Posts

“It Certainly Sounds Creepy:” John Durham Adopts the “Coffee Boy” Defense

At one point during his redirect of FBI Supervisory Analyst Brian Auten yesterday, John Durham was so desperate to insinuate that the Crossfire Hurricane/Mueller team was incompetent, that he even argued that they didn’t investigate Sergei Millian thoroughly enough.

Durham was trying to suggest that Auten should have discovered and pulled the call records for a 212 number, in addition to the 404 prefix number around which Durham has built his entire case.

Q. Right. Do you recall whether or not the FBI ever did — in Crossfire Hurricane ever run that number down to see what the records might show?

A. The 212 number?

Q. Correct.

A. It’s possible. I don’t have a recollection of that while I sit here now.

Q. If you had done that, if the investigators had done that, is that something you think you would recall?

A. Not necessarily.

Q. There’s some probability that if you had actually run the numbers to the ground, you would remember that?

A. No. But, I mean, for a number trace, that may have been one of the analysts that I had under me. If we did it, again, I don’t know whether it was run or not.

Durham was trying to suggest that the FBI should have found a second phone number used by Sergei Millian that — it appears from Durham’s own exhibit list — Durham either didn’t know about or wanted to keep hidden. In the process, he implied that Mueller didn’t investigate Millian, whom Durham still believes was a victim in all this, aggressively enough.

I predicted, on multiple occasions, that Durham would be destroying his purported victims in a claimed effort to avenge them.

He should have listened to me.

Because thus far, Durham’s vengeance for Trump and his flunkies has done more to air details of the criminal investigations into everyone Durham claims to be defending than it has served to present proof of Danchenko’s guilt.

Close to the beginning of his cross-examination yesterday, Danchenko attorney Danny Onorato got Auten to lay out that three of the original subjects of the Crossfire Hurricane investigation — everyone but Carter Page — were convicted.

Q Now, you also understand that when Crossfire Hurricane opened — I think you testified yesterday that there were four people who the government was looking at, correct?

A Correct.

Q Papadopoulus?

A Correct.

Q Paul Manafort, the former campaign manager?

A Correct.

Q Carter Page?

A Correct.

Q And the fourth?

A Michael Flynn.

Q And are you aware that — I think Mr. Durham asked you — whether Mr. Page was ever charged or convicted of a crime?

A Yes, he did. He asked me that.

Q And what did you tell him?

A No.

Q What about the other three people?

A Well, Mr. Manafort, yes.

Q Was he convicted?

A Yes.

Q Next person?

A Michael Flynn.

Q Convicted?

A Yes.

Q Okay. Next?

A George Papadopoulos.

Q Okay. And?

A Yes.

Q So three of those four were convicted of crimes?

A Correct.

Q Based on the Crossfire Hurricane investigation?

A As it went over to the special counsel’s office, yes.

Q Okay.

Even before rehearsing the results of the Mueller investigation, Onorato had Auten describe that the Australian tip that predicated the entire investigation pertained to George Papdopoulos.

Okay. Now, given your background with respect to, you know, analytics and, you know, your work history, is it fair to say that you were assigned to the Crossfire Hurricane investigation?

A Yes.

Q Now, a quick summary would be to say that Crossfire Hurricane started because someone who was represented to be a high-level Trump campaign official and advisor, Mr. Papadopoulos, allegedly indicated that the Russians would help leak damaging information to the Clintons and Obamas, right?

A They had received a suggestion that they could be helped that way, yes.

Q Again, that person was George Papadopoulos, right?

A That is correct.

Q Okay. And the FBI opened an investigation on July 31, 2016?

A Yes.

Q That was before you had any information regarding the Steele dossier, right?

A That is correct.

Q That was before you even — so you would agree with me that the opening of that investigation had nothing to do with the Steele information; it had nothing to do with the initiation of Crossfire Hurricane?

A Correct.

Q You would agree that the goal of Crossfire Hurricane was to determine whether or not there was truth to the allegation that a friendly foreign government had provided the U.S. with respect to Russia and collusion between the Trump administration?

A That is correct. [my emphasis]

Onorato was laying the foundation — as I also predicted — to show proof that Durham’s entire basis for claiming that Millian could not have called Danchenko in July 2016 was easily disproven with basic details of Millian’s cultivation of Papadopoulos in the very same time period. This wasn’t about the fact that Papadopoulos admitted he had lied to cover up his ties with Russian-linked figures.

But it seems to have made Durham nervous that the jury would notice he had.

Perhaps because of this, Durham several times made really defensive comments about George Papadopoulos.

Durham spent part of his redirect of Auten attacking his claim that Papadopoulos was a “high level advisor to the Trump Campaign” (which arose from Onorato’s accurate description of the tip from Australia, as I noted in bold above), delivering the “Coffee Boy” defense Trump once used with great flourish to the “ladies and gentlemen of the jury.”

Q. Okay. Now, there were a number of questions that defense counsel asked you that you — well, there were a number of questions that counsel asked you that I want to probe a little bit more deeply. Mr. Onorato asked you or made reference to George Papadopoulos and said — and said — incorporated in his question, that George Papadopoulos was a high level advisor to the Trump Campaign, and you said yes. Well, tell the ladies and gentlemen of the jury with respect to George Papadopoulos, how old was George Papadopoulos in the 2016 election?

A. I want to say Papadopoulos was in his 30s.

Q. How about 28? Does that refresh your recollection?

A. It could be around 28.

Q. And was he such a high level advisor that he still had on his resume that he was in a student UN panel?

A. No, that was on his resume.

Q. Right. So this person that you agreed to was a high level advisor to Trump, the Trump Campaign, was a 28-year old who still had on his resume that he was a UN — a student UN person? [my emphasis]

When Auten tried to remind Durham that Trump himself had pitched Papadopoulos as a key foreign policy advisor, Durham interrupted.

A. I would say that part of my articulation of that deals with the fact that Mr. Papadopoulos was part of the small group of advisors that were named, I believe, in March of 2016

Q. Right.

A. For the president — for the former president.

Q. With respect to high level advisor, you don’t have any idea whether Papadopoulos even, you know, had occasion to talk to Trump, do you?

A. Well, he was at the meeting that — that was announced —

Q. He was at one meeting —

MR. ONORATO: Can the witness finish his question — his answer?

MR. DURHAM: Sure.

Remember that Durham and Bill Barr went on a junket to Italy together to chase Papadopoulos’ conspiracy theories without ever interviewing Papadopoulos first (which he still has not done, three years later). And now he’s telling us Papadopoulos was just a low level coffee boy?

After attempting to debunk that people — like the former President, the former Attorney General, and he himself treated Papadopoulos as if he had credibility — Durham then tried to get Auten to agree that Mueller was more worried that Papadopoulos was an asset of Israel’s than Russia’s. When Auten tried to clarify that, no, Mueller investigated Papadopoulos for both, Durham interrupted again.

Q. And, in fact, with respect to Mr. Papadopoulos, isn’t it, in fact, true that, as to Papadopoulos, what the FBI thought it was more — of more interest in Papadopoulos was his relationship to Middle Eastern countries, not to Russia?

A. Actually, I would argue that it was a combination of both. I think —

Q. And I — I’m sorry.

THE COURT: Go ahead. Finish your answer.

THE WITNESS: I think I’ve asserted in testimony that it was a both and.

Before this, Durham twice went on at great length suggesting that Millian couldn’t be a spy recruiting George Papadopoulos — even though Papadopoulos himself described Millian as “a very shady kind of person” — because they were discussing real estate and energy, not “collusion” with Russia. He did this first in a morning hearing before the jury came in.

The defendant has provided what he has premarked as Defendant’s Exhibit 480, 4-8-0, which is an email, a LinkedIn message from Millian to George Papadopoulos. Unless the defendant is going to somehow explain to the jury what Millian and Papadopoulos were communicating about at this period of time, then the Court should not permit it. Papadopoulos and Millian, as I think the defense knows from the discovery in this case, were exchanging any number of emails or Facebook exchanges or LinkedIn all about real estate, potential real estate transactions.

And so what the defense would be asking the jury to do is to draw some adverse inference that there was something going on between Millian and Papadopoulos that they really don’t know about, but it certainly sounds creepy. Well, in fact, if you look at what the communications were, as I say, between Papadopoulos and Millian, they are all about real estate, potential real estate investments.

[snip]

MR. DURHAM: 486 is from Millian to Papadopoulos. Again, you know, its irrelevant to these proceedings, but for the same reason, in the government’s view, it would be inadmissible unless we want to get into evidence relating to what Papadopoulos and Millian were doing at or about the time these email exchanges were occurring. [my emphasis]

He did it again in the middle of Onorato’s cross in the guise of voir dire before admitting the communications between Millian and Papadopoulos.

Q. And do you remember what Papadopoulos and Millian were involved in that generated these numbers?

A. I don’t recall exactly what they were involved in, but it was —

Q. But was it pretty much they were involved in real estate or investment discussions over a long period of time?

A. That, I don’t recall exactly.

Q. Well, how about generally? Do you generally refer — recall that Papadopoulos and Millian were involved in discussions about real estate projects and the like?

A. In January of…

Q. Well, this whole period that’s reflected in Defendant’s Exhibit 403.

A. Yeah, again, I don’t know if I — I don’t know if I can speak to that at this point.

Q. Well, you — you were the analyst — that supervisory analyst, correct?

A. Yes.

Q. Did you recall, sir, what it was that Mr. Millian was involved in, the kind of investments?

A. Yes, he was involved in investments and the like.

Q. Right.

A. But I don’t know if I can speak to, at this point, these phone records being tied to any real estate deals or anything of that sort.

Q. Right. So all of these records have shown there was contact between the two of them, correct?

A. Correct.

Q. And did you know that Millian was involved in the energy sector as well?

A. Yes, correct.

Q. And did you know that Papadopoulos was talking about getting involved in the energy sector in the Middle East?

A. Yes, I did know that.

Q. Does that refresh any recollection as to whether or not the contact between Millian and Papadopoulos had to do with energy and other investments?

A. Again, I am familiar with both of those things. I don’t know if that is what this document was actually written for.

Q. Okay. And there’s nothing in this document that tells you what it is about, correct?

A. No. Gmail talks about — there are a couple of references on — it’s not — it’s Bates Number — last Bates number is 105262.

Q. Uh-huh.

A. And there are two paragraphs that talk about another individual involved with energy.

Q. Right. This is all about business, correct?

A. Again, I don’t know if all of this is about business. I know that there are paragraphs in here involving energy.

Q. Okay. So one can tell from this is that they were involved in exchanges of emails or the like, correct?

A. Correct.

Q. And it appears it has to do with energy, correct?

A. It might , yes. Again, there are a lot of — there are a lot of communications on here.

Q. Yes.

A. So I would not be able to state with any substance that these are all involving energy issues.

Q. You can’t say that because the document doesn’t tell the jury what it’s about, other than that it, at least it has partially to do with energy?

