a tutanota address to leave questions.  1. Leave questions at: [email protected]

1:41PM: [not included] Hosenball to Fritsch:

yes I have emailed tuta and they have responded but haven’t sent me any new links yet. but I am pressing. but have you downloaded more data from them ?

1:43PM: [not included] Fritsch to Hosenball, “no”

1:44PM: Fritsch to Lichtblau:

fyi found this published on web … and downloaded it. super interesting in context of our discussions

[mediafire link] [my emphasis]

2:23PM: [not included] Lichtblau to Fritsch, “thanks. where did this come from?”

2:27PM: [not included] Hosenball to Fritsch:

tuta sent me this guidance

[snip]

Since I am technically hopeless I have asked our techie person to try to get into this. But here is the raw info in case you get there first. Chrs mh

2:32PM: Fritsch to Lichtblau:

no idea. our tech maven says it was first posted via reddit. i see it has a tutanota contact — so someone anonymous and encrypted. so it’s either someone real who has real info or one of donald’s 400 pounders. the de vos stuff looks rank to me … weird

6:33PM (likely 2:33PM): Fwd Alfa Fritsch to Seago

6:57PM (like 2:57PM): Re alfa Seago to Fritsch

7:02PM (likely 3:02): Re alfa Seago to Fritsch

3:27PM: [not included] Fritsch to Hosenball cc Simpson: “All same stuff”

3:58PM: [not included] Hosenball to Fritsch, asking, “so the trumpies just sent me the explanation below; how do I get behind it?”

4:28PM: [not included] Fritsch to Hosenball, “not easily, alas”

4:32PM: Fritsch to Hosenball, cc Simpson:

Though first step is to send that explanation to the source who posted this stuff. I understand the trump explanations can be refuted.

So I assume that Durham will argue that Fusion must have passed on the information that the FBI was investigating — and they may have! (though none of the currently public emails reflect that — and suggest that was all part of Michael Sussmann’s devious plan on September 19.

When, under threat of prosecution, an attempt to prevent politicization turns into an attempt to hide political bias

That’s where things will get interesting. One key dispute in this case is why one keeps secrets. Durham wants to argue that keeping secrets can only serve a political purpose.

Sussmann will argue that keeping secrets facilitates national security interests.

Sussmann will show that everyone at the FBI recognized the value, to the FBI, of stalling a newspaper article about a potentially important threat so the FBI could covertly investigate it. All the more so during election season when — investigation after investigation into the Russian investigation has shown — the FBI was, if anything, being too careful in an attempt to avoid impacting Trump’s political fortunes, even while Jim Comey was tanking Hillary’s campaign. According to Sussmann’s own sworn testimony — testimony that Durham didn’t bother testing before charging Sussmann — allowing the FBI the opportunity to do that was the reason Sussmann shared the Alfa Bank anomaly with the FBI. Durham wants to imprison Sussmann for giving the FBI that heads up, arguing that because he hid his purported clients, it led the FBI to open a Full Investigation more quickly than they otherwise would have (even though, as Sussmann’s team has demonstrated, the FBI did nothing that would have required a Full Investigation in the short period during which they investigated).

A key part of that story Durham wants to tell — needs to tell, given all the evidence that the FBI perceived this to be a DNC-related tip — is that some of his key villains were attempting to hide the perceived political nature of the tip, rather than ensuring the integrity of the investigation itself (or possibly, but I’m still working on this, protecting the identity of a CHS).

Central to that narrative is the changing testimony of FBI Agent Ryan Gaynor — his stated reasons for refusing to let the case agents in Chicago interview either Sussmann or Georgia Tech professor David Dagon. In an interview on October 30, 2020 (a week after Durham had been granted Special Counsel status), Gaynor explained that he had intervened to make sure agents couldn’t conduct interviews that would have led to a more robust investigation to ensure the integrity of the investigation.

Q. Okay. So you remember telling the government that you believed that the agents in Chicago would have been biased by Mr. Sussmann’s perception of the issue — the source’s perception of the issue if they had interviewed him before they got all of the data and analyzed it?

A. Yes.

Q. Okay. And that’s because, at the time, you believed the DNC was the source of the information itself. Right?

A. That’s because, at the time, I believed that he was a DNC attorney associated with the Democratic party and it would be potentially highly-biasing information.

Q. And you told the government, if you had provided the identity of the DNC as the source of the information, they would have known there was possible political motivation. rignt?

A. I recall that exact statement.

Shortly after he gave this testimony, prosecutors took a break, and told his lawyer they were moving towards treating Gaynor as a subject of, rather than just a witness in, the investigation.

Q. Okay. Well, at or around the time you were talking about passing along the source’s name or not, you took a break in the meeting. Do you remember taking breaks during the meeting?

A. I do.

Q. And do you remember when you broke at that point that the government told your attorney that your own status in the investigation had changed. Do you remember hearing that?

A. So I didn’t hear that, but when my attorney came back in, he advised me that my status was in jeopardy.

After that, Gaynor went back, looked at two sets of scribbled notes (Gaynor, because he remains at FBI, was able to review his notes, unlike a number of other Durham witnesses), and decided that now that he thought about it, Jonathan Moffa had actually instructed him to keep a close hold on Sussmann’s identity. It wasn’t his decision anymore, it was Moffa’s, and the dastardly Peter Strzok was in on it. Once Gaynor testified that way, he became a — to Andew DeFilippis, anyway — credible witness again.

Q. Okay. And when you told the government there was a close hold, were you told that your status changed back to being a witness?

A. At the conclusion of the interview, once I had gone over all of the material that I brought and walked through what I had reconstructed and what I could recollect after doing so, I was informed that my status had changed, yes.

Q. Changed back to being a witness?

A. To a witness, yes.

Q. So you go into meeting one being told you are a witness, telling them you decided not to share the agents’ names among other things. Then you are told you are a subject facing criminal charges, potentially. You come back. You tell them about a close hold, and you go back to being a witness; is that right?

Politico may have been the only outlet that described this fairly shocking testimony.

These conflicting claims about the purported reasons to keep Sussmann’s identity (as opposed to the investigation itself) a secret are important background to that Hosenball email on October 5, which I suspect Durham will use to claim that the Democrats were leaking about the investigation.

Starting almost immediately after getting the investigation, Chicago case agents started asking to interview the source, variously defined to be either Sussmann or the person who wrote the white paper. Gaynor kept pushing the agents to go review the logs again — though the file memorializing the contents of what it describes as a single thumb drive (Sussmann shared two) was not written up until October 4. But then, by October 5 (the same day that Hosenball asked the FBI for comment, albeit this report comes in four hours later), FBI had learned from one of their confidential human sources that David Dagon had a role in the white paper and he — and the FBI’s own source! — would be going public pushing the credibility of the allegations.

In that email, newbie agent Allison Sands explained that they were going to contact Dagon.

So, among other things, on the same day Hosenball writes in reflecting an awareness that there was an ongoing investigation, the FBI hears from a CHS who says he or she has already been talking with David Dagon and was going public backing the claims (though this source was speaking to the WaPo, not Reuters).

Note that, as of that date, the FBI still hadn’t received logs from Listrak.

By the time Allison Sands wrote that email, it appears from Lync messages that like others probably haven’t been noticed to reflect UTC time zone, had already contacted Rodney Joffe’s handler to contact Dagon.

Fun with missing Bates stamps

Side note. There are actually two versions of the notes that purportedly caused Gaynor to change his mind about there being a close hold and on what source that close hold was on. There’s Defense Exhibit 524, which has a slew of Bates stamps, and 7 redactions.

And then there’s a page from Government Exhibit 279, which appears between a page with Bates stamp SC-6454 and one with Bates stamp SC-6456, which has no Bates stamp at all (and lacks the protective order stamp that appears on the other pages of the exhibit).

That version of the exhibit has just four redactions, one of which is smaller. The unredacted bits on the exhibit reveal discussions of the informant and recognition that the statements of the informant “likely triggered” the press attention.

Incidentally, Durham’s team took an entire day to upload this set of exhibits. I’m wondering if the exhibit that was viewed by Gaynor and entered into evidence actually looked like this one does.

Calling the agent of a foreign agent to ask for comment

There’s one other thing going on. On the stand, Gaynor spent a great deal of time explaining about how important it was to hide an investigation — particularly from anyone who might have a partisan interest — during an election.

Except for all the talk of a close hold, the FBI wasn’t holding this very close. They were stomping around to a bunch of sources asking for data logs, even before they had checked what was on (one of) the thumb drives that Sussmann had dropped off. They fairly demonstrably were stomping around before they understood what they should be looking for.

They also were calling Mandiant, which was working for Alfa Bank, which by October 19 when they were formally interviewed discovered Alfa Bank had no logs, but which knew of the investigation by October 5.

Q. Uh-huh. You testified about the reasons why you’d want to keep it covert, you wouldn’t want to do anything that could affect the election so close to the election. Right?

A. Yes.

Q. The FBI, as part of the Alfa-Bank investigation, talked to a number of different individuals outside of the FBI to acquire information, to get you information so that you could investigate the allegations. Right?

A. Yes.

Q. Okay. You spoke to people at Central Dynamics?

A. Yes, and I believe the investigative team documented in the email that I saw that they had done it in a manner to attempt to avoid it outing the allegation.

[snip]

A. I’m sorry?

Q. And how is that that they could conduct an interview with a third party in a way that the third party wouldn’t tell other people about it?

A. They described it in a manner that they had obfuscated what their direct interest was.

Q. So from the Central Dynamics’ perspective, they didn’t know what you were looking at?

A. That is what I had in the email chain, yes. n

Q. But you testified that the FBI interviewed Mandiant as part of the investigation. Correct?

A. Yes. My understanding there is that was a private liaison relationship that occurred.

Q. Mandiant — just to be clear — Alfa-Bank itself hired Mandiant to analyze whether there was a secret communications channel. Correct?

A. Yes.

Q. So Alfa-Bank paid Mandiant to look into whether there was a secret communications channel. Right?

A. Yes.

Q. And Alfa-Bank obviously had a relationship with Mandiant that was put at issue by hiring Mandiant. Right?

A. Yes.

Q. Okay. So the FBI went to Alfa-Bank’s paid consultant and asked them for their view on the allegation. Correct?

A. I believe the FBI had a prior relationship with one of the employees, and they utilized that in the field. Plus, I don’t think the Bureau would violate policy on a sensitive investigative matter when the Chief Division Counsel of the office is involved. So I would assume that they did that in a manner that they did not feel would be alerting or go to the media.

Q. Mr. Gaynor, the FBI in this investigation went to Alfa-Bank’s paid consultant and asked them for their views of the allegations. correct?

A. Yes.

Q. And Alfa-Bank’s paid consultant could have told Alfa-Bank. Correct?

A. Yes.

Q. And could have told the press for all you know. Correct?

A. Yes. And I don’t know how Chicago mitigated that.

Q. And is it your testimony that going to Alfa-Bank, the Russian bank that is the focus of this investigation, and asking their paid consultant for their views on the matter wasn’t going to overt?

A. Again, I don’t know how Chicago mitigated that issue.

[snip]

Q. Did you ever have a conversation with anybody at headquarters about whether to provide the names of the source to the Chicago agents?

A. Yes. There was a conversation about the close hold, as I mentioned, although it wasn’t correctly, I guess, documented between Pete Strzok, myself and Mr. Moffa at some point during that time period.

[snip]

Q. And the reason that you say no one talked to him is because, as of that point, October 6th, you had already concluded that there was nothing to these allegations. Right?

A. As of October 5th, evening of October 5th, we had come to a pretty solid conclusion that these allegations did not have merit and there wasn’t a national security threat.

Q. Are you aware that the agents first interviewed Alfa-Bank’s paid consultant, Mandiant, merely two weeks later on October 19th?

A. So I’m aware that we had information from Mandiant as of October 5th that they had looked at this allegation and found that it didn’t have merit. And then I’m also aware that there was an interview that was conducted later, October 19th or so, when I was made aware of it, yes.

A text between Allison Sands and Scott Hellman reflects the FBI had contact with Alfa Bank by October 4.

It appears that contact occurred in London — a place where Mark Hosenball has strong source ties since the time in 1976 when he got expelled for reporting on Northern Ireland.

In other words, Gaynor’s currently operative stance is that case agents couldn’t contact David Dagon — much less Rodney Joffe, who had business ties with the FBI — to find out what was going on, because that would present a conflict.

But it was okay for the FBI to contact the agent of the subject of the investigation overtly.

Agent Gaynor belatedly rediscovers the Mediafire package

Incidentally, when that original request for comment from Hosenball came in, it got transferred to people in the cyber division, then shared with the investigative team. In response, the senior-most person on that team sent it to Peter Strzok. Strzok forwarded it, at 3:02 on October 5, to Ryan Gaynor.

On October 13, just over a week after he had originally received it, Gaynor sent the Mediafire package to the case team, noting that the observations in it reflected actions taken in response to their investigation, but asking for their technical opinion.

He included Moffa and Joe Pientka on that email.

But not Strzok, who knew he had received it 8 days earlier.

OTHER SUSSMANN TRIAL COVERAGE

Scene-Setter for the Sussmann Trial, Part One: The Elements of the Offense

Scene-Setter for the Sussmann Trial, Part Two: The Witnesses

The Founding Fantasy of Durham’s Prosecution of Michael Sussmann: Hillary’s Successful October Surprise

With a Much-Anticipated Fusion GPS Witness, Andrew DeFilippis Bangs the Table

John Durham’s Lies with Metadata

emptywheel’s Continuing Obsession with Sticky Notes, Michael Sussmann Trial Edition

Brittain Shaw’s Privileged Attempt to Misrepresent Eric Lichtblau’s Privilege

The Methodology of Andrew DeFilippis’ Elaborate Plot to Break Judge Cooper’s Rules

Jim Baker’s Tweet and the Recidivist Foreign Influence Cheater

That Clinton Tweet Could Lead To a Mistrial (or Reversal on Appeal)

John Durham Is Prosecuting Michael Sussmann for Sharing a Tip on Now-Sanctioned Alfa Bank

Apprehension and Dread with Bates Stamps: The Case of Jim Baker’s Missing Jencks Production

Technical Exhibits, Michael Sussmann Trial

Jim Baker’s “Doctored” Memory Forgot the Meeting He Had Immediately After His Michael Sussmann Meeting

The FBI Believed Michael Sussmann Was Working for the DNC … Until Andrew DeFilippis Coached Them to Believe Otherwise

The FBI Believed Michael Sussmann Was Working for the DNC … Until Andrew DeFilippis Coached Them to Believe Otherwise

/75 Comments/in , , /by

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs of transcripts. But if you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations. This coverage reflects the culmination of eight months work. 

There’s accumulating evidence that at least some people — including some key decision-makers — believed the FBI believed that the Alfa Bank tip came from the DNC — and that Andrew DeFilippis has engaged in a lot of coaching to try to make that evidence go away.

The first time FBI Agent Ryan Gaynor testified to John Durham about the investigation into the Alfa Bank anomaly in October 2020, he told prosecutors that the DNC was the source of the allegation.

Q. Okay. So in your first meeting with the government, you — this is October of 2020, correct?

A. Yes.

Q. You told them multiple times that you believed that the Democratic National Committee was the source of the allegations of connections between Alfa-Bank and Russia, correct?

A. Correct, which was wrong.

Q. Okay. But you said that you thought the Democratic party itself was who provided the information, correct?

A. I did say that in the meeting.

That’s even what he has written down in a briefing document he kept in Fall 2016.

At the end of that October 2020 interview, prosecutors threatened Gaynor with prosecution.

His more recent testimony, starting for the first time on May 13, was that Sussmann was representing himself. The reason he now remembers that to be true goes to the heart of Durham’s materiality: it would have mattered if Sussmann was representing the DNC, so he must have been representing himself.

Q. Okay. I want to ask you, first, about testimony that you gave today where you said that when Mr. Moffa told you that Mr. Sussmann was a DNC attorney, you said, “I understood that to mean that he had been affiliated with the Democratic party but that he had come representing himself on the Alfa-Bank allegations.” Do you remember giving that testimony?

A. That was my take-away.

Q. And you gave that testimony that I just read?

A. Yes; that he was a DNC attorney, but that my take-away from that discussion was that he wasn’t there representing the DNC.

Q. When you were asked, “When Mr. Moffa said Mr. Sussmann was an attorney for the DNC, what impression did you come away with?” what did you understand that to mean? And your answer was: “I understood that to mean that he had been affiliated with the Democratic party, but that he had come representing himself,” right?

