Posts

Methinks Joshua Schulte Doth Protest Too Much over Anonymous

/1 Comment/in , /by

Accused Vault 7 leaker Joshua Schulte — whose trial starts Monday — and the government are having a fight over Paul Rosenzweig’s expert witness testimony again (see this post for the most comprehensive coverage of this dispute). Rosenzweig submitted the Powerpoint he plans to use at trial. Schulte raised objections to the Powerpoint as a whole and to specific slides on it. And the government responded, offering to make some modifications.

The general complaint from Schulte is that the government is using Rosenzweig to introduce otherwise inadmissible hearsay. In one case, the government has agreed to withdraw the claim (a quote from Fred Kaplan, who in my opinion is not particularly reliable with respect to WikiLeaks in any case). The government makes two responses of particular interest. First, that experts are allowed to draw on periodicals to make their conclusions.

Moreover, the defendant’s objection to the introduction of statements from respected news publications ignores that the Rules of Evidence expressly provide for the introduction of such material. Federal Rule of Evidence 803(18) expressly permits the recitation of “[a] statement contained in a . . . periodical . . . if . . . the statement is . . . relied on by the expert on direct examination; and . . . the publication is established as a reliable authority by the expert’s admission or testimony, by another expert’s testimony, or by judicial notice.”

After pulling the Kaplan quote, there’s not really much left in the slide deck that quotes journalistic sources, aside from direct quotes about the diplomatic backlash to the State cables. But what the government doesn’t say is that WikiLeaks presents itself as a respected news publication, which if they truly believe is true should allow introducing the WikiLeaks material as such.

But the government wants to prevent that from coming into evidence (even though Schulte warned that calling Rosenzweig would invite it). Indeed, rather than including material from the About page that Schulte would like to include that makes that point,

The excerpts from the WikiLeaks website are taken out of context. If the government is permitted to introduce two sentences from the lengthy “about” page on WikiLeaks.org, the defense would be entitled to introduce other portions of that page, including that WikiLeaks is a “multi-national media organization and associated library,” that it has “contractual relationships” with more than 100 major media organizations, and that it has won numerous media awards. See https://wikileaks.org/What-is-WikiLeaks.html.

The government has offered to pull this slide:

Rather than conceding (or even mentioning) WikiLeaks’ claim to be a respected media outlet, the government says it can introduce the vast majority of the clips from WikiLeaks’ site because they are not assertions at all.

Indeed, other than WikiLeaks’ statements regarding the content of the Vault 7 leaks, the particular statements from WikiLeaks and Assange about which Mr. Rosenzweig will testify are not “statements” or “assertions” such that the rule against hearsay is even applicable.

That’s true. Some of what Rosenzweig plans to submit includes the pre-release hype WikiLeaks gave the Vault 7 release, including the release purporting to show the US had infiltrated French political parties (which it claimed provided justification for the Vault 7 release) and slides emphasizing the spookiness of the release, including this one invoking Chelsea Manning and Edward Snowden in the same breath as Julian Assange.

Other slides capture the instructions WikiLeaks gives to leakers, including to contact WikiLeaks if you have very large submissions (as this was) and to format and dispose of hard drives.

The government will claim Schulte followed some — but not all — of these instructions, in part because he couldn’t dispose of his CIA workstation, and in part because he kept the hard drives and a thumb drive he used to exfiltrate the files.

Mind you, WikiLeaks didn’t warn leakers not to Google everything they were doing as they did it, which is the really damning evidence against Schulte.

In any case, I can’t help but imagine we’ll be seeing this very same slide deck in a trial in EDVA (if Assange is ever extradited), as it shows a continuation of the kinds of activities charged in the existing Assange indictment. Assange’s extradition hearing has been split into two, with the second starting in May, so the government would have plenty of time to add such charges after this trial (which may last a month).

In addition to Rosenzweig’s refusal to include WikiLeaks’ awards (which I would imagine Schulte will bring out on cross in any case, though I honestly wonder why they didn’t bring in their own expert to present such material), one Schulte claim that absolutely has merit is that Rosenzweig should not use the WikiLeaks logo on all these slides.

Each page of the power point has the WikiLeaks logo and name from the WikiLeaks website as if the power point document itself was created by WikiLeaks. This creates a misleading impression and should be removed.

Schulte doesn’t lay out what misleading impression the logo provides, but I would argue it suggests that WikiLeaks endorses some of the content in the slide deck, pertaining to damage or the characterization of certain leaks. The government says this misleading impression can be avoided with an instruction.

With respect to the inclusion of the WikiLeaks logo on the relevant pages of the Demonstrative, WikiLeaks is the subject of his testimony, and it is reasonable to include it as a header. To avoid any confusion, the Government will elicit from Mr. Rosenzweig that the Demonstrative as a whole was prepared as a demonstrative aid for his testimony and was not produced by WikiLeaks.

I vehemently disagree with this stance. Over half of people are visual learners (indeed, the government will rely on visual reenactments to show how they claim Schulte stole the files). The logo on this slide deck ascribes to WikiLeaks things that they would strongly dispute. Particularly given that Rosenzweig is claiming there are three official WikiLeaks channels — the site, the WikiLeaks Twitter account, and Assange’s Twitter account — it is imperative that he differentiate in his presentation between what is official and what is his own analysis.

All of which is to say that, as predicted, calling Rosenzweig will invite a dispute over what kind of organization WikiLeaks really is (which is probably the point).

All that said, I’m frankly stunned that, amidst all the other slides in this presentation — including the one showing convicted leaker Chelsea Manning (whose leaks, the government will show, Schulte viewed as damaging in real time) and admitted leaker Edward Snowden (whom the government will show Schulte was Googling at a key time in August as he was also Googling WikiLeaks for almost the first time) — Schulte objects, again, to the invocation of Anonymous in this slide.

Having not objected that the government will raise Chelsea Manning and not objected that the government will raise Edward Snowden, Schulte is objecting that they’re raising Jeremy Hammond — like Manning, a confessed WikiLeaks source — and a 2010 operation to punish Paypal and others for blacklisting WikiLeaks.

We renew our objections to references to Anonymous, which are irrelevant and prejudicial.

As I have laid out, the way in which Schulte himself adopted the identity of Anonymous as part of his effort to leak to the WaPo from jail links together the three main pieces of evidence of that — his Signal texts with Shane Harris, his ProtonMail account in the name of Anonymous, and his prison notebooks. Schulte’s the one who claimed to be Anonymous, whether or not it’s true (and given the ethics the group adopts about membership, by claiming to be a member he basically is one). Anonymous’ tie to WikiLeaks is clearly admissible evidence based on Schulte’s own actions.

Schulte deems the invocation of Anonymous to suggest “concerted activity” that is more disturbing than simply stealing CIA’s hacking tools and leaking them to WikiLeaks in an effort to burn CIA to the ground out of spite for being made to sit in what Schulte considered an “intern desk” rather than a “prestigious desk with a window,” which is the motive the government says it will present.

The evidence of claimed participation in a shadowy, underground group infamous for cyber-attacks and dumping on WikiLeaks is unduly prejudicial as it suggests concerted activity of a type even more disturbing than what is charged.

The evidence suggests that Schulte adopted at least three personalities to leak from jail, deliberately attempting to present the illusion of concerted activity. Given the concerted concern about Anonymous amid all the equally damning references, perhaps some of Schulte’s imaginary friends aren’t actually imaginary?

As I disclosed in 2018, I provided information to the FBI in 2017. The government recently stated publicly that matters on which I shared information are related to Schulte. Aside from two press inquiries, I have not spoken with the government about Schulte.

Joshua Schulte Wanted to Include Instructions to Contact WikiLeaks in a Pro Se Motion

/7 Comments/in , /by

The lawyers for accused Vault 7 leaker Joshua Schulte made a last ditch effort yesterday to limit how much information from his prison notebooks can be admitted as evidence in his trial starting next week. Perhaps inadvertently, the letter provides new details about why the government believes Schulte was trying to leak from jail, as well as some hints about why his lawyers claim they may be responsible for some of his exposure on those charges.

As I had noted, the government wants to include a passage from his notebooks instructing somebody to “ask WikiLeaks” if they need help to prove that Schulte had knowledge of what WikiLeaks had received.

“Ask WikiLeaks” (014099) (undated): In the middle of the page, the defendant writes, “If you need help ask WikiLeaks for my code.”3 The defendant’s direction to consult WikiLeaks about his “code” is admissible as Nonpublic Information Evidence, because it is a statement that WikiLeaks is in possession of source code for tools upon which the defendant worked and that are contained in the back-up file that was stolen, even though WikiLeaks has not publicly disclosed that it possesses any source code for all of the tools. Schulte’s knowledge of non-public aspects of the information that was given to WikiLeaks helps to demonstrate that he was the one who gave that information to WikiLeaks in the first place.

Schulte’s lawyers argue, unpersuasively, that this is not relevant, though they also argue that it is “privileged information or work product” because the passage is part of a pro se motion Schulte was trying to draft.

  • “If you need help ask WikiLeaks for my code.” Gov. Ltr. 8. The government says that this sentence means that “WikiLeaks is in possession of source code for tools upon which the defendant worked and that are continued in the backup file that was stolen, even though WikiLeaks has not publicly disclosed that it possesses any source code for all of the tools.”

Nothing in the unredacted portion of Page JAS_022627 (classified #014099) is relevant to the government’s case. On the contrary, the beginning of the page is clearly part of a legal motion that Mr. Schulte was drafting. The top of the page states: “You can create a forensic copy of the device & then have control over it. There has been no reason over this past year that we would not have had access to this critical evidence except that the prosecutors have lied to your honor & played games.” This is privileged information or work product and is therefore not admissible.

Obviously, Schulte’s lawyers are wrong that this is not relevant to the government’s case, either on the MCC charges or the charges in chief. They don’t deny that this reflects knowledge that WikiLeaks has source code that Schulte wrote; they simply remain silent about it.

They’re instead making a half-hearted attempt to argue that it pertains to Schulte’s defense. That is, they’re arguing that in a pro se motion addressed to Judge Crotty, Schulte included instructions about how to use the code he wrote for the CIA to do something, possibly obtain forensic evidence from the CIA that the government had not yet turned over.

While the privilege claim, half-hearted as it is, is an interesting one, Schulte’s argument in some ways makes this passage more damning. After all, he had already, by this point, included allegedly classified information in a pro se bail motion. Around this period he tried to release information publicly via a pro se motion again, though the government pulled it from PACER before most people could access it. Schulte eventually would submit a pro se lawsuit challenging his SAMs designation that happened to make many of the same claims he had made in his “Presumption of Innocence” blog and alluded to some of the same challenges he had tried to make to warrants by leaking protected or classified information (though the government has not claimed it included classified information). That is, the record suggests that Schulte was using his pro se motions to communicate publicly as much as to mount legal arguments (though his pro se motion raises some important points about our shitty criminal justice system amid a lot of dreck and lies).

That makes the second part of what Schulte’s lawyers claim was a planned pro se motion all the more interesting. The government wants to present a page that appears 37 Bates stamp numbers later in Schulte’s notebook which lists a bunch of potentially classified topics.