A. Correct.

Q. Between Millian and Papadopoulos, correct?

A. That’s what it appears, correct.

Q. So it would be unreasonable to conclude anything or draw any conclusions from this other than Papadopoulos and Millian were involved in investments in the energy sector, right?

A. I don’t know if I can say that it follows necessarily from this, that all of these things deal with that.

Q. That wasn’t my question, though.

A. Okay.

Q. My question was: It would be unreasonable to conclude from this document anything other than they were at least involved in talking about — the energy sector, correct?

A. I would say that from this document there may —

Q. Uh-huh.

A. — there are likely communications within this list of communications dealing with energy, though I cannot say, analytically speaking, that all of these deal with energy

Q. Fair enough. You know that Millian was involved in the energy sector and real estate?

A. I do recall that.

Q. And Papadopoulos is involved in the energy sector and real estate?

A. I recall that.

Q. And so this document doesn’t have anything to do, from looking at it on its particulars, anything to do with Russia and Russia collusion and the like, correct?

A. So the only thing that this has is — it has a list of — most of it is a list of communications between the two parties, dates, times.

Q. Okay. [my emphasis]

When he finally got the witness back and the exhibits admitted, Onorato mocked the way Durham had wasted all his time.

Q. Okay. And I’m glad that Mr. Durham took five minutes of my examination with you to talk about something I didn’t want to ask you about, okay? I don’t care if they were talking about going to the beech or vacation. It’s not relevant to —

He then noted that he really didn’t give a fuck what they were talking about. This was about metadata. Onorato was introducing it to show that the investigation into both Millian and Papadopoulos revealed that there were communications between the two men — communications not relying on the single cell phone that Durham bothered to obtain the call records for. Danchenko’s lawyer was showing that, during the same period when, Durham is arguing, Millian could not have arranged a meeting in New York with Danchenko because he was in Asia and the single phone the records of which Durham bothered to pull had been turned off temporarily, Millian had been arranging a meeting in New York with Papadopoulos.

Q. So the import of that document is that you were investigating Mr. Papadopoulos after Crossfire Hurricane, right?

A. In Crossfire Hurricane, yes.

Q. Right. But you got —

A. And special counsel.

Q. Right. And then Mr. Millian was also being investigated, right?

A. Correct.

Q. And so, the import of that is that there’s communication between Papadopoulos and Millian, and the FBI was documenting that because it was important, right?

A. Correct.

Q. Okay. It doesn’t — I don’t care about the contents of what they were discussing, just the fact that there was this relationship that you needed to explore, right?

Again, the primary purpose of introducing Papadopoulos was to show that the entire metadata-based argument that Durham will make about the impossibility of a call between Millian and Danchenko simply ignored publicly-known metadata from the very same period, metadata that the FBI believed was important.

Onorato was not trying to and does not need to prove that Millian was recruiting Papadopoulos as a Russian asset.

But the mere act of introducing these communications flipped the table, and Durham started making a desperate defense of two of the claimed victims he was championing.

Durham’s observation that all those communications “certainly sound[] creepy” was made outside the presence of the jurors. But in his bid to claim Papadopoulos was just a Coffee Boy, Durham himself introduced the possibility that two men he is attempting to claim were unfairly investigated really were engaged in “Russia collusion.”

Oleg Deripaska Indicted for His Anchor Baby and Flowers for a TV Host

SDNY just unsealed an indictment against Oleg Deripaska and three others for sanctions violations. Just one person — naturalized US Citizen Olga Shikri — was in the US to be arrested. The other main consequences from this indictment will be the forfeiture of property related to the sanctions violations. The indictment lists the three properties that were searched last year.

The central allegations in the indictment pertain to efforts — successful with a first child, and unsuccessful with a second — to set up Deripaska’s girlfriend to give birth in the US and via that process, obtain US citizenship for the child.

Then, in or about 2020, SHRIKI and BARDAKOVA helped DERIPASKA’s girlfriend, VORONINA, travel from Russia to the United States so she could give birth to DERIPASKA’s and VORONINA’s child in the United States.  Despite DERIPASKA’s ongoing support for the Russian regime, he funded hundreds of thousands of dollars of transactions so that his child could take advantage of the U.S. healthcare system and U.S. birthright.  SHRIKI orchestrated the payment of approximately $300,000 worth of U.S. medical care, housing, childcare, and other logistics to aid VORONINA and DERIPASKA’s efforts to help VORONINA give birth in the United States, which resulted in the child receiving U.S. citizenship.  DERIPASKA counseled VORONINA on obtaining a visa to travel to the United States, including by telling her to be “careful” ahead of an interview by U.S. immigration authorities.  VORONINA thereafter applied for and obtained a U.S. visa for a purported ten-day tourism visit without disclosing her intent to travel and stay in the United States for approximately six months to give birth to DERIPASKA’s child.  Following the birth, SHRIKI, BARDAKOVA, and VORONINA conspired to conceal the name of the child’s true father, DERIPASKA, going so far as to change, slightly, the spelling of the child’s last name.

Later, in or about 2022, at DERIPASKA’s further behest and for his further benefit, SHRIKI and BARDAKOVA attempted to facilitate VORONINA’s return to the United States to give birth to DERIPASKA’s and VORONINA’s second child.  This second attempt included BARDAKOVA and VORONINA’s attempt to use false statements to conceal DERIPASKA’s funding and secure VORONINA’s entry into the United States – an attempt that was thwarted, and VORONINA was denied entry and returned immediately to Istanbul, through which she had flown from Russia to the United States.

In addition to a music studio sold in 2019, the indictment refers to other purchases in the US, including Easter flowers for a US TV host.

BARDAKOVA – largely based in Russia – directed SHRIKI to engage in particular illegal transactions on DERIPASKA’s behalf.  These instructions included directing SHRIKI to obtain U.S. goods and technology for DERIPASKA.  Moreover, between in or about May 2018 and in or about 2020, BARDAKOVA instructed SHRIKI to purchase and send flower and gift deliveries on behalf of DERIPASKA to DERIPASKA’s social contacts in the United States and Canada.  The deliveries included, among others, Easter gift deliveries to a U.S. television host, two flower deliveries to a then-former Canadian Parliament member, and two flower deliveries in 2020 to VORONINA while she was in the United States in 2020 to give birth to DERIPASKA’s child.

Perhaps most interesting to me is that the investigation was active in 2020, in the wake of Geoffrey Berman’s firing. Shriki is accused of destroying records in advance of a September 23 grand jury appearance. This was the period when Barr was furiously cleaning up all remaining traces of the Russian investigation (and it was the same month when Yevgeniy Prigozhin’s Interpol red notice was withdrawn, even though the indictment against him in the US remains).

In Berman’s book (which I’ll write about one of these days), he makes it quite clear Barr was protecting Rudy in this period. Was he also protecting Deripaska?

Update: Interesting timing! Andy Beshear announced he has recouped the $15 Million Matt Bevin dumped in Deripaska’s aluminum venture in KY.

When Steven Engel and Ed O’Callaghan Said It Was Legal for Russia to Hack Hillary

There’s a detail of Bill Barr’s memo declining any prosecution of Trump for the Mueller investigation that I intended to point out after it was released.

Steven Engel and Ed O’Callaghan treated Russia’s hack of Hillary as if it was not a crime.

They did so because they treated Trump’s direction to Corey Lewandowski to order Jeff Sessions to limit Mueller’s investigation of Russian election tampering prospectively, not historically, along with Trump’s efforts to constrain Mueller’s investigation in other ways. In doing so, they applied the conclusion they had drawn — that Mueller hadn’t charged any underlying conspiracy and therefore there was no underlying crime into which Trump was trying to obstruct the investigation — to the Russian hack-and-leak itself.

The Report also discusses a second category of actions taken by the President after the appointment of the Special Counsel, most notably after he learned that the Special Counsel had opened an investigation into potential obstruction of justice. Most of the conduct identified consists of facially lawful actions that are part of the President’s constitutional responsibility to supervise the Executive Branch. The Special Counsel considers, for example, whether the President obstructed justice by asking the White House Counsel to direct the firing of the Special Counsel; by asking Corey Lewandowski to contact the Attorney General and seek his assistance in narrowing the Special Counsels investigation; and by asking the Attorney General to reverse his recusal and to supervise the Special Counsel’s investigation. We do not believe that the principles of federal prosecution support charges based upon any of those actions. As noted, the evidence does not establish that the President took any of these actions because he sought to prevent the investigation of an underlying criminal offense, separate and apart from the obstruction case, and the Department rarely brings obstruction cases absent a separate criminal offense. Such a prosecution is doubly inappropriate where, as here, the conduct under investigation is lawful on its face, and the evidence of any corrupt motive is, at the very least, questionable. Federal criminal statutes should be construed to avoid criminalizing generally innocent conduct. S See, e.g., Arthur Anderson, 544 U.S. at 703-04; Ratzlaf. United States, 510 USS. 135, 144 (1994). The standard for demonstrating that a public official acted with corrupt intent is demanding. And there is considerable evidence to suggest that the President took these official actions not for an illegal purpose, but rather because he believed the investigation was politically motivated and undermined his Administration’s efforts to govern.

Moreover, in evaluating the nature of the President’s conduct, it bears emphasis that none of his requests to change the supervision of the investigation were actually carried out. The conduct under investigation is based entirely upon “directions” by the President to subordinates to take actions on his behalf that they did not undertake. In each instance, if the President truly wanted to cause those actions, he could have done it himself (for instance, ordering the Deputy Attorney General to terminate the Special Counsel or directing the Attorney General to unrecuse or to resign). After the President provided his direction, in each instance, the orders were not carried out. Of course, it is true that an act may constitute an attempt or an endeavor, even if unsuccessful. But the facts that the President could have given these directions himself, and did not remove any subordinate for failing to convey his directions, weigh against finding an intent to obstruct justice. [my emphasis]

The Lewandowski direction, recall, wasn’t exclusively about the investigation into Trump. Trump’s scripted instructions were explicitly about “election meddling,” something Mueller charged in two separate indictments. Trump’s script for Sessions would have shut down investigation into Russia’s hack-and-leak campaign, not just Trump’s potential role in it.

During the June 19 meeting, Lewandowski recalled that, after some small talk, the President brought up Sessions and criticized his recusal from the Russia investigation. 605 The President told Lewandowski that Sessions was weak and that if the President had known about the likelihood of recusal in advance, he would not have appointed Sessions. 606 The President then asked Lewandowski to deliver a message to Sessions and said “write this down.”607 This was the first time the President had asked Lewandowski to take dictation, and Lewandowski wrote as fast as possible to make sure he captured the content correctly.608 The President directed that Sessions should give a speech publicly announcing:

I know that I recused myself from certain things having to do with specific areas. But our POTUS .. . is being treated very unfairly. He shouldn’t have a Special Prosecutor/Counsel b/c he hasn’t done anything wrong. I was on the campaign w/ him for nine months, there were no Russians involved with him. I know it for a fact b/c I was there. He didn’t do anything wrong except he ran the greatest campaign in American history.609

The dictated message went on to state that Sessions would meet with the Special Counsel to limit his jurisdiction to future election interference:

Now a group of people want to subvert the Constitution of the United States. I am going to meet with the Special Prosecutor to explain this is very unfair and let the Special Prosecutor move forward with investigating election meddling for future elections so that nothing can happen in future elections. 610

By treating the Lewandowski direction in the same analysis as stuff that more directly pertained to the investigation into Trump himself, Engel and O’Callaghan applied the same (corrupt) conclusion — that there was no underlying crime — to the Russian hack-and-leak as they did to Trump’s efforts to maximize the effect of the hack-and-leak. That amounts to claiming that Russia’s hack of Hillary and the Democratic party was not a crime.