A. So he’s affiliated with the Democratic party because he was a DNC attorney.

Q. And your impression was he had come representing himself?

A. My take-away from that meeting, what I recall, is that I did not believe that he was there representing the DNC specifically because, had he been, that would have been information that would have impacted it.

This is a tautology: If Sussmann had been representing the DNC it would have mattered so it must be the case that Gaynor believed he was not representing the DNC. It also happens to be the central argument of DeFilippis’ materiality claim.

Meanwhile, Scott Hellman — Durham’s star cyber witness — received a text from his boss, Nate Batty (with whom he compared notes before his first interview with Durham), referring to the white paper as a “DNC report” on September 21, 2016, two days after Jim Baker received the materials.

Michael Sussmann lawyer Sean Berkowitz asked Hellman about that the other day. At first, Hellman expressed surprise about that text.

Q. All right. And then, with respect to Stranahan, he asks you and Nate to write a report about the — write a summary of the DNC report. Correct? That’s what it says?

A. That’s what it says in this chat, yes.

Q. And did you understand, sir, that the information had come from a DNC, meaning Democratic National Committee, source?

A. I did not understand that, no.

Q. Did you know what Nate Batty knew about it?

A. I don’t think he knew anything about it.

Q. Did you call up Tim and say, what a second. This is a DNC report? That’s political motivation.

A. No.

Q. Didn’t do anything or it didn’t occur to you?

A. The first time I saw this was two years ago when I was being interviewed by Mr. DeFilippis, and I don’t recall ever seeing it. I never had any recollection of this information coming from the DNC. I don’t remember DNC being a part of anything that we read or discussed.

Q. Okay. When you say, the first time you saw it was two years ago when you met with Mr. DeFilippis, that’s not accurate. Right? You saw it on September 21st, 2016. Correct?

A. It’s in there. I don’t have any memory of seeing it.

Later in Berkowitz’ cross-examination he returned to the text. He asked how it could be that a white paper from a DNC lawyer could be referred to as a DNC report.

Q. And although you were surprised to see it today, it appears that at least somebody, such as Mr. Batty was aware and you were aware that somebody was calling this white paper a DNC report. Correct?

A. I was not aware that anybody was calling it a DNC report, and I don’t believe Mr. Batty knew that either.

Q. But you saw the link message. Right?

A. I did see the link message, yes.

Berkowitz asked Hellman how it could be that he would see a reference to a DNC report and not take from that it was a DNC report. Hellman describes “the only explanation that … was discussed” — which is that it was a typo.

Q. What’s your explanation for it?

A. I have no recollection of seeing that link message. And there is — have absolutely no belief that either me or Agent Batty knew where that data was coming from, let alone that it was coming from DNC. The only explanation that popped or was discussed was that it could have been a typo and somebody was trying to refer to DNS instead of DNC.

Q. So you think it was a typo?

A. I don’t know.

Q. When you said the only one suggesting it — isn’t it true that it was Mr. DeFilippis that suggested to you that it might have been a typo recently?

A. That’s correct.

Q. Okay. You didn’t think that at the time. Right?

A. I did not. I had never seen it or had any memory of seeing it ever before it was put in front of me.

With some prodding, Hellman admitted that when he referred to “discussing explanations,” he meant doing so with Andrew DeFilippis. This exchange was, quite literally, Berkowitz eliciting Hellman to provide an answer that DeFilippis thought up — one necessary to sustain DeFilippis’ narrative — without, at first, admitting it was DeFilippis’ opinion of what the truth must be.

So after DeFilippis threatened Gaynor with prosecution, he came to remember something other than what the note, tying the white paper to DNC lawyer Michael Sussmann, that he used to “refresh his memory” said.

And when faced with the possibility, two years or maybe six after the fact, that Scott Hellman’s epically shitty analysis of the white paper could have been influenced by being told that it was a DNC white paper, Hellman offered up the explanation that DeFilippis offered him.

At least twice, then, under coaching from Durham’s lead prosecutor, key witnesses have come to believe something other than what the documentary evidence suggests.

The fact that DeFilippis has twice coached witnesses to deny any understanding at FBI that this was a DNC tip — whether it was a DNC tip or not — is really telling. That’s because DeFilippis has to try to pitch a nearly unsustainable position: how his single witness to Sussmann’s alleged crime, Jim Baker, can in 2016 have told Bill Priestap the following:

Q. I think you testified yesterday that by this time you were at least generally aware that Mr. Sussmann represented the DNC in connection with hacks; is that right?

A. That’s correct.

Q. And what, if anything, did you say to Mr. Priestap about that?

A. I think I told him like, okay, this is who Michael is. He’s represented the Democratic party in the Russian hack that we were also investigating and/or the Hillary Clinton Campaign. So just, again, to orient Bill to who Michael was. I mean, that’s a serious credential in terms of being a cyber security expert. And then to explain: But in this case he said he’s not appearing on behalf of them. In this case he’s coming in as a good citizen.

And then, in 2018, have told Jim Jordan the following:

Q. Mr. Jordan then says: “And he was representing a client when he brought this information to you or just out of the goodness of his heart? Someone gave it to him and he brought it to you?”

A. In that first interaction, I don’t remember him specifically saying that he was acting on behalf of a particular client.

Q. Did you know at the time that he was representing the DNC in the Clinton campaign?

A. I can’t remember. I had learned that at some point. I don’t, as I said — as I think I n said last time, I don’t specifically remember when I learned that — excuse me — so I don’t know that I had that in my head when he showed up in my office. I just can’t remember.

Q. Did you learn that shortly thereafter if you didn’t know it at the time?

And then testify last week this way.

Q. Okay. Number two, did you know on the September 19th, 2016 meeting that Mr. Sussmann had been representing Hillary For America’s campaign and the DNC in connection with the hack investigation. Did you know that on September 19th when he met with you?

A. Sitting here today, I think the answer is, yes, I did know that by that point in time.

Q. I’ve written down, “yes, DNC and HFA and hack”. I want to be really clear. You’re not saying that he said that in the meeting. correct?

A. Correct.

Q. And you’re not saying he said he was there on behalf of them? You’re just saying that in your mind you knew that he had been acting as a lawyer for those two entities in connection with the hack. Correct?

It’s not just a question of whether Baker will be a credible witness, though his wildly changing claims about the DNC are among the reasons why his testimony is not credible.

It’s also that Durham wants to point to Sussmann’s failure, a year earlier in a Congressional hearing, to offer up his ties with the Democrats as proof he was lying. But Durham is treating Baker’s failure to do so in the same situation as an innocent mistake. For his single witness to be credible, DeFilippis has to find a way to excuse Baker’s failure to offer that up in a far more direct question while pointing to Sussmann’s failure to offer it up as proof of guilt.

He has to do so to defend his prosecutorial decisions, too. Given how much stake DeFilippis has placed on Baker sharing with Priestap that he knew Sussmann represented the Democrats, it makes it far less credible that Baker didn’t knowingly lie to Jordan. Especially given the way Baker responded to a Berkowitz question, suggesting that perhaps he hadn’t been truthful with Jordan, but instead was “careful.”

Q. And when you gave voluntary information to Congress, you understood that you were under oath?

A. I don’t think I was under oath, but I understood that it’s a crime to make false statements to Congress.

Q. So you tried to be as careful as you could. Correct?

A. I tried to be as careful as I could in that environment, yes, sir.

Q. You tried to be as truthful as you could?

A. (No response)

Q. Tried to be as truthful as you could?

A. Yes, sir.

Sussmann’s team is going to argue that there are a long list of people against whom there is far better evidence for false statements or perjury charges than him, with the single difference being that the other people were willing to tell the storytale DeFilippis is using prosecutorial resources to tell. And the first person on that list — it makes me sick to my stomach to say — is Jim Baker.

Finally, it’s a matter of materiality. DeFilippis has to find a way for it to be the case that his single witness knew when he met with Sussmann that Sussmann was a DNC lawyer (because Bill Priestap’s notes reflect that), but didn’t view that to be material to everything that happened next.

And the only way to sustain that rickety narrative is to ensure that no one else — not even the people using documentary proof reflecting a belief that this was a DNC report to refresh faded memories — understood that the white paper came from the DNC.

Thus far, Sussmann’s cross-examination has elicited evidence that at least three witnesses changed their testimony after interviews with DeFilippis, adopting a “memory” that conflicts with the documentary record with regards to whether the FBI believed the white paper to be associated with the DNC.

OTHER SUSSMANN TRIAL COVERAGE

Scene-Setter for the Sussmann Trial, Part One: The Elements of the Offense

Scene-Setter for the Sussmann Trial, Part Two: The Witnesses

The Founding Fantasy of Durham’s Prosecution of Michael Sussmann: Hillary’s Successful October Surprise

With a Much-Anticipated Fusion GPS Witness, Andrew DeFilippis Bangs the Table

John Durham’s Lies with Metadata

emptywheel’s Continuing Obsession with Sticky Notes, Michael Sussmann Trial Edition

Brittain Shaw’s Privileged Attempt to Misrepresent Eric Lichtblau’s Privilege

The Methodology of Andrew DeFilippis’ Elaborate Plot to Break Judge Cooper’s Rules

Jim Baker’s Tweet and the Recidivist Foreign Influence Cheater

That Clinton Tweet Could Lead To a Mistrial (or Reversal on Appeal)

John Durham Is Prosecuting Michael Sussmann for Sharing a Tip on Now-Sanctioned Alfa Bank

Apprehension and Dread with Bates Stamps: The Case of Jim Baker’s Missing Jencks Production

Technical Exhibits, Michael Sussmann Trial

Jim Baker’s “Doctored” Memory Forgot the Meeting He Had Immediately After His Michael Sussmann Meeting

Apprehension and Dread with Bates Stamps: The Case of Jim Baker’s Missing Jencks Production

/111 Comments/in , /by

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs of transcripts. But if you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations. This coverage reflects the culmination of eight months work. 

I’ve done a couple of posts showing how much fun one can have with Bates stamps — the serial numbers stamped onto every page of discovery that tells you a little bit about how any document was treated. In this post, for example, I showed that when John Durham accidentally-on-purpose released an exhibit with a bunch of Fusion GPS documents, he wasn’t doing so primarily to get them admitted at trial, because he had no intention of using most of them at trial. In this post, I showed that Durham hadn’t looked at key investigative documents that Michael Horowitz had relied upon in the Inspector General investigation into Crossfire Hurricane before Durham claimed he knew better than Horowitz about the predication of the Russian investigation. As of now, by the way, Horowitz is on the schedule to be a witness for Michael Sussmann. Ostensibly he’ll just talk about how valuable an anonymous tip that Sussmann once shared on behalf of Rodney Joffe proved to be, but who knows whether he’ll get a question about comments Durham has made about knowing better than Horowitz about things he hadn’t done the work to understand?

This post about Bates stamps won’t be so fun. It fills me with dread.

In this post and these two threads (Thursday night, Friday morning), I tried to summarize the Greek tragedy of Sussmann lawyer Sean Berkowitz’ cross-examination of Jim Baker. The short version of it is that these two men, men who used to be friends, are stuck in some nightmare Hunger Games created by a right wing mob led by Donald Trump. After years of being dragged through the mud because they dared to try to protect the United States from Russia in 2016, the survival of each depends on taking out the other. Jim Baker only avoids prosecution if he adheres obediently to John Durham’s internally contradictory script. Sussmann only gets his life back if he takes Baker out. While just Sussmann’s lawyer, Sean Berkowitz, and Jim Baker appear on this stage, it’s quite clear that Durham and DeFilippis set it.

Berkowitz started by quoting Baker’s explanation, from his earlier testimony, for why he had never searched his own files for texts with Sussmann.

Q. It’s your investigation, you said. I’m just here to answer the questions. Right? It’s Mr. DeFilippis’ investigation. You’re just here to answer the questions. Is what you said?

The context of that statement, from Andrew DeFilippis’ direct questioning of Baker, is crucial to understanding what follows.

The comment was Baker’s explanation to Durham’s lead prosecutor for why he only found a September 18, 2016 text from Michael Sussmann in March of 2022, almost six months after an entire indictment had been built around what Sussmann had said, instead, on September 19. As teed up by DeFilippis, Baker went looking for and found that text because Durham was just trying to comply with Jencks obligations, the requirement that prosecutors provide the prior statements of government witnesses in their possession to defendants.

Q. Are you familiar with the concept of Jencks materials or 3500 materials?

A. Yes.

[snip]

A. Correct. Yes. It’s an act of Congress that requires that — the reference to 3500 is a section in the U.S. Code.

Q. So did there come a time when you were asked by the Government to give any statements you might have on the subject of your testimony today?

A. Yes.

Q. And just tell us how that happened and then what you did in response.

A. There was a phone call with the Government. I think it was in March of this year. And it was to discuss discovery-related matters in part in the conversation. And I think it was Mr. Durham who asked me, you know: You need — we have an obligation to hand over discovery to the defense in this case. And can you go look for emails and other communications that you might have had with Mr. Sussmann?

And so in response to that, I — after we got off the phone, I immediately went to my phone and started looking through emails and then I looked for texts. And I did a search for texts with Michael’s last name; and texts came up, and I scrolled through them. They took a while to down — it was clear to me at least that they were downloading from the cloud.

And as I scrolled through and got to the beginning of my set of communications with Michael, this is the first one that I had.

Q. Now, had you — have you spoken to and met with the Government in connection with this case previously?

A. Yes.

Q. And had you previously located this text message here?

A. Not to the best of my recollection. No.

Q. What, if anything, was the reason for that?

A. It’s — I was not — I mean, the way I thought about it was that frankly, like, I am not out to get Michael. And this is not my investigation; this is your investigation. And so if you ask me a question, I answer it. If you ask me to look for something, I go look for it. But to the best of my recollection, nobody had asked me to go look for this material before that. [my emphasis]

Nobody had ever asked him to go look for evidence in his own possession related to the defendant against whom he was the key witness before, Baker testified. There’s a lot that’s unsaid — and batshit crazy — about this. One is that Durham only asked for communications directly with Sussmann, at least as Baker described events that happened just a few months ago.

Anyway, that was Durham’s explanation for how this text got shared with the government in March, six months after Durham had charged Sussmann for lying to hide what Durham imagines were Sussmann’s self-interests in a meeting with Baker on September 19, 2016. And by Baker’s telling, this belated request wasn’t just an example of DeFilippis trying to cover up his past incompetence (again). Durham was personally involved in this.

The only Bates stamp on this exhibit looks like this:

As you can see from Sussmann’s challenges to Durham’s exhibits submitted earlier this month, SCO-###### is one of two standard Bates stamps that Durham uses, the other being SC-########. Note both have a dash.

I knew as soon as I read the transcript that DeFilippis’ suggestion that this was about Jencks was intentionally misleading. Almost certainly, Durham found this text because they were still trying to comply with Sussmann’s demands, first made immediately after the indictment and then over and over after that, that prosecutors find  the communications about Sussmann’s role in killing a NYT story that he knew must exist. Besides, Jencks is an obligation to turn over statements about an investigation in the government’s possession. These texts weren’t, until Durham asked for them, in the government’s possession.

I mean, I guess if they were, and Durham had been sitting on them for six months, then Durham has even bigger problems, which I don’t rule out.

That’s the background to the way Sussmann’s lawyer began his cross-examination. After reminding Baker of this statement, Berkowitz then laid out that, while Baker had met over ten times with Durham’s team, he had declined to meet with Sussmann’s team. Berkowitz introduced a letter he had sent Baker’s lawyer on April 20, asking to meet.

That letter had no Bates stamp. Just the Exhibit number submitting it into evidence.

That suggests Durham’s team hadn’t seen this letter yet — though I’m sure nothing about the letter was a surprise to them. Baker has met with Durham’s team at least twice since Berkowitz sent this letter. Berkowitz asked if Baker knew about the letter but Baker dodged, saying only that he had delegated the decision about meeting with Sussmann’s team to his lawyer, Dan Levin.

Then Berkowitz asked whether Baker knew what it was like to be under criminal investigation.

A. Yes.

Q. That’s Mr. Durham?

A. Yes.

They talked for a while about an earlier Durham investigation, one that lasted from 2017 until 2019 (Berkowitz made Baker repeat the dates), into whether information about surveillance that Baker had shared with a journalist had, or had not, been an authorized disclosure. Berkowitz talked about what might have happened had Baker been charged.

Loss of his legal career.

Being prosecuted.

