Charles Ortel Archives

Posts

Rat-Fucker Rashomon: Accessing Hollywood Cover-Ups of the Russian Attribution

The Mueller Report has a section that purports to address whether Trump’s team timed the Podesta email release to drop in such a way as to drown out the Access Hollywood video. After explaining that the stolen emails came out less than an hour after the video, the Mueller Report explains,

The Office investigated whether Roger Stone played any role in WikiLeaks’s dissemination of the Podesta emails at that time.

The very next sentence, however, talks only about Jerome Corsi, suggesting that the investigation into this question lived and died (a maudlin death) with Corsi’s conflicting testimony.

During his first September 2018 interview, Corsi stated that he had refused Stone’s July 25, 2016 request to contact Assange, and that had been the last time they had talked about contacting Assange.

The Mueller Report spends three different paragraphs discussing not Roger Stone’s role, but Jerome Corsi’s shifting explanations on the topic of whether Corsi (but not Stone) had succeeded in getting the Podesta emails released on October 7.

Here’s a sample of that Abbot and Costello routine plopped right in the middle of the Mueller Report:

Corsi gave conflicting accounts of what happened after Stone purportedly informed him about the video. Initially, Corsi told investigators that he had instructed Stone to have WikiLeaks release information to counteract the expected reaction to the video’s release, and that Stone said that was a good idea and would get it done. Later during the same interview, Corsi stated that Stone had told Corsi to have WikiLeaks drop the Podesta emails immediately, and Corsi told Stone he would do it.

This passage relegates the phone records that — the affidavits make clear — had constituted a key part of this prong of the investigation to a footnote, and to add to the comedy routine, even cites a Chuck Ross story that Mueller’s team knew (because they proved as much at trial) aired transparent Stone lies in order to incorporate a Stone denial regarding October 7.

249 Chuck Ross, Jerome Corsi Testified That Roger Stone Sought WikiLeaks’ Help To Rebut ‘Access Hollywood’ Tape, Daily Caller (Nov. 27, 2018) (quoting Stone as claiming that he did not have knowledge of the tape until its publication).

This makes a second time that Ross proved to be a really useful idiot to the Mueller team.

Having laid out how unreliable Corsi is and never directly revealing what they knew about Stone’s actions, the Mueller Report then answers a different question than the one that frames the section, “whether Roger Stone played any role in WikiLeaks’s dissemination of the Podesta emails at that time.” Instead, it answers whether Corsi’s claims to have gotten the early release were credible. They weren’t:

The Office investigated Corsi’s allegations about the events of October 7, 2016 but found little corroboration for his allegations about the day.

The Mueller Report, then, substitutes a comedy routine about Jerome Corsi for a sober discussion revealing what the investigation into this question really examined and actually concluded.

The SSCI Report provides a more nuanced discussion of this question, incorporating some, but not all, of the phone records that investigators were interested in, as well as presumed Stone communications with Trump, book-ending the release, and Corsi’s boasts after the fact that first gave investigators reason to pursue this question.

(U) WikiLeaks did not release anything on October 6. Nevertheless, on October 6, Stone tweeted: “Julian Assange will deliver a devastating expose on Hillary at a time of his choosing. I stand by my prediction. #handcuffs4hillary.”1661 Stone and Credico had five additional calls that day.1662

(U) On the afternoon of October 6, Stone received a call from Keith Schiller’s number. Stone returned the call about 20 minutes later, and spoke-almost certainly to Trump–for six minutes. 1663 The substance of that conversation is not known to the Committee. However, at the time, Stone was focused on the potential for a WikiLeaks release, the Campaign was following WikiLeaks’s announcements, and Trump’s prior call with Stone on September 29, also using Schiller’s phone, related to a WikiLeaks release. Given these facts, it appears quite likely that Stone and Trump spoke about WikiLeaks.

(U) At approximately 4 p.m. on October 7, The Washington Post released the Access Hollywood tape.1664 Witnesses involved in Trump’s debate preparation recalled that the team first heard of the tape about an hour prior to its public release. 1665 According to Jerome Corsi, however, news of the release also made its way to Roger Stone.1666 Corsi and Stone spoke twice that day at length: once at 1:42 p.m. for 18 minutes, and once at 2:18 p.m. for 21 minutes. 1667 Corsi recalled learning from Stone that the Access Hollywood tape would be coming out, and that Stone “[w]anted the Podesta stuff to balance the news cycle” either “right then or at least coincident.”1668 According to Corsi, Stone also told him to have WikiLeaks “drop the Podesta emails immediately.”1669

(U) When the tape later became public, Corsi claimed that he was not surprised by the graphic language because he had already heard it. 1670 Corsi recalled previewing the Access Hollywood tape with conference call participants during one or two calls that day: a WorldNetDaily staff call at 1:08 p.m., or a 2 p.m. call involving Total Banking Solutions that included Malloch. 1671 Corsi remembered telling conference participants that the tape was a problem and to contact Assange. 1672 Corsi then “watched all day to see what Assange would do,” and when the Podesta emails were released, he thought to himself that Malloch “had finally got to Assange.”1673 However, Corsi later told investigators that he did not call Malloch or Stone after the WikiLeaks release to convey this reaction because, in contradiction to his earlier statements, he was “doubtful” that Malloch had succeeded. 1674

(U) Corsi also claimed that he tweeted publicly at WikiLeaks in order to get them to release documents, but no such tweets could be located. 1675 The SCO was unable to identify any conference call participants who recalled getting non-public information about the tape from Corsi that day; the Committee did not seek to confirm those findings. 1676

(U) At approximately 4:32 p.m. on October 7-approximately 32 minutes after the release of the Access Hollywood tape-WikiLeaks released 2,050 emails that the GRU had stolen from John Podesta, repeatedly announcing the leak on Twitter and linking to a searchable archive of the documents. 1677

[snip]

On October 8, Stone messaged Corsi: “Lunch postponed – have to go see T,” referring to Trump. 1681

(U) Corsi said that after the October 7 WikiLeaks release, he and Stone agreed that they deserve.d credit and that.”Trump should reward us.”1682 However, Corsi said that Stone was concerned about having advance information about the Podesta release, and that Stone recruited Corsi to make sure no one knew Stone had advance knowledge of that information. After the October 7 release, Corsi claimed that Stone directed him to delete emails relating to the Podesta information.1683

But a later affidavit — one that was sealed through Stone’s prosecution and therefore something that the Mueller Report would avoid mentioning — reveals that someone Charles Ortel introduced Stone to in August 2016 — I call the person R because incomplete redactions show his or her last name ends in “r” — also had close communication with Stone on the day of the Access Hollywood video drop. Combined and with one key addition, the timeline for that day (so without the probable Trump book-ends the day before and the day after) looks this way [my emphasis]:

11:27 AM, CORSI placed a call to STONE which STONE did not answer.

11:53AM, STONE received a phone call from the Washington Post. The call lasted approximately twenty minutes.

12:33PM, R calls Stone. The call lasted approximately seven minutes.

1:42PM, STONE called CORSI and the two spoke for approximately seventeen minutes.

2:18PM, CORSI called STONE and the two spoke for approximately twenty minutes.

2:38PM, R calls Stone. That call lasted approximately one minute.

3:32PM, DHS releases Joint Statement attributing election interference to and tying WikiLeaks and the GRU cut-outs to Russia.

3:32PM, R FaceTimes Stone. They don’t connect.

4:00PM, the Washington Post published a story regarding the Access Hollywood tape.

4:32PM, WikiLeaks tweets out its first release of emails hacked from John Podesta that focused primarily on materials related to the Clinton Foundation. On or about August 2, 2016, when CORSI emailed STONE on Target Account 1, he wrote “I expect that much of next dump focus, setting stage for Foundation debacle.”

6:27PM, Ortel sends STONE an email titled, “WikiLeaks – The Podesta Emails” with a link to the newly-released Podesta emails. Approximately ten minutes later, STONE forwarded message to CORSI at Target Account 1 without comment. STONE does not appear to have forwarded the email to any other individual.

“R” may be associated with the Peter Smith effort to find Hillary’s deleted emails. Later affidavits reveal that Stone first obtained ProtonMail (along with Signal) the day he first spoke with this person; other materials show that everyone involved in the Smith effort was required to use ProtonMail.

That said, “R” may be just another person with some kind of tie to WikiLeaks. Another part of this affidavit describes Stone and “R” meeting on October 10, a meeting at which, Stone later seemed to suggest, he met with his Assange source; the affidavit suggests that “R” might fit Stone’s later description of a male who traveled back and forth from the UK. That is, this person, like Credico, may be just another cover story for his true contact.

Including “R’s” contacts with Stone into the timeline, however, suggests another possible reason to explain the timing of the WikiLeaks release. It appears that at the moment DHS dropped what was — at the time — an unprecedented statement attributing the election hacking to the Russian Government and describing, “recent disclosures of alleged hacked e-mails on sites like DCLeaks.com and WikiLeaks and by the Guccifer 2.0 online persona [to be] consistent with the methods and motivations of Russian-directed efforts,” “R” tried unsuccessfully to contact Stone via FaceTime.