“What We Expect to Find in Emails” (014136) (undated): At the top of this page, the defendant writes “What we expect to find in emails.” On the remainder of the page, the defendant writes a list of items, many of which contained classified information. This portion of the Blue Notebook is admissible as Intent Evidence and MCC Classified Information Evidence, because it shows the defendant cataloguing classified information that, if publicly disclosed, would likely be harmful to the United States. Indeed, some of the categories of information identified by the defendant on this page—such as certain operations—is the same as the classified information contained in the Fake Authentication Tweet, which serves to show that the defendant’s intent was to collect these materials for dissemination, not for any legitimate purpose related to his defense.

As noted, Schulte claims that this passage was not part of Schulte’s planned “New Articles,” which appears 22 pages earlier in the notebook, but instead the pro se motion. His defense claims this was a Fifth Amendment one, which I’m not sure I understand; it seems more like a selective prosecution challenge, but then they’re not engaging with the substance here.

What We Expect to Find in Emails (014136) (undated). This page is clearly part of Mr. Schulte’s pro se motion to dismiss under the Fifth Amendment for prosecutorial misconduct. The Fifth Amendment is referenced at the top of the right-hand page. As such it is privileged work product. In addition, the government has not specified which part of this page contains classified information and because the handwriting is not always legible the defense cannot fairly guess the offending part. Again this seems more a statement of Mr. Schulte’s political viewpoint, now as a wrongfully charged and detained defendant, and even were it not privileged, it would be irrelevant and unduly prejudicial.

In any case, even Schulte’s own lawyers are saying that Schulte wanted to submit a pro se motion that, first, instructed someone to use a tool he wrote for the CIA that could be obtained by asking WikiLeaks, possibly to find a bunch of email that includes classified information about CIA operations.

I can see how, in the wake of being busted once trying to spread protected information via pro se motion, his attorneys might advise him to draft any pro se motions in his notebook (at the time he had a classified discovery computer, but it’s not clear what he could write and save on it), which they could then review to make sure he wasn’t getting himself in more legal trouble. But then, when it was discovered, the government used it to claim he intended to leak more classified information.

Yet Schulte’s letter — in conjunction with evidence the government has said they’d submit at trial if the attorney-client advice issue came up — makes it clear that he was unhappy with his lawyer, Sabrina Shroff’s advice.

Finally, the government’s more general assertion that the conflict surrounding the MCC notebooks has somehow “disappear[ed]” based on the court’s ruling over objection that Mr. Schulte may not raise an advice-of-counsel defense is also incorrect. Gov. Ltr. 1. Indeed, the specific pages the government seeks to introduce include work product in preparation for Mr. Schulte’s defense. Some the pages that the government seeks to introduce also specifically mention “Sabrina” and refer to his family reaching out to different defense lawyers, strongly implying that Mr. Schulte had concerns about his current defense team. These portions of the notebooks only highlight the inherent conflict that the current defense team faces in representing Mr. Schulte. Additionally, if Mr. Schulte is convicted, this issue will surely be taken up on appeal, and may well cause a reversal of a conviction. The issue will only begin to “disappear” if the notebooks are excluded from the trial.

The government could easily show — and will, when Schulte appeals based on this argument — that at the time Shroff was trying to get him to stop trying to go public, he was threatening to go around her.

For example, the Government has described to the defense how, if the defendant offered his counsel’s testimony, the Government would likely rely on recorded prison calls in which the defendant criticized defense counsel’s advice, including, for example, calls in which the defendant stated that he would “go around” Ms. Shroff to disclose information to the media, despite her objections to this strategy.

In other words, written at a time when Schulte was trying to bypass Shroff, submitting a pro se motion including instructions on how to get and use one of the hacking tools he wrote, possibly to obtain classified emails, it could be seen as an attempt to use the pro se motion to leak information (or instruct others how to get and leak it). There’s no chance that that address, “If you need help ask WikiLeaks for my code,” was intended for Judge Crotty (who, in his writings, Schulte describes in very unfavorable terms), after all. Nor is it clear how someone as smart as Schulte is would include information confirming his role in the leak in a pro se motion claiming that prosecutors had unfairly targeted him.

All of which makes it interesting, to me, that this last-ditch letter addressing Schulte’s notebooks mounts an effort to get all reference to Anonymous, specifically, excluded from trial.

The government also again makes repeated reference to the “Anonymous” group. Dkt 257, at 5, 12, 17. As explained in our response to the motions in limine, all reference to Anonymous should be excluded under Rule 404(b).

[snip]

The defense continues to object to any mention of Autonomous [sic] as unduly prejudicial and because it may confuse the jury.

The government has said it will introduce evidence that Schulte, in real time in 2010, opined that Chelsea Manning’s leaks to WikiLeaks had done damage, which not only proves that he followed historical WikiLeaks releases but believed that the way WikiLeaks had released her leaks did some damage. That piece of evidence is utterly damning in support of a claim that Schulte intended to damage the US with his alleged leaks. And the defense is focusing, instead, on Schulte’s self-proclaimed reference to Anonymous?!?!?

While Schulte’s team doesn’t specifically reference which arguments it relies on here, weeks ago, the defense made this argument about why mentioning Anonymous would be prejudicial.

The government has provided no justification to introduce comments about Anonymous, which must be excluded under Rule 404(b). The government offers no support why it should be allowed to introduce “additional communications with the Reporter, including encrypted communications in which [Mr.] Schulte claims to have been [a] member of the group Anonymous, which is a group known for conducting cyber-attacks that has provided documents to WikiLeaks in the past.” Gov. Mot. 33. This “additional” evidence is clearly not part of the charged offenses nor is it inextricably intertwined with them. The jury will discern no gaps in the government’s case if it is not included in the proof. Instead, it is just classic “bad act” evidence that would be purely prejudicial. The evidence of claimed participation in a shadowy, underground group infamous for cyber-attacks and dumping on WikiLeaks is unduly prejudicial as it suggests concerted activity of a type even more disturbing than what is charged.

[snip]

The government also states that Mr. Rosenzweig will testify that in 2012 “Anonymous and WikiLeaks worked together to release information.” Gov. Res. 13. This testimony will “aid the jury in understanding the hacking group’s relationship with WikiLeaks” and that Mr. Schulte had “contact with access to WikiLeaks. Gov. Res. 13. As explained above, supra Point II(C)(1), information about Anonymous should be excluded from the trial.

That is, when Schulte’s team wrote this weeks ago (when they were trying unsuccessfully to exclude Paul Rosenzweig’s testimony about what Anonymous is and its past relationship with WikiLeaks), they focused only on the prejudicial aspect. Now, they’re claiming that discussion of Anonymous will confuse the jury, except that’s precisely why the government wanted Rosenzweig to explain what Anonymous is.

But we now know how inadequate this argument is.

Remember: the letter Schulte sent yesterday is an attempt to get Schulte’s notebooks (or at least the most damning parts of them) excluded from trial. But their reference to the government’s plan to introduce references to Anonymous in the letter actually draws from four different kinds of evidence: his notebooks, the Samsung phone he used in jail, and Signal texts and ProtonMail he used to contact a reporter (who warrant affidavits and recent filings have confirmed is WaPo’s Shane Harris).

Partly, the references to Anonymous prove that Schulte used the Samsung phone and the Annon ProtonMail account (the passwords for the ProtonMail accounts were also in the notebook), and that therefore the Signal texts that remain on the phone were sent by him.

In his correspondence with the Reporter, the defendant, pretending to be the defendant’s family and friends, asked the Reporter to send him the versions of the defendant’s articles that the defendant and his family had previously provided to the Reporter. When the Reporter demurred and sought confirmation from the defendant’s family whether the Reporter could provide the defendant’s articles to the user of the Annon Account, the defendant, posing as a member of his family, used a secure messaging application, Signal, to authorize release of the articles. In these Signal communications (the “Signal Messages”), the defendant claimed that the user of the Annon Account was a member of the hacktivist group Anonymous, of which, according to the defendant, the defendant was once a member. Anonymous has collaborated in the past with WikiLeaks to disclose stolen sensitive information.

[snip]

Signal and Twitter to Send Articles and Tweets (014327) (Sept. 2, 2018): In this portion of the Red Notebook, Schulte writes, among other things, “Well its September now. Locked in all day. Hopefully tonight I can setup Signal from my cell & msg [last name of the Reporter] to confirm anon’s permission and get my fucking articles. I also need to confirm my twitter.” This page contains Use Evidence. In particular, the defendant references setting up Signal “from my cell”—which supports that the defendant was using Signal on the Samsung Phone—to confirm “anon’s permission”—which shows that the defendant was using the Anon Account to “get [his] fucking articles.” The defendant also made clear that he had created a Twitter account when he wrote “I also need to confirm my twitter.”

[snip]

The Samsung Phone: Although the Samsung Phone was not found in the defendant’s cell, the Government intends to show that it was one of the cellphones that the defendant used at the MCC through various pieces of evidence, including by comparing identifying information appearing on the Samsung Phone to one of the images taken by CW-1 of one of the cellphones the defendant used in prison. The Samsung Phone contains, among other things, evidence that Encrypted Email Accounts were accessed on the cellphone, but not the actual communications from those accounts. The Samsung Phone also contains the Signal Messages in which the defendant, among other things, pretended to be a third person and attempted to convince the Reporter that the user of one of the Encrypted Email Accounts with whom the Reporter was corresponding (but who was in fact the defendant) is a member of the online hacktivist group Anonymous who is trying to help the defendant.

The Encrypted Email Accounts: The Annon Account contains the defendant’s correspondence with the Reporter, including the September 2018 Emails that attached the classified Network Structure Document and the Protected Search Warrant. The other Encrypted Email Accounts also contain records related to the defendant’s use and control of the Social Media Accounts, such as, for example, email notifications when the defendant modified the Social Media Accounts.

If I understand all this correctly, not only did Schulte use a ProtonMail account claiming to be a member of Anonymous to send details of CIA’s network structure to Harris (one of the charged pieces of classified information), but also used it to try to get him to send Schulte the original copies of his blog posts. Schulte was pretending to be a member of Anonymous on ProtonMail and a member of his family on Signal. And Schulte documented that scheme in his notebook in some of the references that Schulte’s lawyers want to exclude (though which they don’t lay out in such a way to show how it glues everything Schulte was doing from jail together).

But there’s still one more reference of Anonymous, tying it directly to the content that Schulte wanted to release: the Malware of the Mind article that reportedly discussed what he did at CIA.

Identifying Malware of the Mind as Article 10 (014319): On this page, the defendant identifies the Malware Article as article 10: “I’m hoping to write /edit my 9 articles. I don’t know how I can them—oh I may text [the Reporter] from [my cousin’s] number. Omar claims that some service exists to do this – I’m dubious. [Redacted]. Although I feel this may not work either . . . IDK Basically on hold for my publication. Secondly, I want to rewrite article #10: Malware of the Mind!” After a line drawn on the page, the page also includes, among other things, the phrase “Anonymous,” and the phrase “classified information.” This entry includes Intent Evidence, in that it shows that the defendant plans to re-draft his articles, including the Malware Article. Furthermore, the defendant’s statement that he might text the Reporter from his cousin’s telephone number, thus continuing to conceal his identity during those communications, is Guilty Conscience Evidence. Finally, the defendant’s reference to “Anonymous” and “classified information” is consistent with the defendant’s claims in his Signal messages that Anonymous is seeking to help prove his innocence by providing information to the Reporter.

