Posts

The Document Found with Roger Stone’s Clemency Did Pertain to Emmanuel Macron

Just days before the snap election Emmanuel Macron recklessly called after Marine Le Pen shellacked his party in the EU elections, we are one step closer to showing a tie between the still unexplained grant of executive clemency to Roger Stone found in the search of Mar-a-Lago and the French President.

As I have described in the past, the first thing listed on the non-privileged search warrant return was an executive grant of clemency for Trump’s rat-fucker. Most people have always assumed that it was one of the known grants of clemency — either the commutation or the later pardon — for Stone’s lying to cover up his 2016 ties to Russia.

Except as listed, it is associated with, “Info re: President of France.”

There had been reports that the President of France in question was Macron. Trump’s defense attorneys seem to have confirmed that.

That confirmation comes as part of a Trump bid to dismiss the entire stolen documents prosecution because the FBI jumbled the order in which documents were found during and after the search. Both before and after the problem with the order of the documents first became understood, in March and then May, Jack Smith’s office did some interviews with the Miami-based agents who did the filter process, which Trump included as exhibits.

As described, the agents exercised varying diligence about maintaining the order of documents in each box; as Agent 5 explained, keeping the order intact was made more difficult because of the contents of the boxes, in which Post-It notes and golf balls were stashed in the same boxes with potentially privileged documents (I can’t make out the first word in this series).

As Agent 17 described, he and Agent 5 did the filter search of Trump’s own desk together as another agent found the box in the closet where the most sensitive classified documents were found (note: it’s clear agents were also being asked about the 43 classified cover sheets allegedly found in that box; Trump’s silence on this point suggests others gave clear answers about it).

As Agent 17 described it, Agent 5 found “Macron doc in desk,” though makes no mention of the clemency associated with it.

Note there was a set of “KJU letters” — the love letters from Kim Jon Un to Trump — in a desk then occupied by Molly Michael, identified as Person 34 in other releases. Trump had returned at least some of these in the January 2022 boxes.

It’s not yet clear how the Macron document, classified Secret, relates to the Stone clemency. But as I wrote here, such a tie could be quite significant: when Scott Brady (the MAGAt US Attorney whose claims to have vetted the Alexander Smirnov hoax were just referred to DOJ for potential prosecution as a false claim to Congress) indicted GRU hackers for operations that included the 2017 MacronLeaks that attempted to help Le Pen in her election against Macron, the indictment claimed to be ignorant of the public details tying Roger Stone associates to the dissemination of the stolen documents.

The Macron document does not appear to be among those charged, so we may never learn more about why Trump had a Stone grant of clemency — and possibly a bunch of other pardons — in his desk drawer.

Note, in addition to exhibits documenting the Mar-a-Lago search, Trump’s lawyers helpfully provided this description of the documents found among the boxes Trump returned in January 2022, two of which required especially sensitive treatment.

No One Puts Roger Stone in a Box

As I noted in my first post on Wednesday’s DOJ response to Trump’s bid to get a Special Master, the filing provides more details about what the FBI found where.

I’ve updated my nifty graphic accordingly.

As a reminder, this graphic attempts to show with horizontal boxes where things were seized, and with vertical boxes, to show where they were cataloged. The original search inventory was catalogued on two different receipts: one — which I refer to as the CLASS receipt — on which all boxes described to contain documents marked as classified were listed, and another — which I refer to as the SSA receipt because the Supervisory Special Agent signed it — which Fox News subsequently reported was where all the potentially privileged materials were catalogued. Once emptywheel gets a graphics department, I’ll update this to reflect 22 boxes were found in the storage room.

While we can’t be entirely certain, it appears that further sorting of the items on the SSA receipt of potentially privileged items has identified two more boxes and 3 additional documents marked as classified.

Another thing I think we can say is that the FBI found Roger Stone in Trump’s desk drawer, not some dusty box stored in a converted bomb shelter.