That presents another possible explanation for the timing, one ignored by many discussing the events of October 7, including the SSCI Report (though I raised it in 2017): that WikiLeaks released the Podesta emails to drown out the attribution announcement. Not only might advance notice of that DHS/ODNI statement be more readily accessible to people in Trump’s orbit (perhaps via Gang of Eight members Devin Nunes or Richard Burr, who were national security advisors to the campaign), but both Russia and WikiLeaks would have a direct stake in swamping the Joint attribution tying WikiLeaks and the stolen emails to Russia.

For what it’s worth, given what I know about both public and private instances of entities playing both sides in this affair, I wouldn’t rule out Russia orchestrating the Access Hollywood leak, either, both to make Trump more desperate and to give the Podesta drop more value as a result.

That doesn’t prove that Stone — with or without Corsi — had any influence on the timing. But a passage of the “R” affidavit repeats a claim that was redacted (to protect an ongoing investigation) earlier in the affidavit. Someone — probably Ted Malloch, whose publicly reported testimony this matches — testified that Corsi claimed credit for the timing in January 2017.

As noted above [redacted] told investigators that in January 2017, CORSI told him that he (CORSI) and STONE were involved in and were aware of the timing and content of the WikiLeaks releases in advance, including the fact that the emails belonged to John Podesta, and CORSI implied, in sum and substance, that STONE was involved in the release of the Podesta emails by WikiLeaks.

None of that confirms anything about the granularity with which Stone affected the timing of the release on October 7. But it does show that, at the time the Mueller team was writing their report and, given both the “R” affidavit redactions and more recent ones, to this day, investigators were and are hiding some of the details they learned about what happened on that day.

Those are the kind of gaps that make narrative analysis interesting.

The movie Rashomon demonstrated that any given narrative tells just one version of events, but that by listening to all available narratives, you might identify gaps and biases that get you closer to the truth.

I’m hoping that principle works even for squalid stories like the investigation into Roger Stone’s cheating in the 2016 election. This series will examine the differences between four stories about Roger Stone’s actions in 2016:

The Mueller Report
The Stone prosecution
The SSCI Report
The affidavits from the investigation

As I noted in the introductory post (which lays out how I generally understand the story each tells), each story has real gaps in one or more of these areas:

My hope is that by identifying these gaps and unpacking what they might say about the choices made in crafting each of these stories, we can get a better understanding of what actually happened — both in 2016 and in the investigations. The gaps will serve as a framework for this series.

The Roger Stone Prosecution Was One Step in an Ongoing Investigation

May 1, 2020/28 Comments/in 2016 Presidential Election, Mueller Probe /by emptywheel

I’ve spent the last few days going through the warrants released the other day in detail. This post attempts to summarize what they show about the Stone investigation.

First, understand the scope of this release. According to a filing the government submitted a year ago, they considered the media request to apply to, “warrants to search Stone’s property and facilities [and] other warrants that were executed as part of the same line of investigation” obtained under both Rule 41 and Stored Communication Act. It does not include warrants from other lines of investigation that happened to yield information on Stone. That said, there is good reason to believe there are either filings that were entirely withheld, or that DOJ’s interpretation of what constitutes the “same line of investigation” is fluid.

In his order to release the files, Judge Christopher Cooper said that the individual redactions hide, “the private information of non-parties, financial information, and non-public information concerning other pending criminal investigations.” In the hearing on the release, the media coalition suggested that people who had testified at Stone’s trial should not be protected under the guise of privacy, and that seems to have been the standard adopted on redactions of names. In general, then, this post assumes that the redaction of names (such as Ted Malloch) protects the privacy of people who did not testify at trial, but the redaction of entire paragraphs (such as 7 paragraphs of boilerplate describing why Malloch was suspected to be involved) was done to protect ongoing investigations. In the list of warrants below, I’ve marked with an asterisk those that — either because they weren’t for Stone’s property or because they didn’t yield evidence relevant to the the obstruction charges he was prosecuted for — were not provided to Stone in discovery; I’ve based that on the list in this order (see footnote 2).

This investigation may well have started as a box-checking exercise, effectively checking whether John Podesta’s allegations that Roger Stone had learned of the hack targeting Hillary’s campaign manager ahead of time. It appears that Mueller’s team slowly came to believe that Roger Stone had gotten advance notice — and possibly advanced possession — of the Podesta email drop. Along the way, it ruled out one after another theory of how he did so.

Two of the most fascinating applications — one pertaining to an Israeli contact and another regarding someone apparently introduced to Stone by Charles Ortel — seem to have fully (the Israeli lead) or partly (the Ortel one) fizzled. (I base that on whether communications described in the affidavits continue to show up in later applications and whether entire paragraphs remain redacted.)

But the government still seems to believe that Stone worked with Corsi and Malloch on these issues. The government is obviously still trying to figure out whether the rat-fuckers and hoaxsters managed to optimize the release of the Podesta emails on October 7, 2016 to drown out the Access Hollywood drop. Mueller’s uncertainty on this point is something explained in redacted sections of the Mueller Report.

Along the way, Mueller developed two side prongs to the investigation: an examination of how Stone used social media to advertise WikiLeaks documents (it’s likely that investigation came to include ads that may have replicated themes being pushed by Russia and may have involved improper collaboration with the campaign), and the obstruction and witness tampering investigation Stone was prosecuted for.

More interesting still, in fall 2018, Mueller’s team started pursuing several leads (including the Ortel one), most of which — if the rule that entirely redacted paragraphs reflect ongoing investigation — continue to be investigated. Indeed, it appears that the prosecution of Stone for obstruction served partly as a means to initiate a prosecution against him, possibly entice him to flip against Trump or others, but perhaps mainly to obtain Stone’s devices in an attempt to get texts from 2016 to 2017 he had deleted, as well as the content of the encrypted communications he had sent using those devices. That is, the search, arrest, and prosecution of Stone appears to have been just one step in an ongoing investigation, an investigation that may be targeting others (including Julian Assange).

Identify the Malloch and Corsi connection (May 2017 to July 2018)

From May (when Mueller’s team first obtained subscriber records on Stone’s Twitter account) until November 2017, the investigation may have been little more than an effort to assess the spat between Stone and John Podesta over Stone’s August 21, 2016 “time in the barrel tweet.” After the team obtained Stone’s Twitter accounts, they moved to obtain the email accounts on which he conducted conversations started on Twitter. In November, Mueller got a warrant for his own team to access Julian Assange’s Twitter accounts (though the government surely already had obtained that). By December, Stone’s email accounts would have led Mueller’s team to believe that Ted Malloch, who was in London, could have been the back channel Stone kept bragging about, and so got his Gmail account. Mueller gagged Google to prevent Malloch from learning that. As a result, Malloch was presumably surprised when he arrived at Logan airport in March and was searched — a search conducted to obtain his phones, partly in an attempt to get to his UK-hosted email.

After Steven Bannon was interviewed in February 2018, Mueller’s team used that to obtain Stone’s Apple account; while not indicated anywhere in these applications, that’s where they would discover Stone and Michael Caputo had responded to a Russian offering dirt on Hillary.

In July, Mueller’s team obtained Jerome Corsi’s email and Apple accounts (there’s no record of them obtaining his Gmail account, but Corsi’s description of Mueller’s knowledge of his August 2016 searches suggests they got it). These affidavits begin to include a 7-page redaction that may indicate ongoing investigation into whether Stone or Corsi optimized the October 7 Podesta email release.

In this phase, the crimes being investigated expanded from just hacking to conspiracy to aiding and abetting. When Mueller got the Assange warrant, he added the illegal foreign contribution charge (one he declined to prosecute in a long redacted passage of the Mueller Report).

Collect materials on Stone’s overt social media campaigns (August 2018)

On May 18, 2018, Mueller’s team interviewed John Kakanis, who had worked on tech issues for Stone during the election. Afterwards, Mueller’s team obtained a series of warrants to collect the social media campaigns Stone had conducted on issues related to the Russian hack-and-leak. Those warrants included one for several Facebook accounts, a Gmail and Twitter account Stone used for such issues, and a Facebook and Gmail account under the Brazilian name Falo Memo Tio. Stone apparently did not receive the Facebook Falo Memo Tio account, and that warrant included a gag.

Track Stone’s efforts to obstruct the investigation (August 2018)

As Mueller’s team started interviewing people loyal to Stone, they became aware that Stone was communicating with witnesses. In May, Mueller obtained a pen register on Stone’s email accounts, allowing them to track with whom Stone was communicating. An August 3, 2018 warrant describes how investigators used those toll records to track such communications:

In the wake of Michael Caputo’s interview, he and Stone communicated via his Hotmail account (this would have been obvious from the story Stone seeded with the WaPo not long after)
After FBI Agents approached Andrew Miller, Stone emailed him via Gmail at least 10 times and a over a hundred times after he started challenging his subpoena
Stone emailed both Corsi and Credico in May 2018
Stone hired a private investigator to conduct a background investigation into someone who had done IT work for him during the campaign and research where he could serve Credico with legal process; in a June 2018 interview, the PI told investigators he and Stone primarily communicated via iPhone text messages

This affidavit included a section (¶¶64-77), based off texts with Credico stored in Stone’s iCloud account and texts published by the media, describing Stone’s threats to Credico.