The defense claims all this is prejudicial because, “it suggests concerted activity of a type even more disturbing than what is charged.” Except, by claiming that Schulte planned to include instructions in a pro se motion that people other than Judge Crotty — people with access to WikiLeaks — might use go get the code he wrote from WikiLeaks, possibly to obtain emails of classified information suggests that may well be what Schulte was attempting.

The government and Schulte are also arguing over what measures the government can use to protect the identities of a slew of CIA witnesses who will testify. Schulte has good reason to complain. In past trials (Jeffrey Sterling’s trial is being cited as precedent), the government engaged in a great deal of theater to make CIA witnesses — including witnesses whose CIA tie had already been declassified, as some of the witnesses here have been — seem especially momentous. Some of that is undoubtedly going on here. But if the government believes (and this letter from his defense does nothing to rebut that belief) that Schulte is using every opportunity in his prosecution to leak more information, there’s actually a solid case for some of those measures.

As I disclosed in 2018, I provided information to the FBI in 2017. The government recently stated publicly that matters on which I shared information are related to Schulte. Aside from two press inquiries, I have not spoken with the government about Schulte.

Joshua Schulte Spoke Positively of Edward Snowden the Day Snowden Came Forward

/in , , , /by

Here I thought that Joshua Schulte’s lawyers had finally come up with a decent argument, that Paul Rosenzweig’s testimony would be pointless to prove that Schulte, in choosing to leak to WikiLeaks, intended to damage the US because the government would have to prove Schulte knew of WikiLeaks when he allegedly first stole the CIA documents in May 2016.

But after pointing out that Schulte’s lawyers already blew their chance to make that argument, in a response the government  then pointed out how bad this argument is: because Schulte’s lawyers have already admitted that, “of course, Mr. Schulte knew” about Chelsea Manning’s leaks.

As an initial matter, the defendant’s Reconsideration Motion directly contradicts the argument he made in his original motions in limine concerning Mr. Rosenzweig’s testimony. The defendant argues in the instant motion that Mr. Rosenzweig’s testimony should not be admitted because there is no evidence that the defendant knew of, for example, Chelsea Manning’s disclosures to WikiLeaks. In his original opposition to the Government’s motions in limine, however, the defendant argued the exact opposite:

Next, the government says that it intends to introduce evidence of Mr. Schulte’s “knowledge of [Ms.] Manning’s leak.” Gov. Res. 11. The release of documents by Ms. Manning was front page news in every major news publication for numerous days. Of course, Mr. Schulte knew about it; so did everyone else who picked up a newspaper. It is not clear what the expert would have to add to this information. (Dkt. 242 at 44).

Worse, the government lays out not just that Schulte wrote about both Manning’s leaks to WikiLeak and Edward Snowden’s leaks, but discloses that they intend to introduce those chats at trial.

Moreover, even setting aside the dubious assertion that a member of the U.S. intelligence community could have been completely unaware of WikiLeaks’ serial disclosures of classified and sensitive information and the resulting harm, the Government’s proof at trial will include evidence that the defendant himself was well aware of WikiLeaks’ actions and the harms it caused. For example, WikiLeaks began to disclose classified information Manning provided to the organization beginning in or about April 2010, including purported information about the United States’ activities in Afghanistan. In electronic chats stored on the defendant’s server, the defendant discussed these disclosures. For example, on August 10, 2010, the defendant wrote in a chat “you didn’t read the wikileaks documents did you?” and, after that “al qaeda still has a lot of control in Afghanistan.” In addition, on October 18, 2010, the defendant had another exchange in which he discussed Manning’s disclosures, including the fact that the information provided was classified, came from U.S. military holdings, and that (according to the defendant) it was easy for Manning to steal the classified information and provide it to WikiLeaks. Similarly, in a June 9, 2013 exchange, the defendant compared Manning to Edward Snowden, the contractor who leaked classified information from the National Security Agency, and stated, in substance and in part, that Snowden, unlike Manning, “didnt endanger in [sic] people.”

Effectively, the government is going to show that Schulte — who like Snowden worked at both CIA and NSA (though in reverse order) — had decided the day that Snowden revealed himself that he hadn’t endangered someone.

I suggested in this post that the government appears to be preparing to use Schulte as an exemplar of an ongoing conspiracy, complete with their reliance on organized crime precedents.

[T]he government is preparing to argue that Schulte intended to harm the United States when he leaked these files to WikiLeaks, a stronger level of mens rea than needed to prove guilt under the Espionage Act (normally the government aims to prove someone should have known it could cause harm, relying on their Non-Disclosure Agreements to establish that), and one the government has, in other places, described as the difference between being a leaker and a spy.

To make that argument, the government is preparing to situate Schulte’s leaks in the context of prior WikiLeaks releases, in a move that looks conspicuously like the kind of ongoing conspiracy indictment one might expect to come out of the WikiLeaks grand jury, one that builds off some aspects of the existing Assange indictment.

That is, the government appears to be using Schulte to lay out their theory — rolled out in the wake of the Vault 7 leaks — that WikiLeaks is a non-state hostile intelligence service.

To be sure, there’s nothing in the least bit incriminating about talking about Snowden in real time. But it will make it a lot easier to hold Schulte accountable for leaking stuff in a far more damaging way in 2016 than Snowden did in 2013.

As I disclosed in 2018, I provided information to the FBI in 2017.

The Glenn Greenwald versus the Julian Assange Charges, Compared

/11 Comments/in , , , , /by

Yesterday, Brazil charged Glenn Greenwald as part of the criminal sim swapping group that also leaked The Intercept details of corruption in Sérgio Moro’s efforts to put Lula in prison.

In a criminal complaint made public on Tuesday, prosecutors in the capital, Brasília, accused Mr. Greenwald of being part of a “criminal organization” that hacked into the cellphones of several prosecutors and other public officials last year.

Here’s the indictment.

The indictment comes after a ruling, in December, that Glenn (whom Bolsonaro was already targeting in a financial investigation) could not be investigated.

Those reports led a Supreme Court justice, Gilmar Mendes, to issue an extraordinary order barring the federal police from investigating Mr. Greenwald’s role in the dissemination of the hacked messages.

Prosecutors on Tuesday said they abided by that order until they found audio messages which, they argued, implicated Mr. Greenwald in criminal activity.

Prosecutors have claimed that they were abiding by that order, which relied on a Brazilian law (which sounds like it’s akin to the Bartnicki decision in the US) that says journalists cannot be prosecuted for publishing stolen information. But they found recordings that — they claim — show Glenn was interacting with the hackers while they were engaged in their other crimes, and advised them to delete logs, which (the indictment argues) helped them evade prosecution.

Citing intercepted messages between Mr. Greenwald and the hackers, prosecutors say the journalist played a “clear role in facilitating the commission of a crime.”

For instance, prosecutors contend that Mr. Greenwald encouraged the hackers to delete archives that had already been shared with The Intercept Brasil, in order to cover their tracks.

Prosecutors also say that Mr. Greenwald was communicating with the hackers while they were actively monitoring private chats on Telegram, a messaging app. The complaint charged six other individuals, including four who were detained last year in connection with the cellphone hacking.

The indictment includes long excerpts of the discussion, which (if my combination of shitty Portuguese assisted by Google Translate is correct) they claim shows that, amid news that Moro had been hacked, the source of the Intercept’s files came to Glenn and admitted there were currently monitoring Telegraph channels in the period before the Intercept was going to publish and had a discussion about whether they had to keep the stuff leaked to the Intercept pertaining to corruption. Glenn was quite careful to note he wasn’t offering advice about what the hackers should do, but said they would keep their one copy in a safe place and so the hackers could do whatever they wanted with the stuff they had. Even in spite of Glenn’s clear statement that The Intercept had obtained the files long before the ongoing hacking, the Brazilian prosecutors claim this shows Glenn knew of ongoing hacking and then discussed deleting logs of the prior hacking, making him a co-conspirator.

Apparently, however, this same evidence had already been reviewed before the December ruling, meaning the government is reversing itself to be able to include Glenn in the charges. The government must first get the approval of the judge that issued the initial ruling to prosecute Glenn.

Let me start by saying that this is both an attack on the press and a fairly clear attempt at retaliation against a Jair Bolsonaro critic, part of a sustained attack on Glenn and his spouse, David Miranda. The press in the US has pretty loudly come out in support of Glenn, and no matter what you think of Glenn or his Russia denialism, Glenn deserves support on this issue.

The charges have led a lot of people to say that the charges are just like what is happening with Julian Assange. They are similar. But I think they are distinct, and it’s worth understanding the similarities and distinctions.

Before I do that, since I’ve been accused — because I report on what the prosecution of Joshua Schulte says — of being insufficiently critical of the existing charges against Assange, here’s a post where I talked about the danger of the first charge against Assange (conspiracy to hack information) and here’s one where I lay out how a number of the Assange charges are for publishing information. I don’t support the current charges against Assange, though I think some of Assange’s more recent actions pose closer calls.

Renewing old charges

In both cases, the government took evidence that had already been assessed — in Assange’s case, chat logs from 2010 that the Obama Administration had deemed were not distinguishable from stuff the NYT does, and in Glenn’s case, the recordings that police had already reviewed before the ruling that Glenn should not be investigated — and found reason to charge that hadn’t existed before. In Glenn’s case, that decision was made just weeks later, under the same Administration. In Assange’s case, that decision came by another Administration (one installed in part with WikiLeaks’ assistance), but also came after WikiLeaks engaged in several more leaks that had pissed off the US.

The US government has (Trump flunky efforts to pardon Assange notwithstanding) always hated Assange, but it’s unlikely he would have been charged without 1) the Vault 7 leak burned the CIA’s hacking ability to the ground and 2) an authoritarian Trump administration with a gripe against journalism generally. That said, it’s still not clear why, if DOJ wanted to go after Assange, they didn’t do it exclusively on actions (like extortion using CIA files) that were more distinguishable from journalism, unless the government plans to add such charges to show a pattern over time, one that culminated in the Vault 7 leaks.

Whereas with Glenn, this feels immediately personalized, an effort to keep looking at a leak that exposed Bolsonaro’s hypocrisy until charges could be invented.

The similar conspiracy charge

Where the two cases are most similar is the common charge: a conspiracy involving computer hacking. But even there, there are important differences.

Brazil is arguing (again, relying on my shitty Portuguese) that Glenn is part of the conspiracy his sources are being prosecuted for because in a conversation where he acknowledged that they were still engaged in criminal hacking, he talked about deleting logs. That is, they’re not arguing that he tried to take part in the hacking. They’re arguing that he helped the ongoing hacking by helping the hackers evade discovery.

This is something that the government has shown WikiLeaks to do, for example showing Assange discussing with Chelsea Manning about operational security. The government cites OpSec assistance in the directly comparable “Conspiracy to Commit Computer Intrusion” charged against Assange (count 18):

  1. It was part of the conspiracy that ASSANGE and Manning used the “Jabber” online chat service to collaborate on the acquisition and dissemination of the classified records, and to enter into the agreement to crack the password hash stored on United States Department of Defense computers connected to the Secret Internet Protocol Network.
  2. It was part of the conspiracy that ASSANGE and Manning took measures to conceal Manning as the source of the disclosure of classified records to WikiLeaks, including by removing usernames from the disclosed information and deleting chat logs between ASSANGE and Manning.