That also means they imply that Trump believed the investigation of Russian hacking would interfere with his ability to govern.

Engel and O’Callaghan’s treatment of the Lewandowski direction with the other obstruction introduces other absurdities into their analysis. For example, Lewandowski wasn’t a subordinate. Trump couldn’t fire Lewandowski for blowing off this order. They don’t consider how much sketchier that made this order: Trump was trying to bypass the entire official chain-of-command to shut down the Russian investigation, making this less a Presidential order than a personal one.

To be clear: I don’t really think Engel and O’Callaghan meant to argue that Russia’s hack of Hillary wasn’t a crime; O’Callaghan would have overseen the decision to charge both Russian indictments.

Perhaps they hadn’t read the Mueller Report closely enough in the seven and a half hours they had before they started drafting this memo to understand the distinction. Perhaps they simply didn’t expect their analysis ever to be made public, so they didn’t much care that lumping the Lewandowski direction in with the other obstruction revealed that they hadn’t thought through this analysis, at all.

Their sloppy treatment of Lewandowski is just another testament to the corruption embodied by this whole memo.

But there it is, analysis from men who’ve since been welcomed at Dechert and WilmerHale that, read literally, suggests they think it was legal for Russia to hack Hillary.

Don’t Analyze Trump Legal Filings Based on the Law, Analyze Them Based on Power

I think people are making a grave mistake of applying principles of law to Trump’s legal maneuvering.

Trump’s lawyers are not making arguments about law.

If there were lawyers concerned about principles of justice participating in his defense, they’d be stridently advising him to work on a plea deal admitting guilt to 18 USC 2071, removing government documents, maybe even agreeing to the probably unconstitutional part of the law that would prohibit him from running for President again, in exchange for removing the more serious 18 USC 793 and 1519 charges from consideration. Such a plea deal is never going to happen. Win or lose, Trump is pursuing power, not adjudication under the law, not even recognition of the law.

One way you can be certain about that is because Evan Corcoran, who got his and Steve Bannon’s asses handed to them in Carl Nichols’ courtroom making legally ridiculous arguments that treat Executive Privilege as a theory of impunity applicable to everyone who is loyal to Trump, has taken from that setback not that his claims about Executive Privilege are ignorant and wrong. Instead, he has doubled down on that approach with Eric Herschmann (and probably the Two Pats, Cipollone and Philbin), undoubtedly believing that so long as he can delay the time until Bannon reports to prison and Trump’s former White House Counsels testify about what really went down on January 6, his people can reclaim Executive authority and make all this go away.

He’s definitely not wrong that he can delay the time until Bannon is jailed, and he may not be wrong about the rest of it.

Four years ago last week, Paul Manafort entered into a plea agreement with Mueller’s team and then promptly started lying about matters to which he had already confessed to get the plea deal in the first place. Manafort managed to sustain the appearance of cooperation through the mid-term election, after which Trump took action that would have been politically problematic before it — firing Jeff Sessions and hiring Billy Barr. Amy Berman Jackson ruled that Manafort had lied during his plea deal. But it didn’t matter. Trump and Barr spent the next two years erasing every legal judgment against him and the Trump flunkies that had remained loyal, erasing Manafort’s conviction and even his forfeiture. They erased a good deal of evidence that he conspired with Russia to get elected in the process. In the end, everyone who played a part in this process ended up better off — in significant part because the process, especially Barr’s part in it, has never been fully reported for what it was. Trump even used the ensuing process of discrediting the Russian investigation as a means to train Republicans — along with likely Fox viewers like Aileen Cannon — to believe he was mistreated in the Russian investigation, when the opposite is the case.

Along the way, Trump did grave damage to rule of law and undermined trust in US institutions. For him, that was a side benefit of the process, but a very important and lasting benefit, indeed.

He’s undoubtedly trying to play the same trick again: Stall the investigation past the election, and then (seemingly confident that Republicans will win at least one house of Congress, by democracy or by deceit) flip the entire investigation into yet another example where Trump has not flouted the law, but instead the law has failed to recognize Trump’s impunity from it.

Consider the analysis of Trump’s objections to Judge Raymond Dearie’s draft Special Master plan. As noted, Trump wailed about two things: that Dearie asked whether Judge Aileen Cannon’s inclusion of any Rule 41(g) claims (which is basically a legal way to demand property back before an indictment) in her order accorded with law and asked Trump to provide a list of the documents he claims to have declassified.

[W]e are concerned that it contemplates resolving issues that were not raised by Judge Cannon in her order, her order denying the stay, or oral argument. Specifically, Judge Cannon was aware of the likelihood of eventual Rule 41(g) litigation and established a process by which the Special Master would evaluate any such claims before reporting and recommending to the Court. While the Plaintiff is, of course, willing to brief anything ordered by the Court under the auspices of the Special Master, we are concerned that the Draft Plan directs the Plaintiff to address whether Rule 41(g) litigation should be litigated under Case No. 9:22-MJ-08332-BER. The Plaintiff respectfully sees no indication the District Court planned to carve out related litigation for a merits determination by the issuing magistrate for the warrant in question. Most importantly, none of the District Court’s Orders have ever indicated that this was even a consideration.

Similarly, the Draft Plan requires that the Plaintiff disclose specific information regarding declassification to the Court and to the Government. We respectfully submit that the time and place for affidavits or declarations would be in connection with a Rule 41 motion that specifically alleges declassification as a component of its argument for return of property. Otherwise, the Special Master process will have forced the Plaintiff to fully and specifically disclose a defense to the merits of any subsequent indictment without such a requirement being evident in the District Court’s order.

Virtually everyone has suggested that the reason that Trump is balking at the order to tell Dearie which documents he declassified is because his lawyers want to avoid lying and they know Trump hasn’t declassified any of these documents. Such observations apparently apply even to Evan Corcoran, who (according to the NYT) suckered Christina Bobb into signing a declaration he wrote about a search he had done that claimed a diligent search was done that has since been proven not to be a diligent search.

Suffice it to say I’m skeptical that these lawyers — at least some of them — would be averse to filing a declaration saying, “Our client tells us he declassified it all,” if it would serve Trump’s purposes. All the more so given that none of them were in a position to know whether Trump declassified them all or not, and Trump not only doesn’t care whether he lies to his lawyers, he’s probably constitutionally incapable of doing anything but.

That’s not the reason why they’re balking about Dearie’s request for a list of documents Trump declassified.

Consider the schedule Trump proposed.

This schedule ensures that key decisions come to a head in mid-November, after the election.

Trump’s goal here is not any final determinations from Dearie (absent a determination that the FBI was mean to Trump just like they were to Carter Page). Cannon’s order fairly obviously invites Trump to contest Dearie’s ultimate decisions so she can de novo decide the issues. Trump’s goal is undoubtedly (because it always is) to create conflict, to sow an invented narrative that DOJ is out to get him. And Trump’s optimal outcome is not necessarily even that Cannon will say Trump declassified all these documents, including some of the Intelligence Community’s crown jewels. Such a proposition might even piss off a few of the Republicans who’ve not entirely lost their mind, until such time as Trump convinces them through the process of repetition and demonization that the IC should never have been spying on (say) Russia in the first place.

Trump’s goal here is to sustain the conflict until such time as Jim Jordan can save him, and the two of them can resume their frontal assault on rule of law again.

All Cannon needs to do to serve that end is at some point, after the election, declare that Trump’s claims about classification, even if incorrect and foolish, are reasonable for a former President. That’s all it would take to make it prohibitively difficult for future prosecutors to indict the 793 charges. This is the same way Barr made it prohibitively difficult for prosecutors to charge outstanding Mueller charges, notwithstanding the number of self-imagined liberals who blame Merrick Garland for that damage.

A more obvious tell comes earlier in Trump’s proposed schedule.

He wants the classified documents shared with his team — none of whom currently has the requisite clearance — this week. Only after that does he want to create the privilege log for the 64 documents his lawyers have had for four days; he wants another two weeks (so 18 days out of a 75 day process, total) before he makes such privilege determinations.

To be fair, that may be what Judge Cannon intended, too. She, meanwhile, will have to review at least one protective order this week, and may use that as further opportunity to muck in the process, to reinforce her demand that DOJ start the process of sharing classified documents even before the 11th Circuit weighs in.

There are probably two very good reasons why Trump wants classified documents in hand before they make any privilege claim. First because (as I have repeatedly pointed out), Cannon used those potentially privileged documents as the harm she hung her authority to wade in on. If Dearie rules that — as DOJ has repeatedly claimed — these documents were pulled out not because they really are privileged, but only because they set the bar for potential privilege so low as to ensure nothing was reviewed, then it takes one of the three harms that Cannon has manufactured off the table. Every time a claimed harm is taken off the table, another basis for Cannon’s power grab, and another basis from which to claim conflict, is eliminated.

Trump needs to forestall that from happening until such time as he has created more conflict, more claimed injury.

The other reason, I suspect, that Trump wants the classified documents in hand before the potentially privileged documents is because he knows that some of the classified documents he stole involve either his White House Counsel (which would be the case if documents pertaining to his Perfect Phone Call with Volodymyr Zelenskyy were in the stash) or his Attorney General (which might be the case with the clemency for Roger Stone). DOJ has always limited its comments about attorney-client privilege to those involving Trump’s personal lawyers, and that approach has continued since then, even in their motion for a stay before the 11th Circuit. They’re not wrong on the law: classified documents involving White House or DOJ lawyers are obviously government documents. But that wouldn’t prevent Trump from claiming they are privileged (or Cannon agreeing with him on that point).

Thus the delay. Trump needs to delay the potentially privileged review until such time as he has those classified documents in hand and can claim that DOJ didn’t include all the potentially privileged ones because they assumed that government lawyers work for taxpayers, not for Trump.

It doesn’t have to be true or legally sound. It needs to be a conflict that can be sustained long enough to let Cannon decide, and decide in such a way that Trump keeps claiming he’s the victim.

Like I said, Corcoran may not be wrong that this will work. A lot depends on what the 11th Circuit decides. But a lot, too, depends on commentators continuing to treat this as a good faith legal dispute when instead it’s just more manufactured conflict.