In response to Stone’s overt efforts to thwart the investigation, Mueller obtained new warrants on Stone’s Hotmail, Gmail, and Apple accounts, which would yield a great deal of evidence for the obstruction and witness tampering charges against Stone. From this point forward, those charges would be included on warrants targeting Stone. In addition, from that point forward, the government appears to have sought to obtain Stone’s communications with those whose testimony he was obstructing (though the names of others besides Credico are redacted).

Starting with the next warrant, affidavits would include a section (¶¶87-89) comparing what Stone had told the House Intelligence Committee with what his own communication records showed, language that would form the backbone for the obstruction indictment.

Investigate the spooky stuff (May to August 2018)

There’s a number of things in these warrants that are difficult to assess. They didn’t show up in Stone’s trial, and it’s unclear whether they were leads that fizzled or reflect far more damning evidence. For example, the Israeli source who kept trying (and ultimately succeeded, once) to use Stone to get a meeting with Donald Trump doesn’t appear to have amounted to much, at least not with respect to the WikiLeaks releases.

A far more intriguing detail is the FBI claim — that lacks details that would be necessary to assess its accuracy — that Stone was searching for details of the Russian operation before those details were made public. The FBI made that claim twice. First, in a July 28, 2018 affidavit, they described that someone conducted searches on dcleaks and “guccifer june” using IP addresses that might be Stone, starting on May 17, 2016. The suggestion is that Stone may have had advance notice of those parts of the Russian operation. But some journalists learned of dcleaks after it got launched in early June and before it got more attention later in the summer. And the original Guccifer, Marcel Lazar, signed a plea agreement in late May 2016. Given Lazar’s claim to have hacked a Hillary server, it’s not unreasonable to think Stone would be researching him. A later warrant discusses someone — who again could be Stone — searching on Guccifer the day that the site would go up, but before it was public.

During the course of its investigation, the FBI has identified a series of searches that appear to relate to the persona Guccifer 2.0, which predate the public unveiling of that persona. In particular, on or about June 15, 2016 (prior to the publication of the Guccifer 2.0 WordPress blog), records from Google show that searches were conducted for the terms “guccifer” and “guccifer june,” from an IP address within the range 107. 77 .216.0/24.

The same rebuttal may be made — that this was about Marcel Lazar and not Guccifer 2.0. But evidence submitted at the trial suggests that Stone started anticipating the June 2016 dump on June 13, not June 15, making the claim more credible.

That July 28 warrant also describes several accounts that look like the FBI suspect Stone of sophisticated operational security. These include:

A Gmail account created on July 28, 2016 (right in the thick of Stone’s effort to find out what WikiLeaks had coming next) and used until July 5, 2017
A Gmail account created on October 26, 2016 and used until August 8, 2017
A Gmail account created on June 27, 2016 and used in conjunction with Craigslist to communicate

The latter effort may suggest some serious OpSec, a way for Stone to communicate publicly without using his own comms.

Finally, there are matching Gmail and Facebook accounts the government obtained warrants for on August 28, 2018. These were old accounts with the Brazilian name Falo Memo Tio. It appears the government was interested in activity on this account from the last four days before the election. They obtained a gag for the Facebook warrant.

Seal warrants investigating an Agent of Foreign Power (August to September 2018)

The government tried to obtain proof that it was Stone doing those searches on Guccifer — as well as evidence about whom he may have met with in early August 2016 when he told Sam Nunberg he had dined with Assange — by obtaining his cell site location for June 14 through November 15 of that year.

Minutes after FBI Agent Andrew Mitchell (who had been the primary affiant on Stone warrants starting in May 2018) obtained that cell site warrant, FBI Agent Patrick Myers obtained a warrant for a mail.com account that Guccifer 2.0 had created on July 23, 2016 and used until October 18, 2016 (the account kept receiving traffic until February 2017). There are several remarkable things about this warrant. While FBI Agents in San Francisco obtained a warrant for it in August 2016, and someone — possibly Mueller’s team — obtained the headers from the account in September 2017, the government had never before obtained a full warrant on the account for the entire span of its activity. So Myers, seven weeks after Mueller released an indictment against the GRU, obtained that information in hopes it would provide more information about how the Guccifer persona had shared files.

The other FBI Agents investigating Stone, to the extent they described such things, were located in either Washington Field Office or FBI Headquarters in DC. Myers, however, was stationed in Pittsburgh, where the investigation into GRU had been moved (they were also working on an indictment for GRU’s hacking of WADA).

Myers’ involvement with Stone extended beyond this curious warrant for Guccifer 2.0’s account. Over the course of the next month, he obtained warrants for:

Stone’s Liquid Web server storing old communications
A Twitter account obtained for redacted reasons
Multiple Twitter accounts obtained for redacted reasons
Multiple Facebook and Instagram accounts obtained for redacted reasons
Multiple Microsoft and Skype accounts obtained for redacted reasons
Multiple Google accounts obtained for redacted reasons
A Twitter account for someone, probably referred by Charles Ortel, whose name ends in R and who traveled back and forth from the UK who Stone suggested, in October 2016, was his intermediary
Multiple Google accounts obtained for redacted reasons

All those warrants, as well as the Guccifer 2.0 account one, included a gag. One of those gag requests — for a warrant for some Twitter accounts — explains,

It does not appear that Stone is currently aware of the full nature and scope of the ongoing FBI investigation. Disclosure of this warrant to Stone could lead him to destroy evidence or notify others who may delete information relevant to the investigation.

Almost all of the warrants (not the R Apple one or the last Google one, though the R Apple one lists perjury) list FARA and 18 USC 951 (Agent of a Foreign Power) as crimes under investigation somewhere in the warrant, though often only in the gag request. To be clear, that doesn’t mean the FBI was investigating Stone as an Agent of a Foreign Power. The Guccifer 2.0 gag says FBI “is investigating WikiLeaks and others” for the listed crimes.

And those gags say the complexity of the investigation means it may extend more than a year from late September 2018. That is, in September 2018, the government took steps in an investigation they expected to last until around the time that Stone would eventually be tried, in November 2019.

Use the obstruction charges to seize Stone’s phones (January to February 2019)

The existence of those mystery warrants, none of which were provided to Stone in discovery and all but the R Apple one which appear to be ongoing, puts what happened in January 2019 in a very different light. At a time when Bill Barr promised to shut down the Mueller investigation as soon as he was confirmed yet while Mueller was still pursuing Andrew Miller’s testimony, the government obtained warrants to search Stone’s two homes, his office, and three devices seized in those searches (the affiants for those warrants had filed for earlier warrants in the investigation).

Unlike all the other warrants, those 2019 warrants listed only the obstruction, false statements, and witness tampering charges against Stone, largely tracking the indictment against him.

Those warrants emphasize the government’s interest in obtaining texts that might be accessed only via a forensic search of Stone’s phone, including texts sent via Apple, but also Signal, Wickr, and WhatsApp texts, as well as ProtonMail emails.

Which is to say, in the context of the warrants released this week, the prosecution of Roger Stone appears to be just one step in a far more serious investigation, one that may well be ongoing.

The warrants

August 7, 2017: Stone’s Twitter Accounts

This warrant only lists CFAA as the suspected crime, and doesn’t allege that Stone was the suspect in it. It also relies on Stone’s own public comments about DMing with Guccifer 2.0 rather than materials already obtained from the account, just the first of an insane number of instances where Stone’s comments to the press formed the basis for probable cause.

September 11, 2017: Stone’s Hotmail Account

When people DMed Stone, he’d refer them to this Hotmail account for further discussion. This affidavit incorporates DMs to Assange (including the June 10, 2017 one discussing a pardon) obtained with the August 7 warrant. It also describes investigating information to be used in the Republican primary. This warrant extended the timeframe of the Stone investigation back to January 1, 2015.

October 17, 2017: Stone’s Gmail

This warrant builds on emails between Corsi and Stone about getting the WikiLeaks releases — including Stone’s “get to Assange” one — to establish the probable cause to get Stone’s Gmail account. Because Corsi would sometimes discuss Podesta related business via both Stone’s Hotmail and Gmail accounts, Mueller’s team was able to get Stone’s Gmail account. This warrant makes it clear the investigation focused on Corsi and Stone’s evolving attacks against John Podesta (which I’ve covered in real time from early on) from the beginning. It also includes a detail about Malloch — that he made a reference in January 2017 about phishing Podesta — that almost certainly remains in the redacted sections pertaining to Malloch.

*November 6, 2017: WikiLeaks and Assange’s Twitter Accounts

This affidavit uses Assange’s DMs with Stone — including another one about a pardon and migration from the WikiLeaks to the Assange account– as well as his sharing of a password with Don Jr to get Mueller his own copy of the WikiLeaks and Assange Twitter accounts, which the government surely already had. The affidavit includes new details on initial communications between Guccifer 2.0 and WikiLeaks, some of which I laid out here. One detail that’s critical is WikiLeaks asked Guccifer 2.0 for Clinton Foundation documents from early on, meaning WikiLeaks and Trump’s people agreed about what they considered the best possible dirt.