But those are described in the “manner and means” section of the conspiracy charge. The overt acts part, however, describes things more commonly described as hacking: Manning’s use of a Linux operating system to obtain Admin privileges, her sharing of a password hash, and Assange’s unsuccessful effort to crack it. That is, Assange is charged with taking an overt act that amounts to hacking, whereas Glenn is charged with advising a source to delete logs (notwithstanding the way Glenn, in very lawyerly fashion, made it clear that he wasn’t offering advice). The inclusion of OpSec in the manners and means is absolutely dangerous in the Assange indictment. But the government alleged something more to include him in a CFAA conspiracy, something not present in the charge against Glenn.

Assange is also charged with another conspiracy charge that reflects ongoing discussions to obtain more information. That’s distinguishable from Glenn’s charge in that Assange was talking about getting more information, whereas all Glenn is alleged to have done is have a discussion at a time he knew his source was committing other ongoing hacking unrelated to and long after obtaining the files he published. But the two conspiracies are similar insofar as the government in question holds a publisher/journalist accountable for continued communication with a source who is engaged in ongoing lawbreaking, but in Assange’s case that crime pertains to obtaining information for Assange, whereas with Glenn it involves an entirely different crime.

More — and in some way, more dangerous — charges against Assange

There’s no parallel between the charge against Glenn and the other charges against Assange, which are some of the most dangerous. As I’ve laid out, there are three theories of prosecution used against Assange:

  • The attempt to hack to obtain additional classified information (described above, along with a charge tied to the things they were trying to obtain by cracking that password)
  • A solicitation of specific files, some of which Manning sought out and provided
  • The publication of three sets of informants names

The last of these is absolutely a charge for publishing information; that’s specifically what (with its contorted thinking) the charge against Glenn tries not to do.

The solicitation request is something both Brazil and the US attempt to insinuate about the Intercept for its advocacy of SecureDrop (which is now used by a slew of outlets). It’s also something that could easily be used to criminalize normal journalism.

The Brazilian charge against Glenn at least attempts to avoid criminalizing any of these things.

Espionage

Of course, that’s a big difference right away. Glenn is not accused of publishing anything classified. Assange is.

And Assange is charged in such a way that gives him liability for releasing classified information under the Espionage Act.

And that’s an added danger of the Assange charges. Thus far, Assange has been charged for leaks that Chelsea Manning has never backed off having a whistleblower interest in leaking (the broad use of State cables she leaked would support that, but that’s less true of the Afghan and Iraqi war logs). As such, Assange is being charged for something that could implicate any journalist publishing classified information.

That said, that could change. That’s why some of the arguments the government is making in the Schulte case are so noteworthy. They are preparing to rely on precedents used for organized crime to argue that, in part because he leaked to WikiLeaks, Schulte intended to harm the US. To the extent that they substantiate that motive, it would put Schulte solidly in the position that the Espionage was designed for. But the government seems to be preparing to apply that argument to WikiLeaks more broadly.

Extradition and international legal process

Finally, though some folks appear to be forgetting this in demanding that the US get involved in Glenn’s case, Glenn was charged as a resident of Brazil for actions taken in Brazil. Assange was charged as an Australian citizen for actions taken in the UK affecting the US government, which has asked the Brits to extradite him for charges (Espionage) that fit under the kind of political crime that often will not merit extradition. Of course, Assange is fighting against Five Eyes governments that, post Vault 7 leak, are likely far less interested in such legal distinctions. Indeed, I suspect that’s one of the reasons the US charged Assange for leaking informant identities; some of those informants were British sources as much as American ones.

Still, the extradition gives Assange a preliminary opportunity to fight these charges, not just because it is a political crime and his health is at risk, but also based on claims (the validity of which I’ve been meaning to unpack) that he was spied on in the Embassy in ways that violate EU if not UK law.

Glenn, however, is facing charges in the increasingly authoritarian country he lives in with his spouse and children. So even though, as I understand it, the high court will have to approve his charges before he is actually prosecuted, Glenn still faces political retaliation within his resident country.

Update: Here’s a Mathew Ingram piece doing similar, though less granular, analysis.

The WikiLeaks Conspiracy: The Government Prepares to Argue WikiLeaks Has Always Been an Organized Crime Syndicate

/60 Comments/in , , /by

Last June, I ran into some folks who remain very close to Julian Assange. One of them scheduled dinner with me solely to scold me for writing honestly about the things that WikiLeaks had done in the past three years rather than focusing exclusively on the EDVA Espionage indictment charging Assange for things he did almost a decade ago.

The person complained that my factual reporting on 2016 election and — especially — the Vault 7 leak (I think this was the offending post) would undercut whatever unanimity there was among journalists (unanimity that I joined) that the existing charges against Assange were a dangerous precedent for actual journalists. Reporting true details about shitty things Assange had done in recent years on my humble little blog, it was claimed, would dangerously and singlehandedly undercut Assange’s defense.

No, I did not much appreciate the irony of being criticized for accurate reporting by someone purportedly defending journalism.

But I also thought the concerted effort to suppress what Assange had done recently, while perhaps necessary to generate the statements of support from journalists that were forthcoming, was short-sighted, because it misrepresents what Assange is actually facing. The grand jury in EDVA remains (as far as we know) active. The government specifically said, in June, that it needed Chelsea Manning’s testimony for subjects or charges not yet charged and said such charges were not time barred (as would be true of any ongoing conspiracy).

As the government’s ex parte submissions reflect, Manning’s testimony remains relevant and essential to an ongoing investigation into charges or targets that are not included in the superseding indictment. See Gov’t’s Ex Parte Mem. (May 23, 2019). The offenses that remain under investigation are not time barred, see id., and the submission of the government’s extradition request in the Assange case does not preclude future charges based on those offenses, see Gov’t’s Supplement to Ex Parte Mem. (June 14, 2019).

Since then, Jeremy Hammond has joined Manning in believing he can wait out whatever EDVA has in store.

Most of all, Joshua Schulte’s prosecution for the Vault 7 leak — a leak almost no WikiLeaks supporters I know will offer an enthusiastic defense of — kept chugging along. In recent weeks, Schulte has submitted a number of questionable filings claiming the dog ate his homework so he can’t be prepared in time for his trial:

  • The attorney appointed after defense attorneys said they needed one more attorney to prep for trial in time said he couldn’t prep for trial in time, but can’t talk about why not until he’s done with a week-long vacation
  • The government’s (admittedly long) motion in limine repeating details the government disclosed several times before took the defense by surprise
  • The defense can’t make a constitutional challenge to CIPA generally until the judge rules on CIPA specifically (this is the one arguably reasonable request)
  • The defense had no idea the government wasn’t claiming Schulte downloaded a terabyte of data onto a thumb drive that can’t hold that terabyte even though the government told the defense that a year ago and then again in November

But as of now, Schulte’s trial is due to start on January 13, a month and a half before Assange’s first substantive extradition hearing starting on February 25.

And at that trial, the government is preparing to argue that Schulte intended to harm the United States when he leaked these files to WikiLeaks, a stronger level of mens rea than needed to prove guilt under the Espionage Act (normally the government aims to prove someone should have known it could cause harm, relying on their Non-Disclosure Agreements to establish that), and one the government has, in other places, described as the difference between being a leaker and a spy.

To make that argument, the government is preparing to situate Schulte’s leaks in the context of prior WikiLeaks releases, in a move that looks conspicuously like the kind of ongoing conspiracy indictment one might expect to come out of the WikiLeaks grand jury, one that builds off some aspects of the existing Assange indictment.

In a motion opposing Schulte’s effort to disqualify Paul Rosenzweig as an expert witness (see this post for background), the government lays out some of the things it plans to have Rosenzweig explain to the jury. Some of this is dangerous criminalization of security, most notably tying WikiLeaks’ endorsement of Tor and Tails to Schulte’s own use of it.

But some of it fleshes out the scope the government laid out when it first requested to call Rosenzweig.

The Government recognizes the need to avoid undue prejudice, and will therefore limit Mr. Rosenzweig’s testimony to prior WikiLeaks leaks that have a direct relationship with particular aspects of the conduct relevant to this case, for example by linking specific harms caused by WikiLeaks in the past to Schulte’s own statements of his intent to cause similar harms to the United States or conduct. Those leaks include (i) the 2010 disclosure of documents provided to WikiLeaks illegally by Chelsea Manning; (ii) the 2010 disclosure of U.S. diplomatic cables; (iii) the 2012 disclosure of files stolen from the intelligence firm Stratfor; and (iv) the 2016 disclosure of emails stolen from a server operated by the Democratic National Committee.

For example, it will tie WikiLeaks’ failure to redact the identities of US sources in Chelsea Manning’s leaks — something charged in counts 15 through 17 of Assange’s indictment — to Schulte’s behavior. It sounds like Rosenzweig will explain something I’ve alluded to: WikiLeaks apparently left the names of some of Schulte’s colleagues unredacted, which given WikiLeaks’ big show of redacting the files could only have been intentional and would have required coordination with Schulte to do.

Mr. Rosenzweig will testify that WikiLeaks does not typically redact the information that it publicly discloses (even when that information may reveal confidential sources). The Government will introduce evidence, however, that the Classified Information was purportedly redacted when posted online. Mr. Rosenzweig’s testimony will help the jury understand the significance of WikiLeaks’ unique claim to have redacted the Classified Information, including, for example, the period of delay between when Schulte disclosed the Classified Information to WikiLeaks (in or about the spring of 2016) and when WikiLeaks first announced that it would begin to disclose the Classified Information (in or about the spring of 2017). [my emphasis]

One reason Assange made a show of redacting the identities was because he was attempting to extort a pardon at the time, so he had to appear willing to negotiate with DOJ. But it seems likely Rosenzweig will explain that that was just a show and that even as WikiLeaks was making that show it was also ensuring that other CIA SysAdmins might be targeted by foreign governments.

Likewise, Rosenzweig will tie the embarrassment caused by Manning’s releases to Schulte’s own intent to cause damage with his self-described Information War against the US.

The Government intends to introduce evidence (including his statements) of Schulte’s knowledge of Manning’s leak and the need for the U.S. government to maintain secrecy over certain information. Furthermore, the Government also plans to introduce evidence of how Schulte, from the Metropolitan Correctional Center (the “MCC”), declared an “information war” against the United States, pursuant to which he intended to publicly disclose classified information and misinformation, including through WikiLeaks (such as the Fake FBI Document), for the purpose of destroying the United States’ “diplomatic relationships,” and encouraged other U.S. government employees to disclose confidential information to WikiLeaks. Mr. Rosenzweig will explain to the jury generally information other leakers have transmitted to WikiLeaks that the organization published and how foreign governments reacted negatively to WikiLeaks’ disclosure of that information—leading, for example, to the highly-publicized resignation of the U.S. Ambassador to Mexico.