Aileen Cannon Calls an Investigation into “What’s Literally a Stolen Diary” … “Politicized”

This is a minor point, but one that deserves more attention. Plus, I plan to use it in future posts about the unlawful assault on property rights that Judge Aileen Cannon has mounted in her opinion appointing a Special Master to stall the investigation into Donald Trump’s suspected theft of classified documents.

In a footnote of her opinion, Judge Cannon pointed to the Special Master appointed in the Project Veritas case as a precedent of a judge (Analisa Torres, in this case), appointing a Special Master “in politicized circumstances.”

Moreover, at least one other court has authorized additional independent review for attorney-client privilege outside of the law firm context, in politicized circumstances. See In re Search Warrant dated November 5, 2021, No. 21-Misc-813, 2021 WL 5845146, at *1 (S.D.N.Y. Dec. 8, 2021) (appointing a special master to conduct review of materials seized from the homes of employees of Project Veritas for potentially attorney-client privileged materials).

To be fair, I kept waiting for Trump’s lawyers to raise this precedent (though not for the principle Cannon did).

But they didn’t.

Not in the original complaint (in which they relied heavily on the Lynne Stewart and Michael Cohen precedent). Not in their supplement (in which they added the Rudy precedent to those they relied on). Similarly, it didn’t come up in the hearing (in which Rudy featured prominently).

This was Judge Cannon going out of her way to find what she believed was a precedent on her own, one that she said supported an, “independent review for attorney-client privilege outside of the law firm context, in politicized circumstances.” But the opinion isn’t about attorney-client privilege. It was, explicitly, about press privileges.

In light of the potential First Amendment concerns that may be implicated by the review of the materials seized from Petitioners, the Court finds that the appointment of a special master will “help[] to protect the public’s confidence in the administration of justice.”

The opinion further holds there is no basis of law to do what Cannon did–intervene because of leaks (more on the leaks Cannon made up later).

Project Veritas and O’Keefe request that the Court order the Government to conduct a search for alleged leaks related to the Government’s investigation. O’Keefe Mot. II at 1. Petitioners do not provide a legal basis for their request or allege that the Government violated any specific rule, law, or policy

Crazier still, there’s no mention in the opinion, at all, about politics.

Nor should there be. This is a case about theft. We know it’s about theft because the two people who’ve already pled guilty in the case acknowledged it in real time (and pled guilty to transporting stolen goods across state lines).

They are in a sketchy business and here they are taking what’s literally a stolen diary and info . . . and trying to make a story that will ruin [the Victim’s] life and try and effect the election. [The Victim] can easily be thinking all her stuff is there and not concerned about it. .  . we have to tread even more carefully and that stuff needs to be gone through by us and if anything worthwhile it needs to be turned over and MUST be out of that house.

We know, too, that it’s not just about a stolen diary. In addition to the diary (which by the way included Ms. Biden’s extensive accounts of her own addiction treatment, the most personal kind of medical record), the thieves stole,

tax records, a digital camera, a digital storage card containing private family photographs, a cellphone, books, clothing, and luggage.

Aileen Cannon believes that the investigation of this theft — the culprits have admitted it!! — is politicized.

Presumably Aileen Cannon believes an investigation into stolen property must be about politics because she believes James O’Keefe’s claim that this was an investigation started under Joe Biden. Had she done as much work to fact-check O’Keefe as she did to find precedents for Trump, though, she would know that this investigation was not started under Joe Biden.

It was started under Donald Trump.

The first call records in this investigation were obtained in November 2020, while Bill Barr was Attorney General (under Merrick Garland, such a step might have required the AG’s approval, but Barr was less interested in such protections). The first warrant targeting people purporting to play the role of journalists was obtained on January 14, 2021. That one, I imagine, did require Main DOJ approval, hopefully even from then-Acting Attorney General Jeffrey Rosen.

Aileen Cannon argues that the investigation started under Bill Barr and Jeffrey Rosen into the theft — this is not contested! — of things including medical and tax records is politicized, mostly because the victim is the current President’s daughter.

Effectively, then, Judge Cannon is arguing that private citizen Ashley Biden can have no recourse for when someone literally steals her medical and tax records, but Trump must have special judicial interference to prevent the FBI taking medical and tax records in the process of investigating 11,000 stolen records.

How To Be a Handmaiden to Corruption, Barr Memo Press Coverage Edition

Much of the coverage of the Barr Memowritten over a weekend after a 7-hour review of the Mueller Report to justify a public statement to Congress exonerating the former President — continues to magnify the corruption of Barr’s act, rather than expose it.

The memo makes numerous factual errors (errors that can be easily documented thanks to a public record liberated by Jason Leopold). One Judge — Amy Berman Jackson — issued a ruling saying that the memo doesn’t do what it claimed it did (deliberate about whether Trump could be charged). She even included a timeline to show her work. Three more Circuit Judges agreed with ABJ’s opinion that DOJ misrepresented what they claimed they had done — by saying they were making a prosecutorial decision rather than a public messaging decision — in an attempt to keep the memo under wraps.

You’d think that after four judges had called out DOJ for shenanigans with this memo, anyone remotely interested in performing the function of journalism would explain why those judges found the project so suspect, and the import of that to the actual claims made in the memo. CREW spent years doing the hard work of liberating the memo to make it easy for journalists!

Instead, numerous outlets simply parroted the language of the memo that four judges had ruled to be a messaging project, thereby treating the memo as a valid exercise of legal analysis and not a performance of corruption.

I’d like to pay tribute to some of the outlets that chose to be a handmaiden to corruption rather than journalists.

I should say, while I bitched about it the day of the release, the NYT improved their story by adding the work of Charlie Savage. (early version; later version) It still treats the focus on Don McGahn as real rather than tactical and chooses to primarily quote experts explaining the problems with the memo rather than lay that out directly. But it notes (as I did) that the memo doesn’t explain something that was at the core of Mueller’s obstruction analysis — pardons. It provides actual reporting explaining that Merrick Garland’s DOJ wasn’t hiding the substance of this when they fought to keep it sealed last year, they were making a “narrower legal” argument — presumably trying to preserve the exemption it had been sealed under (the b5A deliberative privilege).

After losing in court on Friday, the Justice Department had the option to appeal the case. But the department’s senior leadership decided to release the document, according to a senior official in federal law enforcement. The leadership never opposed airing its contents, but had contested its release on narrower legal grounds, the person added.

Compare that with some of the stenography that remains untouched.

Eric Tucker, Memo sheds light on decision to clear Trump in Russia probe (AP)

Unsurprisingly, Eric Tucker ignores the opinions from four judges who called out this memo and spends three paragraphs ignoring the evidence that this was a hash job instead describing it as a record of “how two of the department’s senior-most leaders arrived at that conclusion,” something the judicial record says it’s not. He then spends seven paragraphs rehashing part of Steven Engel and Ed O’Callaghan’s argument, never calling out factual errors and ignoring their even more problematic treatment of witness tampering. Only after that does Tucker explain that two courts (he only mentions the Circuit) deemed that it had been improperly withheld, without explaining why. Finally, in the last two paragraphs, he quotes from CREW about the substance of the memo, as if he doesn’t have the competence to assess it himself.

Ryan Lucas, DOJ releases a Mueller-era memo to Barr on the decision not to prosecute Trump (NPR)

Unlike the AP, NPR didn’t claim, in its headline, that this memo actually did represent the decision-making process. But Ryan Lucas dedicated much of his story on the memo — paragraphs three and four, and then nine through eleven — parroting the claimed rationale of the lawyers. It describes the rebukes from the judges this way: “A district court judge and a panel of circuit court judges disagreed and ordered its release.” That leaves him free to pitch the question of Barr’s exoneration of Trump (which he calls “declin[ing] to prosecute Trump”) as a he-said, she-said affair, pitting CREW and 1,000 former prosecutors against Trump and his supporters. Lucas ends the piece by describing the current investigation into whether Trump violated the Espionage Act and obstructed an investigation by refusing to return classified documents an investigation into “storing presidential documents at his Mar-a-Lago residence.”

Robert Legare, Government lawyers advised Barr not to bring obstruction charges against Trump after Mueller report, newly-released memo reveals (CBS)

Of 28 paragraphs in this story, twelve report the claimed analysis of the memo unfiltered, as if it really was a predecisional declination memo, as if it really did analyze the entirety of the report, as if it was factually accurate. It dedicates four paragraphs to more recent efforts of Barr and the others involved to justify their decisions or separate themselves from Trump. Rather than describing the years-long fight featuring judges repeatedly calling out both the project of the memo itself and the means by which it was hidden, Legare described only that it, “was ordered unsealed by an Appeals Court after a FOIA request and subsequent lawsuit were filed seeking its release.” Ultimately, then, this article treats the memo as something the judges say it’s not — a view that would be reinforced by an assessment of the actual claims made against the now-public record of the investigation itself.

Ryan J. Reilly and Dareh Gregorian, DOJ releases unredacted memo to Barr on Trump, obstruction in Mueller probe (NBC)

Reilly interrupted breaking a story about an important January 6 militia arrest the other day to cover this live and did a pretty good job on the air. But in the write-up with Dareh Gregorian, they spend paragraphs three through eight quoting at length from the memo. Along the way, they claim the memo “dismiss[ed] Mueller’s concerns about Trump’s … dangling of pardons to some witnesses,” rather than calling it out for ignoring pardons entirely. While the piece noted that Barr “announced that the Justice Department would not prosecute the case the same day the memo was sent to him” and described ABJ’s ruling that, “Barr’s mind had already been made up before the memo was written,” thereby hinting that the memo was just a messaging project, they don’t consider the import of that sequence for the analysis itself. And rather than identifying the problems of the memo themselves, they describe that, “many people strongly disagreed with the analysis laid out in the memo,” and explicitly identify CREW as ” left-leaning,” treating the actual substance as something inaccessible to them and so just a matter for ongoing political dispute.

Alexander Mallin, DOJ releases memo behind Barr’s decision not to prosecute Trump for obstruction (ABC)

To his credit, in the five paragraphs describing what led to the release of the memo with which Alexander Malin starts his coverage, he describes the judges concluding that, “Barr and other DOJ officials were not candid in their statements about the role the memo played in their decision to not charge Trump.” Which makes it all the more mystifying why he dedicates eleven paragraphs of his story quoting the memo at length, with no fact-checking or push-back, as if it the memo really was real analysis that led to Barr’s decision to make an announcement that he wouldn’t have charged Trump if he could have.

I get it. This memo came out amid a flood of news, especially for those of us on the DOJ beat. I get that people rushed to do quick analyses so they could go back to watching dockets in Florida, Georgia, and DC.

But what happened with this memo — four judges overriding a b5 exemption based on their assessment that DOJ misrepresented the function of the memo — is virtually unprecedented. That, by itself, should lead reporters to scrutinize the memo (or at least the process) for the kind of dishonesty the judges judged it was, rather than treating it as a transparent record of legal analysis that ABJ already showed it’s not. All the more so when, as is the case here, thousands of pages recording the underlying evidence (evidence that the authors of the memo explicitly say they’re not going to cite) are publicly available.