*December 19, 2017: Ted Malloch’s Gmail

In addition to extra details about campaign communications (both between Stone and the campaign, and with Malloch and the campaign), this includes details of Turkish dirt Malloch was offering. It reveals that Stone got RNC credentials for Malloch (where, evidence suggests, Stone had meetings where upcoming releases may have been discussed). In addition, because Stone’s order to Corsi to reach out to Malloch is so important, this affidavit has previously unknown details about those days. The affidavit describes Malloch writing Stone on November 13, 2016 while with Jerome Corsi, a detail that may get redacted in subsequent affidavits.

This warrant included a gag on the provider.

This is the first application that introduces Stone, Corsi, and Malloch at the beginning of each affidavit, a practice that would generally continue (though some of these changes reflect different FBI agents writing the affidavit).

March 14, 2018: Two Apple Accounts used by Stone

In February, Steve Bannon was interviewed for two long days. He was asked questions and shared texts with Stone. This application uses some of what he testified about to justify getting Stone’s Apple accounts. Stone had his iCloud account set to full backup, but later warrants would make clear that he had deleted some of his texts from 2016 and 2017. Stone would later blame Sam Nunberg for revealing that he had claimed to have “dined” with Julian Assange while visiting Los Angeles in early August 2016, but this application began to incorporate that email into boilerplate application language (a footnote on what Nunberg told investigators about this is redacted in later warrants).

This application added wire fraud to Stone’s potential charges; it’s not at all clear why.

*March 27, 2018: Malloch’s person and his baggage

This warrant allowed the FBI to search Malloch as he landed in Logan airport. It incorporated details from Malloch’s Gmail obtained in December and was at least in part an effort to get to his UK-based email.

*May 4, 2018: Mystery Israeli Gmail

Over the course of the year, an Israeli exploited a seeming pre-existing relationship with Jerome Corsi to get close to Stone and through him to Trump. The person appeared to offer Stone dirt to save Trump (this story provides some background on potential players). Stone seems to have been reluctant to meet at multiple times, as when he said, in May 2016, “I am uncomfortable meeting without Jerry,” claimed, in June, “to have been poisoned,” in July, came down “with a nasty cold and too ill to travel,” followed later with, “I have pneumonia and may be hospitalized later today,” claimed, “Matters complicated” in August. When, in early November, they tried again, the Israeli deferred claiming, “HAVING a TIA. Early Stroke. … Blury Virson.” These exchanges never show up in later filings, so it’s quite likely Mueller determined they were nothing (or at least, that Stone and Corsi had done nothing wrong) after obtaining the emails. Alternately, a redaction in the affidavit may suggest the Israeli in question got referred and some kind of investigation is ongoing. This warrant included a gag on the provider.

*July 12, 2018: Jerome Corsi’s CSC Holdings, Windstream, and Apple accounts (second version)

This adds language about Russian hacking after the initial compromise (including the September hack of the AWS server). It includes 7 paragraphs of language from after the election that is redacted, possibly because it remains under investigation. This Stone filing describes four of those paragraphs as pertaining to Corsi taking credit for optimizing the Podesta release and Malloch introducing Corsi to Assange after the election (see this post). Some of the redactions (probably the Malloch introduction) repeats the “phishing Podesta” quip. This warrant included a gag on the provider. It limited the scope of the warrant to June 15 through November 10, 2016 and included only CFAA and conspiracy in the crimes being investigated.

July 27, 2018: Roger Stone’s OpSec emails

This warrant obtains the search histories for 3 Gmail accounts Roger Stone set up, possibly for OpSec purposes. They include:

Target Account 1 created on July 28, 2016 and used until July 5, 2017
Target Account 2 created on October 26, 2016 and used until August 8, 2017
Swash Buckler Account created on June 27, 2016 and used to communicate via Craigslist ads

Between May 17, 2016 and June 15, 2016, the affidavit suggests, Stone may have conducted Google searches for DCLeaks and Guccifer (which could be 1 or 2) prior to the publication of the Guccifer 2.0 blog. The FBI connected them to Stone via the IP addresses he used to access Twitter and Facebook, something they would continue to investigate. The affidavit also reveals that Stone deleted the search history for a different Google account between January 18 and July 23, 2016.

August 2, 2018: Roger Stone marketing Facebook accounts

This warrant gets three of Stone’s Facebook accounts, two of which include advertisements pertaining to WikiLeaks or Russia (the description of the third is redacted). Stone used this warrant when signaling to his co-conspirators what was in his warrants, so redacted details are available here. The biggest redaction for an ongoing investigation pertains to whether Corsi and Stone affected the release of the Podesta emails and Malloch offering to set Corsi up with Assange after the election.

August 3, 2018: Renewed warrants for Apple, Hotmail, and Gmail

Partly because the way Stone worked the press and aired the threats he had made against Randy Credico, it became clear he was tampering or comparing notes with witnesses (also including Jerome Corsi, Michael Caputo, and Andrew Miller, as well as one other witness that Stone hired a private investigator to investigate). That gave Mueller the excuse to get new warrants on Stone’s main email and text accounts to get those conversations. This request expanded the focus to include Credico and others (the names of the others are redacted but are likely those with whom Stone was trying to tamper). This warrant also adds obstruction and witness tampering to the crimes being investigated.

August 8: Warrants for a Gmail and Twitter account Stone used for social media campaigns (Twitter)

On May 18, 2018, Mueller’s team interviewed John Kakanis about work he did for Stone during the campaign. He described how Stone conducted social media campaigns — including materials relating to WikiLeaks and the Russian investigation — which both of these accounts played a role in.

August 20, 2018: Warrant for Stone’s cell site information from June 15 to November 15, 2016

Citing the searches probably made by Stone for Guccifer and dcleaks information before those accounts were made public, the government obtained cell site information for the period from the day that the Guccifer 2.0 account first started to a day the week after the election. The affidavit also explained wanting to know if Stone was with the Trump campaign at various times and where he was in Los Angeles when he told Sam Nunberg he had dined with Assange. Note, this affidavit suggests Stone did a Google search on “Guccifer” on June 15, 2016 before the site went up.

*August 20, 2018: Warrant for Guccifer 2.0’s second email account

The same day the government got a warrant to find out where Stone had been when during the election, they got a renewed warrant for one of the email accounts associated with the Guccifer 2.0 site. They had previously gotten everything from that email account in “approximately” August 2016, and then gotten headers for any emails sent in “approximately” September 2017. Getting the full content would give it additional details on any activity with the account between the original warrant — August 2016 — and the final login on October 18, 2016, as well as any email traffic subsequent to that. The stated purpose for obtaining this information was to “assist in identifying additional means by which Guccifer 2.0 shared stolen documents with WikiLeaks and others.” Patrick Myers, an FBI agent located in Pittsburgh (and therefore presumably someone more closely involved in the GRU investigation) obtained this warrant. This warrant included a gag on the provider. Parts of this warrant invoke 18 USC 951 — agent of a foreign power charges — in addition to the other crimes under investigation.

*August 28, 2018: Warrant for Stone’s Falo Memo Tio Facebook account

August 28, 2018: Warrant for Stone’s Falo Memo Gmail account

This incorporates details about Stone’s Facebook accounts used to push the hack-and-leak, found in the earlier August Facebook warrants. It seeks to obtain an old Stone Facebook account that got advertising traffic right before the election. These were Stone-specific warrants that was not turned over in discovery, suggesting it returned nothing pertaining to his prosecution. The Facebook warrant, but not the Gmail one, included a gag on the provider; it also was not included in the warrants provided to Stone in discovery.

August 28, 2018: Warrant for Stone’s rogerstone@mail account

This email account–and the fact that he had been using it to tell his cover story about WikiLeaks–showed up in his Gmail account.

*September 24, 2018: Warrant for Stone’s Liquid Web server

This was a server Stone used to encrypt and back up his data in case the government seized his computers. It was not provided to Stone in discovery so may not have revealed any interesting information. This is the first of these affidavits written by Patrick Myers, an FBI agent located in Pittsburgh.

*September 26, 2018: Mystery Twitter Account

*September 27, 2018: Mystery Facebook and Instagram Accounts

*September 27, 2018: Mystery Microsoft include Skype

*September 27, 2018: Mystery Google

On September 26 and 27, Mueller’s team obtained a bunch of new warrants. All were obtained by Myers, the Pittsburgh FBI agent. All included gags on the provider. Most entirely redact the description of why the FBI needed the accounts, suggesting these investigations are ongoing. They also invoke 951 and FARA in the sealing request.

*September 27, 2018: Mystery Twitter Accounts 2

Like the other warrants obtained on September 27, the explanation for targeting these Twitter accounts is sealed. Like them, Myers obtained the warrant. Like those, it includes a request for sealing that lists 18 USC 951 — acting as an unregistered foreign agent — and FARA. Unlike the other warrants from that day, the justification for sealing this one explains that “It does not appear that Stone is fully aware of the full scope of the ongoing FBI investigation.”