Berkowitz talked about how that investigation basically boiled down to several conflicting versions of a phone call that other witnesses had given Durham. Their word against Baker’s.

Q. So at least one of their recollections was inconsistent with yours. Right?

A. Yes. Yes.

Q. Memories are a difficult thing, aren’t they, sir?

A. That’s a difficult question to answer. That depends.

That’s how Berkowitz prefaced the first of a long list of things Baker had said in Michael Sussmann’s trial that conflicted with things he had said in the past, a list that carried into a second day (actually Baker’s third day on the stand). At this point, Berkowitz mentioned just one of them — Baker’s inconsistent testimony to the Inspector General in July 2019 — then interrupted.

He put up a text to Ben Wittes that Baker sent the day after Durham was appointed in this matter (so weeks before that particular interview with the IG). Wittes and Baker were talking about TV appearances, but Baker seemed preoccupied by the Durham appointment.

MR. BERKOWITZ: The date, Mr. Cleaves.

THE WITNESS: There we go. Okay. Sorry. May 14th, 2019. Thank you.

BY MR. BERKOWITZ:

Q. And you write: “It went well. It was about the Love piece which was good. CNN Tonight was okay but didn’t cover that at all. And now I get to be investigated for another year or two by John Durham. Lovely.” Correct?

A. Right.

Q. So you expected to be investigated further by Mr. Durham. Correct?

A. Yes, I did.

I’ll come back to the metadata on the text in just a bit.

The text makes it clear how, after being investigated by John Durham from 2017 to 2019, upon learning that Durham had just been appointed to investigate other matters implicating Baker, FBI’s former General Counsel immediately realized the investigation would continue for another two years.

Baker was wrong about the timing. Durham’s investigation just celebrated its third birthday.

This text frames all of Baker’s subsequent cooperation in that light — in Baker’s immediate recognition that the hell he had been going through for the previous two years would continue another two. Or three. Or longer.

This is brilliant lawyering on Berkowitz’s part. But remember as you read along that this is really a Hunger Games conflict staged by Trump and Bill Barr to exploit the US Justice system to create a never-ending supply of revenge theater that will incite the base and lead the press to do shitty reporting for easy clicks. This is an act of revenge targeting anyone who has ever dared to question Trump’s corruption. Or even, question the dangers of Russian interference in American democracy.

Back to Berkowitz. After showing Baker the text reflecting his immediate dread about being investigated by Durham for two more years, Berkowitz described how, the day after Durham’s appointment (actually it was about three days after, and so two days after this text), Baker had his lawyer reach out to Durham and offer to cooperate.

The letter is actually kind of funny. It shows Levin emailing and saying, “Jim asked me to reach out and let you know that he is available if you wish to interview him (he just spoke to the IG today).” Durham seems to have forwarded that email from one of his DOJ emails to another. I sort of wonder if there was a BCC, because Durham was in really close contact with Bill Barr’s office in these weeks. Durham then attempted to write back to Levin but at least as it appears (because he forwarded the email to himself rather than simply replying with a CC to his second DOJ account), Durham simply wrote to himself, responding into a void about meeting with “tour client” soon.

The Bates stamp for this exhibit looks like this:

DX-811 is the exhibit number for this trial (DX shows that it is one of Sussmann’s exhibits, as opposed to one of the government’s).

LW-06_0001 may reflect Sussmann’s Latham & Watkins’ lawyers sharing their proposed exhibits with Durham and Judge Cooper before the trial.

SCO-012114 is the regular Bates stamp associated with Durham’s production to Sussmann. It’s part of the same series (though much earlier in) the Bates stamp of the text that Baker turned over to Durham on March 4. SCO dash ######.

And SCO-3500U-4007 seems to be a Bates stamp specifically tied to Jencks discovery, which as noted above is called Rule 3500. That’s a really handy Bates stamp because it may indicate what Durham is treating as Jencks discovery. It appears in other direct statements made by Durham’s witnesses about this investigation. The calendar entry for the September 19, 2016 meeting between Baker and Sussmann, for example, has one of those 3500 stamps.

The text that, DeFilippis suggested, Durham had only asked for out of a diligent desire to comply with Jencks obligations doesn’t have one of these 3500 Bates stamps. Here it is again, SCO dash ######.

Having shown those three documents — Berkowitz’s request for a meeting with Baker, Baker’s text to Wittes dreading two more years of investigation by Durham, and Levin’s letter to Durham immediately after his appointment offering to come in for an interview — Berkowitz then resumed talking about inconsistencies in Baker’s testimony. He alluded, briefly, to a sworn statement Baker made to the grand jury under questioning from DeFilippis about the role that the General Counsel would have in FBI investigations. Then, after going through what Baker’s current testimony is, Berkowitz asked,

Q. The fact that Mr. Sussmann stated specifically in his message that he was acting on his own and not for a client did not factor heavily into your decision to meet with him. Correct?

This statement is inconsistent with the testimony Baker gave on the stand. Baker disavowed it.

A. I disagree with that.

So Berkowitz did what’s known as “refreshing” a witness’ memory, first by reading him what the 302 memorializing an FBI interview said.

Q. All right. Do you remember speaking with these folks in March of this year — by these folks to be, correct for the record, the prosecution team, Mr. DeFilippis?

A. In March of this year, I spoke to them, yes.

Q. Okay. And in March of this year, is it not true that you told them you do not believe that the fact that Sussmann stated specifically in his texts that he was acting on his own and not for a client factored heavily into your decision to meet with Michael Sussmann the very next day. You told them that?

A. Can you repeat the first part of that again? Sorry.

Q. “Baker does not believe that the fact that Sussmann stated specifically in his text message that he was acting on his own and not for a client factored heavily into his decision to meet with Sussmann the very next day”?

Baker, perhaps realizing that this interview from a few months ago conflicts with the testimony he has just given, had forgotten the question.

A. So, I’m sorry. What’s your question?

Q. You told them that on March 4th of 2022.

Baker didn’t recall giving that conflicting testimony.

A. Sitting here today, I don’t recall telling them that.

Berkowitz offered to show him the proof: a 302 interview report that, unlike the meeting between Baker and Sussmann on September 19, 2016, actually documents what was said.

Q. Refresh your recollection to see the 302 of your meeting, sir?

A. Sure. I haven’t seen that 302 before.

This is an opportunity for Berkowitz to explain, as he did when he used one to refresh Scott Hellman’s memory earlier in the week, what a 302 is and how FBI always creates 302s for fact witnesses.

Q. All right. And to orient the jury is when an agent is present and take notes. Correct?

A. It’s a report of an interview.

Q. And when a witness is interviewed by the FBI, an agent is there to take notes, if it’s a fact witness, and put it into a report. Correct?

A. Correct.

Q. You didn’t do that with Mr. Sussmann. Right?

A. Correct.

Berkowitz asked Baker if he remembered making the statement on March 4. DeFilippis’ single witness to Sussmann’s alleged crime professed, for the second time in short order, not to remember something that happened just a few months ago.

Q. Does it refresh your recollection that, on March 4th of 2022, you told the FBI and Mr. DeFilippis that you didn’t believe the fact that Mr. Sussmann stated specifically in his text he was acting on his own and not for a client factored heavily into your decision to meet with Mr. Sussmann the next day?

A. I don’t recall making that statement sitting here today.

Q. And it’s your testimony

MR. BERKOWITZ: You can take that down.

BY MR. BERKOWITZ: Q. It’s your testimony that that’s not accurate. Correct?

A. It’s my testimony today that, as I think about it today, that that’s not accurate.

More than just forgetting what he said a few months ago, Baker is showing the jury how, if his current belief conflicts with a past one shared under threat of false statements charges, he’ll simply say his past truth is not the truth. Not accurate.

Then Baker thinks of something: the significance of the date.

A. Can I ask you a question? When was that 302? What was the date? What meeting or what interview was that pertaining to?

Q. There’s a lot of different meetings and interviews here. This one was a couple of months ago on March 4th of 2022 —

A. Okay.

Q. — in connection with your trial preparation for today.

A. That was the date that I found the text, yes.

Q. Okay. Did that change your recollections at all or —

Baker explains that discovering a text in which Sussmann had stated that he wasn’t asking for the September 19, 2016 meeting “on behalf of any client,” but wanted to help the FBI had upset him, suggesting that might explain why he gave testimony a few months ago that substantially differs from the testimony he gave on the stand.

A. Well it’s just it was a very — it was a very difficult day for me and it was a bit upsetting.

As a reminder, this day was not just a stressful one for Baker. While I can’t think of an evidentiary basis by which Sussmann could share this with the jury, after Baker found a text that greatly complicated Durham’s prosecution, Durham accused Sussmann of hiding evidence, a stance he was forced to drop after Sussmann obtained a subpoena on his own to disprove that accusation.

Anyway, after noting that Baker met with Durham in spite of the stress of having found the text, Berkowitz asked Baker, for the first time in this Hunger Games conflict, whether he was aware that it was a crime to lie to the FBI.

A. I know very well it’s a crime to make a false statement to the FBI if that’s what you are getting at. Whether they say it or not, I know it.

At that point, Berkowitz pulled out a white board and starting writing down the things that Baker was committing to believing were the truth. He started with “the elephant in the room,” the memory that, if the jury finds it shaky, will sink this entire prosecution.

Q. Let’s start with the elephant in the room. Sitting here today, what is your testimony about what Mr. Sussmann told you relative to clients?

A. At the meeting in person on the 19th of September?

Q. Yes.

A. Okay. My testimony is that he said that he was not there on behalf of any particular client or words to that effect.

Q. Oh, now it’s “words to that effect.” Okay.

DeFilippis objected.

He didn’t want Berkowitz to write this down, I’m sure, because any juror taking notes is going to write down exactly what Berkowitz writes down, thereby solidifying the points in their memory. That’s how my memory works anyway: If I write it down, I’m far more likely to remember it. People think I have a really good memory, but in actuality, I just write a lot more than most people.

DiFilippis probably also didn’t want Berkowitz to write this down because it’ll isolate the key claims that Baker has made, thereby making it easier for jurors to compare his currently operative statements with what he had said in the past. DeFilippis wanted just the court reporter to write this down, in a transcript that won’t ever be shared with the jury.

MR. DeFILIPPIS: Objection, Your Honor, we do have a court reporter.

THE COURT: Overruled.

Berkowitz walked Baker through his currently operative story for the following:

  • What Sussmann said on September 19 about having a client
  • Whether Baker knew Sussmann worked for Hillary that day
  • How long the meeting was
  • What Sussmann said about a news organization ready to publish a story
  • Whether he identified any particular cyber experts
  • Whether those experts — Steve Bellovin, Matt Blaze, and Susan Landau — had vouched for the data
  • Whether Baker or Sussmann had taken notes
  • Whether he had refused to share Sussmann’s name when Scott Hellman and an FBI administrative person  named Jordan Kelly had come to obtain the materials, as Scott Hellman testified earlier in the week

That’s when they break for lunch. After lunch they go over Baker’s meeting with Bill Prietsap, his calls to get Eric Lichtblau’s name later in the week, and his foggy memory about the details from the the March 6, 2017 when the Alfa Bank allegation comes back up. I’m not sure whether this got written onto a white board or not (it sounds like Berkowitz had filled the white board before lunch).

Berkowitz then returned to the many times Baker had given conflicting testimony under oath, starting with his testimony before Congress.

Q. And when you gave voluntary information to Congress, you understood that you were under oath?

A. I don’t think I was under oath, but I understood that it’s a crime to make false statements to Congress.

Q. So you tried to be as careful as you could. Correct?

A. I tried to be as careful as I could in that environment, yes, sir.

Q. You tried to be as truthful as you could?

A. (No response)

Q. Tried to be as truthful as you could?

A. Yes, sir.

Berkowitz then went through and laid out how his prior testimony conflicts with what he’s just laid out on the whiteboard and after lunch.

Again, great lawyering, but the reason this is so dreadful is because this is precisely the kind of Hunger Games conflict that Reality TV show star Donald Trump uses to accrue power.

Berkowitz reminded Baker that his two appearances before Congress in October 2018 could be subject to false statement prosecution, his 2019 interview with the Inspector General (which Baker calls “the I.G. thing”), the two meetings with Durham at which Sussmann was raised in June 2020 (at such time as Trump and Barr were pressuring Durham for pre-election results). All potentially subject to prosecution as false statements or perjury.

Berkowitz ended the day by asking about threats, returning again to the possibility that any single one of these inconsistent statements — the most recent of which discussed thus far was on March 4, 2022, the statute of limitation for which would not expire until 2027 — could be charged as a false statement.

Q. Did they threaten you, sir, with anything — based on the fact that you had previously told folks under oath or subject to perjury — that you had said inconsistent things?

A. Mr. Durham and his team have never threatened me in any way.

Q. But you understood, sir, did you not, as a lawyer, that if you had said something that someone determined was false, under oath, or subject to perjury, you could be prosecuted. Correct?

I suspect that, by the end of the week, Berkowitz will argue that several of Durham’s witnesses have made more easily provable false statements — and more material — to the Special Counsel and others than Sussmann, but Durham is not choosing to prosecute the ones who tell the story he wants told, the story he chooses to refresh. Remember, there are at least three documents already introduced that Durham chose not to use to refresh Baker’s memory to something different than he delivered on the stand last week.

Which brings me back to DeFilippis’ excuse for finding a text that Sussmann was asking for but which Durham had never bothered to look for, and the inconsistent statement — that Sussmann’s notice that he was not there on behalf of any client had a big role in him taking the meeting — and Baker’s attribution of his now-inconsistent answer to stress.

Durham discovered on March 4 that Baker had relevant texts he never bothered to ask for in 16 months of investigation before he charged Sussmann. DeFilippis introduced that text by claiming prosecutors had discovered it by asking — John Durham asked himself, according to Baker — for Jencks material.

That text has no Bates stamp reflecting that it is Jencks material.

There’s something else about that text. It looks nothing like the text that Berkowitz entered describing Baker’s dread as he realized Durham was going to be investigating for two more years. Here’s the text Baker turned over in March, in response to Durham’s request for any communications involving Sussmann, but only communications involving Sussmann.

Here’s the text to Wittes expressing certainty that Durham would investigate him for two more years.

These are both iMessage texts! They look entirely different, though, because one is a screen cap turned over by Baker, and the other was obtained via legal process served on Apple (which is where all the extra metadata comes from).

More interesting still, however, is the Bates stamp on the set of texts involving Wittes. The Bates stamp on that text looks like this:

There’s the red stamp that, I’m guessing, is the stamp associated with a pre-trial proposed exhibit.

There’s the trial exhibit stamp, DX-810.

And then there’s a Bates stamp that does not match any Durham Bates stamp I’ve seen. SCO_######. Underscore, not dash.

Although this is a statement by a witness — the key witness!! — about this very investigation, there’s no Jencks stamp.

Mind you, the government only has to turn over statements about an investigation under Jencks if it is in their possession. So maybe this was never in their possession? If it was, it’d be a Jencks violation and Sussmann could ask to have the entirety of Baker’s testimony thrown out. All of it.

I have no idea where this text string comes from. Perhaps it came from an FBI Inspection Division investigation of all these same people; such material was among the stuff that Durham was permitted to turn over late. Perhaps, as Latham & Watkins did when Durham accused Sussmann of hiding this text, they got a subpoena and obtained it themselves. But it appears, at least, that it didn’t come from Durham.

If that’s right — if, even after discovering that Baker had texts that were absolutely critical to this investigation that he had never turned over, Durham didn’t choose to obtain these texts directly from Apple themselves, or at the very least ask Baker to turn over all texts pertinent to his investigation — there are several implications. First, it’s proof that Durham never ever subjected Baker, the guy who offered to cooperate on day three, to investigative scrutiny for his role in the events from September 19, 2016 that Durham has chosen to criminalize. Nor has Durham tested what might be behind any of Baker’s subsequent inconsistent statements. And when Durham discovered that Baker had had texts that were critical to his investigation almost three years into the investigation, his first response was to attempt to blame Sussmann. When that didn’t work, it appears, Durham didn’t put his prosecution at risk to see what other texts, texts that might be critical to Durham’s investigation but which didn’t involve communications between him and Sussmann, might be in Baker’s iCloud account.

This is brilliant lawyering. But it’s all just a part of Donald Trump’s Hunger Games, revenge theater targeting the people who questioned his complicit ties with Russia. And the wrong people are going to get hurt.