Effectively, the government will argue that if you want to conduct an Information War on the US, you choose to leak to WikiLeaks and ensure it will be as damaging as possible. Whatever the circumstances of Manning’s leaks, this uses Schulte’s stated desire to damage the US to retroactively taint what WikiLeaks has claimed in the past was mere journalistic exposure of wrong-doing. That doesn’t necessarily change the First Amendment danger in charging Assange. But it surely attempts to undercut WikiLeaks’ brand as a journalistic entity.

Most interestingly, the government will point to a claim Schulte made to a journalist while writing from jail (one that is plausible given some of his past public postings, but if true, is an unfathomable indictment of CIA’s vetting process) that he once belonged to Anonymous. Rosenzweig will tie this to Anonymous’ decisions to leak the Stratfor cables to WikiLeaks in 2012.

As described in the Government Motions in Limine, in encrypted communications from one of the Contraband Cellphones, Schulte (posing as a third person) stated that he had previously been a member of Anonymous, a group of online hacker activists. Mr. Rosenzweig will testify about how, in 2012, Anonymous and WikiLeaks worked together to release information from a private U.S. intelligence firm.

Of course, Anonymous didn’t just leak the Stratfor cables to WikiLeaks. They also shared files stolen during the Arab Spring and the Syria files. The latter leak provides one of the earliest indicators where the process by which WikiLeaks obtained files may have involvement of Russia, because somehow a file that would have been very damning for Russia never got published. But both would make the story the US wants to tell more complex (though still potentially consistent).

In any case, the focus on Stratfor may explain why the government is holding Jeremy Hammond in contempt to try to get him to testify in the EDVA grand jury, particularly if the government has reason to believe that Schulte was part of that hack.

Finally, the government will use Rosenzweig to explain how, in the wake of the DNC leak and at a time he was in a huff at his CIA bosses again, Schulte did … something in August 2016.

The Government intends to introduce evidence that Schulte transmitted the Classified Information to WikiLeaks in the spring of 2016, that WikiLeaks did not begin to disclose the Classified Information until March 2017, that Schulte was angry with CIA management in August 2016 over a performance review he received, that Schulte’s protective order against Employee-1 was vacated in August 2016, and that, around that same time (i.e., in August 2016), Schulte began to conduct extensive research online about WikiLeaks. The Government intends to offer evidence relating to those searches, including the specific queries Schulte conducted. Schulte has argued in his writings that his August 2016 research was related to WikiLeaks’ August 2016 disclosure of information stolen from a Democratic National Committee server (the “DNC Leak”). Mr. Rosenzweig will testify about the DNC Leak, including the type of information that WikiLeaks actually disclosed in connection with that leak, which will demonstrate why Schulte’s WikiLeaksrelated searches include queries that had nothing to do with the DNC Leak

Side note: Part of the media blitz Assange did in the wake of the DNC leaks included a claim to Chuck Todd that if WikiLeaks ever received information from US intelligence, they would publish it.

Well, it’s a meta story. If you’re asking would we accept information from U.S. intelligence that we had verified to be completely accurate, and would we publish that, and would we protect our sources in U.S. intelligence, the answer is yes, of course we would.

No one else would have, but Schulte would presumably have recognized this as a nod to him, reassurance provided on heavily watched TV that WikiLeaks was progressing towards releasing the files Schulte had leaked. Which is why the likelihood that Schulte also stole a single file reflecting CIA collecting information on who might win the 2012 French presidential election, which WikiLeaks subsequently falsely portrayed as proof that CIA had infiltrated political parties in France rather than asked well-placed sources for readily available information, is of particular interest.

The government, however, is going to point to other Google searches by Schulte from August 2016 that lump Edward Snowden and Shadow Brokers in with WikiLeaks.

For example, in addition to searching for information about WikiLeaks and Julian Assange, its primary leader, Schulte also conducted searches using the search terms “narcissist snowden,” “wikileaks code,” “wikileaks 2017,” “shadow brokers,” and “shadow broker’s auction bitcoin.” “Snowden” was presumably a reference to Edward Snowden, the former NSA contractor who disclosed information about a purported NSA surveillance program, and “Shadow Brokers” was a reference to a group of hackers who disclosed online computer code that they purportedly obtained from the NSA, beginning in or about August 2016.

I have long wondered whether Vault 7 was not a free-standing leak but instead part of the Shadow Brokers operation.  This seems to suggest the government knows they are. If that’s right, it would suggest that in the period when the government was trying to figure out precisely what Russia had done in 2016, both the NSA and CIA’s ability to spy on Russia (and other countries) would have been been deliberately burnt to the ground. And if Schulte knowingly participated in that — in an effort to ensure that the US would struggle to even learn what Russia had done in 2016 — it would explain why they’re planning on arguing he is more of a spy than a leaker.

Which would, in turn, explain why they took the first steps towards arresting Assange as FBI started putting together the evidence needed to charge Schulte on these leaks in 2017.

Let me be clear: I’m not saying I’m sure they’ll fill all these details in a superseding Assange indictment (though the government said it could not provide Assange the underlying evidence even for the 2010 charges until around Christmas — at which point Schulte will have gone through the CIPA process of declassifying classified information for use in his defense, and they could add charges at least until the February 25 hearing). It may still be that the government won’t want to get into the level of classified detail they’d need to to flesh out that case, particularly if they can’t coerce Manning and Hammond to cooperate.

I’m also not making a normative judgment that this eliminates the very real problems with the way Assange is charged now. Without seeing the government’s case, it’s too soon to tell.

What I’m trying to do is lay out what the government seems to be preparing to argue about WikiLeaks in the Schulte case. No doubt this will get me invited for another stern scolding at dinner, but it’s time to stop pretending Assange is being prosecuted for the understanding of WikiLeaks that existed in 2010. By all means, people can and will still defend Assange for taking on an imperialist America. For much of the world (though presumably not among any Five Eyes governments, including Assange’s home country), that still makes him an important dissident taking on a superpower. There is some merit to that stance, but it also requires arguing that superpowers shouldn’t have democratic elections.

But the government is preparing to argue that, after helping Russia tamper in America’s election, WikiLeaks deliberately burned some of CIA’s collection abilities to the ground, making it harder for the US to figure out how Russia did so. The government is preparing to argue that such actions are consistent with what WikiLeaks has been up to since 2010.

I’ve been expecting we might see an indictment alleging WikiLeaks and its associates were and remain engaged in an ongoing conspiracy (a possibility that, if Manning and Hammond’s lawyers haven’t warned them about, they are being utterly negligent, because the government could well argue that obstructing this investigation by refusing to provide immunized testimony is an overt act furthering the conspiracy).

The citations the government has used to justify Rosenzweig’s testimony are heavily focused on terrorism and mob cases (United States v. Farhane and United States v. Mustafa, which are al Qaeda cases; United States v. El Gammal, which is an ISIL one, and United States v. Rahimi, the self-radicalized Chelsea bomber; United States v. Lombardozzi and United States v. Locascio which are Gambino cases, United States v. Amuso, a Lucchese case), including one RICO case. That’s undoubtedly why Schulte’s lawyers really want Rosenzweig’s testimony excluded, to avoid having WikiLeaks treated like an organized crime syndicate.

But if the government is preparing to claim that WikiLeaks worked with Schulte not only to obtain files it tried to use to extort a pardon but then released them in a way that would hurt America’s efforts to respond to Russia’s 2016 operation, that’s a pretty compelling analogy.

Update: After comments from Stefania Maurizi, I’ve rephrased how I described what happened with the Syria Files. I want to be clear the statement in the post was not based on what I’ve been told by reliable sources about the process by which those files got shared with WikiLeaks.

As I disclosed last year, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post. 

The Government Prepares to Argue that Transmitting Information *To* WikiLeaks Makes the Vault 7 Leak Different

/19 Comments/in , , , /by

In a long motion in limine yesterday, the government suggested that if Joshua Schulte had just been given a “prestigious desk with a window,” he might not have leaked all of CIA’s hacking tools in retaliation and caused what the government calls “catastrophic” damage to national security.

Schulte grew angrier at what he perceived was his management’s indifference to his claim that Employee-1 had threatened him. Schulte also began to complain about what, according to him, amounted to favoritism toward Employee-1, claiming, for example, that while the investigation was ongoing, Schulte was moved to an “intern desk,” while Employee-1 had been moved to a “prestigious desk with a window.”

[snip]

The Leaks are the largest illegal disclosure of CIA information in the agency’s history and, as noted above, caused catastrophic damage to national security.

Along the way, the motion provides the most detailed description to date about how the government believes Schulte stole the Vault 7 files from CIA. It portrays him as an arrogant racist at the beginning of this process, and describes how he got increasingly belligerent with this colleagues at CIA leading up to his alleged theft of the CIA’s hacking files, leading his supervisors to recognize the threat he might pose, only to bollox up their efforts to restrict his access to CIA’s servers.

The motion, along with several other submitted yesterday, suggests that the government would like to argue that leaking to WikiLeaks heightens the damage that might be expected to the United States.

Along with laying out that it intends to argue that the CIA charges (stealing the files and leaking them to WikiLeaks) are intertwined with the MCC charges (conducting “information war” against the government from a jail cell in the Metropolitan Correction Center; I explained why the government wants to do so here), the government makes the case that cybersecurity expert Paul Rosenzweig should testify as a witness about WikiLeaks.

Rosenzweig will testify about (i) WikiLeaks’s history, technical and organizational structure, goals, and objectives; (ii) in general terms, prior leaks through WikiLeaks, in order to explain WikiLeaks’s typical practices with regard to receiving leaked classified information, its practices or lack thereof regarding the review and redaction of sensitive information contained in classified leaks, and certain well-publicized harms to the United States that have occurred as a result of disclosures by WikiLeaks; and (iii) certain public statements by WikiLeaks regarding the Classified Information at issue in this case.

Rosenzweig’s testimony would come in addition to that of classification experts (probably for both sides) and forensic experts (again, for both sides; Steve Bellovin is Schulte’s expert).

The expert witnesses were allowed to testify as to the background of the organization Wikileaks; how the U.S. Government uses certain markings and designations to identify information that requires special protection in the interests of national security; the meaning of certain computer commands and what they would do; how various computers, servers, and networks work; how data is stored and transferred by various computer programs and commands; and the examination of data that is stored on computers and other electronics.

The only motion in limine Schulte submitted yesterday objected to Rosenzweig’s testimony. Schulte argues that the government’s expert notice neither provides sufficient explanation about Rosenzweig’s intended testimony nor proves he’s an expert on WikiLeaks. More interesting is Schulte’s  argument that Rosenzweig’s testimony would be prejudicial. It insinuates that Rosenzweig’s testimony would serve to substitute for a lack of proof about how Schulte sent the CIA files to WikiLeaks (Schulte is alleged to have used Tor and Tails to transmit the files, which would leave no forensic trace).

In Mr. Schulte’s case, the government has no reliable evidence of how much information was taken from the CIA, how it was taken, or when it was provided to WikiLeaks. The government cannot overcome a lack of relevant evidence by introducing evidence from other cases about how much information was leaked or how information was leaked in unrelated contexts. The practices of WikiLeaks in other contexts and any testimony about alleged damage from other entirely unrelated leaks is completely irrelevant.

Schulte’s claimed lack of evidence regarding transfer notwithstanding, that’s not how the government says they want to use Rosenzweig’s testimony. They say they want to use his testimony to help prove that Schulte intended to injure the US.