*September 27, 2018: Mystery Apple ends in R

Then there’s another odd September 27 warrant application. Like the other warrants obtained on September 27, Myers wrote the affidavit for this one, and it included a gag. Unlike the others, however, the explanation for targeting this account is not entirely redacted. The affidavit explains that,

On August 17, 2016, someone (Charles Ortel?) introduced Stone and R
Between that introduction and November 3, 2016, Stone and R were in contact 60 times
On October 7, R and Stone spoke during the time between when WaPo alerted him to the Access Hollywood Video and the time it dropped
On October 10, R and Stone probably met for pizza on the Upper East Side
On October 12, Stone claimed that he had met his intermediary, who traveled back and forth to London, on October 10

The list of information targeted includes an additional name, probably that of Charles Ortel.

*October 5, 2018: Mystery Multiple Googles

Like the September 27 warrants, the explanation for targeting these accounts remains entirely redacted. Like them, the affidavit was written by Myers and sealed under a Kyle Freeny request. Unlike those, however, this one does not list 951 and FARA in the request to seal. This affidavit also does not include the contacts with “R” in the narrative about October 7, suggesting that lead may have fizzled.

January 24, 2019: Stone’s NY property

January 24, 2019: Stone’s FL property

January 24, 2019: Stone’s FL office

February 13, 2019: Three of Stone’s devices

The warrants for the searches in conjunction with Stone’s arrest on January 24 are fairly similar (one agent wrote the one in NY, another did the two in FL), except for the descriptions of the premises, facilitated by how much media Stone has done at these locations.

The affidavits themselves largely track the indictment, though showing where the government had sourced the evidence that ultimately got introduced at evidence at trial. The affidavits add people named in the indictment — Rick Gates, Steve Bannon, and Erik Prince (whose description is redacted) — premised on the import of proving that Stone had lied about telling these people about his purported link to WikiLeaks. As compared to the earlier warrants, these affidavits have a closer focus on the release (and reliance, exclusively, on the Crowdstrike and GRU indictment attribution, which is something Stone litigated and which I may return to).

These warrants make it clear that one of the things the government was doing was searching Stone’s homes for all his electronic devices in hopes of getting texts from 2016 to 2017 he deleted and his encrypted communications, which include:

WhatsApp, downloaded on October 5, 2016 to talk to Erik Prince
Signal and ProtonMail downloaded on August 18, 2016; Stone used Signal to talk to Margaret Kunstler
Wickr downloaded on August 5, 2017

Update: One detail I forgot to add about the 2019 search warrants: They explain that Stone responded to a grand jury subpoena in November 2018 asking for the texts he had with Credico, after he told the press — specifically, Chuck Ross, for a credulous story that spun Stone’s like — that his attorney had them. It’s one of the most hilarious ways that Stone’s blathering to the press hurt him.

Update: One more detail about the 2019 search warrants. The FBI was specifically looking for a “file booklet” recording a meeting Stone had with Trump at Trump Tower during the 2016 election.

60. On or about May 8, 2018, a law enforcement interview of [redacted] was conducted. [redacted] was an employee of Stone’s from approximately June 2016 through approximately December 2016 and resided in Stone’s previous New York apartment for a period of time. [redacted] provided information technology support for Stone but was not formally trained to do so. [redacted] was aware that Stone communicated with Trump during the 2016 presidential campaign, and afterward, both in person and by telephone. [redacted] provided information about a meeting at Trump Tower between Trump and Stone during the time [redacted] worked for him, to which Stone carried a “file booklet” with him. Stone told [redacted] the file booklet was important and no one should touch it. [redacted] also said Stone maintained the file booklet in his closet.

61. On or about December 3,2018, law enforcement conducted an interview of an individual (“Person 2”) who previously had a professional relationship with a reporter who provided Person 2 with information about Stone. The reporter relayed to Person 2 that in or around January and February 2016, Stone and Trump were in constant communication and that Stone kept contemporaneous notes of the conversations. Stone’s purpose in keeping notes was to later provide a “post mortem of what went wrong.”

A Biased FBI Agent Was Running an Informant on an Oppo-Research Predicated Investigation–into Hillary–in 2016

December 17, 2019/32 Comments/in 2016 Presidential Election /by emptywheel

I’m still working on my slow read of the DOJ IG Report on Carter Page. But I wanted to call attention to this footnote, which a few people have already noted.

We reviewed the text and instant messages sent and received by the Handling Agent, the co-case Handling Agent, and the SSA for this CHS, which reflect their support for Trump in the 2016 elections. On November 9, the day after the election, the SSA contacted another FBI employee via an instant messaging program to discuss some recent CHS reporting regarding the Clinton Foundation and offered that “if you hear talk of a special prosecutor .. .I will volunteer to work [on] the Clinton Foundation.” The SSA’s November 9, 2016 instant messages also stated that he “was so elated with the election” and compared the election coverage to “watching a Superbowl comeback.” The SSA explained this comment to the OIG by saying that he “fully expected Hillary Clinton to walk away with the election. But as the returns [came] in … it was just energizing to me to see …. [because] I didn’t want a criminal to be in the White House.”

On November 9, 2016, the Handling Agent and co-case Handling Agent for this CHS also discussed the results of the election in an instant message exchange that reads:

Handling Agent: “Trump!”

Co-Case Handling Agent: “Hahaha. Shit just got real.”

Handling Agent: “Yes it did.”

Co-Case Handling Agent: “I saw a lot of scared MFers on … [my way to work] this morning. Start looking for new jobs fellas. Haha.”

Handling Agent: “LOL”

Co-Case Handling Agent: “Come January I’m going to just get a big bowl of popcorn and sit back and watch.”

Handling Agent: “That’s hilarious!” [my emphasis]

The footnote appears in the discussion of an informant who had some sort of tie to Trump who offered up a bunch of documents without tasking. The documents got entered into FBI’s files and remained there when the IG did their review.

The passage has generally been noted to demonstrate that anti-Hillary case agents involved in related investigations used their FBI phones to engage in political speech, just like Peter Strzok and Lisa Page did.

But it says something more.

It pertains to FBI’s investigation into the Clinton Foundation — an investigation predicated (unlike the Trump one) on opposition research, the Steve Bannon-funded Clinton Cash. This is the investigation, of course, that Andrew McCabe confirmed for the Wall Street Journal, just weeks before the election.

The passage reveals that the FBI had actively tasked CHSes — that is, informants — as part of their investigation into one of the candidate’s Foundations. Mind you, this was reported in real time (including in that WSJ article). But you might think that, upon discovering that politically biased agents were tasking informants to collect on one of the candidates, the IG might take the time to investigate that.

There’s no indication that happened.

According to John Solomon (!!!), FBI reopened their investigation into the Clinton Foundation in early 2018.

The Universe of Hacked and Leaked Emails from 2016: Podesta Emails

October 23, 2018/12 Comments/in 2016 Presidential Election, emptywheel, Mueller Probe, WikiLeaks /by emptywheel

When Mueller’s team released George Papadopoulos’ plea deal last year, I noted that the initial denials that Papadopoulos had advance warning of the emails the Russians were preparing to hack and leak did not account for the entire universe of emails known to have been stolen. A year and several Mueller indictments later, we still don’t have a complete understanding of what emails were being dealt when. Because that lack of understanding hinders understanding what Mueller might be doing with Roger Stone, I wanted to lay out what we know about four sets of emails. This series will include posts on the following:

DNC emails
Podesta emails
DCCC emails
Emails Hillary deleted from her server

The series won’t, however, account for two more sets of emails, anything APT 29 stole when hacking the White House and State Department starting in 2015, or anything released via the several FOIAs of the Hillary emails turned over to the State Department from her home server. It also won’t deal with the following:

Emails from two Hillary staffers who had their emails released via dcleaks
The emails of other people released by dcleaks, which includes Colin Powell, some local Republican parties (including some 2015 emails Peter Smith sent to the IL Republican party), and others with interests in Ukraine
A copy of the Democrats’ analytics program copied on AWS
The NGP/VAN file, which was not directly released by Guccifer 2.0, but is central to one of the skeptics’ theories about an alternative source other than Russia

Meuller remains coy about how the Podesta emails were released by WikiLeaks

My post on the DNC emails noted some timing curiosities about when and how the DNC emails got shared with WikiLeaks.

The curiosities about the Podesta emails, however, are far more important for questions about Roger Stone’s knowledge of the process.

As a number of people have observed, while Mueller’s GRU indictment provides extensive details describing how Podesta was hacked and showing that the infrastructure to hack him was used for other parts of the operation, the indictment is far more coy about how the Podesta emails got to WikiLeaks.

In or around 2016, LUKASHEV sent spearphishing emails to members of the Clinton Campaign and affiliated individuals, including the chairman of the Clinton Campaign.