According to the filing, FBI seized classified materials from just two rooms: Trump’s office and a storage closet.

[C]lassified documents were found in both the Storage Room and in the former President’s office.

The filing also makes clear that the TS/SCI documents in the picture included as an appendix came from a container seized from Trump’s office.

See, e.g., Attachment F (redacted FBI photograph of certain documents and classified cover sheets recovered from a container in the “45 office”).

That helps us sort out the locations of the items seized in the search. The label “2A” in the picture confirms the container in question is item 2 on the inventory, the leatherbound box, which is further confirmed because that box was the only one in the entire inventory described to enclose TS/SCI documents. So that also makes clear (as I suspected) that the leatherbound box was seized in Trump’s office.

In part based on known FBI search processes and the role of proximity in this search protocol, we can surmise that the other items lacking an A-prefix were also seized in Trump’s office (items 1 through 7 here, plus item 4, described only as “documents,” on the SSA receipt that we know lists the items originally identified as potentially including privileged material). It’s hypothetically possible that some of those items were seized in Trump’s residence, but in part because the filter team only searched Trump’s office and in part because there’s not a second series of numbers from a room identified as “B,” I think it more likely this stuff was in Trump’s office.

Given that the only other location from which classified documents were seized was the storage room, it suggests all the A-prefix boxes were seized there. Again, that makes sense given what we know of FBI processes: they label a room with a letter, then label the items in that room by letter and number. There were at least 73 boxes or other items searched in that storage room.

So the first page of what I call the CLASS receipt, the items outlined in red would have been found in Trump’s office, and the items outlined in purple would have been found in the storage room. Everything else on the CLASS receipt, too, would have been seized from the storage room.

And the SSA receipt included some number of documents seized from Trump’s office that filter agents wanted to review some more, as well as five boxes that, for some reason, investigative agents stopped searching and brought to the filter team to handle.

If all that’s right, it means that DOJ seized 26 (out of at least 73) boxes from the storage room, and seven items total (one of which was described as “documents,” plural, on the SSA privileged receipt) from Trump’s office, for a total of 33.

I’ll come back to that number, 33.

From that inventory, according to DOJ’s filing, 13 boxes include documents marked as classified, and all told, the FBI collected over 100 documents marked classified on August 8.

Of the Seized Evidence, thirteen boxes or containers contained documents with classification markings, and in all, over one hundred unique documents with classification markings—that is, more than twice the amount produced on June 3, 2022, in response to the grand jury subpoena—were seized.

Those over 100 break down this way, by location:

  • 76 documents found in boxes in the storage room
  • 3 documents (individually) found in desk drawer(s) in Trump’s office
  • At least 22 documents in the leatherbound box (I count around 23 from the picture)

It’s the number of total boxes with documents marked as classified, 13, that can’t be reliably broken down.

That’s because DOJ’s filing describes two more boxes that contain documents marked as classified, 13, than are reflected on the receipts, which show 11. They’ve found two more since August 8. The extra two boxes may come from one of two places: either boxes on the CLASS receipt that were not previously identified to include documents marked as classified but in which one or two classified documents were discovered on closer inspection, or boxes among the five originally on the SSA receipt that, after further filter review, were subsequently discovered to have classified documents.

It doesn’t really matter in the grand scheme of things — two boxes post-privilege review or two boxes in which there’s a stray classified document shorn of its cover sheet.

But it may reflect further processing of materials on the SSA receipt.

The government’s language on this is a bit confusing. In one place, the government seems to suggest the case agents have not reviewed anything in the containers originally designated to include potentially privileged documents (though this may simply mean the investigative team has finished its scrutiny of all boxes known not to contain privileged documents, without commenting on the rest).

The investigative team has reviewed all the materials in the containers that the privilege review team did not segregate as potentially attorney-client privileged.

