Andrew DiFilippis Archives

Thanks to those who’ve donated to help defray the costs of trial transcripts. Your generosity has funded the expected costs. If you appreciate the kind of coverage no one else is offering, we’re still happy to accept donations for this coverage — which reflects the culmination of eight months work.

During his cross-examination of Jim Baker, Michael Sussmann’s lawyer Sean Berkowitz introduced the Electronic Communication that opened the investigation pertaining to the Alfa Bank anomaly. He did so, ostensibly, to show that when DeFilippis elicited Jim Baker to explain the predication of investigations, Baker claimed not to remember that an investigation into the Alfa Bank anomaly had been opened, and claimed not to remember that the EC erroneously said the investigation was a referral from DOJ.

Q. And you were aware, though, because the government showed you a document, that a particular file number here was opened up, correct?

A. I don’t — did I see that? I don’t remember seeing that yesterday.

Q. Let’s show — I don’t think they showed it to you yesterday. They showed it to you in one of your preparation exhibits.

A. Okay. Okay.

Baker should have known it because he was shown the Electronic Communication during an interview with Durham, but he had forgotten it on the stand. So this appeared to be yet another attempt to show Baker’s hot-and-cold running memory.

When Berkowitz moved to enter it into evidence, DeFilippis noted it was a government exhibit, suggesting they weren’t hiding it (even though they hadn’t shown it to Baker on the stand). Probably they would have introduced it when Alfa Bank case agent Allison Sands testifies, probably Monday.

But introducing it with Baker gave Sussmann an opportunity to lay out several huge problems with Durham’s case against him and ensure that DeFilippis has to deal with this EC with Sands.

First, there’s this: When the FBI opened an investigation into this anomaly, they considered it an investigation into Alfa Bank.

This was an investigation into Alfa Bank. Not an investigation into Donald Trump.

In the part of the EC that explains why they opened it, they repeat, again, that it’s an investigation into Alfa Bank. But they also opened it because the FBI was still trying to figure out what Trump associate got an advance heads up that the Russians were going to intervene to hurt Hillary. But even in the context of the fact that one of the agents investigating Crossfire Hurricane had been pulled back to Chicago to work on this investigation, the investigation was not into biological human Donald Trump, it was into corporate human Trump Organization.

Based on the information above, FBI Chicago has predicated a Full Counterintelligence investigation into the activities of ALFA BANK, in order to conduct further investigation regarding the extent and nature of the network communications between ALFA BANK and the TRUMP ORGANIZATION. This investigation will attempt to determine the validity of the information that was provided by the third-party entity, and to assess whether or not pose a threat to either the TRUMP ORGANIZATION, or United States national security.

In addition, FBI investigation [redacted] [CROSSFIRE HURRICANE] was predicated based on an allegation that a member of the TRUMP campaign had received a suggestion from the Russian Government, indicating that the Russian government could assist the TRUMP campaign with an anonymous release of information during the campaign, which would be a detriment to the HILLARY CLINTON campaign. Investigation in [redacted] has surfaced additional ties between the TRUMP campaign team and the Russian government.

Investigation of the communications between the Russian ALFA BANK and the TRUMP ORGANIZATION could provide additional insight about the connections between the TRUMP ORGANIZATION and Russia, and help to determine whether those ties pose a threat to United States national security.

This matter is being treated as a Sensitive Investigative Matter based on the fact that the TRUMP ORGANIZATION is affiliated with a current U.S. Presidential candidate. As such, FBI Chicago requests that FBIHQ/NSLB coordinate with the US DEPARTMENT OF JUSTICE to provide all appropriate notifications required by the DIOG.

So it was sensitive because it related to Trump Organization, and only through that corporate human, to the biological human who was a presidential candidate. Even there, the EC at least envisioned, appropriately, that Trump might be a victim of this, as he would be if someone were trying to infiltrate the campaign or his company.

And in fact, Durham’s own evidence supports the predication against Alfa. The script that Durham falsely suggested (he will be disproven on this point later) were the basis for the research in the technical white paper was focused on Alfa Bank.

There is another that includes the anomalous mail server in question, right next to dcleaks — a query that may well have returned data on Roger Stone’s pre-public searches on the domain, and in any case, since this was entered as a government exhibit, should have obliged Durham to turn over details of these Stone searches.

It’s only a request from July 2017 — probably in conjunction with Dan Jones’ attempt to chase down this anomaly — that the searches were called “Trump query jobs,” and even there, one was focused on Alfa Bank.

The FBI viewed this as an investigation into Alfa Bank, and Joffe’s data requests actually reinforce that.

That creates three problems for Durham.