The Government is entitled to argue that Schulte intended to harm the United States, by transmitting the stolen information to WikiLeaks, because he knew or had reason to know what WikiLeaks would do with the information. The fact that WikiLeaks’ prior conduct has harmed the United States and has been widely publicized is powerful evidence that Schulte intended or had reason to believe that “injury [to] the United States” was the likely result of his actions—particularly given that the Government will introduce evidence that demonstrates Schulte’s knowledge of earlier WikiLeaks disclosures, including his own statements.

It does so by invoking WikiLeaks’ past leaks and the damage those leaks have done.

Accordingly, proof that it was foreseeable to Schulte that disclosure of classified information to WikiLeaks could cause “injury [to] the United States” is a critical element in this case. Indeed, the Senate Select Committee on Intelligence has explicitly stated “that WikiLeaks and its senior leadership resemble a non-state hostile intelligence service.” S. Rep. 115-151 p. 10. In order to evaluate evidence related to this topic, the jury will need to understand what WikiLeaks is, how it operates, and the fact that WikiLeaks’ previous disclosures have caused injury to the United States. The Government is entitled to argue that Schulte intended to harm the United States, by transmitting the stolen information to WikiLeaks, because he knew or had reason to know what WikiLeaks would do with the information.

Notably, the government motion invokes the Senate’s recognition that WikiLeaks resembles “a non-state hostile intelligence service.” That may well backfire in spectacular fashion. That statement didn’t come until over a year after Schulte is alleged to have stolen the files. And the statement was a follow-up to Mike Pompeo’s similar claim, which was a direct response to Schulte’s leak. If I were Schulte, I’d be preparing a subpoena to call Pompeo to testify about why, after the date when Schulte allegedly stole the CIA files, on July 24, 2016, he was still hailing the purported value of WikiLeaks’ releases.

The thing is, showing that the specific nature of the intended recipient of a leak is an element of the offense has never been required in Espionage leak cases before. Indeed, the government’s proposed jury instructions are based off the instruction in the Jeffrey Sterling case. While the government flirted with naming James Risen an unindicted co-conspirator in that case, they did not make any case that leaking to Risen posed unique harm.

Moreover, even before getting into Schulte’s statements about WikiLeaks (most of which have not yet been made public, as far as I’m aware), by arguing the CIA and MCC charges together, the government will have significant evidence not just about Schulte’s understanding of WikiLeaks, but his belief and that they would lie to harm the US. The government also has evidence that Schulte knew that WikiLeaks’ pretense to minimizing harm with the Vault 7 files was false, and that instead WikiLeaks did selective harm in its releases, though it doesn’t want to introduce that evidence at trial.

In other words, this seems unnecessary, superfluous to what the government has done in past Espionage cases, and a dangerous precedent (particularly given the way the government suggested that leaking to The Intercept was especially suspect in the Terry Albury and Reality Winner cases).

That’s effectively what Schulte argues: that the government is trying to argue that leaking to WikiLeaks is particularly harmful, and that if such testimony goes in, it would be forced to call its own witnesses to testify about how past WikiLeaks releases have shown government malfeasance.

This testimony could also suggest that the mere fact that information was released by WikiLeaks necessarily means that it was intended to—and did—cause harm to the United States. These are not valid evidentiary objectives. Instead, this type of testimony would create confusion and force a trial within a trial on the morality of WikiLeaks and the extent of damage caused by prior leaks. If the government is allowed to introduce this evidence, the defense will necessarily have to respond with testimony about how WikiLeaks is a non-profit news organization, that it has previously released information from government whistle-blowers that was vital to the public understanding of government malfeasance, and that any assertion of damages in the press is not reliable evidence.

The government, in a show of reasonableness, anticipates Schulte’s argument about the prejudice this will cause by stating that it will limit its discussion of prior WikiLeaks releases to a select few.

The Government recognizes the need to avoid undue prejudice, and will therefore limit Mr. Rosenzweig’s testimony to prior WikiLeaks leaks that have a direct relationship with particular aspects of the conduct relevant to this case, for example by linking specific harms caused by WikiLeaks in the past to Schulte’s own statements of his intent to cause similar harms to the United States or conduct. Those leaks include (i) the 2010 disclosure of documents provided to WikiLeaks illegally by Chelsea Manning; (ii) the 2010 disclosure of U.S. diplomatic cables; (iii) the 2012 disclosure of files stolen from the intelligence firm Stratfor; and (iv) the 2016 disclosure of emails stolen from a server operated by the Democratic National Committee.

The selected cases are notable, as all of them (with Manning’s leaks seemingly listed twice) involve cases the government either certainly (with the EDVA grand jury seeking Manning and Jeremy Hammond’s testimony) or likely (with ongoing investigations into Roger Stone) currently has ongoing investigations into.

As a reminder: absent an unforeseen delay, this trial will start January 13, 2020 and presumably finish in the weeks leading up to the beginning of Julian Assange’s formal extradition process on February 25. The government has maintained it can add charges up until that point, and US prosecutors told British courts it won’t provide the evidence against Assange until two months before the hearing (so around Christmas).

Schulte’s trial, then, appears to be the opening act for that extradition, an opening act that will undermine the claims WikiLeaks supporters have been making about the journalistic integrity of the organization in an attempt to block Assange’s extradition. Rosenzweig’s testimony seems designed, in part, to heighten that effect.

Which may be why this instruction appears among the government’s proposed instructions.

Some of the people who may have been involved in the events leading to this trial are not on trial. This does not matter. There is no requirement that everyone involved in a crime be charged and prosecuted, or tried together, in the same proceeding.

You may not draw any inference, favorable or unfavorable, towards the Government or the defendant from the fact that certain persons, other than the defendant, were not named as defendants in the Indictment. Do not speculate as to the reasons why other persons were not named. Those matters are wholly outside your concern and have no bearing on your function as jurors.

Whether a person should be named as a co-conspirator, or indicted as a defendant in this case or another separate case, is a matter within the sole discretion of the United States Attorney and the Grand Jury.

As noted, a number of different WikiLeaks supporters have admitted to me that they’re grateful Assange has not (yet) been charged in conjunction with the Vault 7 case, because even before you get to his attempt to extort a pardon with the files, there’s little journalistic justification for what it did, and even more reason to criticize WikiLeaks’ actions as the case against Schulte proceeded.

Yet the obscure proceedings before the EDVA grand jury suggests the government may be pursuing a conspiracy case that starts in 2010 and continues through the Vault 7 releases, with the same variety of Espionage and CFAA charges continuing through that period.

By arguing the CIA and MCC charges in tandem, the government can pretty compellingly make the case that WikiLeaks’ activities went well beyond journalism in this case. But it seems to want to use Rosenzweig’s testimony to make the case more broadly.

[Some of] Where Trump Wants to Go with the Server in Ukraine Story

/127 Comments/in , , , /by

As I emphasized in this post, before Trump pushed Volodymyr Zelensky to frame Hunter Biden, he first pressed Ukraine’s president to “get to the bottom” of the “what happened with this whole situation with Ukraine.”

The President: I would like you to do us a favor though because our country has been through a lot and Ukraine knows a lot about it. I would like you to find out what happened with this whole situation with Ukraine, they say Crowdstrike … I guess you have one of your wealthy people… The server, they say Ukraine has it. There are a lot of things that went on, the whole situation. I think you are surrounding yourself with some of the same people. I would like to have the Attorney General call you or your people and I would like you to get to the bottom of it. As you saw yesterday, that whole nonsense ended with a very poor performance by a man named Robert Mueller, an incompetent performance, but they say a lot of it started with Ukraine. Whatever you can do, it’s very important that you do it if that’s possible.

Contrary to virtually all the coverage on this, there is reason to believe that Bill Barr can get information from Ukraine that will feed the disinformation about the Russian operation. Trump has obviously been told — and not just by Rudy Giuliani (as Tom Bossert believes) — to ask for this, but some of this is probably part of the disinformation that Russia built in to the operation.

Rudy Giuliani wants to frame Alexandra Chalupa

This morning, Rudy Giuliani explained that he wants to know who in Ukraine provided information damning to Trump during the 2016 campaign.

GIULIANI: I have never peddled it. Have you ever hear me talk about Crowdstrike? I’ve never peddled it. Tom Bossert doesn’t know what he’s talking about. I have never engaged in any theory that the Ukrainians did the hacking. In fact, when this was first presented to me, I pretty clearly understood the Ukrainians didn’t do the hacking, but that doesn’t mean Ukraine didn’t do anything, and this is where Bossert…

STEPHANOPOULOS: So, why does the president keep repeating it?

GIULIANI: Let’s get on to the point…

STEPHANOPOULOS: Well, this was in the phone call.

GIULIANI: I agree with Bossert on one thing, it’s clear: there’s no evidence the Ukrainians did it. I never pursued any evidence and he’s created a red herring. What the president is talking about is, however, there is a load of evidence that the Ukrainians created false information, that they were asked by the Obama White House to do it in January of 2016, information he’s never bothered to go read. There are affidavits that have been out there for five months that none of you have listened to about how there’s a Ukrainian court finding that a particular individual illegally gave the Clinton campaign information. No one wants to investigate that. Nobody cared about it. It’s a court opinion in the Ukraine. The Ukrainians came to me. I didn’t go to them. The Ukrainians came to me and said…

STEPHANOPOULOS: When did they first come to you?

GIULIANI: November of 2016, they first came to me. And they said, we have shocking evidence that the collusion that they claim happened in Russia, which didn’t happen, happened in the Ukraine, and it happened with Hillary Clinton. George Soros was behind it. George Soros’ company was funding it.

This is an effort to frame Alexandra Chalupa, who while working as a DNC consultant in 2016 raised alarms about Paul Manafort. This is an effort that Trump has pursued since 2017 in part with a story first floated to (!!) Ken Vogel, an effort that key propagandist John Solomon was pursuing in May. Remember, too, that Chalupa was hacked separately in 2016, and believed she was being followed.

Peter Smith’s operation may have asked for help from a hacker in Ukraine

But per the transcript, this is not about Rudy, it’s about Barr. And even leaving Rudy’s antics aside, there is more that Trump may be after.

First, a fairly minor point, but possibly important. According to Charles Johnson, he advised Peter Smith to reach out to Weev for help finding Hillary’s deleted emails.

Johnson said he also suggested that Smith get in touch with Andrew Auernheimer, a hacker who goes by the alias “Weev” and has collaborated with Johnson in the past. Auernheimer—who was released from federal prison in 2014 after having a conviction for fraud and hacking offenses vacated and subsequently moved to Ukraine—declined to say whether Smith contacted him, citing conditions of his employment that bar him from speaking to the press.

At the time (and still, as far as I know), Weev was living in Ukraine. The Mueller Report says that his investigators never found evidence that Smith or Barbara Ledeen (or Erik Prince or Mike Flynn, who were also key players in this effort) ever contacted Russian hackers.

Smith drafted multiple emails stating or intimating that he was in contact with Russian hackers. For example, in one such email, Smith claimed that, in August 2016, KLS Research had organized meetings with parties who had access to the deleted Clinton emails, including parties with “ties and affiliations to Russia.”286 The investigation did not identify evidence that any such meetings occurred. Associates and security experts who worked with Smith on the initiative did not believe that Smith was in contact with Russian hackers and were aware of no such connection.287 The investigation did not establish that Smith was in contact with Russian hackers or that Smith, Ledeen, or other individuals in touch with the Trump Campaign ultimately obtained the deleted Clinton emails.