In another place the government filing seems to suggest that since seizing the documents, a subsequent privilege review may have freed up materials — like some of the contents of those five boxes and documents, plural, from Trump’s office — for subsequent review or, in the case of Trump’s passports, return to the subject of the investigation.

[T]he government’s filter team has already completed its work of segregating any seized materials that are potentially subject to attorney-client privilege, and the government’s investigative team has already reviewed all of the remaining materials, including any that are potentially subject to claims of executive privilege.

In a third place, the government’s filing seems to suggest that DOJ has freed up everything not identified as potentially privileged, resulting in a much smaller possible universe of potentially privileged documents than the original five boxes plus “documents” laid out on the SSA receipt.

The privilege review team has completed its review of the materials in its custody and control that were identified as potentially privileged. The privilege review team identified only a limited subset of potentially attorney-client privileged documents.

I don’t so much care about the uncertainty except insofar as the small number might thwart Trump’s efforts to stall things with a Special Master review.

But several other things suggest that after pulling six items (five boxes from the storage room and “documents” from Trump’s office) for closer review on August 8, it has since freed up things that are clearly not privileged, and along the way identified some number of documents marked as classified.

One reason that almost has to be the case is that DOJ has segregated all classified documents because it has to do so to keep them secure (which will also help prove any eventual charges against Trump).

All of the classified documents seized in the August 8 search have been segregated from the rest of the seized documents and are being separately maintained and stored in accordance with appropriate procedures for handling and storing classified information.

This seems to suggest that even for the potentially privileged documents, the filter team has at least identified if they’re classified, so they can be stored someplace more secure than a hotel safe.

Another reason that seems, necessarily, to be true is that DOJ talks about documents marked as classified. While the FBI seized three individual documents from what appears to be Trump’s desk drawer — the Roger Stone clemency, a potential Presidential Record, and a handwritten note — none of those were described as classified, which would be easy to note. They might be classified, but they are not marked as such.

Which is to say that the two boxes not identified on the CLASS receipt that, per DOJ’s filing had classified documents, may be two that also contain potentially privileged documents. And the three documents from the desk drawer that are marked as classified were among those the filter team thought might be privileged. And in fact, Trump seems to know there are potentially privileged documents that are also classified. About the only thing Trump’s lawyers agree with DOJ about, regarding a hypothetical Special Master, is that that person should have TS/SCI clearance. (Which seems to be a confession that Trump broke the law, but Trump and his lawyers are doing that a lot of late.)

That also seems to be the only way to explain the treatment of items from Trump’s office: the filter team identified things that clearly weren’t privileged — such as the leatherbound box and all its contents and two binders of photos — then seized the rest as a category, documents, that they they have since done a more attentive privilege review on.

Three classified documents that were not located in boxes, but rather were located in the desks in the “45 Office,” were also seized. Per the search warrant protocols discussed above, the seized documents included documents that were collectively stored or found together with documents with classification markings.6

6 Plaintiff repeatedly claims that his passports were outside the scope of the warrant and improperly seized, and that the government, in returning them, has admitted as much. See D.E. 1 at 2 & n.2; D.E. 28 at 3, 8, 9. These claims are incorrect. Consistent with Attachment B to the search warrant, the government seized the contents of a desk drawer that contained classified documents and governmental records commingled with other documents. The other documents included two official passports, one of which was expired, and one personal passport, which was expired. The location of the passports is relevant evidence in an investigation of unauthorized retention and mishandling of national defense information; nonetheless, the government decided to return those passports in its discretion.

That’s how it was possible to seize three passports but not have them show up on the original receipt. They were included along with those documents, plural, on the SSA receipt. But then further review made it clear that Trump’s visa stamps are not classified, and Jay Bratt returned them to Evan Corcoran.

In my nifty graphic above, I’ve put the passports where they belong, in a desk drawer in Trump’s office.

Now let’s return to DOJ’s affirmation that the total number of items seized were 33.