First, on redirect, DeFilippis got his star cyber agent Scott Hellman, to offer up this explanation for why he found the white paper crap when the counterintelligence people saw something more. It’s about the data, his star witness said.

Q. Now the counterintelligence division, when they look at information like this, are they looking at it with an eye towards the same issues or different issues from the cyber division?

A. Um, I think they’d probably be looking at it from the same vantage point, but if you’re not — you don’t have experience looking at technical logs, you may not have the capability of doing a review of those logs. You might rely on somebody else to do it. And perhaps counterintelligence agents are going to be thinking about other investigative questions. So I guess it would probably be a combination of both.

Never mind that the evidence shows that Hellman didn’t look closely at the data, which caused him to make a false claim in his own assessment of it. He should know that this tied in with the investigation into whom, in Trump’s camp, got advance notice that Russia was going to attack Hillary, because he was on an email that his boss, Nate Batty, sent laying out how the guy investigating George Papadopoulos had been called back to Chicago to also look at this.

Curtis has been working (TDY) the election issues and has been called back by CD to work matters related to this white paper. CG had a copy of the white paper I forwarded to you from CD channels, and was inquiring as to whether ECOU 1 had any logs or other data from the referenced server.

Sure, maybe his comment about “other investigative questions” covers Hellman here. But the reason CD looked at this differently is because they were hunting for the Trump associate who got advance notice of the hack-and-leak. Hellman knows that.

Another problem this creates for Durham is that — as laid out here — he accused Michael Sussmann of lying about sharing allegations about “a Presidential candidate.”

As Sussmann noted in a recent filing summarizing conflicting views on jury instructions, Durham’s indictment describes Sussmann’s alleged lie this way:

[O]n or about September 19, 2016, the defendant stated to the General Counsel of the FBI that he was not acting on behalf of any client in conveying particular allegations concerning a Presidential candidate, when in truth, and in fact, and as the defendant knew well, he was acting on behalf of specific clients, namely, Tech Executive-1 and the Clinton Campaign.

Never mind that Durham characterized the allegations as pertaining to “a Presidential candidate,” which presents other problems for Durham, he has also accused Sussmann of lying about having two clients.

Mr. Sussmann proposes modifying the last sentence as follows, as indicated by underlining: Specifically, the Indictment alleges that, on or about September 19, 2016, Mr. Sussmann, did willfully and knowingly make a materially false, fictitious, and fraudulent statement or representation in a matter before the FBI, in violation of 18 U.S.C. § 1001(a)(2), namely, that Mr. Sussmann stated to the General Counsel of the FBI that he was not acting on behalf of any client in conveying particular allegations concerning Donald Trump, when, in fact, he was acting on behalf of specific clients, namely, Rodney Joffe and the Clinton Campaign.5 The government objects to the defense’s proposed modification since it will lead to confusion regarding charging in the conjunctive but only needing to prove in the disjunctive.

4 Authority: Indictment.

5 Authority: Indictment.

Durham’s language about “conjunctive” versus “disjunctive” will likely be the matter for heated debate next week. Particularly in the wake of Cooper’s decision that the materials from the researchers won’t come in as evidence, Durham seems to be preparing to prove only that Sussmann lied about representing Hillary, and not about Joffe. Sussmann, meanwhile, seems to believe that Durham will have to prove that his alleged lie was intended to hide both alleged clients.

At least the people who opened this investigation didn’t see these allegations to pertain to Donald Trump, biological human They viewed them, first and foremost, as an allegation about Alfa Bank, and secondarily as an allegation about corporate human, Trump Organization.

This distinction will show up over and over again in the next week.

Finally, this goes to materiality. There was no way FBI was going to take allegations that might explain who got advance notice of the hack-and-leak attack on Hillary and not see if it answered that question. Durham wants to complain that this got opened as a Full Investigation when the allegations weren’t that strong. They weren’t! But the reason why it got opened as a Full Investigation is because Crossfire Hurricane had already been opened as a Full Investigation looking for the unknown subject who had gotten a heads up on Russia’s attack plans,

Sussmann has both Jonathan Moffa (who is included on this opening EC) and Michael Horowitz slotted as witnesses next week. He explicitly said that Moffa will address materiality and, depending on how things go, Horowitz’s determination that CH was properly predicated as a Full Investigation might become an issue as well.

In other words, Durham is going to have to talk about Crossfire Hurricane.

And from there, things could get worse, because we know Durham didn’t provide discovery to allow Sussmann to fully argue these issues.

John Durham is prosecuting Michael Sussmann because he brought allegations to the FBI about a bank that has now been sanctioned as part of an effort to halt Russia’s efforts to dismantle democracies in Ukraine and elsewhere, including the United States. Yet for months, he has claimed that such a tip did grave damage to Donald Trump.