Weev is a hacker, but not Russian. So if Smith had reached out to Weev — and if Weev had given him any reason for optimism in finding the emails or even the alleged emails that Ledeen obtained — it might explain why Trump would believe there was information in Ukraine that would help him.

CrowdStrike once claimed its certainty on Russian attribution related to a problematic report on Ukraine

But that’s not the CrowdStrike tie.

At least part of the CrowdStrike tie — and what Zelensky actually could feed to Trump — pertains to a report they did in December 2016. They concluded that one of the same tools that was used in the DNC hack had been covertly distributed to Ukrainian artillery units, which (CrowdStrike claimed) led to catastrophic losses in the Ukranian armed forces. When the report came out — amid the December 2016 frenzy as President Obama tried to figure out what to do with Russia given the Trump win — CrowdStrike co-founder Dmitri Alperovitch pitched it as further proof that GRU had hacked the DNC. In other words, according to CrowdStrike, their high confidence on the DNC attribution was tied to their analysis of the Ukrainian malware.

In a now deleted post, infosec researcher Jeffrey Carr raised several problems with the CrowdStrike report. He correctly noted that CrowdStrike vastly overstated the losses to the Ukranian troops, which both an outside analyst and then the Ukranian Defense Ministry corrected. CrowdStrike has since updated its report, correcting the claim about Ukrainian losses, but standing by its analysis that GRU planted this malware as a way to target Ukrainian troops.

Carr also claimed to know of two instances — one, another security company, and the other, a Ukrainian hacker — where the tool was found in the wild.

Crowdstrike, along with FireEye and other cybersecurity companies, have long propagated the claim that Fancy Bear and all of its affiliated monikers (APT28, Sednit, Sofacy, Strontium, Tsar Team, Pawn Storm, etc.) were the exclusive developers and users of X-Agent. We now know that is false.

ESET was able to obtain the complete source code for X-Agent (aka Xagent) for the Linux OS with a compilation date of July 2015. [5]

A hacker known as RUH8 aka Sean Townsend with the Ukrainian Cyber Alliance has informed me that he has also obtained the source code for X-Agent Linux. [11]

Carr argued that since CrowdStrike’s attribution of the DNC hack assumed that only GRU had access to that tool, their attribution claim could no longer be trusted. At the time I deemed Carr’s objections to be worthwhile, but not fatal for the CrowdStrike claim. It was, however, damning for CrowdStrike’s public crowing about attribution of the DNC hack.

Since that time, the denialist crowd has elaborated on theories about CrowdStrike, which BuzzFeed gets just parts of here. Something that will be very critical moving forward but which BuzzFeed did not include, is that the president of CrowdStrike, Shawn Henry, is the guy who (while he was still at FBI) ran the FBI informant who infiltrated Anonymous, Sabu. Because the FBI reportedly permitted Sabu to direct Antisec to hack other countries as a false flag, the denialist theory goes, Henry and CrowdStrike must be willing to launch false flags for their existing clients. [See update below, which makes it clear FBI did not direct this.] The reason I say this will be important going forward is that these events are likely being reexamined as we speak in the grand jury that has subpoenaed both Chelsea Manning and Jeremy Hammond.

So Trump has an incentive to damage not just CrowdStrike’s 2016 reports on GRU, but also CrowdStrike generally. In 2017, Ukraine wanted to rebut the CrowdStrike claim because it made it look bad to Ukranian citizens. But if Trump gives Zelensky reason to revisit the issue, they might up the ante, and claim that CrowdStrike’s claims did damage to Ukraine.

I also suspect Trump may have been cued to push the theory that the GRU tool in question may, indeed, have been readily available and could have been used against the DNC by someone else, perhaps trying to frame Russia.

As I’ve noted, the GRU indictment and Mueller Report list 30 other named sources of evidence implicating the GRU in the hack. That list doesn’t include Dutch hackers at AIVD, which provided information (presumably to the Intelligence Community generally, including the FBI). And it doesn’t include NSA, which Bossert suggested today attributed the hack without anything from CrowdStrike. In other words, undermining the CrowdStrike claims would do nothing to undermine the overall attribution to Russia (though it could be useful for Stone if it came out before his November 5 trial, as the four warrants tied to his false statements relied on CrowdStrike). But it would certainly feed the disinformation effort that has already focused on CrowdStrike.

That’s just part of what Trump is after.

Update: Dell Cameron, who’s one of the experts on this topic, says that public accounts significantly overstate how closely Sabu was being handled at this time. Nevertheless, the perception that FBI (and Henry) encouraged Sabu’s attacks is out there and forms a basis for the claim that CrowdStrike would engage in a false flag attack. Here’s the chatlog showing some of this activity. Hammond got to the Brazilian target by himself.

DOJ Says It Never Offered Accused Vault 7 Leaker Joshua Schulte a Plea Deal

/7 Comments/in , /by

As the Joshua Schulte prosecution has inched along against the backdrop of the Julian Assange indictment, I’ve heard chatter about his plans: that the two sides might prosecute the child porn charges and leave the leak untried; that the government was trying to get him to cooperate against Assange.

In the former case, the opposite now seems more likely. Last week, Judge Paul Crotty granted Schulte’s motion to sever his child porn and copyright charges from his Espionage ones. But the minute order states that the Espionage charges will be tried first, in November, with the child porn charges tried some time after that. That’s true, even though the Espionage charges are far more complex to try than the child porn ones. If the government wanted to use the child porn charges to put Schulte away indefinitely and avoid the difficulties of an Espionage trial, they’d try those first. (Update: at the hearing where this was decided, the defense said they wanted the Espionage trial to go first, and all other parties agreed.)

As to the latter, Schulte himself has sown the belief he was being offered a plea deal. In one version of his “Presumption of Innocence” blog, for example, he claimed (falsely, given the warrants he himself released) the government never obtained any evidence implicating him in the leak, and was just pursuing the child pornography charges to “break” him so he’ll cooperate against WikiLeaks.

I’m arrested and charged with a crime that had nothing to do with the initial search warrant and that I was completely innocent. The U.S. Attorney unethically and immorally misleads the court regarding what the initial investigation was about, when they found the illicit materials, and the fact that they did not think I was involved for 5 months until their initial investigation came up empty. I’m denied bail and thrown into prison immediately and they use the situation as leverage telling my attorney every day that he can make this huge embarrassment and misunderstanding all go away if only I would agree to cooperate on the WikiLeaks investigation and admit to it. They admit, unabashedly that these entire charges are nothing more than a ruse, an attempt at leverage to break me.

A version of this claim was repeated in a piece the Intercept did yesterday claiming to track how (a select group of) leakers got identified by the FBI.

Of the four Espionage Act cases based on alleged leaks in the Trump era, the most unusual concerned Joshua Schulte, a former CIA software developer accused of leaking CIA documents and hacking tools known as the Vault 7 disclosures to WikiLeaks. Schulte’s case is different from the others because, after the FBI confiscated his desktop computer, phone, and other devices in a March 2017 raid, the government allegedly discovered over 10,000 images depicting child sexual abuse on his computer, as well as a file and chat server he ran that included logs of him discussing child sexual abuse images and screenshots of him using racist slurs. Prosecutors initially charged Schulte with several counts related to child pornography and later with sexual assault in a separate case, based on evidence from his phone. Only in June 2018, in a superseding indictment, did the government finally charge him under the Espionage Act for leaking the hacking tools. He has pleaded not guilty to all charges.

Schulte was identified as the suspect just like all the other people profiled in the story were: because he was one of the few people who had access to the files that got leaked and his Google searches mapped out a damning pattern of research involving the leak, among other things. In his case, WikiLeaks itself did several things to add to the evidence he was the source. It is true that Schulte was charged with the porn charges first and that it took 15 months for the government to ultimately charge the leak, but the theory of Schulte’s role in the leak has remained largely unchanged since a week after the first files were dropped.

Schulte again suggested he might get a plea deal in his lawsuit against then Attorney General Jeff Sessions for imposing Special Administrative Measures against him when he raised 5K1 letters that might allow someone to avoid mandatory minimum sentencing.

But in last week’s opposition to Schulte’s motion to suppress most of the warrants against him — including some on the grounds that they relied on poisonous fruit of attorney-client privileged material — the government denies ever offering a plea deal.

Schulte claims that the FBI read his thoughts on severance (which the Government has consented to) or a plea offer (which the Government has not made), but none of those “thoughts” are referenced in any subsequent search warrant.

The claim that the government left unredacted a reference to Schulte’s views on a plea deal does not appear in the unredacted version of Schulte’s motion to suppress, but given his lawyers’ claim that his journals were intended to be a discussion of his legal remedies, it may be an attempt to suppress the Presumption of Innocence notes cited above (even though Schulte made the same notes public).

Mr. Schulte’s narrative writings and diary entries contain information he “considered to be relevant to his potential legal remedies.”

There’s lot of room for a discussion short of a plea offer that might be true even given the government claim that “the Government has not made” any offer (such as that one of the series of attorneys who have represented Schulte has recommended that he seek a deal).

But the detail is particularly interesting given the timing of his trial and something the government claimed the last time Chelsea Manning and her lawyers tried to get her out of jail. It insisted they want Manning’s testimony for subjects and charges not included in Assange’s current indictment, and said the submission of the extradition request against Assange does not preclude future charges based on those offenses.

As the government’s ex parte submissions reflect, Manning’s testimony remains relevant and essential to an ongoing investigation into charges or targets that are not included in the superseding indictment. See Gov’t’s Ex Parte Mem. (May 23, 2019). The offenses that remain under investigation are not time barred, see id., and the submission of the government’s extradition request in the Assange case does not preclude future charges based on those offenses, see Gov’t’s Supplement to Ex Parte Mem. (June 14, 2019).

Barring a delay because of Classified Intelligence Protect Act proceedings, Schulte will face trial on the Espionage charges in November, three months before the next hearing in Assange’s extradition. And while there’s no hint in Schulte’s case that WikiLeaks played a role in the front end of Schulte’s alleged leak, there’s abundant evidence that they continued to cooperate with him in the aftermath and even in the initial release itself. Indeed, that’s some of the most damning evidence against Schulte.

Schulte seems to think he could cooperate against Assange and face lesser charges. If the government told the truth last week, he may have little prospect to diminish what would amount to a life sentence if he’s found guilty.

Detaining Chelsea Manning: Other People, Times, and Patterns

/9 Comments/in , /by

Friday, the government responded to Chelsea Manning’s request to be freed in light of Julian Assange’s superseding indictment, in which she argued the grand jury couldn’t use any of her testimony to shore up the existing indictment against Assange.