If you’re reporting on a document that DOJ made false claims in an attempt to keep secret, parroting what it says at length, with no discussion of why DOJ made misrepresentations to keep it secret, with no effort on your own to test whether what it says is any more true than what was said to keep it hidden, you’re doing readers a disservice.

Four judges and CREW (plus Leopold, with his earlier Mueller Report FOIA) have given you an easy way to reassess what Bill Barr did to pre-empt the results of the Mueller Report in 2019. To instead simply repeat his past claims or those whom he ordered (and worked with) to justify a pre-ordained result is not journalism.

The Word “Pardon” Doesn’t Appear in the Barr Memo

As I noted in this post, there’s something missing in this passage — indeed, in the entirety of — the Barr Memo declining prosecution of former President Trump.

We likewise do not believe that the President’s public statements exhorting witnesses like Flynn, Manafort, Stone, or Cohen, not to “flip” should be viewed as obstruction of justice. The Report makes clear that the President equated a witness’s decision to “flip” with being induced by prosecutors to manufacture false evidence against others. We cannot say that the evidence would prove beyond a reasonable doubt that the President’s statements, most of which were made publicly, were intended to induce any of those witnesses to conceal truthful evidence or to provide false evidence. Once again, this conclusion is buttressed by the absence of any clear evidence that these witnesses had information that would prove the President had committed a crime. The President’s public statements could be viewed as efforts to defend himself from public criticism related to the Special Counsel’s investigation or to discourage the witnesses from making what the President believed might be false statements in exchange for a lesser sentence. Those statements do not warrant a prosecution for obstruction of justice.

The word “pardon.”

That’s important for two reasons. First, Barr said repeatedly, under oath, as part of his confirmation hearing, that trading false testimony for a pardon would be obstruction. Here’s what he said, for example, in response to a question from Lindsey Graham.

Lindsey: So if there was some reason to believe that the President tried to coach somebody not to testify or testify falsely, that could be obstruction of justice?

Barr: Yes, under that, under an obstruction statute, yes.

Here’s what he said to Patrick Leahy.

Leahy: Do you believe a president could lawfully issue a pardon in exchange for the recipient’s promise to not incriminate him?

Barr: No, that would be a crime.

And pardons are a critical part of the discussion in the Mueller Report to substantiate obstruction. The word pardon appears 67 times. Indeed, contrary to the discussion in the Barr Memo that claimed most of Trump’s witness-tampering happened in public, several of the discussions of pardons described in the Mueller Report involved non-public communication.

A voicemail that John Dowd left for Rob Kelner in November 2017 was presented as background to Trump’s public discussion of a pardon for Mike Flynn.

I understand your situation, but let me see if I can’t state it in starker terms. . . . [I]t wouldn’t surprise me if you’ve gone on to make a deal with . . . the government. . . . [I]f . . . there’s information that implicates the President, then we’ve got a national security issue, . . . so, you know, . . . we need some kind of heads up. Um, just for the sake of protecting all our interests if we can. . . . [R]emember what we’ve always said about the President and his feelings toward Flynn and, that still remains . . . .835

[snip]

On December 1, 2017, Flynn pleaded guilty to making false statements pursuant to a cooperation agreement.841 The next day, the President told the press that he was not concerned about what Flynn might tell the Special Counsel.842 In response to a question about whether the President still stood behind Flynn, the President responded, “We’ll see what happens.”843 Over the next several days, the President made public statements expressing sympathy for Flynn and indicating he had not been treated fairly.844 On December 15, 2017, the President responded to a press inquiry about whether he was considering a pardon for Flynn by saying, “I don’t want to talk about pardons for Michael Flynn yet. We’ll see what happens. Let’s see. I can say this: When you look at what’s gone on with the FBI and with the Justice Department, people are very, very angry.”845

Paul Manafort told Rick Gates that Trump was “going to take care of us,” which Gates took to suggest a pardon.

In January 2018, Manafort told Gates that he had talked to the President’s personal counsel and they were “going to take care of us.”848 Manafort told Gates it was stupid to plead, saying that he had been in touch with the President’s personal counsel and repeating that they should “sit tight” and “we’ll be taken care of.”849 Gates asked Manafort outright if anyone mentioned pardons and Manafort said no one used that word.850

And the private comments Robert Costello made to Michael Cohen — again in the context of Trump’s public comments about Cohen not flipping — led him to believe Trump would, at least, pay his defense fees.

In an email that day to Cohen, Costello wrote that he had spoken with Giuliani.1026 Costello told Cohen the conversation was “Very Very Positive[.] You are ‘loved’. . . they are in our corner. . . . Sleep well tonight[], you have friends in high places.”1027

By issuing his prosecution declination while Trump’s attempted witness tampering was still in progress, Barr ensured that the corrupt trade-off would and could  be completed, at least with Flynn, Stone, and Manafort.

And in doing so, he ensured that ongoing investigations wouldn’t find precisely the evidence he was sure didn’t exist.

A Roger Stone Pardon for MacronLeaks Isn’t As Crazy as It Sounds

In April 2020, DOJ released the warrants from the Roger Stone investigation. With six of those, DOJ redacted broad swaths of the justifications behind the warrants, none of which were shared with him as part of his obstruction prosecution.

September 26, 2018: Mystery Twitter Account

September 27, 2018: Mystery Facebook and Instagram Accounts

September 27, 2018: Mystery Microsoft include Skype

September 27, 2018: Mystery Google

September 27, 2018: Mystery Twitter Accounts 2

October 5, 2018: Mystery Multiple Googles

All six were obtained by Patrick Myers, an FBI agent located in Pittsburgh, whereas almost all the warrants obtained before that were signed by agents located in DC (in earlier weeks, Myers had also obtained a warrant targeting a second account used by the GRU persona, Guccifer 2.0).

In his order releasing the warrants, Judge Christopher Cooper explained that all the redacted information (and so the information justifying these warrants) was redacted to protect, “the private information of non-parties, financial information, and non-public information concerning other pending criminal investigations.”

One of those warrants explicitly said that the government requested a gag on the provider involved (in that case, Twitter) because Roger Stone seemed not to understand the full extent of the investigation into him.

It does not appear that Stone is currently aware of the full nature and scope of the ongoing FBI investigation. Disclosure of this warrant to Stone could lead him to destroy evidence or notify others who may delete information relevant to the investigation.

In addition to the crimes for which Mueller declined to charge Stone (foreign donations) or of which he was convicted (witness tampering and obstructing an investigation), the warrant sought evidence of conspiracy (18 USC 371), two foreign agent laws (18 USC 951 and 22 USC 611), and computer hacking (18 USC 1030).

These warrants strongly suggest that in April 2020, as Bill Barr was making unprecedented efforts to limit Stone’s punishment for the crimes of which he had been convicted, DOJ continued to investigate whether Stone conspired with foreign entities — and given that a Guccifer 2.0 warrant is among this series, Russia would be that foreign entity — to engage in computer hacking.

That’s important background to the seizure from Trump’s office of document reflecting Executive Clemency for Stone that appears to have a link to a French President, possibly Emmanuel Macron.

If Stone were involved with the MacronLeaks operation on which the GRU teamed up with alt-Right figures in Stone’s orbit, it’s conceivable Trump secretly pardoned him to prevent him from being included in the indictment covering that operation.

Based on the FOIA exemptions in various versions of the Mueller Report released, the Stone investigation that continued after Mueller closed up shop appears to have been closed between September 18, 2020 and November 2, 2020. On the latter date — literally the day before the 2020 election — DOJ provided Jason Leopold a version of the Mueller Report with newly-unsealed passages. It revealed for the first time that, on page 178, a footnote modified the discussion in the body of the Report about whether Stone could be prosecuted for conspiring with Russia on computer hacking by explaining that Mueller had referred the issue to DC US Attorney’s Office for further investigation.

The Office determined that it could not pursue a Section 1030 conspiracy charge against Stone for some of the same legal reasons. The most fundamental hurdles, though, are factual ones.1279

1279 Some of the factual uncertainties are the subject of ongoing investigations that have been referred by this Office to the D.C. U.S. Attorney’s Office.

A version of the report released to Leopold on June 3, 2019 redacted that footnote because of an ongoing investigation. And a spreadsheet justifying all continued redactions released on September 18, 2020 seems to have redacted it too. The unredacted publication of it on November 2, 2020 suggests whatever investigation in Stone DOJ had been pursuing had been closed.

Stone’s wasn’t the only investigation that got shut down in the months before Donald Trump would lose the presidency. In that period, previously redacted references to investigations into two of Paul Manafort’s businesses, and an investigation into a suspected $10 million cash infusion during the 2016 election from an Egyptian state-owned bank were unsealed — though both were unsealed by the time of that September filing. There was even reference to a warrant for Erik Prince’s phone, suggesting any investigation into him had similarly been shut down.

What made Stone’s case different, however, is that DOJ never told us what the investigation was about (indeed, two referrals that likely pertain to Stone were redacted in that November 2020 release, which they shouldn’t have been if the cases were really closed).

The most important referral from the Mueller investigation, then — the one that Billy Barr was hired to make go away — simply got deep-sixed sometime in the months when it looked like Trump would lose the election, with no explanation as to what the investigation even was. And, again, it appears to have happened between September 18 and November 2, 2020.

As it happens, DOJ rolled out an indictment against GRU on October 19, just 15 days before the election (and just 14 days before DOJ released the language pertaining to Stone). It covered six GRU attacks, though focused especially on the 2018 Olympic Destroyer attack on the Pyeongchang Olympics.

But it included, almost as a throwaway, GRU’s role in the 2017 MacronLeaks campaign. By description, it held just one of the charged individuals accountable for the spearphishing part of the MacronLeaks campaign: Anatoliy Kovalev, the one guy (as noted) also charged in the DNC hack.

Defendant ANATOLIY SERGEYEVICH KOVALEV was a Russian military intelligence officer assigned to Military Unit 74455. KOVALEV sent spearphishing emails targeting a wide variety of entities and individuals, including those associated with French local government entities, political parties, and campaigns; the 2018 Winter Olympics; the DSTL; and a Georgian media entity. KOVALEV also engaged in spearphishing campaigns for apparent personal profit, including campaigns targeting large Russian real estate companies, auto dealers, and cryptocurrency miners, as well as cryptocurrency exchanges located outside of Russia. KOVALEV is a charged defendant in federal indictment number 18-CR-215 in the District of Columbia. [my emphasis]

In the Mueller indictment of the GRU, Kovalev is described as the guy responsible for the hacking that targeted voting infrastructure — the kind of stuff that really could have affected the outcome, especially in North Carolina.

72. In or around July 2016, KOVALEV and his co-conspirators hacked the website of a state board of elections (“SBOE 1”) and stole information related to approximately 500,000 voters, including names, addresses, partial social security numbers, dates of birth, and driver’s license numbers.