Other Sussmann trial coverage

Scene-Setter for the Sussmann Trial, Part One: The Elements of the Offense

Scene-Setter for the Sussmann Trial, Part Two: The Witnesses

The Founding Fantasy of Durham’s Prosecution of Michael Sussmann: Hillary’s Successful October Surprise

With a Much-Anticipated Fusion GPS Witness, Andrew DeFilippis Bangs the Table

John Durham’s Lies with Metadata

emptywheel’s Continuing Obsession with Sticky Notes, Michael Sussmann Trial Edition

Brittain Shaw’s Privileged Attempt to Misrepresent Eric Lichtblau’s Privilege

The Methodology of Andrew DeFilippis’ Elaborate Plot to Break Judge Cooper’s Rules

Jim Baker’s Tweet and the Recidivist Foreign Influence Cheater

That Clinton Tweet Could Lead To a Mistrial (or Reversal on Appeal)

John Durham Is Prosecuting Michael Sussmann for Sharing a Tip on Now-Sanctioned Alfa Bank

That Clinton Tweet Could Lead To a Mistrial (or Reversal on Appeal)

/34 Comments/in , /by

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

If you follow coverage of the Michael Sussmann trial anywhere but here and Politico, you would believe that the big news from Friday is that former Hillary campaign manager Robby Mook testified that Hillary personally approved of sharing the Alfa Bank story. As part of that coverage, virtually everyone is also covering the tweet admitted where Hillary focused attention on the Franklin Foer story after it came out.

Here’s how CNN covered it.

Slate published a story on October 31, 2016, raising questions about the odd Trump-Alfa cyber links. After that story came out, Clinton tweeted about it, and posted a news release that said, “This secret hotline may be the key to unlocking the mystery of Trump’s ties to Russia.”

[snip]

Inside the courtroom, prosecutors showed the jury Clinton’s tweet about the Trump-Alfa article from Slate, and Mook read aloud portions of the campaign’s news release about the story. The release was from Jake Sullivan, who is currently President Joe Biden’s national security adviser.

“We can only assume that federal authorities will now explore this direct connection between Trump and Russia as part of their existing probe into Russia’s meddling in our elections,” Sullivan said in the release on October 31, 2016, one week before Election Day.

The special counsel team has previously said that the Clinton campaign’s media blitz around the Slate story “is the very culmination of Mr. Sussmann’s work and strategy,” to allegedly gin up news coverage about the Trump-Alfa allegations and then get the FBI to start an investigation.

During the hearing, Twitter users recirculated Clinton’s old post. It caught the eye of billionaire Elon Musk, who has become increasingly vocal about political matters while he tries to buy Twitter, and recently announced his support for the Republican Party. He called the Trump-Alfa allegation “a Clinton campaign hoax” and claimed that Sussmann “created an elaborate hoax.” [my emphasis]

Obviously, the frothy right has made it the center of a frenzy to investigate Hillary herself. Surely it will also lead to an investigation of Jake Sullivan.

The thing is, legally, the part about investigating wasn’t supposed to come into the trial and will be something that, at the very least, Judge Christopher Cooper issues an instruction to the jury on.

This media frenzy was the predictable result of Andrew DeFilippis breaking Cooper’s rules. Again.

Here’s what the tweet, as sent to the jury will look like.

Here’s what the transcript looks like (though I don’t believe the transcript will be sent back to the jury).

Nevertheless, the jury heard it because — just minutes after being instructed not to include the language about the FBI investigation and not to read from the tweet!! — DeFilippis “accidentally” handed Robby Mook the unredacted copy to read, and coached him to continue to read the stuff that was redacted.

Q. And is there any reason why he would be the one to issue a statement like this?

A. You know, Jake’s a pretty highly regarded national security expert.

Q. Okay.

A. So it makes sense that he’s the voice on this.

Q. Could you just read the content of Mr. Sullivan’s statement.

A. Starting with “This could”?

Q. Yes.

A. “This could be the most direct link yet” —

Q. I’m sorry, start at the top.

A. “In response to a new report from Slate showing that the Trump Organization has a secret server registered to Trump Tower that has been covertly communicating with Russia, Hillary For America Senior Policy Advisor Jake Sullivan released the following statement Monday.” Keep going?

Q. Yes.

A. “This could be the most direct link yet between Donald Trump and Moscow. Computer scientists have apparently uncovered a covert server linking the Trump Organization to a Russian-based bank. “This secret hotline may be the key to unlocking the mystery of Trump’s ties to Russia. It certainly seems the Trump Organization felt it had something to hide, given that it apparently took steps to conceal the link when it was discovered by journalists. [my emphasis]

Here’s the bench conference that immediately preceded this exchange, in which DeFilippis made one last bid to enter the tweet into evidence. This language was redacted on first release of the transcript, but got unsealed overnight.

MR. DeFILIPPIS: Your Honor, could we have a quick call? (The following is a bench conference held outside the hearing of the jury)

MR. DeFILIPPIS: Your Honor, the government believes we’ve now laid an adequate foundation for probing into admissibility in connection with the Tweet and press statement that we’ve been talking about.

Mr. Mook has testified that the candidate herself approved a decision to send this to the media. The Tweet and press statement themselves refer to the FBI, and the defense admitted a Tweet during their examination of Mr. Baker.

We don’t think it’s, in light of this testimony, in any way prejudicial or cumulative because it addresses both the FBI issue and the issue of the decision to provide it to the media.

So we would ask that we be able to present the Tweet to Mr. Mook.

MR. BOSWORTH: Your Honor, we object. It remains the case that the — you know, Ms. Clinton is not on the witness stand. Jake Sullivan is not on the witness stand.

Jake Sullivan, weeks after Mr. Sussmann went to the FBI, issued a statement about the Slate article that was published that there’s no evidence that Mr. Sussmann had anything to do with. And that press statement goes into an area that goes beyond anything for which they’ve laid a foundation. And it’s highly prejudicial in that that statement doesn’t just say this is a serious story. It calls on the FBI to investigate.

That is incredibly prejudicial because it suggests that Mr. Sussmann was going to the campaign on their behalf, and there was literally zero evidence that the campaign knew Mr. Sussmann was going, including in Mr. Mook’s testimony today.

And second, that’s weeks after Mr. Sussmann went to the FBI. And the statement itself doesn’t say, “We’re so glad the FBI’s already investigating.” They’re steering far clear of any knowledge they could have even conceivably had about the investigation.

So we think Your Honor’s prior ruling stands.

THE COURT: All right. I want to review the statement again for the information that you say is extraneous.

Generally, as I indicated, I think, earlier this week, this does complete the story, and a lot of this is subject to cross. I think it can be explained that — just because it has Ms. Clinton’s name on it and is a statement of the campaign and it completes the narrative that the government has tried to advance, but I am concerned about any other extraneous information of the Tweet that may not be pertinent. So let me take a look at it. Can you complete your cross, or shall we just take a break?

MR. DeFILIPPIS: Maybe take a break, Your Honor. (This is the end of the bench conference)

THE COURT: All right. Ladies and gentlemen, we’re going to take about a five-minute break, so if you could just — to resolve an evidentiary issue. So if you could just retire to the deliberation room, we’ll call you when we’re ready. (Jury exits courtroom)

[snip]

THE WITNESS: Yes, Your Honor.

MR. BOSWORTH: Your Honor, do you want me to pass it up?

THE COURT: Yes, if you can pass it up. We have it back in chambers, but let me…

THE COURTROOM DEPUTY: Everyone can be seated.

THE COURT: Please be seated. And I’ll tell you what, just give me five minutes. (Recess taken)

THE COURT: All right. Mr. DeFilippis, if you can lay a foundation that he had knowledge that a story had come out and that the campaign decided to issue the release in response to the story, I’ll let you admit the Tweet. However, the last paragraph, I agree with the defense, is substantially more prejudicial than it is probative because he has testified that had neither — he nor anyone at the campaign knew that Mr. Sussmann went to the FBI, no one authorized him to go to the FBI, and there’s been no other evidence admitted in the case that would suggest that that took place. And so this last paragraph, I think, would unfairly suggest to the jury, without any evidentiary foundation, that that was the case. All right?

MR. DeFILIPPIS: Your Honor, just two brief questions on that.

THE COURT: Okay.

MR. DeFILIPPIS: Can we — so can we use — depending on what he says about whether he was aware of the Tweet or the public statement, may we use it to refresh him?

THE COURT: Sure. Sure.

MR. DeFILIPPIS: Okay. And then, as to the last paragraph, could it be used for impeachment or refreshing purposes as well in terms of any dealings with the FBI?

THE COURT: You can use anything to refresh.

MR. DeFILIPPIS: Okay.

THE COURT: But we’re not going to publish it to the jury. We’re not going to read from it. And let’s see what he says.

DeFilippis wasn’t even supposed to read it!! But he ignored Cooper’s orders, issued minutes earlier, and predictably set off a firestorm.

After Mook left the stand, Judge Cooper acknowledged that the FBI paragraph shouldn’t have come in. He acknowledged that DeFilippis had used it as hearsay to admit it for the truth. Sussmann’s lawyer Michael Bosworth graciously pretended DeFilippis’ actions were not intentional.

THE COURT: All right. Please be seated. Just for the record, in addition to the 403 grounds for the last paragraph of the press statement, it’s also hearsay from Mr. Sullivan for the truth — or whether it’s being offered for the truth, certainly it’s likely to be received for the truth that the campaign wished the FBI to investigate or had some hand in the FBI investigation. So that section of the Tweet, consistent with the Court’s prior ruling, is inadmissible as hearsay as well.

MR. BERKOWITZ: Thank you, Your Honor. Just briefly?

THE COURT: Yes.

MR. BERKOWITZ: Mr. DeFilippis, I’m sure, didn’t intend it, but he gave him the unredacted Tweet to perhaps refresh his recollection. He read probably two sentences, and we would ask that you strike from the record his reading of that. I know that —

THE COURT: The Court will strike those two sentences, and we’ll specify it for the court reporter. And obviously let’s make sure that the redacted copy is included in the exhibits that go to the jury.

MR. DeFILIPPIS: Yes, we will, Your Honor.

But DeFilippis did more than “accidentally” give Mook the unredacted tweet! He also had him read it, which he had just been told not to do.

Worse still, the record shows that neither Mook nor Hillary would have known about this tweet. It surely had high level press involvement, but this was presented as the words of Hillary when it was explicitly anything but.

And this is precisely what Sussmann’s team warned would happen when, in a pretrial hearing, Cooper floated reversing his past decision to exclude the tweet.

So the more I sort of dug into each side’s sort of theories of relevance over the weekend as we finalized the last motions in limine ruling, which you obviously got, I thought I might revisit one issue. And that is the Clinton campaign press release from October, late October, I guess.

I provisionally ruled that that would not be admissible based on the submissions that you all made. And I ruled from the bench without really getting any argument on that issue. And my previous understanding was that it was being offered to show a direct attorney-client relationship between Mr. Sussmann and the campaign as well as potentially the effect on the listener under a hearsay exception.

But I guess my question, as I have thought more about this, given the sort of two competing theories of the case and two narratives laid out in the Court’s ruling on the motion in limine, is whether it is relevant not for the truth, but to show the campaign’s connection to the alleged public relations effort to play stories regarding the Alfa-Bank data with the press and that therefore it of context for the Government’s motive theory, that Mr. Sussmann sought to conceal that effort, as well campaign’s general connection to that effort.

So, Mr. Berkowitz, please address that if want.

MR. BERKOWITZ: Yes, your Honor. Thank you for raising the issue.

THE COURT: Yes. And I will also say that I’ve never introduced a tweet at a trial. And there are certain evidentiary issues with what a tweet is and who it is sent by. I would like to avoid those issues. But there is a separate press release, which I’m not quite sure I appreciated when I ruled from the bench a week and a half ago.

MR. BERKOWITZ: So let me try and address the contextualized issue, your Honor.

With respect to the campaign’s involvement or PR connection to the Alfa-Bank story, we expect there will be testimony or other evidence that ties that together. And I know that in your motion in limine ruling, you assumed without saying we conceded it that we were taking the position that Mr. Sussmann was not acting on behalf of Hillary for America.

We’re not going to be taking the position that he was not counsel for Hillary for America in connection with various efforts and communications; and we will obviously address that at trial. But I don’t know that the connection between the campaign and PR efforts, opposition research to get the story of Alfa-Bank out there is going to be something that’s in dispute.

And I would ask that you, as you think about this issue, which is somewhat inflammatory because it gets the candidate — it’s a month after; it’s a different newspaper issue; and there’s no connection between Mr. Sussmann and that tweet to suggest that he was involved in that or was otherwise doing it.

And so as what else is coming is more prejudicial relates to a number it’s evaluated, I think contextualizing into evidence, I think that that tweet than it would be probative. It also of other issues that you note from an evidentiary standpoint.

So we don’t think that the tweet itself for all the reasons in our motion, but also because it’s not — it would be cumulative, I think, of the other evidence related to whether there was a connection at the time about that. Without getting into too much work product or issues, there were updates to the campaign related to, for example, the possibility of a New York Times story coming out. And I think that that will be what’s relevant as opposed to the larger issue of, you know, whether they continue to try and press that after the meeting.

THE COURT: I appreciate that. But there were a couple double negatives in there.

MR. BERKOWITZ: Please correct me or ask me to refocus it.

THE COURT: Did I understand you to say that the defense will not be contesting that he was representing the campaign in connection with some of the media outreach that was going on?

MR. BERKOWITZ: Correct.

THE COURT: Mr. DeFilippis?

MR. DeFILIPPIS: Yes, your Honor. Let me just briefly say that I think it’s plain from the contents of the tweet and the press statements themselves that the Government is not offering those for their truth. So I think your Honor, it seems, agrees that they’re not hearsay. It’s more of a relevance/probity thing.

And while I don’t have it in front of me, your Honor, when you read the contents both of the press statement and the tweet, the thrust of them is the very culmination of Mr. Sussmann’s work and strategy, which was twofold: First, the strategy, as the Government will argue at trial, was to create news stories about this issue, about the Alfa-Bank issue; and second, it was to get law enforcement to investigate it; and perhaps third, your Honor, to get the press to report on the fact that law enforcement was investigating it.

And we see all three things there reflected in the tweet and in the press statement. It says something to the effect of, Donald Trump has a secret channel with Russia and the FBI should look into this or we trust that the FBI is looking into this.

That is highly probative, your Honor, because it is, as I said, the culmination of everything the Defendant was trying to do as he billed work to the campaign.

And we expect to call at least currently, your Honor, the campaign manager of the Hillary Clinton campaign, who will say this was a conscious decision. After being briefed specifically on Mr. Sussmann’s efforts, the campaign made a conscious decision, authorized at the very highest levels of the campaign, to share the Alfa-Bank allegations with the media.

THE COURT: Well, if that’s going to be the case, and he’s not contesting that he was representing the campaign in connection with that effort, isn’t the tweet cumulative? It’s icing on the cake. Right?

MR. DeFILIPPIS: I don’t think so, your Honor, only because we will not have, your Honor — we will not call reporters to the stand who will in fact confirm that the campaign spoke to the media. We will not — we will have essentially the testimony of a campaign official.
And then the only way to show, your Honor, how the campaign actually capitalized on what it was that Mr. Sussmann did in the media is to — and it’s a very limited — as your Honor knows, it’s not long. It’s not particularly or really at all prejudicial, your Honor, because the contents of it are essentially just the candidate and one of her advisors adopting the allegation that Mr. Sussmann has been working on.

So, your Honor, it’s really just context and the pure result of everything that Mr. Sussmann and the campaign were working on in this regard. And it’s not inflammatory. It simply states the allegation and it states that the campaign hopes the FBI’s looking into it.
We —

THE COURT: I’ll reserve on it. Let’s see how the evidence comes in. And just don’t open on it.

MR. DeFILIPPIS: Okay. Thank you, your Honor.

MR. BERKOWITZ: Your Honor, I was also asking permission to approach, but I guess I don’t need to here.

Mr. DeFilippis in describing the relevance focused on the portion of the tweet that was different than you or I were talking about, that calling on the FBI to investigate. That in and of itself in our — from our perspective suggests that they are offering the tweet for the truth of the matter, that that’s what the campaign desired and wanted and that it was a accumulation of the efforts.

Number one, it’s not the truth; and in fact, it’s the opposite of the truth. We expect there to be testimony from the campaign that, while they were interested in an article on this coming out, going to the FBI is something that was inconsistent with what they would have wanted before there was any press. And in fact, going to the FBI killed the press story, which was inconsistent with what the campaign would have wanted.