The government has now indicted Mr. Assange on 18 very serious counts, without the benefit of or apparent need for Ms. Manning’s testimony. The government’s extradition packet must be submitted in finalized form very soon. Any investigation of him after that point will be nugatory. United States v. Moss, 756 F.2d 329, 331-32 (4th Cir. 1985), see also United States v. Kirschner, 823 F. Supp. 2d 665, 667 (E.D. Mich. 2010)(finding that posti-ndictment questioning about the same conduct but different charges than those in the indictment was permissible, but questioning leading only to further information about the same charges would be impermissible). Any further investigation of unindicted targets will likewise be futile, as charges would be time-barred, and in any case, it is perfectly understood that Ms. Manning has no useful information about any parties other than the person behind the online handle “pressassociation.” She is not possessed of any that is not equally available to them, and in any case, her absence has posed no obstacle to indictment and superseding indictment.

The government response suggests this assertion — that there are no charges that they need Manning’s testimony for — is incorrect.

As the government’s ex parte submissions reflect, Manning’s testimony remains relevant and essential to an ongoing investigation into charges or targets that are not included in the superseding indictment. See Gov’t’s Ex Parte Mem. (May 23, 2019). The offenses that remain under investigation are not time barred, see id., and the submission of the government’s extradition request in the Assange case does not preclude future charges based on those offenses, see Gov’t’s Supplement to Ex Parte Mem. (June 14, 2019). Manning’s speculations about the direction of the grand-jury investigation, the purpose of her testimony, and the need for it are insufficient to show otherwise. [My emphasis]

The formulation here is curious, for the reasons laid out below.

Not time barred: Assange was first indicted on March 6, 2018, two days short of the 8-year anniversary of the alleged attempt to crack a password that was the basis for the conspiracy to violate CFAA charge. That suggests they were relying on the claim that the international character of the alleged CFAA charge extended the SOL to eight years, though they could also claim the conspiracy was ongoing if both Manning and Assange were believed to continue to engage in a conspiracy (though given that the conspiracy was defined as hacking, it would seem to be limited to the time until Manning’s arrest on May 27, 2010). I think — but am not sure — that if further charges are not time-barred, the government is either relying on a continued conspiracy, perhaps based off the conspiracy to receive national defense information in the superseding indictment, which because it was charged under espionage has a ten year statute of limitations, or arguing that the conspiracy to violate CFAA extended to other people.

Possibility of additional charges “based on those offenses”: To continue to coerce Manning for charges pertaining to Assange, the government has to argue (and claims it has, in two ex parte filings) that it is seeking additional charges. If I understand how the UK’s extradition process works, unless it gets a waiver, the US government can’t add additional crimes against Assange on top of what it already charged in the extradition packet, but some people say it’s possible to add on instances of the same charges until such time as he’s extradited. That may mean it wants to lard on espionage charges.

Targets not included in the superseding indictment: Manning claims she only has information about “pressassociation” — that is, Assange. But the government may believe there are other people involved in this. It would be unsurprising if the government were homing on other key WikiLeaks figures (I’ve had people wonder whether the government would go after Jake Appelbaum, for example, and there’s another figure people have been chatting about). Recall, too, that the government interviewed David House during this process, extending the time frame and the actions to publicity to supporting Manning that would extend into the period when she was jailed and prosecuted.

Charges not included in the superseding indictment: If there are other people the government is targeting for crimes the statutes of limitation for which haven’t expired (or as part of the conspiracy including Assange and Manning in any kind of continuation), then the government could just charge them.

All that said, there’s something funny with the timing. Manning’s request suggested that Assange was charged sometime between May 14 and 16 — which would put it after she got the subpoena from the new grand jury but before a court hearing on May 16.

Some time between May 14 and May 16, 2019, Julian Assange was charged in a superseding indictment with 17 Counts relating to offenses under the Espionage Act. This indictment was also obtained without the benefit of or apparent need for Ms. Manning’s testimony.

The government corrected that in their response.

Manning claims that Assange was charged in the superseding indictment at some point “between May 14 and May 16, 2019.” Mot. to Reconsider Sanctions 2. That representation is inaccurate. The face of the indictment reflects that it was returned in open court on May 23, 2019, and the signature page bears the same date. See Superseding Indictment, United States v. Julian Paul Assange, No. 1:18-cr-111-CMH (E.D. Va. May 23, 2019) (Dkt. No. 31) (Exhibit B).

Meanwhile — perhaps to show that it had briefed Judge Anthony Trenga about the ongoing investigation before he approved the current contempt finding — the government also unsealed a bench memo submitted back on May 15. That memo also argued they still needed Manning’s testimony — but it was based on the 1-count indictment against Assange.

This indictment against Assange does not affect Manning’s obligation to appear and testify before the grand jury. Under the law, the government cannot use grand jury proceedings for the ‘sole or dominant purpose’ of preparing for trial on an already pending indictment.” United States v. Alvarado,840 F.3d I E4, lE9 (4th Cn. 2016) (quoting United States v. Moss,756 F.2d329,332 (4th Cir. l9E5)). Yet it is equally well settled that, even after returning an indictment, the grand jury may continue investigating new charges or targets that are related to the pending indictment, See id at I89-90; United States v. Bros. Co$t/. Co. of Ohio,2l9 F.3d 300, 314 (4th Cir. 20OO); Moss,7 56 F .2d at 332. At the same time it files this memorandum, the government is filing an ex parte pleading that describes the nature of the grand jury’s ongoing investigation in this matter. See Gov’t’s Ex Parte Submission Regarding Nature of Grand-Jury Investigation (May 14, 2019). As that filing reflects, Manning has testimony that is directly relevant and important to an ongoing investigation into charges or targets that arc not included in the pending indictment. See id. Thus, the recently unsealed indictment against Assange does not provide Manning with just cause for refusing to comply with the Court’s order to testify in front of the grand jury.

That said, they’ve updated that argument in sealed form. As bolded above, though, the government has briefed the court three times on why it still needs Manning’s testimony:

  • May 14, 2019 (not noted in the docket, but possibly docket 3)
  • May 23, 2019 (docket #10)
  • June 14, 2019 (docket #22)

On the day of Assange’s superseding indictment, the government explained to Judge Trenga that the “charges or targets” they were still investigating were “not included in the superseding indictment” and also said they weren’t time-barred. On the day of Friday’s extradition hearing, the government told Trenga that “the government’s extradition request in the Assange case does not preclude future charges based on those offenses.”

All of which might conflict with the public reports that the government will not charge Assange with any further charges. Or it might mean that there are other people that the government wants to weave into these conspiracy charges.

One final point. In the May 15 bench memo, the government discounts Manning’s objections to grand juries (appealing to how they’re supposed to work rather than how they do), and then insinuates she’s refusing to testify out of self-interest.

In addition to their description of what happened when she went before the grand jury, their description of what they deem her self-interested motive not to testify is the only other part of the narrative that remains redacted.

Which is to say the government has some notion of Manning’s motives that — aside from being placed amid a discussion that demonstrably fails to understand her claims about grand juries — they imagine she’s doing all this to benefit herself. That may be true. It may be, for example, that testifying about what she now understands to have happened nine years ago would change the public understanding of what she did. But the government is not willing to share what that is.

On Joshua Schulte and Julian Assange’s 10 Year Old Charges

/19 Comments/in , /by

The WaPo has confirmed what Natasha Bertrand earlier reported: the extradition package for Julian Assange will only include the 10 year old charges related to the publication of Chelsea Manning’s leaks, not any of WikiLeaks more controversially handled charges. I’ve been meaning to write a post on how this is the stupidest available approach, which will satisfy neither those who regard him as a villain, will expose other journalists to similarly dangerous charges, and possibly even fuck up the security establishment’s entire effort to exact some revenge against Assange. I hope to return to that when I get some deadlines and travel done, but suffice it to say this is a big hot mess.

To be clear, I actually think it’s not eleven-dimensional chess on the part of Bill Barr to save Trump some embarrassment once Roger Stone’s trial reveals the extent to which Trump’s campaign tried to “collude” with WikiLeaks (though it will not only have that effect, but make it harder for DNC to sustain its lawsuit against the GOP and WikiLeaks for their actions in the 2016 election). Rather, I think this is an attempt to prosecute Assange with the least cost on the security establishment, being run by people who are utterly tone deaf to the costs it will incur elsewhere.

But I do want to say several things about why and how DOJ is not charging Assange in the Vault 7 leak.

Bertrand noted that I thought that the EDVA charges would be related to Vault 7.

Still, just several months ago, numerous experts felt confident that prosecutors would also hit Assange with charges over Vault 7. Prominent national security journalist Marcy Wheeler predicted in Februarythat DOJ would “very clearly go after Assange” for the Vault 7 disclosure, and that a sealed indictment against him in the Eastern District of Virginia was likely related to that leak — the CIA is, after all, headquartered in Virginia, as ABC noted. Assange himselfreportedly expressed concern that prosecutors would charge him with crimes related to Vault 7.

She didn’t provide even the full context of my tweet, much less my post, arguing that Assange’s efforts to extort a pardon using the Vault 7 files would be something obviously unconnected to journalism. The superseding indictment does mention Assange’s use of “insurance files” to ensure his ability to publish documents in his possession, but no charges were attached to that, which later uses of the tactic and the Vault 7 pardon effort would have supported.

Which is to say the government could have charged Assange for something specifically excluded from Bartnicki’s protection of the publication of stolen materials, but did not. Again, the government has chosen to go about this in the stupidest way possible.

That said, I’m not surprised they’re not going after Assange for the Vault 7 leak itself.

As it is, the CIA has been inexcusably uncooperative with Joshua Schulte’s discovery efforts. At times. some pretty aggressive prosecutors have seemed almost apologetic about it. Schulte has staked a lot on trying to expose details of his initial warrants, and while his later behavior seems to suggest there was something to their targeting of him (or, at the very least, his post-indictment behavior has been self-destructive), at the very least the CIA may have participated in some epically bad parallel construction. They may be trying to hide that as much as the actual details of CIA’s hacking program.

Meanwhile, the government and Schulte have been discussing severing his charges from last year — which include one charge of contempt and a charge of attempted leak of classified information — from everything else.

As the Court is aware, trial in this matter is currently set for April 8, 2019. (See Minute Entry for August 8, 2018 Conference). To afford the parties sufficient time to prepare the necessary pretrial motions, including suppression motions and motions pursuant to the Classified Information Procedures Act (“CIPA”), the parties respectfully request that the Court adjourn the trial until November 4, 2019. The parties are also discussing a potential agreement concerning severance, as well as the order of the potentially severed trials. The parties will update the Court on severance and a pretrial motion schedule at or before the conference scheduled for April 10, 2019.

That might be something they tried to base a plea off of: they’d have video evidence to back their case, so it might avoid the CIPA process CIA is unwilling to engage in.

Back in May, Schulte’s team submitted a motion to vacate his SAMs (Special Administrative Measures limit a prisoner’s communication with others). It was based off the case the government made prior to his superseding indictment and left out all the allegations the government made about the 13 email and social media accounts Schulte was allegedly running from his jail cell, and as such deliberately understated why the government wanted the SAMs. The government asked for and got an extension to respond until Monday — notably, after all decisions about Assange would have had to have been made. Any response (unless it’s sealed) will have to provide more details about what happened last fall, so if they’re trying to get a plea deal, it might come this week in lieu of that SAMs response.

But the question would be what that plea agreement would look like.

Finally, the government is going to have to provide some explanation for why Chelsea Manning remains in jail for contempt. Unless they can claim they’re going after other people related to WikiLeaks, they should not be able to keep her jailed.