Remember when I wrote an entire post, based on the FBI’s Borgesian counting methods, arguing that others were making a big mistake by assuming there was one item, Roger Stone clemency for things we know about — his lying to cover up how he coordinated with Russia in 2016 — listed as item 1, and another separate item, information about a French President, listed as item 1A?

Well, the people who filed Wednesday’s filing — who presumably have DOJ’s detailed inventory in hand — tell us that the number of items seized equals 33.

During the August 8 Execution of the Search Warrant at the Premises, the Government Seized Thirty-Three Boxes, Containers, or Items of Evidence, Which Contained over a Hundred Classified Records, Including Information Classified at the Highest Levels

Pursuant to the above-described search protocols, the government seized thirty-three items of evidence, mostly boxes (hereinafter, the “Seized Evidence”), falling within the scope of Attachment B to the search warrant because they contained documents with classification markings or what otherwise appeared to be government records.

That’s precisely the number recorded on the inventory. 33.

The only way the people in possession of that more detailed inventory would assert, still, that there were 33 items on the original inventory is if item 1, Executive Grant of Clemency for Roger Jason Stone, Jr., and item 1A, info re: President of France, are the same object.

If there are 33 items, Trump granted clemency to Stone for something to do with a French President.

Let me repeat that: If the people who wrote this filing, who unlike you and I are privy to the detailed inventory of what was taken, say there were 33 items taken, then the Stone clemency itemized as item 1 in the inventory we do have contains — within it — information about a French President.

This is a pardon or some other kind of clemency that, rather than giving it to DOJ for publication, Trump stuck in a desk drawer. Not a box in a storage room. Trump had a pardon (or some other clemency) for his rat-fucker about an unknown subject relating to a French President, stashed in his desk drawer, apparently right next to his passports and three documents marked as classified that may be privileged.

And that’s one of the reasons I found DOJ’s generous offer to unseal the more detailed receipt, in the guise of sharing it with Trump, to be rather delicious.

1 Plaintiff also sought a more detailed receipt for the property seized during the August 8, 2022 execution of the search warrant. D.E. 1 at 19-21; see generally D.E. 28. The Court ordered the government to file under seal “[a] more detailed Receipt for Property specifying all property seized pursuant to the search warrant.” D.E. 29 at 2. The government filed today under seal, in accordance with the Court’s order, the more detailed receipt. Although the receipt of property already provided to Plaintiff at the time of the search, see In Re Sealed Search Warrant, No. 22-MJ-8332 (S.D. Fla.) (hereinafter, “MJ Docket”), D.E. 17 at 5-7, is sufficient under Fed. R. Crim. P. 41, the government is prepared, given the extraordinary circumstances, to unseal the more detailed receipt and provide it immediately to Plaintiff. [my emphasis]

Be careful of what you wish for, Donny, especially with the press coalition already asking Judge Cannon to unseal these sealed materials.

If Trump pardoned Roger Stone for something to do with — say — a hack-and-leak campaign, conducted in coordination with the GRU, targeting Emmanuel Macron, but then stuck the pardon in his desk drawer rather than sending it to DOJ to be published along with all his other utterly corrupt pardons, it’s not something he wants to be public. My guess is the potential Presidential Record and the handwritten note, also apparently found in his desk drawer, are similarly things Trump wouldn’t like to be public. Likewise the three classified, potentially privileged documents found in the same desk drawer, which he agrees would require a TS/SCI clearance to review.

Trump stuck his rat-fucker in his desk drawer. And now his efforts to gum up this investigation may make that public.

Update: Judge Cannon has thwarted live coverage of the hearing on this today. But NBC reported that she will not order the release of the more detailed inventory, which may suggest she recognizes it doesn’t help Trump.

A Roger Stone Pardon for MacronLeaks Isn’t As Crazy as It Sounds

In April 2020, DOJ released the warrants from the Roger Stone investigation. With six of those, DOJ redacted broad swaths of the justifications behind the warrants, none of which were shared with him as part of his obstruction prosecution.