[snip]

75. In or around October 2016, KOVALEV and his co-conspirators further targeted state and county offices responsible for administering the 2016 U.S. elections. For example, on or about October 28, 2016, KOVALEV and his co-conspirators visited the websites of certain counties in Georgia, Iowa, and Florida to identify vulnerabilities.

76. In or around November 2016 and prior to the 2016 U.S. presidential election, KOVALEV and his co-conspirators used an email account designed to look like a Vendor 1 email address to send over 100 spearphishing emails to organizations and personnel involved in administering elections in numerous Florida counties. The spearphishing emails contained malware that the Conspirators embedded into Word documents bearing Vendor 1’s logo.

The Olympic Destroyer indictment obtained weeks before the election held Kovalev (and the GRU) accountable for the spearphish and communications with some French participants.

27. From on or about April 3, 2017, through on or about May 3, 2017 (during the days leading up to the May 7, 201 7, presidential election in France), the Conspirators conducted seven spearphishing campaigns targeting more than 100 individuals who were members of now-President Macron’s “La Republique En Marche!” (“En Marche!”) political party, other French politicians and high-profile individuals, and several email addresses associated with local French governments. The topics of these campaigns included public security announcements regarding terrorist attacks, email account lockouts, software updates for voting machines, journalist scoops on political scandals, En Marche! press relationships, and En Marchel internal cybersecurity recommendations.

28. KOVALEV participated in some of these campaigns. For example, on or about April 21, 2017, KOVALEV developed and tested a technique for sending spearphishing emails themed around file sharing through Google Docs. KOVALEV then crafted a malware-laced document entitled “Qui_peut_parler_ aux journalists.docx” (which translates to “Who can talk to journalists”) that purported to list nine En Marche! staff members who could talk to journalists about the previous day’s terrorist attack on the Champs-Elysees in Paris. Later that day, the Conspirators used an email account that mimicked the name of then-candidate Macron’s press secretary to send a Google Docs-themed spearphishing email to approximately 30 En Marche! staff members or advisors, which purported to share this document.

29. From on or about April 12, 2017, until on or about April 26, 2017, a GRU-controlled social media account communicated with various French individuals offering to provide them with internal documents from En Marche! that the user(s) of the account claimed to possess.

But it professed utter and complete ignorance about how the stolen documents started to get leaked.

30. On or about May 3 and May 5, 2017, unidentified individuals began to leak documents purporting to be from the En Marche! campaign’s email accounts.

But they weren’t unidentified, at least not all of them! As a DFIR report released 15-months before this indictment laid out, while there was a Latvian IP address that hadn’t been publicly identified at that point (one the FBI surely had some ability to unpack), the American alt-right, including Stone associate Jack Posobiec, made the campaign go viral, all in conjunction with WikiLeaks.

First there was a rumor spread from that Latvian IP to 4Chan to William Craddick to Jack Posobiec.

Last but not least came the “#MacronGate” rumor. Two hours before the final televised debate between Macron and Le Pen, on Wednesday, May 3, at 7:00 p.m.,41 a user with a Latvian IP address posted two fake documents on 4chan. The documents suggested that Macron had a company registered in Nevis, a small Caribbean island, and a secret offshore bank account at the First Caribbean Bank, based in the Cayman Islands. Again, the rumor itself was not entirely new. Macron himself had seen it coming. More than two weeks earlier on TV he warned that this type of rumor was likely to appear: “This week, you will hear ‘Mr. Macron has a hidden account in a tax haven, he has money hidden at this or that place.’ This is totally false, I always paid all my taxes in France and I always had my accounts in France.”42 What was new this time, however, was the release of two documents supposedly proving this rumor. The user who posted the two documents on 4chan did it purposefully on the evening on the final televised debate to attract more attention, and even suggested a French hashtag: “If we can get #MacronCacheCash trending in France for the debates tonight, it might discourage French voters from voting Macron”43.

Then the rumor spread on Twitter. The 4chan link was first posted by Nathan Damigo, founder of the American neo-Nazi and white-supremacist group Identity Evropa, and was further circulated by William Craddick, founder of Disobedient Media and notorious for his contribution to the Pizzagate conspiracy theory that targeted the US Democratic Party during the 2016 American presidential campaign. The first real amplifier was Jack Posobiec—an American alt-right and pro-Trump activist with 111,000 followers at the time: his tweet was retweeted almost 3,000 times. Only after 10:00 p.m. did the rumor begin to spread in French, mostly through far-right accounts using the #MacronCacheCash hashtag. The first tweets in French seemed to have been automatically translated from English.44

[snip]

The same user with the Latvian IP address who posted the fake documents on Wednesday announced on Friday morning that more were coming, promising, “We will soon have swiftnet logs going back months and will eventually decode Macron’s web of corruption.”49 Those responsible for #MacronGate thereby provided evidence that they were the same people responsible for the #MacronLeaks that were released later that day.

Then there were the leaked files themselves, which followed the same pattern: an anonymous leak to Craddick to Posobiec to WikiLeaks.

The files were initially posted on Archive.org, an online library site, supposedly in the morning63 (the time of first release on the website cannot be determined, as these original threads have since been deleted). At 7:59 p.m., the links to the threads were posted on PasteBin, a file-sharing site, under the name “EMLEAKS.” At 8:35 p.m., they were shared on 4chan. Then came their appearance on Twitter: Craddick was again the first to share the link to the PasteBin dump at 8:47 p.m., quickly followed by Jack Posobiec at 8:49 p.m., who provided a link to the 4chan thread with, for the first time, the hashtag #MacronLeaks.64 Contrary to what would later become a widespread misconception, Posobiec was not the first to tweet, Craddick was. However, Posobiec was the first to use the hashtag that would lend its name to the entire operation, hence the confusion. Posobiec’s tweet and hashtag was retweeted eighty-seven times within five minutes. He later said he had been alerted to the incoming dump by the user with a Latvian IP address who had posted the #MacronGate fake documents two days prior: “The same poster of the financial documents said to stay tuned tomorrow for a bigger story–so I pretty much spent the next 24 hours hitting refresh on the site.”65

So far, this conversation was exclusively Anglophone. This makes it clear that the hashtag #MacronLeaks was launched and spread in the United States, by the American alt-right. It was WikiLeaks that internationalized the spread, at 9:31 p.m., by tweeting: “#MacronLeaks: A significant leak. It is not economically feasible to fabricate the whole. We are now checking parts,” with a link to the files on PasteBin. Only then came the first French amplifiers, who happened to be Le Pen supporters

MacronLeaks was, openly and proudly, a joint venture between the GRU, far right influencers in Stone’s immediate orbit, and WikiLeaks. It was an attempt to repeat the 2016 miracle that elected Donald Trump, by supporting the Russian-supporting Marine Le Pen by damaging Macron.

There’s something unusual about the indictment, too. Alone among the indictments obtained by the Pittsburgh US Attorney’s office that month (October 2020), it was the single one signed in wet blue ink by the US Attorney, Scott Brady. Both the copy released by DOJ and the one docketed in PACER also lacked a jury foreperson’s signature.

Admittedly, most of the indictments WDPA obtained that month were fairly podunk crimes that wouldn’t need heightened security: a fentanyl dealer, a cocaine dealer, two unhoused men charged with theft, an aggravated assault, manufacturing a controlled substance, Social Security fraud, VA benefit fraud, all were signed in black ink, at least some of them electronically. But a child sexual trafficking indictment and a CSAM possession indictment, both originally filed under seal, also bear the foreperson’s signature and that black ink signature. Even a ransomware indictment rolled out nationally on October 15 — which would have the same kind of international sensitivities and national coordination as the GRU indictment — had a normal jury foreperson’s signature.

While Brady was not a surprising choice for US Attorney in Pittsburgh (he had previously been an AUSA), he was perhaps the most politicized of Trump’s US Attorneys. He’s the guy whom Barr put in charge of ingesting the dirt on Hunter Biden that Rudy Giuliani was getting from suspected Russian agents.

To be clear: There’s no public allegation that Stone had anything to do with MacronLeaks, though HateWatch places him at a Milo Yiannopoulos party where MacronLeaks appears to have come up, after the leaks but before the French election. I’m not saying that Stone was involved in the MacronLeaks operation.

But the response to the Stone reference in the subpoena receipt has assumed that the Stone reference cannot be related to the French President reference, all assumptions made by journalists that never covered the ongoing aspects into whether Stone conspired with Russia on a hack. If Trump did issue his rat-fucker a secret pardon for follow-on cooperation with Russian hackers, though, it would explain a number of things about the aftermath of the Mueller investigation, including what happened to the investigation into whether Stone conspired with Russia on hacking campaigns.

For his part, Trump included a bit of a tirade about the Stone reference in his motion for a Special Master last night.

In addition, did the affiant to the warrant fairly disclose any pretextual “dual” purpose at work in obtaining the warrant? For example, the Receipt for Property largely fails to identify seized documents with particularity, but it does refer to the seizure of an item labelled “Executive Grant of Clemency re: Roger Jason Stone, Jr.” Aside from demonstrating that this was an unlawful general search, it also suggests that DOJ simply wanted the camel’s nose under the tent so they could rummage for either politically helpful documents or support other efforts to thwart President Trump from running again, such as the January 6 investigation.

This is legally and politically nonsensical. If the pardon is the known pardon, then it’s not politically damaging at all. If it’s a real pardon of any kind — as a pardon written on a cocktail napkin arguably would be — then it’s a Presidential Record and squarely within the scope of the warrant (which permits seizure of any Presidential record created during Trump’s term). If the information about the French President is part of the document and appears to be sensitive, then it would qualify as a likely classified document. If the pardon were found in Trump’s safe next to his leatherbound box of TS/SCI documents, then it would be covered by the proximal search protocol laid out in the warrant. The pardon was legally seized.

Trump’s claims are nonsensical. But they’re also the the kind of squealing that invites further attention to what the clemency document really is.

Demands for Sua Sponte Do-Overs and Billy Barr’s Thought Experiment about Trump’s Criminality

In a post last year about what was then a still heavily-redacted Amy Berman Jackson opinion ordering DOJ to release a Barr memo covering up the Mueller investigation, I wrote that this might finally be the case where DOJ would be held accountable for bullshit claims made in service of protecting secrets in FOIA cases.

Will Amy Berman Jackson Finally Break the Spell of OLC Feeding Bullshit FOIA Claims to DC District Judges?

Yesterday, Judge Amy Berman Jackson ruled that the government must turn over a memo written — ostensibly by Office of Legal Counsel head Steve Engel — to justify Billy Barr’s decision not to file charges against Donald Trump for obstructing the Mueller Investigation. The Center for Responsibility and Ethics in Washington FOIAed the memo and sued for its release. The memo itself is worth reading. But I want to consider whether, by making a nested set of false claims to hide what OLC was really up to, this opinion may pierce past efforts to use OLC to rubber stamp problematic Executive Branch decisions.