[snip]

For example, on or about March 19, 2016, LUKASHEV and his co-conspirators created and sent a spearphishing email to the chairman of the Clinton Campaign. LUKASHEV used the account “john356gh” at an online service that abbreviated lengthy website addresses (referred to as a “URL-shortening service”). LUKASHEV used the account to mask a link contained in the spearphishing email, which directed the recipient to a GRU-created website. LUKASHEV altered the appearance of the sender email address in order to make it look like the email was a security notification from Google (a technique known as “spoofing”), instructing the user to change his password by clicking the embedded link. Those instructions were followed. On or about March 21, 2016, LUKASHEV, YERMAKOV, and their co-conspirators stole the contents of the chairman’s email account, which consisted of over 50,000 emails.

[snip]

The funds used to pay for the dcleaks.com domain originated from an account at an online cryptocurrency service that the Conspirators also used to fund the lease of a virtual private server registered with the operational email account [email protected]. The dirbinsaabol email account was also used to register the john356gh URL-shortening account used by LUKASHEV to spearphish the Clinton Campaign chairman and other campaign-related individuals.

[snip]

On or about October 7, 2016, Organization 1 released the first set of emails from the chairman of the Clinton Campaign that had been stolen by LUKASHEV and his co-conspirators. Between on or about October 7, 2016 and November 7, 2016, Organization 1 released approximately thirty-three tranches of documents that had been stolen from the chairman of the Clinton Campaign. In total, over 50,000 stolen documents were released.

Mueller’s silence, thus far, about how the Podesta emails got shared with WikiLeaks is intriguing for several reasons, even aside from the fact that (as noted in the last post) the first documents Guccifer 2.0 shared were billed as DNC emails but (as far as have been identified) are actually Podesta ones. Perhaps Mueller doesn’t know how those emails were passed on. Perhaps the sources and methods by which the FBI learned about how they were shared are too sensitive to put in an indictment. Perhaps Mueller has reserved that story for a later indictment.

The August to September timing on receipt of the emails

The publicly known timing is no more clear.

The Roger Stone tweet on which suspicions of advance knowledge of WikiLeaks’ releases rest — warning “Trust me, it will soon [sic] the Podesta’s time in the barrel” — is dated August 21, 2016.

That date is significant, because it’s not at all clear WikiLeaks had the Podesta emails by that point (and if so, may have just obtained them).

Raffi Khatchadourian cites a WikiLeaks staffer saying they received the emails in “late summer” but also points to an August 24 Fox News interview where Assange described processing “a variety of documents, from different types of institutions that are associated with the election campaign,” which doesn’t necessarily narrow down those emails to Podesta’s.

A pattern that was set in June appeared to recur: just before DCLeaks became active with election publications, WikiLeaks began to prepare another tranche of e-mails, this time culled from John Podesta’s Gmail account. “We are working around the clock,” Assange told Fox News in late August. “We have received quite a lot of material.” It is unclear how long Assange had been in possession of the e-mails, but a staffer assigned to the project suggested that he had received them in the late summer: “As soon as we got them, we started working on them, and then we started publishing them. From when we received them to when we published them, it was a real crunch. My only wish is that we had the equivalent from the Republicans.”

As we’ll see later in this series, there was more certainty that by August 24 WikiLeaks had other hacked emails than that they had Podesta’s.

Khatchadourian also notes that the raw files are all dated September 19 and describes Assange “weaponizing” the release of the data a week or two before the files were released starting on October 7.

All of the raw e-mail files that WikiLeaks published from Podesta’s account are dated September 19th, which appears to indicate the day that they were copied or modified for some purpose. Assange told me that in mid-September, a week or two before he began publishing the e-mails, he devised a way to weaponize the information. If his releases followed a predictable pattern, he reasoned, Clinton’s campaign would be able to prepare. So he worked out an algorithm, which he called the Stochastic Terminator, to help staff members select e-mails for each day’s release. He told me that the algorithm was built on a random-number generator, modified by mathematical weights that reflected the pattern of the news cycle in a typical week. By introducing randomness into the process, he hoped to make it impossible for the Clinton war room “to adjust to the problem, to spin, to create antidote news beforehand.”

That timing lines up in interesting ways with the date when retired British diplomat Craig Murray claims he got a handoff of something (he’s never explained precisely what it was, though it sounded like it could be an encryption key) relating to the Podesta emails when he was in DC to attend the Sam Adams Award ceremony on September 25.

All of which suggests significant events relating to the transfer to WikiLeaks and preparation of the Podesta emails happened after the Stone tweet.

Still later, according to a recent WSJ report, Peter Smith indicated that he knew Podesta emails were coming ahead of time (the reporting is not clear whether this was before or after the fact).

The person familiar with Mr. Smith recalled him repeatedly implying that he knew ahead of time about leaks of Mr. Podesta’s emails.

That claim is all the more interesting when you tie it to the email shared with Smith via foldering on October 11, seemingly reflecting happiness about emails already released, which would seem to point to the Podesta emails that started to drop four days earlier.

“[A]n email in the ‘Robert Tyler’ [foldering] account [showing] Mr. Smith obtained $100,000 from at least four financiers as well as a $50,000 contribution from Mr. Smith himself.” The email was dated October 11, 2016 and has the subject line, “Wire Instructions—Clinton Email Reconnaissance Initiative.” It came from someone calling himself “ROB,” describing the funding as supporting “the Washington Scholarship Fund for the Russian students.” The email also notes, “The students are very pleased with the email releases they have seen, and are thrilled with their educational advancement opportunities.”

The email apparently linking the contemporaneous release of the Podesta emails to a future hoped for release of deleted Hillary ones is significant for several reasons. First, it shows that other geriatric rat-fuckers, in addition to Stone, linked the two. The reflection of pleasure with emails on October 11 is significant given that that was the day WikiLeaks released two Podesta emails Smith associate Jerome Corsi and Stone would use to advance an attack on Podesta pertaining to his ties with Joule Unlimited, an attack that the right wing had been pushing since August (and working on since March). The WSJ notes that both Corsi and Charles Ortel (to the latter of whom Stone now ties some of his WikiLeaks claims) were tied to both Smith and Stone, though Stone claims to have been unaware of the Smith effort.

Stone’s three different explanations for his tweet and the import of Joule emails

In this post, I looked in detail at how epically shitty Stone’s current excuse for his August 21 Podesta tweet is. Over time, Stone has basically offered at least three excuses for it.

First he adopted an explanation offered in March 2017 by Jerome Corsi. In that explanation, Corsi basically conflated two efforts: an attack on John Podesta based on his service on the board of Joule Unlimited from 2010 to 2014, and an effort to respond to mid-August reports on Paul Manafort’s corrupt ties to Russia by focusing instead on Tony Podesta.

The Joule attack research was started (per web access dates recorded in this report) two days before Podesta was spearphished, on March 17, and first rolled out publicly in a Steve Bannon-affiliated Government Accountability Insitute report on August 1. Corsi and Stone resuscitated the attack starting on October 6 (the day before the Podesta emails started coming out), seemingly correctly anticipating the WikiLeaks email releases that Stone and Corsi would use to advance the attack.

The Corsi explanation that Stone once adopted conflated that attack with a report that Corsi did for Stone (starting at PDF 39), which largely projected onto Tony Podesta the corrupt ties to Ukraine and Russia that Paul Manafort had; the report only tangentially focused on John. The date on the Corsi report is August 31, ten days after Stone’s tweet, but Corsi claims he and Stone started it on August 14.

Stone offered a slightly different explanation when he testified under oath to the House Intelligence Committee. There, he generalized the attack on “the Podesta brothers” and attributed his tweet to “early August” discussions about the August 31 Corsi report. In his prepared statement, he made no mention of Joule.

In the wake of Corsi’s interview on September 6 and grand jury appearance on September 21 (in conjunction with which he reportedly shared a bunch of documents that would substantiate when he and Stone were talking about Joule and when about Tony Podesta), Stone changed his tune again, now only admitting publicly for the first time that Charles Ortel forwarded him an email showing James Rosen promising “a massive dump of HRC emails relating to the CF in September,” but also attributing any August 14 interest to something besides Corsi, a Breitbart post that may be this one.

Stone, however, says that the tweet was based on “an August 14th article in Breitbart News by Peter Schweitzer that reported that Tony Podesta was working for the same Ukrainian Political Party that Paul Manafort was being excoriated for,” and that “the Podesta brothers extensive business dealings with the Oligarchs around Putin pertaining to gas, banking and uranium had been detailed in the Panama Papers in April of 2016.”

Stone’s explanations seem to attempt to do three things:

Provide non-incriminating explanations for any foreknowledge of WikiLeaks — first pointing to Randy Credico and now to James Rosen
Offer explanations for discussions about Podesta that he may presume Mueller has that took place around August 14
Shift the focus away from Joule and the remarkable prescience with which the right wing anticipated that WikiLeaks would be able to advance an attack first rolled out on August 1

With that in mind, I find the timeline of Stone’s tweets mentioning either Podesta instructive. It shows Stone never mentioned either brother until August 15 — the day after the first of the stories on Manafort’s Ukraine corruption and after that August 14 date he seems so worried about. That tweet, “@JohnPodesta makes @PaulManafort look like St. Thomas Aquinas Where is the @NewYorkTimes?” may prove as interesting as the August 21 one.