And so we think that a tweet in October after there’s an article about it is being offered to prove something inconsistent with what actually happened.

This jury is not sequestered. It would take a great deal of diligence to avoid the shit storm this set off.

There is no way to undo the damage that this will do to the trial. And it happened because DeFilippis ignored not one but two parts of Cooper’s order — first, that the reference to the FBI be redacted, and second, that it not be read.

And it’s clear from the record that this has been the plan all along, just like using a self-described non-expert at DNS to offer an opinion about DNS. The truth is it’s Durham’s team, not Hillary, that had the plan to set off an October Surprise by manipulating the press all along.

Worse still, while there are legal measures to take, even then that would not undo the damage. Anything Cooper does to correct his own poor decision and DeFilippis’ worse flouting of Cooper’s orders would be blamed on him being an Obama appointment, not the law, and only further fuel the firestorm.

Even as the record sits right now, I believe there’s a great deal from which the jury would find reasonable doubt to convict. Given where I think Sussmann’s team is going to go from here, I think chances are good they get an acquittal.

But the Durham team just succeeded in a desperate bid to win this case using hearsay. Because hearsay is all they’ve got.

Jim Baker’s Tweet and the Recidivist Foreign Influence Cheater

/75 Comments/in , , /by

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

In my post on what prosecutors need to prove to win their case against Michael Sussmann, I noted they had to prove that:

  • Sussmann said the lie that they claim he did: that he affirmatively said he was not sharing the Alfa Bank allegations on behalf of a client
  • He said it on September 19, and not just on September 18
  • It was an intentional lie
  • It was material, meaning the alleged lie mattered to the operation of the FBI

I think the government has, in some ways, done best presenting their materiality arguments (but then, that’s the lowest bar). But even there, exhibits submitted at trial show that at least two of the key decision-makers on investigative issues had received a text referencing that this was a DNC report; Andrew DeFilippis speculated with one of the witnesses who received the text that it was a typo for DNS. And it appears, in multiple situations, people just assumed that Sussmann was at the FBI on behalf of the Hillary campaign, and took it into account. That said, Berkowitz got Baker — who was a key player in the Stellar Wind story that Eric Lichtblau held through an election in 2004 — to explain how important, from a national security perspective, it can be to hold certain stories.

And as I’ll show, Sussmann’s team may have something very special in store to make their materiality argument.

Regarding whether his statement that he was not there “on behalf of any client,” I think Sussmann has made a very good case that he meant his comment to Jim Baker on September 18 that he wanted to help the FBI. Both Marc Elias and Robbie Mook testified that sharing advance warning of a story they wanted to come out was the last they would have wanted or approved, because Jim Comey had done so much to damage the campaign. Particularly if Eric Lichtblau testifies, Sussmann will have a powerful story about all the damage that going to the FBI did to the campaign.

As to the other questions, they all go to Baker’s credibility on the stand.

I can’t say how the jury reacted, but I think prosecutors really didn’t do what they needed to do to prove that Sussmann repeated his comment about not meeting with Baker on behalf of any client and, then, hiding it when he helped the FBI kill the story later in the week. And Berkowitz did even more to show the changing nature of Baker’s statements about the meeting over time.

I did two long twitter threads on Sean Berkowitz’ cross-examination of Baker (Thursday night, Friday morning). I think Berkowitz achieved the following:

  • Used Baker to define “lie” as having an intention to deceive.
  • Made it clear that Baker reconstructed his understanding of his face-to-face meeting with Sussmann with the help of a chain of custody log that an FBI agent referring to the process called “doctored.” That’s going to provide Sussmann’s team a great metaphor to explain what Baker’s memory consists of.
  • Got Baker to suggest his memory of what happened on September 19 amounted to “words to that effect” of what has been charged.
  • Got Baker to agree that there’s at least a 25% chance Sussmann told him he had a client on September 21, which would be proof he wasn’t hiding a client.
  • Foregrounded the possibility that Baker could be prosecuted for his many inconsistent statements, including some that were made in 2018 and some that were made months ago. The statute of limitations on Baker’s inconsistent statements won’t expire until 2027.
  • Showed that Baker’s testimony on the stand was inconsistent with things he told Durham even in recent months; and Baker continues to not remember key details both of what happened on September 19 but also much more recently.
  • Showed that Baker’s reconstructed memory shifts at times from “that matter” (collecting the data) to the meeting itself; this is a reconstructed memory that can only come from prosecutors.
  • Demonstrated that Durham withheld at least three documents that could have “refreshed” Baker’s memory to believing Sussmann had told him he had a client.
  • Placed Durham in the room for some of the key sessions — including in Summer 2020, when Barr and Trump were pressuring Durham to show some results in time for the election — when Baker’s memory was “refreshed.”

Those threads were hard to write and I’m sure even more painful for people who are friends of one or both men to read. The story Berkowitz told was how, through the relentless grind of Republican blowhards and the Trump DOJ’s politicized investigations, Baker came to “remember” testimony that could put his friend, Sussmann, someone who had tried to get him a job when he was at a really bad point in his life, in prison.

There was no way out for Sussmann except to destroy his friend. And Berkowitz at least made it seem that Baker had believed there was no way out for him except to “refresh” his memory to match what Durham wanted.

I suspect it likely that Sussmann’s team will point out that Durham is choosing to prosecute just the people whose story doesn’t match the one that Durham wants to tell. It’s not just Baker whose testimony to Durham is inconsistent with provable facts, but Durham is not prosecuting any of the witnesses who are saying what he wants them to.

With all that as background I want to point to something subtle that I suspect will become part of that theme. Ostensibly to address materiality — Baker’s belief, one he shared with Congress in 2018 but contradicted under coaching by Durham on the stand — that if you have a national security tip you need to feel free to come to the FBI. Baker tweeted it out on June 13, 2019.

This would have been posted weeks after Durham was appointed, which — Baker testified — led Baker to expect he’d be under criminal investigation again.

Q. And you, sir, were aware that Mr. Baker was — I mean, Mr. Durham was reappointed as special counsel, correct, in or around 2019?

A. For this matter?

Q. yes.

A. yes.

Q. And when that happened, you were concerned, were you not?

A. Concerned about what?

Q. That Mr. Durham might come and investigate you more?

A. I wasn’t concerned about it. I expected it.

Q. All right. You expected to be investigated further by Mr. Durham. Correct?

A. Correct.

After having laid out how Baker had been investigated by Durham as part of a leak investigation for years, Berkowitz even introduced a text that Baker sent Ben Wittes the day after Durham was appointed saying, “now I get to be investigated for another year or two by John Durham. Lovely.”

But the tweet about going to the FBI wasn’t about Durham and it wasn’t random.

Rather, it was a response to something Trump said in an interview with George Stephanopoulos, between the time Mueller wrapped up his investigation, in part, of Trump’s request, “Russia, are you listening,” in 2016 and the time Trump asked Volodymyr Zelensky, “but first, I would like you to do us a favor.” On the same day Baker encouraged people to go to the FBI if they had evidence, ABC posted an interview in which Trump said,

“It’s not an interference, they have information — I think I’d take it,” Trump said. “If I thought there was something wrong, I’d go maybe to the FBI — if I thought there was something wrong. But when somebody comes up with oppo research, right, they come up with oppo research, ‘oh let’s call the FBI.’ The FBI doesn’t have enough agents to take care of it. When you go and talk, honestly, to congressman, they all do it, they always have, and that’s the way it is. It’s called oppo research.”

I’m not precisely sure how Sussmann’s team is going to use this tweet, beyond the materiality question, materiality about precisely this situation, whether someone should share information with the FBI after their opponent solicited help from a hostile foreign government.

But it sure seems to be evidence of more than just materiality.

The Methodology of Andrew DeFilippis’ Elaborate Plot to Break Judge Cooper’s Rules

/101 Comments/in , , , /by

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

When Michael Sussmann attorney Sean Berkowitz was walking FBI Agent Scott Hellman through the six meetings he had with Durham’s team on Tuesday — meetings he first had as a witness about the investigation into the Alfa Bank allegations and later in preparation for his trial testimony — Berkowitz asked Hellman about how, sometime earlier this year, Andrew DeFilippis and Jonathan Algor asked him whether he could serve as their DNS expert for the trial.

Q And then, more recently, you met with Mr. DeFilippis and I think Johnny Algor, who is also at the table here, who’s an Assistant U.S. Attorney. Correct?

A. Yes.

Q. They wanted to talk to you about whether you might be able to act as an expert in this case about DNS data?

A. Correct.

To Hellman’s credit, he told Durham’s prosecutors — who have been investigating matters pertaining to DNS data for two years — that he only had superficial knowledge of DNS and so wasn’t qualified to be their expert.

Q. You said, while you had some superficial knowledge, you didn’t necessarily feel qualified to be an expert in this case, correct, on DNS data?

A. On DNS data, that’s correct.

It wasn’t until the third day of trial before Durham’s team presented any evidence about the alleged crime. Instead, Durham’s first two witnesses were their nominal expert, David Martin, and Hellman, who told Durham he wasn’t an expert but who offered opinions he neither had the expertise to offer nor had done the work to substantiate.

That’s important, because DeFilippis used him to provide an opinion only an expert should give. And virtually everything about his testimony — his claim to have relied on the data in the materials without looking at the thumb drives, an apparently made up claim about the timing of the analysis, and behaviors that the FBI normally finds suspicious — suggest he’s not only not a DNS expert qualified to assess this report, but his assessment of the white paper Sussmann shared also suffers from serious credibility issues.

The battle over an expert

The testimony of the nominal expert, David Martin, was remarkably nondescript, particularly given the fight that led up to his testimony. Durham’s team sprung even having an expert on Sussmann at a really late date: on March 30, after months of blowing off Sussmann’s inquiries if they would. Not only did they want Martin to explain to the jury what DNS and Tor are, Durham’s team explained, but they also wanted him to weigh in on the validity of conclusions drawn by researchers who had found the anomaly.

  • the authenticity vel non of the purported data supporting the allegations provided to the FBI and Agency-2;
  • the possibility that such purported data was fabricated, altered, manipulated, spoofed, or intentionally generated for the purpose of creating the false appearance of communications;
  • whether the DNS data that the defendant provided to the FBI and Agency-2 supports the conclusion that a secret communications channel existed between and/or among the Trump Organization, Alfa Bank, and/or Spectrum Health;

[snip]

  • the validity and plausibility of the other assertions and conclusions set forth in the various white papers that the defendant provided to the FBI and Agency-2;

As Sussmann noted in his motion to limit Martin’s testimony, he didn’t mind the testimony about DNS and Tor. He just didn’t want this trial to be about the accuracy of the data, especially without the lead time to prepare his own expert.

As the Government has already disclosed to the defense, should the defense attempt to elicit testimony surrounding the accuracy and/or reliability of the data that the defendant provided to the FBI and Agency-2, Special Agent Martin would explain the following:

  • That while he cannot determine with certainty whether the data at issue was cherry-picked, manipulated, spoofed or authentic, the data was necessarily incomplete because it was a subset of all global DNS data;
  • That the purported data provided by the defendant nevertheless did not support the conclusions set forth in the primary white paper which the defendant provided to the FBI;
  • That numerous statements in the white paper were inaccurate and/or overstated; and
  • That individuals familiar with these relevant subject areas, such as DNS data and TOR, would know that such statements lacked support and were inaccurate and/or overstated.

Based off repeated assurances from Durham that they weren’t going to make accuracy an issue in their case in chief, Judge Cooper ruled that the government could only get into accuracy questions if Sussmann tried to raise the accuracy of the data himself. But if he said he relied on the assurances of Rodney Joffe, it wouldn’t come in.

The government suggests that Special Agent Martin’s testimony may go further, depending on what theories Sussmann pursues in cross-examination or his defense case. Consistent with its findings above, the Court will allow the government’s expert to testify about the accuracy (or lack thereof) of the specific data provided to the FBI here only in certain limited circumstances. In particular, if Sussmann seeks to establish at trial that the data were accurate, and that there was in fact a communications channel between Alfa Bank and the Trump Campaign, expert testimony explaining why this could not be the case will become relevant. But, as the Court noted above, additional testimony about the accuracy of the data—expert or otherwise—will not be admissible just because Mr. Sussmann presents evidence that he “relied on Tech Executive-1’s conclusions” about the data, or “lacked a motive to conceal information about his clients.” Gov’s Expert Opp’n at 11. As the Court has already explained, complex, technical explanations about the data are only marginally probative of those defense theories. The Court will not risk confusing the jury and wasting time on a largely irrelevant or tangential issue. See United States v. Libby, 467 F. Supp. 2d 1, 15 (D.D.C. 2006) (excluding evidence under Rule 403 where “any possible minimal probative value that would be derived . . . is far outweighed by the waste of time and diversion of the jury’s attention away from the actual issues”).

Then, days before the trial, the issue came up again. Durham sent a letter on May 6 (ten days before jury selection), raising a bunch of new issues they wanted Martin to raise. Sussmann argued that Durham was trying to expand the scope of what his expert could present. Among his complaints, Sussmann argued that Durham was trying to make a materiality argument via his expert witness.

Third, the Special Counsel apparently intends to offer expert testimony about the materiality of the false statement alleged in this case. Indeed, the Special Counsel’s supplemental topic 9 regarding the importance of considering the collection source of DNS data is plainly being offered to prove materiality. But the Special Counsel did not disclose this topic in either his initial expert disclosure or Opposition, and the Court’s ruling did not permit such testimony. The Special Counsel should not now be allowed to offer an entirely new expert opinion under the guise of eliciting testimony regarding the types of conclusions that can be drawn from a review of DNS data.

Judge Cooper considered the issue Tuesday morning, before opening arguments. When asking why Martin had to present the concept of visibility, DeFilippis explained that Hellman–the Agent who’s not an expert on DNS but whom DeFilippis nevertheless had asked to serve as an expert on DNS–would talk about the import of knowing visibility to assess data.

THE COURT: Well, but isn’t the question here whether a case agent — is your case agent later going to testify that that was something that the FBI looked at or wanted to look at in this case and was unable to do so, and that that negatively affected the FBI’s investigation in some way? MR.

DeFILIPPIS: Yes, and I expect Special Agent Hellman, who will testify likely today, Your Honor, I expect that that is a concept that he will say was relevant to the determination that — determinations he was making as he drafted analysis of the data that came in. And, again, I don’t think we — for example, another way in which this comes up is that the FBI routinely receives DNS data from various private companies who collect that data, and it is always relevant sort of the breadth of visibility that those companies have. So it’s relevant generally, but also in this particular case the fact that the FBI did not have insight into the visibility or lack of visibility of that data certainly affected steps that the FBI took.

THE COURT: Okay. But Mr. Sussman has not been accused of misrepresenting who the source is. He’s simply — but rather who the client is. So how do you link that to the materiality of the alleged false statement?

MR. DeFILIPPIS: Because, Your Honor, I think we view them as intertwined. It was because — it was in part because Mr. Sussman said he didn’t have a client that made it more difficult for the FBI to get to the bottom of the source of this data or made it less likely they would, and so — and, again, I don’t think we expect to dwell for a long time on this, but I think the agents and the technical folks will say that that is part of why the origins of the data are extremely relevant when they took investigative steps here.

When Cooper noted Sussmann’s objection to Martin discussing possible spoofing of data, DeFilippis again answered not about what Martin would testify, but what Hellman would.

As DeFilippis explained, he claimed to believe that under Cooper’s ruling, the government could put in any little thing they wanted that they claimed had been part of the investigation.

And Special Agent Hellman, when he testifies today — now, Your Honor’s ruling we understand to permit us to put into evidence anything about what the FBI analyzed and concluded as its investigation unfolded because that goes to the materiality of the defendant’s statement. So Special Agent Hellman — through Agent Hellman we will offer into evidence a paper he prepared when the data first came in, and among its conclusions is that the data might — he doesn’t use the word “spoof” — but might have been intentionally generated and might have been fabricated. That was the FBI’s initial conclusion in what it wrote up.

So in order for the jury to understand the course of the FBI’s investigation and the conclusions that it drew at each stage, those concepts are at the center of it.

[snip]

MR. DeFILIPPIS: Okay. Your Honor, I’m sorry. We understood your ruling to be that the FBI’s conclusions as it went along were okay as long as we weren’t asserting the conclusion that it was, in fact, fabricated. You know, I mean, it’s difficult to chart the course of the FBI’s investigation unless we can elicit at each stage what it is that the FBI concluded.