A key part of ABJ’s decision pivoted on the claims made by Paul Colburn, who’s the lawyer from OLC whose job it is (in part) to tell courts that DOJ can’t release pre-decisional OLC memos because that would breach both deliberative and attorney-client process, Vanessa Brinkmann, whose job it is (in part) to tell courts that DOJ has appropriately applied one or another of the exemptions permitted under FOIA, and Senior Trial Attorney Julie Straus Harris, who was stuck arguing against release of this document relying on those declarations. ABJ ruled that all three had made misrepresentations (and in the case of Straus Harris, outright invention) to falsely claim the memo was predecisional and therefore appropriate to withhold under FOIA’s b5 exemption.

Yesterday, the DC Circuit decided that (unless DOJ appeals again) yes, this will be that case. It ordered DOJ to release the rest of the Barr memo and it did so for precisely the reasons ABJ laid out: DOJ had played games with its claims about what was in the memo.

The opinion, written by Sri Srinivasan and joined by Judith Rogers and David Tatel, agreed with ABJ that the Department’s Declarations evolved but yet never actually described the predecisional advice at hand — which ABJ and the Circuit agree pertained to what Barr should say to Congress about Mueller’s results.

The Department’s submissions during the course of this litigation have at various times suggested three decisional processes to which the March 2019 memorandum might have pertained. The first two, as the Department acknowledges, cannot support its reliance on the deliberative-process privilege. As for the third, although that one might well have justified the Department’s invocation of the privilege, the Department never relied on—or even mentioned—that decisional process in the district court until the Department had already noticed its appeal to this court. And the district court was not required to grant judgment to the Department on a theory the Department never presented before taking an appeal.

1.

The first of the three decisional processes suggested in the Department’s submissions to the district court concerned whether to charge President Trump with a crime. Although the Department has since clarified that it was never in fact considering a prosecution, the Department’s submissions to the district court appeared to indicate in various ways that the March 2019 memorandum made recommendations about an actual charging decision.

[snip]

2.

If the Department’s analysis of whether the evidence in the Mueller Report would support an obstruction-of-justice charge did not in fact relate to a decision about whether to initiate or decline a prosecution, then why engage in that analysis? The Department’s submissions to the district court perhaps could be interpreted to indicate that the memorandum’s analysis of that question, if not related to an actual charging decision, was instead part of an abstract thought experiment. On that conception, the memorandum formed part of an academic exercise to determine whether President Trump’s conduct met the statutory definition of obstruction, solely for Attorney General Barr’s information, without any connection to any ensuing action by Barr or the Department.

[snip]

3. Because there was never an actual charging decision to be made in this case, and because the Department does not rely on a mere thought experiment about whether the evidence would support a charge as the relevant decisional process, the question naturally arises: what is the decisional process that the Department believes justifies its withholding of the March 2019 memorandum? The Department’s answer, per its briefing in our court, is that the memorandum “was intended to assist the Attorney General in deciding what, if anything, to communicate to Congress and the public about whether the evidence recounted in the Special Counsel’s report was sufficient under the Principles of Federal Prosecution to support a prosecution.” Dep’t Br. 25–26. That is, the deliberations about whether the evidence in the Report amounted to a crime went to deciding whether to say something to the public on that issue, not deciding whether to initiate a prosecution (which was never on the table).

[snip]

And here, it is now apparent that the March 2019 memorandum recommended reaching a conclusion on the evidentiary viability of an obstruction-of-justice charge as a means of preempting a potential public reaction to the Mueller Report. In that light, if the Department’s submissions to the district court had connected the memorandum to a decision about making a public statement, then the district court might well have concluded that the memorandum was privileged. But that is not how the Department elected to justify its invocation of the privilege in the district court.

And because DOJ claimed that the memo pertained to one kind of predecisional advice (whether to charge a President who could not be charged) rather than the real predecisional advice (to tell Congress that he couldn’t have been charged based on the evidence), the Circuit holds, DOJ must release the full memo.

In short, while the decisional process on which the Department now relies involved a determination as to whether the Attorney General should make a public statement, none of the Department’s submissions to the district court suggested that the March 2019 memorandum related to such a decision. In its briefing to us, the Department expresses regret that its submissions to the district court could have left the misimpression that an actual charging decision was under consideration, and it assures us that any misimpression it may have caused to that effect was inadvertent and not the result of any bad faith. Still, the Department at no point indicated to the district court that the memorandum gave advice on the making of a public statement. The Department thus failed to carry its burden to establish the relevant decisional process.

This section of the opinion, if it is not appealed, would lay important new groundwork for FOIA litigation. It effectively holds that if the government provides bullshit excuses about the reasons it wants to protect something from FOIA release (as they did here), even if there was a different reason that would have been legal but embarrassing that they did not make, their failure to provide the real reason in their declarations effectively waives their opportunity to make it.

Holding an agency to its burden in that regard serves important purposes. “The significance of agency affidavits in a FOIA case cannot be underestimated.” King v. DOJ, 830 F.2d 210, 218 (D.C. Cir. 1987). In a standard FOIA case, the government agency knows the full contents of any withheld records, while the requester confronting black redaction boxes is (literally) left in the dark. The requester’s lack of knowledge “seriously distorts the traditional adversary nature of our legal system’s form of dispute resolution.” Vaughn v. Rosen, 484 F.2d 820, 824 (D.C. Cir. 1973). An agency’s declarations supporting its withholdings “must therefore strive to correct, however[] imperfectly, the asymmetrical distribution of knowledge that characterizes FOIA litigation.” King, 830 F.2d at 218.

This case is illustrative. In its district court briefs, CREW focused its arguments on why the Department could not have been considering obstruction charges against the sitting President. That was understandable, because CREW had no reason to suspect that the memorandum might have related to a distinct decisional process about making a public statement. We cannot sustain the withholding of the memorandum on a rationale that the Department never presented to the district court and that CREW therefore never had an opportunity to challenge.

The Department responds with an argument that would effectively shift the burden from the Department to the court. According to the Department, even if it failed to establish that the March 2019 memorandum related to a decision about making a public statement, the district court should have reached that conclusion of its own accord based on its in camera review of the memorandum. The Department thus now seeks to prevail based on the district court’s in camera review even though the Department had initially objected to that review. We cannot accept the Department’s argument.

In a FOIA case, the government bears the burden of showing that requested records are exempt from disclosure. The government is a party in every FOIA case, is well versed in the conduct of FOIA litigation, and is fully capable of protecting its own interests in that arena. A district court can rely on the government to do so and can assume that the government has reasons for its choices and an understanding of their implications. It would put too much on the district court—and would relieve the government of its summary judgment burden—to expect a judge reviewing records in camera to come up with unasserted legal theories for why a document might be exempt from disclosure. To hold otherwise would “seriously distort[] the traditional adversary nature of our legal system’s form of dispute resolution.” Vaughn, 484 F.2d at 824.

Here, the Department failed to satisfy its burden, and the district court, as the court itself explained, was “under no obligation to assess the applicability of a privilege on a ground the agency declined to assert.” CREW, 538 F. Supp. 3d at 140 n.11.

And the opinion rejects the government’s argument it should have gotten a do-over, because it did not ask for reconsideration.

The Department contends that, even if the district court was not required to grant judgment in its favor, the court at least should have given the Department an opportunity to make supplemental submissions. We are unpersuaded by the Department’s assertion that the district court needed to sua sponte grant it a do-over.

The Department was given a number of opportunities to justify its withholding of the March 2019 memorandum. After initially attaching two declarations to its motion for summary judgment, the Department attached an additional declaration to its reply brief. Those three declarations, coupled with the Department’s two briefs, gave ample opportunity to identify Attorney General Barr’s messaging to the public as the relevant decisional process. But the Department never did so. Nor did the Department ask for an additional chance to clarify its position after seeing the district court’s summary-judgment decision, which pointed out that the Department’s submissions up to that point had created a misimpression about the nature of the decisional process. The Department did not move for reconsideration, instead seeking only a stay pending appeal. We cannot fault the district court for not giving the Department another chance when the Department never requested one.

The government can appeal this decision.

And by my read, DOJ still (says it) disagrees with CREW and the judges about the predecisional advice was. In DOJ’s briefing, it maintains the decision was ultimately about the sufficiency of evidence against Trump — which the Circuit calls a thought experiment — not about a PR stunt. That is, it’s saying that its briefing was close to accurate, and ABJ should have understood that once she read the memo itself.

Perhaps whatever Steven Engel and Ed O’Callaghan had to say in the sealed part of the memo really is something DOJ will go to the mat to (or assume a Trump majority on SCOTUS will) hide. Perhaps that’ll incent DOJ to try again or go to Trump’s protectors at SCOTUS to keep this sealed.

But some of the other things DOJ did — such as not asking for reconsideration — may make this an uphill climb in any case.

In any case, the Circuit did — as ABJ did herself — sharply limit the application of this decision. This decision does not affect the hated b5 exemption.

Our decision is narrow. We do not call into question any of our precedents permitting agencies to withhold draft documents related to public messaging. Indeed, if the Department had identified the March 2019 memorandum’s connection to public messaging, the district court might well have sustained the Department’s reliance on the deliberativeprocess privilege. And of course nothing in our decision should be read to suggest that deliberative documents related to actual charging decisions fall outside the deliberativeprocess privilege. We hold only that, in the unique circumstances of this case, in which a charging decision concededly was off the table and the agency failed to invoke an alternative rationale that might well have justified its invocation of the privilege, the district court did not err in granting judgment against the agency.

It only affects the consequences of providing bullshit excuses for trying to keep something secret.

We won’t know for some days yet whether DOJ will appeal. For now, though, the Circuit is holding DOJ accountable for misrepresentations in service of Barr’s cover-up.

Related links

May 3, 2021: Initial redacted ABJ opinion

May 5, 2021: Will Amy Berman Jackson Finally Break the Spell of OLC Feeding Bullshit FOIA Claims to DC District Judges?

May 24, 2021: DOJ motion for a stay pending appeal

May 24, 2021: Unredacted ABJ opinion

May 24, 2021: Partly redacted memo

May 25, 2021: On the Barr Memo: Julie Straus Harris Says Julie Straus Harris’ Unexplained “Flourish” Wasn’t a Lie

May 25, 2021: Frankenstein’s OLC: DOJ Says DOJ Can’t Do What DOJ Did in the Barr Memo

May 26, 2021: Bill Barr Issued Prosecution Declinations for Three Crimes in Progress

June 5, 2021: Bill Barr Is Not Dick Cheney

June 14, 2021: ABJ order granting stay

[Photo: National Security Agency, Ft. Meade, MD via Wikimedia]

18 USC 793e in the Time of Shadow Brokers and Donald Trump

Late last year, a Foreign Affairs article by former Principal Deputy Director of National Intelligence Sue Gordon and former DOD Chief of Staff Eric Rosenbach asserted that the files leaked in 2016 and 2017 by Shadow Brokers came from two NSA officers who brought the files home from work.