Stone mentioned John Podesta again in that August 21 tweet.

Then he remained silent on Twitter about Clinton’s campaign chairman until the day after the Podesta emails started coming out, whereupon Stone started claiming that Podesta had been money laundering for Russia.

Stone’s first tweet as the Podesta emails dropped pointed back to an earlier Corsi post reporting that the Podesta Group was also under investigation. That same day, he pointed to the Corsi post that seemed to anticipate the Joule attack would be returning. Yet, in an interview done after the release on October 11 of the Podesta emails that both he and Corsi would later rely on to extend the Joule attack, Stone made no mention of those emails or the Joule attack. By the next day, however, Stone was relying on (but not linking) those emails.

In other words, at least as measured by his Twitter feed, Stone was uninterested in the Joule attack when it came out in August. He didn’t mention it at all in his two Podesta tweets that month (nor does he in his currently operative explanation). But he did become interested in the story in advance of the release of emails by WikiLeaks pertaining to the attack.

This is probably a good time to recall that many of the Stone associates Mueller has interviewed did research for Stone, and others had access to his social media accounts. Note that even this selection of his tweets show the use of multiple clients — Twitter Web Client, Tweetdeck, and Twitter for iPhone — that may reflect different people posting from his account.

Stone’s claims about WikiLeaks — and his outreach to Guccifer 2.0 — took place as Manafort started to panic about his own Russian ties

Given some of Stone’s explanations (and his apparent concern with offering some explanation for discussions about Podesta on August 14), I also find it notable the way this timeline overlaps with Manafort’s increasingly desperate efforts to stave off bankruptcy even while working for Trump for “free.” Part of those efforts, of course, involved criminal efforts to hide his ties to Russia in the wake of reporting on those ties in mid-August.

It’s unclear when Manafort knew for sure his ties with Russia would blow up. In the wake of the first WikiLeaks dump on July 27, he got asked about his and Trump’s ties to Russia, a question he struggled with before responding by pointing to Hillary’s deleted emails. In spite of the risk of his own Russian ties, Manafort met on August 2 with Konstantin Kilimnik, talking (among other things) about unpaid bills and the presidential election. Sometime in early August, in advance of the first NYT story substantiating his Russian ties, he was reportedly blackmailed over the secret ledgers of his work with Ukrainian oligarchs.

Remarkably, just as attention to Trump and Manafort’s ties to Russia started becoming an issue, Republicans had that GAI report insinuating a tie between Hillary and Russia all ready to go on August 1. That insinuation went through John Podesta and his ties to Joule. Before laying out that relationship, however, the GAI report suggested there must be more dirt on the topic in the emails Hillary deleted.

More recently, in January, 2015, Podesta became the campaign chairman of Hillary Clinton’s campaign for the 2016 presidential bid.85

During Hillary Clinton’s tenure as Secretary of State, he was in regular contact with her and played an important role in shaping U.S. policy. For one thing, he sat on the State Department’s Foreign Affairs Policy Board, appointed by Hillary. (The board was established in December 2011.)86

The full extent of Podesta’s email communication cannot ultimately be known because Hillary Clinton deleted approximately half of her emails after she left the State Department.

So along with everything else the report did, it built expectations that Hillary’s deleted emails would reveal secret dirt about Russia she was suppressing to win the campaign.

By the time the report came out, we know that Stone was already interested in what WikiLeaks might have, as Charles Ortel BCCed him on an email suggesting that WikiLeaks had Clinton Foundation emails to dump in September in late July.

Then, precisely as the Russian attack on Podesta was rolling out, Stone flip-flopped on his claimed belief about who hacked Hillary Clinton. Between August 1 and August 5, on the same days he was claiming to have dined with Julian Assange when he was instead in Southern California meeting his dark money associates, he started claiming that Guccifer 2.0 was just a hacktivist, not Russians. That stated belief has always been central to his claims not to have conspired with Russia.

In significant part because he flip-flopped publicly, he and Guccifer 2.0 started communicating, first about Stone’s claim that Guccifer 2.0 had nothing to do with Russia, then about Guccifer 2.0 being shut down on Twitter:

August 12: Guccifer 2.0: @RogerJStoneJr thanks that u believe in the real #Guccifer2

August 13: Stone: @WL @G2 Outrageous! Clintonistas now nned to censor their critics to rig the upcoming election.

Stone: @DailyCaller Censorship ! Gruciffer2 is a HERO.”

August 14: Guccifer 2.0: #Guccifer2 Here I am! They’ll have to try much harder to block me! #DNCleak #dccchack

Stone: First #Milo, now Guccifer 2.0 – why are those exposing the truth banned? @RealAlexJones @infowars #FreeMilo

Stone: @poppalinos @RealAlexJones @infowars @GUCCIFER_2 Thank You, SweetJesus. I’ve prayed for it.

That’s when Stone moved their conversations to DM.

That conversation, including Guccifer 2.0’s question whether Stone found “anything interesting in the docs I posted?” (which, in public context at least, would refer to some DCCC documents Guccifer had posted on WordPress on August 12) took place even as Stone was continuing to speak about knowing what was in the next WikiLeaks dump and as he responded badly to his childhood friend becoming the target of NYT’s attention on August 14.

As noted, Stone seems to be struggling to answer why he was discussing John Podesta on August 14.

To be sure, Stone was talking to Corsi on August 14 or 15. On August 15, Corsi published an interview with Stone, in which he claimed to have been badly hacked and described what he expected would come next from WikiLeaks.

But nothing in the interview mentions Podesta.

Stone’s descriptions of what WikiLeaks might dump next in that interview could reflect the BCCed James Rosen email reporting that WikiLeaks would dump Clinton Foundation documents in September, but the information he laid out went far beyond that email (and promised an October surprise, not a September dump).

“In the next series of emails Assange plans to release, I have reason to believe the Clinton Foundation scandals will surface to keep Bill and Hillary from returning to the White House,” he said.

[snip]

In a speech Southwest Broward Republican Organization in Florida, published Aug. 9 by David Brock’s left-wing website Media Matters, Stone said he had “communicated with Assange.”

“I believe the next tranche of his documents pertain to the Clinton Foundation, but there is no telling what the October surprise may be,” he said.

Stone told WND that Assange “plans to drop at various strategic points in the presidential campaigns Hillary Clinton emails involving the Clinton Foundation that have yet to surface publically.”

“Assange claims the emails contain enough damaging information to put Hillary Clinton in jail for selling State Department ‘official acts’ in exchange for contributions to the Clinton Foundation and as a reward for Clinton Foundation donors becoming clients of Teneo, the consulting firm established by Bill Clinton’s White House ‘body man’ Doug Band,” he said.

That same day, August 15, is the first time Stone ever mentioned Podesta on Twitter.

Stone claims (and claimed, in sworn testimony) that his focus on John Podesta was a response to the allegations against Manafort. That makes the confluence of all these events all the more interesting.

Corsi’s lawyer claims he avoided criminal liability

As noted above, Jerome Corsi has explained what he knows of all this in a September 21 grand jury appearance, a grand jury appearance that Mueller seems to have been working towards since having Ted Malloch questioned way back in March.

In advance of that testimony, Corsi’s attorney David Grey seemed to suggest that Corsi declined to participate in certain activities involving Stone that might have exposed him to criminal liability.

Gray said he was confident that Corsi has done nothing wrong. “Jerry Corsi made decisions that he would not take actions that would give him criminal liability,” he added, declining to elaborate.

Asked if Corsi had opportunities to take such actions, Gray said, “I wouldn’t say he was offered those opportunities. I would say he had communications with Roger Stone. We’ll supply those communications and be cooperative. My client didn’t act further that would give rise to any criminal liability.”

But Mueller is apparently now chasing down Corsi’s associates.

FBI agents have recently been seeking to interview Corsi’s associates, according to the person.

One other key player in the Podesta hand-off conflated the Podesta brothers

The close ties between how Stone focused on both Podesta brothers in response to the public allegations against Manafort is interesting for another reason.

Former Ambassador Craig Murray, the only one not denying some role in the handoff of the Podesta emails (again, he has said he didn’t get the emails themselves, which he believed were already with WikiLeaks, but something associated with them).

Murray told Scott Horton that his source had obtained whatever he received from a figure in American national security with legal access to the information.

[H]e says “The material was already, I think, safely with WikiLeaks before I got there in September,” though other outlets have suggested (with maps included!) that’s when the hand-off happened. In that account, Murray admits he did not meet with the person with legal access; he instead met with an intermediary.

But the explanation of his source’s legal access and motivation not only doesn’t make sense, but seems to parrot what Stone was saying at the time.

I also want you to consider that John Podesta was a paid lobbyist for the Saudi government — that’s open and declared, it’s not secret or a leak in a sense. John Podesta was paid a very substantial sum every month by the Saudi government to lobby for their interests in Washington. And if the American security services were not watching the communications of the Saudi government paid lobbyist then the American intelligence services would not be doing their job. Of course it’s also true that the Saudis’ man, the Saudis’ lobbyist in Washington, his communications are going to be of interest to a great many other intelligence services as well.