Judge Cooper ordered that references to spoofing be removed — leading to a last minute redaction of an exhibit — but permitted a discussion of visibility to come in.

After all that fight, Martin’s testimony was not only bland, but it was recycled powerpoint. He not only admitted lifting the EFF description of Tor for his PowerPoint, but he included their logo.

Hellman delivers the non-expert expert opinion Durham was prohibited from giving

As I said, Martin was witness number one, Hellmann — the self-described non-expert in DNS — was witness number two.

Even though Hellman admitted, again, that he’s not a DNS expert, DeFilippis still had him go over what DNS is.

Q. How familiar or unfamiliar are you with what is known as DNS or Domain Name System data?

A. I know the basics about DNS.

Q. And in your understanding, on a very basic level, what is DNS?

A. DNS is basically how one computer would try and communicate with another computer.

After getting Hellman to explain how he purportedly got chain of custody signatures on September 20, 2016 for the materials Michael Sussmann dropped off with James Baker on September 19, DeFilippis walked Hellman through how, he claimed, he had concluded that the allegations Sussmann dropped off were unsupported. Hellman reviewed the data accompanying the white paper, Durham’s star cybersecurity witness claimed on the stand, and after reviewing that data, determined there was no allegation of a hack in the materials and therefore nothing for the Cyber Division to look at. And, as a report he wrote “within a day” summarized, he concluded the methodology was horrible.

As you read the following exchange, know that (as I understand it) some, if not most, of what Hellman describes as the methodology is wrong. Obviously, if Hellman’s understanding of the methodology is wrong, then the opinion that DeFilippis elicits from a guy who admitted he was not an expert on DNS but whom DeFilippis nevertheless asked to serve as his expert witness on DNS before inviting David Martin in to present slides lifted from the Electronic Frontier Foundation instead [Takes a breath] … If Hellman’s understanding of the methodology and the data he’s looking at is wrong, then his opinion about the methodology is going to be of little merit.

With that understanding, note the objection of Sean Berkowitz, who fought DeFilippis’ late hour addition of an expert that DeFilippis wanted to use to opine on the validity of the research, bolded below.

So we looked at the top part, which set out your top-line conclusion. You then have a portion of the paper that says, “The investigators who conducted the research appear to have done the following.” Now, Special Agent Hellman, it appears to be a pretty technical discussion, but can you just tell us, in that first part of the paper, what did you set out and what did you conclude?

A. It looks to be that they were looking for domains associated with Trump, and the way that they did that was they looked at a list of sort of all domains and looked for domains that had the word “Trump” in them as a way to narrow down the number of domains they were looking at.

And then they wanted to find, well, which of that initial set of Trump domains, which of them are email servers associated with those domains. And the way they did that was to search for terms associated with email, like “mail” or other email-related terms to then narrow down their list of domains even further to be Trump-associated domains that were email servers.

Q. And did you opine on the soundness of that methodology? In other words, did you express a view as to whether this was a good way to go about this project?

A. We did not — I did not feel that that was the most expeditious way to go about identifying email servers associated with the domain.

Q. And why was that?

A. You can name an email server anything you want. It doesn’t have to have the words “mail” or “SMTP” in it. And so by — if you’re just searching for those terms, I would wager to guess you would miss an actual email server because there are other — there are other more technical ways that you can use — basically look-up tools, Internet look-up tools where you can say, for any domain, tell me the associated email server. That’s essentially like a registered email server. But the way that they were doing it was they were just looking for key terms, and I think that it just didn’t make sense to me why they would go about identifying email servers that way as opposed to just being able to look them up.

Q. Was there anything else about the methodology used here by the writer or writers of this paper that you found questionable or that you didn’t agree with?

A. I think just the overall assumptions that were being made about that the server itself was actually communicating at all. That was probably one of the biggest ones.

Q. And what, if anything, did you conclude about whether you believed the authors of the paper or author of the paper was fairly and neutrally conducting an analysis? Did you have an opinion either way?

MR. BERKOWITZ: Objection, Your Honor.

THE COURT: Basis?

MR. BERKOWITZ: Objection on foundation. He asked him his opinion. He’s not qualified as an expert for that.

THE COURT: I’ll overrule it.

A. Sorry, can you please repeat the question?

Q. Sure. Did you draw a conclusion one way or the other as to whether the authors of this paper seemed to be applying a sound methodology or whether, to the contrary, they were trying to reach a particular result? Did you —

A. Based upon the conclusions they drew and the assumptions that they made, I did not feel like they were objective in the conclusions that they came to.

Q. And any particular reasons or support for that?

A. Just the assumption you would have to make was so far reaching, it didn’t — it just didn’t make any sense.

That’s how, as his second witness, Andrew DeFilippis introduced the opinion of a guy who admitted he wasn’t an expert on DNS that DeFilippis had asked to serve as an expert even though DeFilippis should have known that he didn’t have the expertise to offer expert opinions like this.

If Sussmann is found guilty, I would bet a great deal of money this stunt will be one part of a several pronged appeal, because Judge Cooper permitted DeFilippis to do precisely what Cooper had prohibited him from doing before trial, and he let him do it with a guy who by his own admission is not a DNS expert.

Cyber Division reaches a conclusion without looking at the thumb drives

Now let’s look at what Hellman describes his own methodology to be.

First, it was quick. DeFilippis seems to think that serves his narrative, as if this stuff was so crappy that it took a mere glimpse to discredit it.

Q. Special Agent Hellman, how long would you say it took you and Special Agent Batty to write this up?

A. Inside of a day.

Q. Inside of a day, you said?

Berkowitz walked Hellman through the timeline of it, and boy was it quick. There’s some uncertainty about this timeline, because John Durham’s office doesn’t feel the need to make clear whether exhibits they’re turning over in discovery reflect UTC or ET. But I think I’ve laid it out below (Berkowitz got it wrong in cross-examination, which DeFilippis used to attack his analysis).

As you can see, not only were FBI’s crack cybersecurity agents making a final conclusion about the data within a day but — by all appearances — they did so before they had ever looked at the thumb drives included with the white papers. From the record, it’s actually not clear when — if!!! — they looked at the thumb drives. But it’s certain they had their analysis finalized no more than one working day after they admitted they hadn’t looked at the thumb drive, which was itself after they had already decided the white paper was shit.

Timeline

September 20, 10:20AM: Nate Batty tells Jordan Kelly they’ll come from Chantilly to DC get the thumb drives

September 20, 10:31AM: Jordan Kelly tells Batty the chain of custody is “Sussman to Strzock to Sporre”

September 20, 12:29PM: Hellman and Nate Batty accept custody of the thumb drives

September 20, 1:30PM: Hour drive back to Chantilly, VA

September 20, 4:44PM: Hellman appears to explain the process of picking up the thumb drives to jrsmith, claiming to have spoken to Baker on the phone. jrsmith jokes about “doctor[ing] a chain of evidence form.”

September 20, 4:58: Hellman says the more he reads the report “it feels a little 5150ish,” suggesting (as he explained to Berkowitz on cross) the authors suffered from a mental disability, and Hellman complains that “it contains an absurd quantity of data” to which Batty responded, the data seemed “inserted to overwhelm and confuse the reader.”

September 21, 8:47AM: Batty tells Hellman their supervisor wants them to “write a brief summary of what we think about the DNC report.” Batty continues by suggesting that “we should at least plug the thumb drives into Frank’s computer and look at the files…”

9/22, 9:44AM: Curtis Heide, in Chicago, asks Batty to send the contents of the thumb drive so counterintelligence agents can begin to look at the evidence. The boys in Cyber struggle to do so for a bit.

9/22, 2:49PM: Batty asks Hellman what he did with the blue thumb drive.

9/22, 4:46PM: Batty sends “analysis of Trump white paper” to others.

In other words, the cyber division spent less than 28 hours doing this analysis.

Yes. The analysis was quick.

Hellman says his analysis is valid because he looked at the data

The hastiness of the analysis and the fact that Hellman didn’t look at the thumb drive before making initial conclusions about the research is fairly problematic, because when he discussed his own methodology, he described the data driving everything.

Q. Now, what principally, from the materials, did you rely on to do your analysis?

A. So it was really two things. It was looking at the data, the technical data itself. There was a summary that it came with. And then also we were comparing what we saw in the data, sort of the story that the data told us, and then looking at the narrative that it came with and comparing our assessment of the data to the narrative.

[snip]

Q. And in connection with that analysis, did you also take a look at the data itself that was underlying this paper?

A. Yes

[snip]

Q. And if we look at that first page there, Agent Hellman, what kind of data is this?

A. It appears to be — as far as I can tell, it looks to be — it’s log data. So it’s a log that shows a date and a time, a domain, and an IP address. And, I mean, that’s — just looking at this log, there’s not too much more from that.

Q. And do you understand this to be at least a part of the DNS data that was contained on the thumb drives that I think you testified about earlier?

A. Yes.

[snip]

A. It would have mattered — well, I think on one hand it would not have mattered from the technical standpoint. If I’m looking at technical data, the data’s going to tell me whatever story the data’s going to tell me independent of where it comes from. So I still would have done the same technical analysis.

But knowing where the data comes from helps to tell me — it gives me context regarding how much I believe in the data, how authentic it is, do I believe it’s real, and do I trust it. [my emphasis]

He repeated this claim on cross with Berkowitz.

I just disagreed with the conclusions they came to and the analysis that they did based upon the data that came along with the white paper.

When Berkowitz asked him why counterintelligence opened an investigation when Cyber didn’t, Hellman suggested that the people in CD wouldn’t understand how to read the technical logs.

A. Um, I think they’d probably be looking at it from the same vantage point, but if you’re not — you don’t have experience looking at technical logs, you may not have the capability of doing a review of those logs. You might rely on somebody else to do it. And perhaps counterintelligence agents are going to be thinking about other investigative questions. So I guess it would probably be a combination of both.

“If I’m looking at technical data,” DeFilippis’ star cybersecurity agent explained, “the data’s going to tell me whatever story the data’s going to tell me.”

Except he didn’t look at the technical data, at least not the data on the thumb drives, before he reached his initial conclusion.

Hellman makes a claim unsupported by the data in his own analysis

I’ll leave it to people more expert than me to rip apart Hellman’s own analysis of the white paper Sussmann shared with the FBI. In early consultations, I’ve been told he misunderstood the methodology, misunderstood how researchers used Trump’s other domains to prove that just one had this anomaly (that is, as a way to test their hypothesis), and misstated the necessity of some long-term feedback loop for this anomaly to be sustained. Again, the experts will eventually explain the problems.

One part of his report that I know damns his methodology, however, is where he says the researchers,

Searched “…global nonpublic DNS activity…” (unclear how this was done) and discovered there are (4) primary IP addresses that have resolved to the name “mail1.trump-email.com”. Two of these belong to DNS servers at Russian Alfa Bank. [my emphasis]

This is the point where every single person I know who assessed these allegations who is at least marginally expert on DNS issues stopped and said, “global nonpublic DNS activity? There are only a handful of people that could be!” See, for example, this Robert Graham post written in response to the original Slate story, perhaps the most influential critique of the allegations, probably even on Durham. Every marginally expert person I know has, upon reading something like that, tried to figure out who would have that kind of visibility on the data, because that kind of visibility, by itself, would speak to their expertise. Those marginally expert people did not have the means to identify the possible sources of the data. But a lot of them — including the NYTimes!! — were able to find people who had that kind of visibility to better understand the anomaly. When Hellman read that, he simply said, “unclear how this was done” and moved on.

Still, Hellman did not contest (or possibly even test) the analysis that said there were really just four IP addresses conducting look-ups with the Trump marketing server. Dozens of people have continued to test that result in the years since, and while there have been adjustments to the general result, no one has disproven that the anomaly was strongest between Alfa Bank and Trump’s marketing domain.

Where Hellman’s insta-analysis really goes off the rails, however, is in his assertion that, “it appears that the presumed suspicious activity began approximately three weeks prior to the stated start date of the investigation conducted by the researcher.”

I’m not a DNS expert, but I’m pretty good at timelines, and by my read here are the key dates in the white paper.

May 4, 2016: Beginning date for look-up analysis

July 28, 2016: Lookup for hostnames yielding Trump

September 4, 2016: End date for look-up analysis

September 14, 2016: Updated search for look-ups covering June 17 through September 14

The start date reflected in this white paper is July 28, 2016. Three weeks before that would be July 7, 2016, a date that doesn’t appear in the white paper. The anomaly started 85 days before the start date reflected in this white paper (and the start date for the research began months earlier, but still over three weeks after the May 4 start date).

I don’t understand where he got that claim. But DeFilippis repeated it on the stand, as if it were reflected in the data, I guess believing it makes his star cybersecurity agent look good.

DeFilippis’ star cybersecurity agent has some credibility problems

There are a few more problems with the credibility of Hellman, DeFilippis’ star cybersecurity agent who is not a DNS expert. One of those is that he compared notes with his boss before first testifying.

Q: And you also spoke with Nate Batty around that time, Right?

A: Yes.

Q: Did you talk to him before the first interview to kind of get ready for it?

A: I think so, but I don’t remember.

Q: Is that something that you encourage witnesses to do, to talk to other witnesses to see if your recollections are consistent?

A: No.

In addition, notwithstanding that Batty was told that Sussmann was in the chain of control, Batty claimed to believe the source was “anonymous” and Hellmann claimed to believe it was sensitive–a human source. Even after comparing notes their stories didn’t match.

There are other problems with Hellman’s memory of the events, notably that in his first interview — the one he did shortly after comparing notes with Batty — he claimed that Baker had told him he was unable to identify the source of the data.

Q. And when you went to Mr. Baker’s office, do you remember what, if anything, was said during that discussion or during that interaction?

A. I remember being in the office, but I don’t distinctly recall what the conversation was. I do remember after the fact, though, that I was frustrated that I was not able to identify who had provided these thumb drives, this information to Mr. Baker. He was not willing to tell me.

At the very least, this presents a conflict with Baker’s testimony, but it’s also another testament to how variable memories can be four years, much less six years, after the fact.

Hellman also claimed, when asked on cross, that the first time he had ever seen the reference to a “DNC report” in September 21 Lync notes he received was two years ago, when he was first interviewed.

A: The first time I saw this was two years ago when I was being interviewed by Mr. DeFilippis, and I don’t recall ever seeing it. I never had any recollection of this information coming from DNC. I don’t remember DNC being a part of anything we read or discussed.

Q: Okay. When you say, the first time you saw it was two years ago when you met with Mr. DeFilippis, that’s not accurate. Right? You saw it on September 21st, 2016. Correct?

A: It’s in there. I don’t have any memory of seeing it.

And when Sean Berkowitz asked about Hellman the significance of seeing the reference to a “DNC report” first thing on September 21, he described that DeFilippis suggested to him that it was likely just a typo for DNS.

Q. What’s your explanation for it?

A. I have no recollection of seeing that link message. And there is — I have absolutely no belief that either me or Agent Batty knew where that data was coming from, let alone that it was coming from DNC. The only explanation that popped or was discussed was that it could have been a typo and somebody was trying to refer to DNS instead of DNC.

Q. So you think it was a typo?

A. I don’t know.

Q. When you said the only one suggesting it — isn’t it true that it was Mr. DeFilippis that suggested to you that it might have been a typo recently?

A. That’s correct.

When asked about a topic for which there was documentary evidence Hellman had seen in real time that he claimed not to remember, Andrew DeFilippis offered up an explanation that Hellman then offered on the stand.

On the stand, DeFilippis also tried to get Hellman to call a marketing server a spam server, though Hellman resisted.

Once you look closely, I don’t think Hellman’s testimony helps Durham all that much. What it proves, however, is that DeFilippis attempted to coach testimony.

One final thing. DeFilippis got his star cybersecurity agent to observe that the researchers didn’t include their name or other markers on their report, as if that’s a measure of unreliablity.

Q. Now, let me ask you, were you able to determine from any of these materials who had actually drafted the paper alleging the secret channel?

A. No.

Q. In other words, was it contained anywhere in the documents?

Here’s what Hellman’s own report looks like:

There’s a unit — ECOU1 — but the names of the individual agents appear nowhere in the report. The report is not dated. It does not specifically identify the white papers and thumb drives by control numbers, something key to evidentiary analysis.

It has none of the markers of regularity you’d expect from the FBI. Hellman’s own analysis doesn’t meet the standards that DeFilippis uses to measure reliability.

This long-time Grand Rapids resident is furious that Hellman judged there was no hack

Everything above I write as a journalist who has tried to understand this story for almost six years. Between that and 18 years of covering national security cases, I hope I now have sufficient familiarity with it to know there are real problems with Hellman’s analysis.