In two separate incidents, employees of an NSA unit that was then known as the Office of Tailored Access Operations—an outfit that conducts the agency’s most sensitive cybersurveillance operations—removed extremely powerful tools from top-secret NSA networks and, incredibly, took them home. Eventually, the Shadow Brokers—a mysterious hacking group with ties to Russian intelligence services—got their hands on some of the NSA tools and released them on the Internet. As one former TAO employee told The Washington Post, these were “the keys to the kingdom”—digital tools that would “undermine the security of a lot of major government and corporate networks both here and abroad.”

One such tool, known as “EternalBlue,” got into the wrong hands and has been used to unleash a scourge of ransomware attacks—in which hackers paralyze computer systems until their demands are met—that will plague the world for years to come. Two of the most destructive cyberattacks in history made use of tools that were based on EternalBlue: the so-called WannaCry attack, launched by North Korea in 2017, which caused major disruptions at the British National Health Service for at least a week, and the NotPetya attack, carried out that same year by Russian-backed operatives, which resulted in more than $10 billion in damage to the global economy and caused weeks of delays at the world’s largest shipping company, Maersk. [my emphasis]

That statement certainly doesn’t amount to official confirmation that that’s where the files came from (and I’ve been told that the scope of the files released by Shadow Brokers would have required at least one more source). But the piece is as close as anyone with direct knowledge of the matter — as Gordon would have had from the aftermath — has come to confirming on the record what several strands of reporting had laid out in 2016 and 2017: that the NSA files that were leaked and then redeployed in two devastating global cyberattacks came from two guys who brought highly classified files home from the NSA.

The two men in question, Nghia Pho and Hal Martin, were prosecuted under 18 USC 793e, likely the same part of the Espionage Act under which the former President is being investigated. Pho (who was prosecuted by Thomas Windom, one of the prosecutors currently leading the fake elector investigation) pled guilty in 2017 and was sentenced to 66 months in prison; he is processing through re-entry for release next month. Martin pled guilty in 2019 and was sentenced to 108 months in prison.

The government never formally claimed that either man caused hostile powers to obtain these files, much less voluntarily gave them to foreign actors. Yet it used 793e to hold them accountable for the damage their negligence caused.

There has never been any explanation of how the files from Martin would have gotten to the still unidentified entity that released them.

But there is part of an explanation how files from Pho got stolen. WSJ reported in 2017 that the Kaspersky Anti-Virus software Pho was running on his home computer led the Russian security firm to discover that Pho had the NSA’s hacking tools on the machine. Somehow (the implication is that Kaspersky alerted the Russian government) that discovery led Russian hackers to subsequently target Pho’s computer and steal the files. In response to the WSJ report, Kaspersky issued their own report (here’s a summary from Kim Zetter). It acknowledged that Kaspersky AV had pulled in NSA tools after triggering on a known indicator of NSA compromise (the report claimed, and you can choose to believe that or not, that Kaspersky had deleted the most interesting parts of the files obtained). But it also revealed that in that same period, Pho had briefly disabled his Kaspersky AV and downloaded a pirated copy of Microsoft Office, which led to at least one backdoor being loaded onto his computer via which hostile actors would have been able to steal the NSA’s crown jewels.

Whichever version of the story you believe, both confirm that Kaspersky AV provided a way to identify a computer storing known NSA hacking tools, which then led Pho — someone of sufficient seniority to be profiled by foreign intelligence services — to be targeted for compromise. Pho didn’t have to give the files he brought home from work to Russia and other malicious foreign entities. Merely by loading them onto his inadequately protected computer and doing a couple of other irresponsible things, he made the files available to be stolen and then used in one of the most devastating information operations in history. Pho’s own inconsistent motives didn’t matter; what mattered was that actions he took made it easy for malicious actors to pull off the kind of spying coup that normally takes recruiting a high-placed spy like Robert Hanssen or Aldrich Ames.

In the aftermath of the Shadow Brokers investigation, the government’s counterintelligence investigators may have begun to place more weight on the gravity of merely bringing home sensitive files, independent of any decision to share them with journalists or spies.

Consider the case of Terry Albury, the FBI Agent who shared a number of files on the FBI’s targeting of Muslims with The Intercept. As part of a plea agreement, the government charged Albury with two counts of 793e, one for a document about FBI informants that was ultimately published by The Intercept, and another (about an online terrorist recruiting platform) that Albury merely brought home. The government’s sentencing memo described the import of files he brought home but did not share with The Intercept this way:

The charged retention document relates to the online recruitment efforts of a terrorist organization. The defense asserts that Albury photographed materials “to the extent they impacted domestic counter-terrorism policy.” (Defense Pos. at 37). This, however, ignores the fact that he also took documents relating to global counterintelligence threats and force protection, as well as many documents that implicated particularly sensitive Foreign Intelligence Surveillance Act collection. The retention of these materials is particularly egregious because Albury’s pattern of behavior indicates that had the FBI not disrupted Albury and the threat he posed to our country’s safety and national security, his actions would have placed those materials in the public domain for consumption by anyone, foreign or domestic.

And in a declaration accompanying Albury’s sentencing, Bill Priestap raised the concern that by loading some of the files onto an Internet-accessible computer, Albury could have made them available to entities he had no intention of sharing them with.

The defendant had placed certain of these materials on a personal computing device that connects to the Internet, which creates additional concerns that the information has been or will be transmitted or acquired by individuals or groups not entitled to receive it.

This is the scenario that, one year earlier, was publicly offered as an explanation for the theft of the files behind The Shadow Brokers; someone brought sensitive files home and, without intending to, made them potentially available to foreign hackers or spies.

Albury was sentenced to four years in prison for bringing home 58 documents, of which 35 were classified Secret, and sending 25 documents, of which 16 were classified Secret, to the Intercept.

Then there’s the case of Daniel Hale, another Intercept source. Two years after the Shadow Brokers leaks (and five years after his leaks), he was charged with five counts of taking and sharing classified documents, including two counts of 793e tied to 11 documents he took and shared with the Intercept. Three of the documents published by The Intercept were classified Top Secret.

Hale pled guilty last year, just short of trial. As part of his sentencing process, the government argued that the baseline for his punishment should start from the punishments meted to those convicted solely of retaining National Defense Information. It tied Hale’s case to those of Martin and Pho explicitly.

Missing from Hale’s analysis are § 793 cases in which defendants received a Guidelines sentence for merely retaining national defense information. See, e.g., United States v. Ford, 288 F. App’x 54, 61 (4th Cir. 2008) (affirming 72-month sentence for retention of materials classified as Top Secret); United States v. Martin, 1:17-cr-69-RDB) (D. Md. 2019) (nine-year sentence for unlawful retention of Top Secret information); United States v. Pho, 1:17-cr-00631 (D. Md. 2018) (66-month sentence for unlawful retention of materials classified as Top Secret). See also United States v. Marshall, 3:17-cr-1 (S.D. TX 2018) (41-month sentence for unlawful retention of materials classified at the Secret level); United States v. Mehalba, 03-cr-10343-DPW (D. Ma. 2005) (20-month sentence in connection with plea for unlawful retention – not transmission – in violation of 793(e) and two counts of violating 18 U.S.C. 1001; court departed downward due to mental health of defendant).

Hale is more culpable than these defendants because he did not simply retain the classified documents, but he provided them to the Reporter knowing and intending that the documents would be published and made available to the world. The potential harm associated with Hale’s conduct is far more serious than mere retention, and therefore calls for a more significant sentence. [my emphasis]

Even in spite of a moving explanation for his actions, Hale was sentenced to 44 months in prison. Hale still has almost two years left on his sentence in Marion prison.

That focus on other retention cases from the Hale filing was among the most prominent national references to yet another case of someone prosecuted during the Trump Administration for taking classified files home from work, that of Weldon Marshall. Over the course of years of service in the Navy and then as a contractor in Afghanistan, Marshall shipped hard drives of classified materials home.

From the early 2000s, Marshall unlawfully retained classified items he obtained while serving in the U.S. Navy and while working for a military contractor. Marshall served in the U.S. Navy from approximately January 1999 to January 2004, during which time he had access to highly sensitive classified material, including documents describing U.S. nuclear command, control and communications. Those classified documents, including other highly sensitive documents classified at the Secret level, were downloaded onto a compact disc labeled “My Secret TACAMO Stuff.” He later unlawfully stored the compact disc in a house he owned in Liverpool, Texas. After he left the Navy, until his arrest in January 2017, Marshall worked for various companies that had contracts with the U.S. Department of Defense. While employed with these companies, Marshall provided information technology services on military bases in Afghanistan where he also had access to classified material. During his employment overseas, and particularly while he was located in Afghanistan, Marshall shipped hard drives to his Liverpool home. The hard drives contained documents and writings classified at the Secret level about flight and ground operations in Afghanistan. Marshall has held a Top Secret security clearance since approximately 2003 and a Secret security clearance since approximately 2002.

He appears to have been discovered when he took five Cisco switches home. After entering into a cooperation agreement and pleading guilty to one count of 793e, Marshall was (as noted above) sentenced to 41 months in prison. Marshall was released last year.

Outside DOJ, pundits have suggested that Trump’s actions are comparable to those of Sandy Berger, who like Trump stole files that belong to the National Archives and after some years pled guilty to a crime that Trump since made into a felony, or David Petraeus, who like Trump took home and stored highly classified materials in unsecured locations in his home. Such comparisons reflect the kind of elitist bias that fosters a system in which high profile people believe they are above the laws that get enforced for less powerful people.

But the cases I’ve laid out above — particularly the lesson Pho and Martin offer about how catastrophic it can be when someone brings classified files home and stores them insecurely, no matter their motives — are the background against which career espionage prosecutors at DOJ will be looking at Trump’s actions.

And while Trump allegedly brought home paper documents, rather than the digital files that Russian hackers could steal while sitting in Moscow, that doesn’t make his actions any less negligent. Since he was elected President, Mar-a-Lago became a ripe spying target, resulting in at least one prosecution. And two of the people he is most likely to have granted access to those files, John Solomon and Kash Patel, each pose known security concerns. Trump has done the analog equivalent of what Pho did: bring the crown jewels to a location already targeted by foreign intelligence services and store them in a way that can be easily back-doored. Like Pho, it doesn’t matter what Trump’s motivation for doing so was. Having done it, he made it ridiculously easy for malicious actors to simply come and take the files.

Under Attorneys General Jeff Sessions and Bill Barr, DOJ put renewed focus on prosecuting people who simply bring home large caches of sensitive documents. They did so in the wake of a costly lesson showing that the compromise of insecurely stored files can do as much damage as a high level recruited spy.

It’s a matter of equal justice that Trump be treated with the same gravity with which Martin and Pho and Albury and Hale and Marshall were treated under the Trump Administration, for doing precisely what Donald Trump is alleged to have done (albeit with far fewer and far less sensitive documents). But as the example of Shadow Brokers offers, it’s also a matter of urgent national security.