As Stone did, this conflates John and Tony. It wrongly suggests that US national security officials would be collecting all of Tony Podesta’s emails, or that collecting on Tony would obtain all of John’s emails. All the more interesting, this conflation would have come in a period when Manafort’s lifelong buddy, Stone, was trying to distract attention from Manafort’s own corruption — which included telling Tony not to disclose the influence-peddling he had done for Manafort in the legally required manner — by projecting Manafort’s corruption onto Tony.

One more point about Murray. Murray has ties (including through the Sam Adams Association the awards ceremony for which he was in DC attending) to NSA whistleblowers Bill Binney (Murray received the award in 2005 and Binney received it in 2015) and Kirk Wiebe. This claim that US law enforcement would collect everything (including Hillary’s deleted emails) is the kind of line that Binney was pushing at the time, including to Andrew Napolitano, who was CCed on the email Stone received about WikiLeaks’ plans in July. Napolitano is one of the people who has championed that Binney line about the hack.

In other words, it’s not just that Murray was telling a similar story as Stone, even though they’re politically very different people. It’s that he was not that distant from the network of Republicans talking about what WikiLeaks might have had.

Update: Emma Best just wrote up something she’s been tracking for some time: there are four different numbers on how many Podesta mails there are.

WikiLeaks’ own data gives us five different totals for the number of Podesta emails:

50,866

57,153

58,660

59,258

59,188

The two most authoritative answers to the question come from WikiLeaks and the Special Counsel’s office, and both indicate that the total exceeded 50,000. While WikiLeaks’ stated there were “well over 50,000” emails, the Special Counsel’s indictment simply said that “over 50,000 stolen documents were released.” Since “documents” can be construed to include both the emails and their various attachments, the SC’s total is even more vague and less definitive than WikiLeaks’.

Ultimately, he best answer to the question of how many Podesta emails there are appears to be 59,188.

This raises the possibility that Stone or Corsi saw copies that WikiLeaks didn’t publish. Mueller’s distinction between how many emails were stolen and how many released suggests FBI may know what WikiLeaks chose not to public, if in fact they did.

Timeline

July 18-21: Stone meets Nigel Farage while at RNC

July 25: Stone gets BCCed on an email from Charles Ortel that shows James Rosen reporting “a massive dump of HRC emails relating to the CF in September;” Stone now claims this explains his reference to a journalist go-between

July 27: Paul Manafort struggles while denying ties to Russia, instead pointing to Hillary’s home server

July 31: GAI report on From Russia with Money claiming Viktor Vekselberg’s Skolkovo reflects untoward ties; it hints that a greater John Podesta role would be revealed in her deleted emails and claims he did not properly disclose role on Joule board when joining Obama Administration

August 1: Steve Bannon and Peter Schweitzer publish a Breitbart version of the GAI report

August 1: Stone NYC > LA

August 2: Manafort and Konstantin Kilimnik meet in the Grand Havana Room in Jared’s 666 Park Avenue and “talked about bills unpaid by our clients, about [the] overall situation in Ukraine . . . and about the current news,” including the presidential campaign

August 2, 2016: Stone dines with dark money funder, John Powers Middleton in West Hollywood

August 3 and 4: Manafort obtains the bio of Steve Calk, from whom he was getting a $16 million mortgage in tacit exchange for a role in the Trump administration

August 3: Stone claims to Sam Nunberg to have dined with Assange

August 3-4: Stone takes a red-eye from LAX to Miami

August 4: Stone flip-flops on whether the Russians or a 400 pound hacker are behind the DNC hack and also tells Sam Nunberg he dined with Julian Assange; first tweet in the fall StopTheSteal campaign

August 5: Trump names Calk to his advisory committee

August 5: Stone column in Breitbart claiming Guccifer 2.0 is individual hacker

August 7: Stone starts complaining about a “rigged” election, claims that Nigel Farage had told him Brexit had been similarly rigged

August 8: Stone tells Broward Republicans he has communicated with Assange, expects next tranche to pertain to Clinton Foundation

August 10: Manafort tells his tax preparer that he would get $2.4 million in earned income collectable from work in Ukraine in November

August 10: Stone asserts that Hillary’s deleted emails will be coming out

Early August: Manafort gets blackmail threat pertaining to secret ledgers

August 12: Guccifer 2.0 publicly tweets Stone

August 13: Stone claims to have been hacked

August 14: NYT publishes story on secret ledgers

August 14: Stone DMs Guccifer 2.0

August 14: Corsi claims to have started research on response to NYT story

August 14: Breitbart piece suggesting NYT was ignoring Hillary’s own ties to Russia; this may be Stone’s latest explanation for interest in Podesta on that date

August 15: Manafort and Gates lie to the AP about their undisclosed lobbying, locking in claims they would make under oath later that fall

August 15: In first tweet mentioning John Podesta, Stone claims John Podesta “makes Paul Manafort look like St. Thomas Aquinas”

August 15: Corsi reports Stone’s prediction that WikiLeaks will release deleted Hillary emails (also reports on claimed hack)

August 17: AP publishes story on Manafort’s unreported Ukraine lobbying, describing Podesta Group’s role at length

August 17: Trump adds Steve Bannon and Kellyanne Conaway to campaign leadership team (Manafort’s daughter claims he hired them)

August 19: Manafort resigns from campaign

August 21: Stone tweets it will soon be Podesta’s time on the barrel

August 26: Rebekka Mercer asks Alexander Nix whether Cambridge Analytica or GAI could better organize the leaked Hillary emails

September 12: Following further reporting in the Kyiv Post, Konstantin Kilimnik contacts Alex Van der Zwaan in attempt to hide money laundering to Skadden Arps

September 28: Corsi post (later linked on Twitter by Stone) noting that Podesta Group also under investigation

October 6: Corsi repeats the Joule/GAI claims

October 11: Release of Podesta email allegedly backing Joule story (December 31, 2013 resignation letter, January 7, 2014 severance letters)

October 11: Foldering email among Peter Smith operatives that may included coded satisfaction with emails released thus far

October 12: Roger Stone interview with the Daily Caller responding to Podesta’s allegations he knew of release in advance, which makes no mention of Joule attack

October 13: In response to accusations he knew of Podesta emails in advance, Stone repeats Joule story falsely claiming this WikiLeaks email, released October 11, substantiates it; Corsi also posts a story on Joule, like Stone not linking to the underlying WikiLeaks emails

October 17: Corsi post that actually links the WikiLeaks releases relied on in his and Stone’s October 13 posts

October 30: Additional Joule letter (including actual transfer signatures) released

October 31: Additional Joule letter released

November 1: Additional Joule letter released

As I disclosed in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post.

Posts

Rat-Fucker Rashomon: Accessing Hollywood Cover-Ups of the Russian Attribution

The Roger Stone Prosecution Was One Step in an Ongoing Investigation

Identify the Malloch and Corsi connection (May 2017 to July 2018)

Collect materials on Stone’s overt social media campaigns (August 2018)

Track Stone’s efforts to obstruct the investigation (August 2018)

Investigate the spooky stuff (May to August 2018)

Seal warrants investigating an Agent of Foreign Power (August to September 2018)

Use the obstruction charges to seize Stone’s phones (January to February 2019)

The warrants

A Biased FBI Agent Was Running an Informant on an Oppo-Research Predicated Investigation–into Hillary–in 2016

OTHER POSTS ON THE DOJ IG REPORT

Overview and ancillary posts

Report shortcomings

Factual revelations in the report

The Universe of Hacked and Leaked Emails from 2016: Podesta Emails

Meuller remains coy about how the Podesta emails were released by WikiLeaks

The August to September timing on receipt of the emails

Stone’s three different explanations for his tweet and the import of Joule emails

Stone’s claims about WikiLeaks — and his outreach to Guccifer 2.0 — took place as Manafort started to panic about his own Russian ties

Corsi’s lawyer claims he avoided criminal liability

One other key player in the Podesta hand-off conflated the Podesta brothers

Timeline

Interesting links

Pages

Tag Archive for: Charles Ortel

Posts

Identify the Malloch and Corsi connection (May 2017 to July 2018)

Collect materials on Stone’s overt social media campaigns (August 2018)

Track Stone’s efforts to obstruct the investigation (August 2018)

Investigate the spooky stuff (May to August 2018)

Seal warrants investigating an Agent of Foreign Power (August to September 2018)

Use the obstruction charges to seize Stone’s phones (January to February 2019)

The warrants

OTHER POSTS ON THE DOJ IG REPORT

Overview and ancillary posts

Report shortcomings

Factual revelations in the report

Meuller remains coy about how the Podesta emails were released by WikiLeaks

The August to September timing on receipt of the emails

Stone’s three different explanations for his tweet and the import of Joule emails

Stone’s claims about WikiLeaks — and his outreach to Guccifer 2.0 — took place as Manafort started to panic about his own Russian ties

Corsi’s lawyer claims he avoided criminal liability

One other key player in the Podesta hand-off conflated the Podesta brothers

Timeline

Interesting links

Pages