But let me speak as someone who lived in Grand Rapids for most of this period, and had friends who had to deal with the aftermath of Spectrum Health appearing at the center of a politically contentious story.

Hellman had, as he testified, two jobs. First, he was supposed to determine whether there were any cyber equities, then he was supposed to do some insta-analysis of the data without first looking at the thumb drives.

According to Hellman, there was no hack.

I was asked to perform two tasks in tandem with Special Agent Batty, and our tasks were, number one, to look at this data, look at the data and look at the narrative that it came with and identify were there any what’s known as cyber equities. And by that it was, was there any allegation of a hacking. That’s what cyber division does. We investigate hacking. So was there an allegation that somebody or some company or some computer had been hacked. That was first.

[snip]

As I mentioned, the first piece was we had to identify was there any real allegation of hacking; and there was not. That was our first task by our supervisor. There was not.

[snip]

The allegation was that someone purported to find a secret communication channel between the Trump organization and Russia. And so we identified first that, no, we didn’t think that there was any cyber equity, meaning that there was probably nothing more for cyber to investigate further, if there was no hacking crime.

Except here’s what the white paper says about Spectrum, that Grand Rapids business that was swept up in this story.

The Spectrum Health IP address is a TOR exit node used exclusively by Alfa Bank. ie.,  Alfa Bank communications enter a Tor node somewhere in the world and those communications exit, presumably untraceable, at Spectrum Health There is absolutely no reason why Spectrum would want a Tor exit node on its system. (Indeed, Spectrum Health would not want a TOR node on its system because, by its nature, you never know what will come out of a TOR node, including child pornography and other legal content.)

We discovered that Spectrum Health is the victim of a network intrusion. Therefore, Spectrum Health may not know it has a TOR exit node on its network. Alternatively, the DeVos family may have people at Spectrum who know there is a TOR node. i.e.,  could have been placed there with inside help.

When faced with some anomalous activity that seemed to tie into the weird DNS traffic, the experts suggested that maybe the Spectrum hack related to the DNS anomaly.

To be clear, this Tor allegation is the the weakest part of this white paper. You will hear about this to no end over the next week. It was technically wrong.

But the allegation in the white paper is that maybe a recent hack of Spectrum Health is why it had this anomalous traffic with Trump’s marketing server. There’s your hack!!

Had the people at FBI’s cybersecurity side actually treated this as a possible compromise, it might have addressed the part of this story that never made any sense. And we might not, now, six years later, be arguing about what might explain it.

Let me be clear: I do think the white paper overstated its conclusions. I don’t think secret communication is the most obvious explanation here.

But there are hacks and then there are hacks in the testimony of DeFilippis’ star cybersecurity agent.

Update: Corrected an attribution to Batty instead of Hellman.

Update: Fixed my own timeline.

Update: Added link to Robert Graham’s analysis.

Update: This may be where Hellman gets his erroneous three week claim. There were two histograms included with the report. One, the close-up, does start around July 7.

But the broader scope shows look-ups earlier, very actively in June, but with a few stray ones in May.

The government didn’t include the pages and pages of logs that Batty complained about in this exhibit. Had they, it would be clear to jurors that this claim is false.

Update: Correction on two points. First, I think I’ve finally got the Lync exchange above correct between Batty and Hellman. As noted, Hellman complains that “it contains an absurd quantity of data” to which Batty responded, the data seemed “inserted to overwhelm and confuse the reader.”

Second, I was wading through exhibits this morning and found the exhibit of 19 pages of logs. Here’s just a subset of them, including logs that go back to May 2016. Hellman didn’t look even at the printed page of log files closely enough to realize his claim about three weeks was wrong. These data weren’t intended to overwhelm the reader. They were there to show how the anomaly accelerated during the election.

John Durham’s Lies with Metadata

/85 Comments/in , /by

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

I’d like to thank John Durham for showing us back in April how he was going to mislead the jury with metadata.

He appears to have done just that, yesterday, with several exhibits entered into evidence. And I fear that unless Durham’s lie is corrected, he will gravely mislead the jury.

As I pointed out in April, because of the email system at Fusion GPS, the first email in any thread they produced to Durham renders as UTC; the rest render as ET. So, for the emails on which one could check, the first email in every thread they released in April was four hours later than the time the email was actually sent.

Durham has revealed that his exhibit has irregularities in the emails pertaining to a key issue: whether Fusion sent out a link to April Lorenzen’s i2p site before Mark Hosenball sent it to them.

This shows up in the timestamps. In the exhibit, the lead email for each appearance appears to be set to UTC, whereas the sent emails included in any thread appear to be set to ET.

For example, in this screencap, the time shown for Mark Hosenball’s response to Peter Fritsch (the pink rectangle) is 1:35 PM, which is presumably Eastern Time.

In this screencap, the very same response appears to be sent at 5:36PM, which is presumably UTC.

Both instances of Peter Fritsch’s email (the green rectangle), “that memo is OTR–tho all open source,” show at 1:33PM, again, Eastern Time.

To be clear: this irregularity likely stems from Fusion’s email system, not DOJ’s. It appears that the email being provided itself is rendered in UTC, while all the underlying emails are rendered in the actual received time.

That means if you show someone only the first email in a thread, you will be misrepresenting what time that email was sent.

That’s what Durham did yesterday with a bunch of Fusion-produced emails he submitted during Laura Seago’s testimony, including (but not limited to):

Over and over, Andrew DeFilippis showed these to Laura Seago and asked her to state what date and time the emails were.

MR. DeFILIPPIS: Okay. And, Your Honor, if there’s no objection from the defense, we’ll offer Government’s Exhibit 612.

MR. BERKOWITZ: No objection.

THE COURT: So moved.

Q. Okay. So what is the date and time of this email?

A. October 5, 2016, at 5:23 p.m.

Q. And the “Subject” line?

A. “Re: so is this safe to look at” — excuse me — “so this is safe to look at.”

While these emails appear to have been produced to Durham at a later time (their Bates numbers from Fusion are about 3000 pages off some of the earlier ones), they’re from the same series and produced by the same custodian, so we should assume that the same anomaly that existed on the earlier ones exists here.

Seago hasn’t seen these emails for years and — because they were treated as privileged — she can only see the first email in a thread, even if there are replies in that thread (and there clearly are, in some of them). She had no way of knowing if she was looking at UTC time!

But Andrew DeFilippis surely does. Indeed, he’s prepping an attack on Sussmann for not understanding that Durham turned over Lync files from the FBI without making clear they, also, get produced in UTC. So he’s aware of which exhibits he has sent to Sussmann without clarifying the correct time. Yet over and over again, DeFilippis asked Seago what time these emails were sent, even though he likely knows (especially since these are files that are no longer privileged, so he has seen those that are threads) that he was deceiving her.

And the timing of these Fusion emails — and possibly some earlier ones exchanged with Rodney Joffe — almost certainly matter.

As I showed in my earlier post, because Durham didn’t fix the anomaly in these emails, they have created the false impression that an October 5 email from Mark Hosenball that shared public links to Tea Leaves’ files came in after Fusion sent it out to Eric Lichtblau. They appear to be prepping another deceit, this one conflating a link that Hosenball sent with one Seago found on Reddit.

Assuming the emails released yesterday share this same anomaly, here’s how the timeline would work out. I’ve bolded the ones that would be grossly misleading taken out of order.

5:23PM (could be 1:23?): Seago to Fritsch, Is this safe?

1:31PM: [not included] Fritsch to Hosenball email with Alfa Group overview

1:32PM: Fritsch sends Isikoff the September 1, 2016 Alfa Group overview (full report included in unsealed exhibit)

1:33PM [not included] Fritsch to Hosenball, “that memo is OTR — tho all open source”

1:35/1:36PM: Hosenball replies, “yep got it, but is that from you all or from the outside computer experts?”

1:37PM: Fritsch responds,

the DNS stuff? not us at all

outside computer experts

we did put up an alfa memo unrelated to all this

1:38PM: [not included] Hosenball to Fritsch:

is the alfa attachment you just sent me experts or yours ? also is there additional data posted by the experts ? all I have found is the summary I sent you and a chart… [my emphasis]

1:41PM: [not included] Fritsch to Hosenball:

alfa was something we did unrelated to this. i sent you what we have BUT it gives you a tutanota address to leave questions.  1. Leave questions at: [email protected]

1:41PM: [not included] Hosenball to Fritsch:

yes I have emailed tuta and they have responded but haven’t sent me any new links yet. but I am pressing. but have you downloaded more data from them ?

1:43PM: [not included] Fritsch to Hosenball, “no”

1:44PM: Fritsch to Lichtblau:

fyi found this published on web … and downloaded it. super interesting in context of our discussions

[mediafire link] [my emphasis]

2:23PM: [not included] Lichtblau to Fritsch, “thanks. where did this come from?”

2:27PM: [not included] Hosenball to Fritsch:

tuta sent me this guidance

[snip]

Since I am technically hopeless I have asked our techie person to try to get into this. But here is the raw info in case you get there first. Chrs mh

2:32PM: Fritsch to Lichtblau:

no idea. our tech maven says it was first posted via reddit. i see it has a tutanota contact — so someone anonymous and encrypted. so it’s either someone real who has real info or one of donald’s 400 pounders. the de vos stuff looks rank to me … weird

6:33PM (likely 2:33PM): Fwd Alfa Fritsch to Seago

6:57PM (like 2:57PM): Re alfa Seago to Fritsch

7:02PM (likely 3:02): Re alfa Seago to Fritsch

3:27PM: [not included] Fritsch to Hosenball cc Simpson: “All same stuff”

3:58PM: [not included] Hosenball to Fritsch, asking, “so the trumpies just sent me the explanation below; how do I get behind it?”

4:28PM: [not included] Fritsch to Hosenball, “not easily, alas”

4:32PM: Fritsch to Hosenball, cc Simpson:

Though first step is to send that explanation to the source who posted this stuff. I understand the trump explanations can be refuted.

 

 

What Durham will completely and utterly misrepresent if it doesn’t clarify this anomaly (and this is the second time they have declined to) is that Seago and Mark Hosenball both accessed different packages of the Tea Leaves materials, one of which then got sent out to Lichtblau. Between 2:33 and 2:57, Seago appears to have compared the files and told Fritsch, who then told Hosenball, that the packages were “all the same stuff.”

With a Much-Anticipated Fusion GPS Witness, Andrew DeFilippis Bangs the Table

/28 Comments/in , , , /by

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work. 

Andrew DeFilippis has done several arguably unethical things in an attempt to win the Michael Sussmann trial.

He repeatedly attempted to get Marc Elias to repeat something Elias shouldn’t have said in the first place: that the only way to understand whether Sussmann had gone to the FBI to benefit the Hillary campaign would be to ask him (in response to which stunt Sussmann is asking for a mistrial).

DeFilippis also set up a ploy to get a non-expert to offer opinions that only an expert should offer (more on that later).

At times (such as during Neustar employee Steve DeJong’s testimony), DeFilippis seemed more focused on eliciting testimony that might help him make a case against Rodney Joffe than obtain a guilty verdict against Sussmann.

And in direct examination yesterday of Fusion’s Laura Seago (my reading of the transcript is here), he did both, violating Judge Cooper’s orders in an attempt to set up his ongoing investigation in a way that did nothing to help him win the trial against Sussmann.

For all the anticipation for it, Seago’s testimony was not all that helpful to Durham’s team. She described having about as much awareness of which Democratic entity Fusion’s ultimately client was as the FBI did on Carter Page’s FISA applications. She indicated that the Alfa Bank allegations were just one of a whole bunch of possible ties to Russia that Trump had. She described how, to the extent Fusion could assess the Alfa Bank allegations, they found them credible. In discussing Fusion’s pitch to Franklin Foer on the Alfa Bank story, she described the other major data scientists who had backed the Alfa Bank allegations, identities that Durham has always suppressed because they kill his conspiracy theory.

Q. And what was discussed? What did you say, and what did they say?

A. I really don’t remember the specifics six years on. We talked about the allegations between the Trump organization and Alfa-Bank. We talked about highly credible computer scientists who seemed to think that these allegations were credible.

Q. And by that, are you referring to Mr. Joffe or somebody else?

A. There were others that ended up being cited in Mr. Foer’s article. He cited L. Jean Camp and Paul Vixie, who invented the DNS system.

During cross-examination by Sussmann lawyer Sean Berkowitz, Seago made it clear she didn’t tell Foer about the FBI investigation into these matters.

Q. And with respect to your meeting with Mr. Foer, did you tell Mr. Foer that the FBI was investigating these allegations?

A. No. I had no knowledge of that investigation.

Q. So before your meeting with Franklin Foer, did you have any information that the FBI was involved in any way?

A. No.

Q. All right. Did Mr. Fritsch or anyone else at the meeting say, “The FBI is looking into this”?

A. Not that I can remember.

Also on cross, Seago described that her impression from having dealt with Joffe is that he really did believe the allegations too.

Q. And your impression of Mr. Joffe that was made at that meeting was that he was — he seemed reliable?

A. Yes.

Q. And he seemed well-placed to have knowledge and information about the server issues?

A. Yes, he did.

Q. And you understood that Mr. Joffe supported the suggestion that there was at least potential contact between Trump servers and Alfa-Bank servers?

A. Yes, I did.

MR. DeFILIPPIS: Objection, Your Honor.

THE COURT: Overruled.

Q. You answered the question?

A. Yes, I did understand that.

But it was in DeFilippis’ treatment of emails that Judge Cooper granted Durham’s team access to, but did not permit them to use at trial, where he got particularly obnoxious. Remember: while Durham’s team maintained from the start that the privilege claims behind these emails were not proper (because they were largely about communicating with the press, not about providing research assistance to the Democrats), the reason they didn’t get access to them was their own incompetence. They didn’t ask for a privilege review until right before trial.

DeFilippis has no one to blame but himself, but in true right wing fashion, he’s lashing out.

Perhaps in an attempt to make some drama out of documents that Cooper described “not very revelatory,” DeFilippis walked Seago through all the ones she was privy to, including those with Joffe that Cooper ruled were privileged.

Generally, such exchanges went something like this:

Q. Ms. Seago, does this appear to be part of the same chain as the prior email exchanges?

A. It has the same “Subject” line and says “Re,” so that is what it appears to be. I have no independent recollection of this email.

Q. And what, if any, connection in your mind did the Alfa Bank issue have to New York? I ask because “New York” is in the “Subject” line. Any sense?

A. I don’t know.

Q. And the attachment on this email, any sense of what that was?

A. I don’t know.

Note: there’s no reason to believe Seago has reviewed these emails recently.

That was all setup for DeFilippis’ last set of questions:

Q. Did you ever receive instructions that you couldn’t disclose your affiliation with Fusion GPS to the media?

A. No. I don’t remember hiding that affiliation from the media ever.

Q. Do you ever remember hiding or considering hiding that affiliation from anyone?

A. No.

Q. How certain are you of that?

A. I’m quite certain. You know, we don’t go around advertising who we are and where we work, but I certainly don’t lie to people, and I don’t lie to the press about where I work.

Q. Okay. So you’re fairly certain you never sought to conceal that?

A. Not that I can recall.

Immediately after Seago left the stand, DeFilippis asked for a bench conference (the DC Court adopted phones for the purpose during COVID and all the judges love them, so they’re keeping them). Seago’s answer to the question, DeFilippis noted, was inconsistent with the content of the email, which referenced Tea Leaves.

MR. DeFILIPPIS: Your Honor, could we speak to you on the phone?

THE COURT: Excuse me?

MR. DeFILIPPIS: Could we speak to you on the phone?

THE COURT: Yes. (The following is a bench conference outside the hearing of the jury)

MR. DeFILIPPIS: Your Honor, can you hear me now?

THE COURT: Yes.

MR. DeFILIPPIS: So we have an issue with regard to Ms. Seago’s testimony. The government followed carefully Your Honor’s order with regard to the Fusion emails that were determined not to be privileged but that the government had moved on.

As Your Honor may recall, there was an email in there in which Ms. Seago talks very explicitly about seeking to approach someone associated with the Alfa-Bank matter and concealing her affiliation with Fusion in the email. When we asked her broadly whether she ever did that, she definitively said no when I, you know, revisited it with her. So it raises the prospect that she may be giving false testimony.

And so we were — you know, I considered trying to refresh her with that, but I didn’t understand that to be in line with Your Honor’s ruling. So the government is — we’d like to consider whether we should be — we’d like Your Honor to consider whether we should be able to at least recall her and refresh her with that document?

THE COURT: I don’t remember that question, but the subject matter was concealing Fusion or her identities in conversations with the press. If I recall correctly, that email related to “tea leaves,” correct?

MR. DeFILIPPIS: Your Honor, I thought I had phrased it more broadly. We can go to the transcript.

THE COURT: Mr. Berkowitz?

MR. BERKOWITZ: Judge, I’m not familiar with the specifics. I’m happy to take a look at the transcript. I certainly got the impression he was asking if she had ever concealed Fusion as an entity from the press. That was what was asked in her deposition, and she answered the same way in her deposition. One thing, just to note, some of our paralegals can hear Mr. DeFilippis talking, so I suggest, just as a reminder, to keep your voices down.

MR. DeFILIPPIS: Sure, sure.

THE COURT: All right. Let me look at the transcript.

(Pause)

THE COURT: Can you hear me?

MR. DeFILIPPIS: Yes, Your Honor.

THE COURT: All right. Looking at the transcript, I think you did ask a more open-ended question. She said, “I don’t remember hiding that affiliation from the media ever.” And then you followed up, “Do you ever remember hiding or considering hiding that affiliation from anyone?” And she answered, “No.” I would — so I think that she — I think the email is inconsistent with her answer, Mr. Berkowitz. But the question now is whether they can refresh her with that email notwithstanding the Court’s order. And now she’s gone.

How are we going to do that even if we were to allow it? Is it worth the candle of calling her back?

MR. DeFILIPPIS: Your Honor, I understand she’s still in the building.

MR. BERKOWITZ: Your Honor, is this email privileged?

MR. DeFILIPPIS: This was one of the emails that was determined not to be privileged by Your Honor.

MR. BERKOWITZ: So why didn’t they impeach her with it when they had the chance?

MR. DeFILIPPIS: Your Honor, the reason is because I didn’t want to violate Your Honor’s order that we couldn’t use those affirmatively.

THE COURT: Well, I think the time to have asked the Court whether using the document to refresh was consistent with the order was before she was tendered and dismissed. So I think you waived your opportunity. All right? So we’re going to move on.

Frankly, I think using the formerly privileged emails to impeach was beyond the scope of Cooper’s order, too. This was an affirmative use of the email!

But this was nothing more than a perjury trap, and with it an attempt to get the content of the email DeFilippis had been prohibited from using before the jury. Cooper didn’t allow it in, though he shouldn’t have allowed that line of questions in either (had such questions been permitted, then Seago should have been permitted to refresh her own memory of them).

Probably, DeFilippis will consider charging her with perjury over this. I think the fact that both Judge Cooper and Berkowitz had the impression that the question pertained solely to outreach to the press, Seago’s reiteration that, “I don’t lie to the press about where I work,” reinforcing that understanding, plus her last minute caveat, “Not that I can recall,” would make such a case as flimsy as this one. Probably, DeFilippis will use this exchange as part of his bid to get access to some subset of the 1,500 other not very revelatory emails that Democrats have claimed privilege over.

But this was a stunt. It wasn’t about getting, or sharing, the truth with the jury (and any scenario in which I can imagine Seago trying to hide her identity with Tea Leaves would suggest a more distant relationship than even I imagined Fusion had, though I would love to know what it was).

When a prosecutor engages in as many stunts as DeFilippis has, it’s a confession he knows the facts are not on his side.

To Celebrate Its Third Birthday, the Durham Investigation Will Attempt to Breach Eric Lichtblau’s Reporter’s Privilege

/27 Comments/in , , /by

Happy Birthday to Johnny D and his merry band of prosecutors! Today marks your third birthday! Quite a milestone for an investigation that has just one conviction — a gift wrapped up with a bow from Michael Horowitz — to show for those three years.

John Durham, however, had something much more ambitious planned to mark the milestone, it appears.

As Sean Berkowitz noted earlier this week, Sussmann’s team wants to call Eric Lichtblau as a witness in next week’s trial. They were able to get Lichtblau to agree to testify based on the understanding he would only testify about conversations with Michael Sussmann and Rodney Joffe. But Durham’s team — I guess to assert the newfound brattiness of a three-year-old — refused to limit their cross-examination to those who had waived confidentiality.

There is an issue here that I want to alert you to. We reached out to Mr. Lichtblau’s counsel, actually counsel for The New York Times, to explore their willingness in light of the First Amendment issues to testify at the trial. And we told him that both Mr. Sussmann and Mr. Joffe would waive any privilege associated with the press privilege; and that gave The New York Times comfort that, notwithstanding their normal policy of objecting, they would allow him to testify about his interactions with

Mr. Sussmann and Mr. Joffe, communications between the two as well as communications with the FBI that wouldn’t be protected by privilege because the FBI reached out to them to ask them to hold the story.

They did tell us that they would object to questioning Mr. Lichtblau about independent research he did in support of the story, you know, people he spoke with to verify sources and other types of things that were not communicated to Mr. Sussmann.

We told him from our perspective that seemed like a fair line to draw, and we would not get into that.

He’s reached out to the Government on that issue, and it appears there may be — again, I don’t want to speak for the Government — but it appears that they may not be in a position today to give The New York Times that assurance. And so we expect The New York Times sometime this week will be filing a motion on that issue to tee it up for your Honor.

I know you’re welcoming all this additional paper.

THE COURT: One more intervenor in the mix.

MR. BERKOWITZ: “All the news that’s fit to print.”

As a motion submitted by Lichtblau yesterday and a declaration from his lawyer Chad Bowman lays out, after Sussmann and Rodney Joffe waived their confidentiality with Lichtblau by April 21, Durham then took eleven days to consider whether they were willing to limit Lichtblau’s testimony to his conversations with the two of them. Predictably, Andrew DeFilippis was not.

On April 21, 2022, I spoke by telephone with Andrew DeFilippis in the Special Counsel’s Office, as well as several of his colleagues. I asked whether the prosecution similarly would be willing to limit examination to direct communications between Mr. Sussmann and Mr. Lichtblau, a journalist, particularly given the Department of Justice’s new policy restricting the use of compulsory process to obtain information from reporters, as memorialized in the Office of the Attorney General’s July 21, 2021 Memorandum, a true and correct copy of which is attached as Exhibit B and which is also available online at at https://www.justice.gov/ag/page/file/1413001/download. Mr. DeFilippis stated that the prosecution needed time to consider the request.

On May 2, 2022, during a follow-up telephone call, Mr. DeFilippis stated that the prosecution was unable to give “any assurance” that their cross-examination questioning of Mr. Lichtblau would be confined to his discussions with Mr. Sussmann. In particular, Mr. DeFilippis stated that certain of Mr. Lichtblau’s email communications with third parties were within the prosecutions possession, and that the prosecution might want to examine Mr. Lichtblau about other, unknown aspects of his reporting. He also indicated a view that any reporter’s privilege would be pierced by a trial subpoena.

This is, by all appearances, a naked attempt to keep a very devastating witness off the stand. There’s no way, even under prior guidelines, Durham would have been able to get Lichtblau’s testimony; particularly given that they’ve got the communications in question, they couldn’t show a need to get his testimony.

That’s all the more true given Merrick Garland’s prohibition on requiring testimony from reporters.

But Lichtblau’s testimony is pretty critical for Sussmann, not least because he’ll make it clear he reached out to Sussmann and that the interest in reporting on Russian hacking was in no way tied to animus towards Trump. Plus, he would explain what an impact that acceding to the request from FBI to hold the story was for his career.

Durham has long tried to hide that after the FBI requested, Sussmann and Joffe acceded to help kill the story. It kills his conspiracy theory. It corroborates Sussmann’s stated motivation for sharing the DNS anomaly, that he was trying to help the FBI. Particularly given that both Sussmann and Joffe have Fifth Amendment reasons not to want to testify, Lichtblau would provide a way to get the full extent of that process into the trial.

But Durham wants to prevent it from coming into evidence unless Lichtblau is willing to pay a needless price for doing so.

Thirty Months after Disputing Michael Horowitz, Durham’s Team Suggests They’ve Never Looked at the Evidence

/32 Comments/in , , /by

In Michael Sussmann’s filing explaining that he couldn’t include highly exculpatory notes — written by Tashina Gaushar, Mary McCord, and Scott Schools — from a March 6, 2017 meeting in his motion in limine because John Durham had provided them to him too late to include, Sussmann claimed that the files were not among those for which Durham had gotten permission to provide late.

The Special Counsel neglects to mention that these handwritten notes were buried in nearly 22,000 pages of discovery that the Special Counsel produced approximately two weeks before motions in limine were due. Specifically, the Special Counsel produced the March 2017 Notes as part of a March 18, 2022 production. The Special Counsel included the March 2017 Notes in a sub-folder generically labeled “FBI declassified” and similarly labeled them only as “FBI/DOJ Declassified Documents” in his cover letter. See Letter from J. Durham to M. Bosworth and S. Berkowitz (Mar. 18, 2022). And although the Special Counsel indicated on a phone call of March 18, 2022 that some of the 22,000 pages were documents that made references to “client,” he did not specifically identify the March 2017 Notes or otherwise call to attention to this powerful exculpatory material in the way that Brady and its progeny requires.

[snip]

[T]he Special Counsel has also failed to explain why this powerful Brady material was produced years into their investigation, six months after Mr. Sussmann was indicted, and only weeks before trial.3

Sussmann was wrong.

When Durham got an extension to his discovery deadlines, he got special permission to turn over (among other things) materials from DOJ IG at a later date.

DOJ Office of Inspector General Materials. On October 7, 2021, at the initiative of the Special Counsel’s Office, the prosecution team met with the DOJ Inspector General and other OIG personnel to discuss discoverable materials that may be in the OIG’s possession. The Special Counsel’s office subsequently submitted a formal written discovery request to the OIG on October 13, 2021, which requested, among other things, all documents, records, and information in the OIG’s possession regarding the defendant and/or the Russian Bank-1 allegations.

[I]n January 2022, the OIG informed the Special Counsel’s Office for the first time that it would be extremely burdensome, if not impossible, for the OIG to apply the search terms contained in the prosecution team’s October 13, 2021 discovery request to certain of the OIG’s holdings – namely, emails and other documents collected as part of the OIG’s investigation. The OIG therefore requested that the Special Counsel’s Office assist in searching these materials. The Government is attempting to resolve this technical issue as quickly as possible and will keep the defense (and the Court as appropriate) updated regarding its status.

In the pre-trial hearing on Monday, Andrew DeFilippis explained that the files came from DOJ IG (and therefore were subject to that later discovery deadline).

We located those statements in the notes in February or early March, when we received a huge production from the DOJ Inspector General’s office. As soon as we noticed that in the notes, we put them on very rapid declassification at the FBI and turned them over to the defense about a week later.

DeFilippis offered an unconvincing excuse for burying belatedly provided Brady material two layers deep in file folders without specific notice. He described the decision to flag the materials as an internal Government decision, which is an odd description unless Michael Horowitz’s office — or those involved in declassifying the records — forced the decision:

We then, speaking internally as the Government, decided it would be important to flag those notes for the defense. And so the day that we produced them, we got on a call. We wanted to be in a position to flag it in a way that we didn’t just put it in the end of a paragraph of a discovery letter. We flagged for the defense that we were going to be producing notes and that that included notes in which the word “client” appeared. And we told them that we thought that would be relevant to them.

[snip]

Let me just say that there was absolutely no effort by the Government to delay here or to hide these in a large production. That is precisely why we got on a phone call and flagged it for the defense.

It’s almost like DeFilippis was hoping this would get no notice.

I can understand why. I’ve described how astounding it was that Durham did not go looking for evidence from DOJ IG until — by Durham’s own telling — October 7, more than two weeks after indicting Sussmann (and likely not long enough before indicting Igor Danchenko to learn key details that undermine at least one charge against him).

But this late provision of exculpatory evidence means one of two things:

  • Durham has always had the files, but did such a poor job of looking for it in discovery he didn’t find it in his own files even as he started hunting Michael Sussmann
  • Durham never had these files

The latter is the more likely possibility, which, as a threshold matter, would mean Durham never reviewed key files that DOJ IG had used in high level witness interviews before disputing Michael Horowitz’ conclusion that the investigation was predicated appropriately. Durham is, literally, only reviewing key files three years into his investigation.

Along the way, he’s learning that conspiracy theories he has been chasing for months and years are false.

The revelation that Durham is discovering exculpatory information in DOJ IG’s files is as important to the efforts to blow up the Mike Flynn prosecution two years ago as it is to the Sussmann prosecution. That’s because the Jeffrey Jensen review of the Flynn prosecution and the Durham investigation were believed to be closely aligned. Indeed, I have shown that the handwritten notes from the FBI that Durham will rely on at trial show the same markers of unreliability that documents that were altered in the Flynn case had.

As I explained in this post, Jensen’s documents started with the Bates stamp used throughout the Flynn prosecution.

But after a period of time, they used a Bates stamp with a different typeface, albeit continuing the same series, suggesting someone else was doing the document sharing.

But if they’re drawing on the same source documents, Durham should at least know notes of that meeting exists. Jeffrey Jensen received and relied on at least one set of notes — Jim Crowell’s notes — from the March 6, 2017 meeting. Those notes, along with Tashina Gauhar’s notes of an earlier briefing and all those that got altered, also have the fat typeface.

The Tashina Gauhar notes turned over to Sussmann (and the others turned over) not only are based off a scan of her original notes and have no post-it notes on them, but they bear both Durham’s Bates stamp (SCO-074095), but also one that likely comes from DOJ IG (SCO-FBIPROD_021529).

All of which seems to suggest there was the same cherry-picking that went into the Durham investigation and the Jensen “review.” Neither reviewed — neither could have!! — what really happened. They reviewed selected records and then (in the Jensen review) altered those records to make false claims that the former President used in a debate attack.

I’ll come back to the issue of what appears in the notes Sussmann released that conflicts with the Flynn releases.

But I’m also interested that Durham is stalling on providing other notes from the meeting.

2 The defense has requested that the Special Counsel search for any additional records that may shed further light on the meeting and certain of those requests remain outstanding. To date, the Special Counsel has represented that the only additional notes from attendees at the meeting that he has identified do not reference whether or not Mr. Sussmann was acting on behalf of a client. The absence in those notes of any reference to whether Mr. Sussmann was acting on behalf of a client also raises questions regarding materiality of the charged conduct: if the on behalf of information were truly material to the FBI’s investigation, presumably all note takers would have written it down. [my emphasis]

Durham can’t be withholding notes because they don’t mention Sussmann having a client. That’s because Scott Schools’ notes mention that the Alfa Bank tip came from an attorney, but don’t mention that he was there on behalf of a client (Schools’ notes may have been included because they are the only ones of the three provided that attributed this discussion to Andy McCabe).

There are at least two other sets of notes from this meeting that are known or presumed to exist:

And there were at least three other people present at the meeting known to take notes:

  • Bill Priestap
  • Andy McCabe
  • Dana Boente

Importantly, in Durham’s objection to admitting these notes as evidence, he makes it clear that James Baker (inexcusably as a lawyer) did not take notes of this or any other meeting, but he does not say whether Priestap (or Trisha Anderson) took notes.

Moreover, the DOJ personnel who took the notes that the defendant may seek to offer were not present for the defendant’s 2016 meeting with the FBI General Counsel. And while the FBI General Counsel was present for the March 6, 2017 meeting, the Government has not located any notes that he took there.

If Priestap took notes, one copy should be in Durham’s possession, in the notebook of Priestap’s notes already on Durham’s exhibit list.

DOJ has been trying to prevent anyone from looking at Andy McCabe’s notes for some time.

But one thing that turning over the DOJ IG retained notes for the others will show is whether alterations in the Strzok, Priestap, and McCabe notes were made.

It’ll also make it easy to test why Jensen’s review redacted a date and added one — albeit the correct one — in the Jim Crowell notes.

 

That is, I wonder if Durhams’ reluctance to turn over those materials stems not from any facts about his own investigation, but from an awareness of the cherry-picking — and possibly worse — that having turned over the past one reveals.

Three posts on the altered documents from the Mike Flynn case

The Jeffrey Jensen “Investigation:” Post-It Notes and Other Irregularities (September 26, 2020)

Shorter DOJ: We Made Shit Up … Please Free Mike Flynn (October 27, 2020)

John Durham Has Unaltered Copies of the Documents that Got Altered in the Flynn Docket (December 3, 2020)