September 26, 2018: Mystery Twitter Account

September 27, 2018: Mystery Facebook and Instagram Accounts

September 27, 2018: Mystery Microsoft include Skype

September 27, 2018: Mystery Google

September 27, 2018: Mystery Twitter Accounts 2

October 5, 2018: Mystery Multiple Googles

All six were obtained by Patrick Myers, an FBI agent located in Pittsburgh, whereas almost all the warrants obtained before that were signed by agents located in DC (in earlier weeks, Myers had also obtained a warrant targeting a second account used by the GRU persona, Guccifer 2.0).

In his order releasing the warrants, Judge Christopher Cooper explained that all the redacted information (and so the information justifying these warrants) was redacted to protect, “the private information of non-parties, financial information, and non-public information concerning other pending criminal investigations.”

One of those warrants explicitly said that the government requested a gag on the provider involved (in that case, Twitter) because Roger Stone seemed not to understand the full extent of the investigation into him.

It does not appear that Stone is currently aware of the full nature and scope of the ongoing FBI investigation. Disclosure of this warrant to Stone could lead him to destroy evidence or notify others who may delete information relevant to the investigation.

In addition to the crimes for which Mueller declined to charge Stone (foreign donations) or of which he was convicted (witness tampering and obstructing an investigation), the warrant sought evidence of conspiracy (18 USC 371), two foreign agent laws (18 USC 951 and 22 USC 611), and computer hacking (18 USC 1030).

These warrants strongly suggest that in April 2020, as Bill Barr was making unprecedented efforts to limit Stone’s punishment for the crimes of which he had been convicted, DOJ continued to investigate whether Stone conspired with foreign entities — and given that a Guccifer 2.0 warrant is among this series, Russia would be that foreign entity — to engage in computer hacking.

That’s important background to the seizure from Trump’s office of document reflecting Executive Clemency for Stone that appears to have a link to a French President, possibly Emmanuel Macron.

If Stone were involved with the MacronLeaks operation on which the GRU teamed up with alt-Right figures in Stone’s orbit, it’s conceivable Trump secretly pardoned him to prevent him from being included in the indictment covering that operation.

Based on the FOIA exemptions in various versions of the Mueller Report released, the Stone investigation that continued after Mueller closed up shop appears to have been closed between September 18, 2020 and November 2, 2020. On the latter date — literally the day before the 2020 election — DOJ provided Jason Leopold a version of the Mueller Report with newly-unsealed passages. It revealed for the first time that, on page 178, a footnote modified the discussion in the body of the Report about whether Stone could be prosecuted for conspiring with Russia on computer hacking by explaining that Mueller had referred the issue to DC US Attorney’s Office for further investigation.

The Office determined that it could not pursue a Section 1030 conspiracy charge against Stone for some of the same legal reasons. The most fundamental hurdles, though, are factual ones.1279

1279 Some of the factual uncertainties are the subject of ongoing investigations that have been referred by this Office to the D.C. U.S. Attorney’s Office.

A version of the report released to Leopold on June 3, 2019 redacted that footnote because of an ongoing investigation. And a spreadsheet justifying all continued redactions released on September 18, 2020 seems to have redacted it too. The unredacted publication of it on November 2, 2020 suggests whatever investigation in Stone DOJ had been pursuing had been closed.

Stone’s wasn’t the only investigation that got shut down in the months before Donald Trump would lose the presidency. In that period, previously redacted references to investigations into two of Paul Manafort’s businesses, and an investigation into a suspected $10 million cash infusion during the 2016 election from an Egyptian state-owned bank were unsealed — though both were unsealed by the time of that September filing. There was even reference to a warrant for Erik Prince’s phone, suggesting any investigation into him had similarly been shut down.

What made Stone’s case different, however, is that DOJ never told us what the investigation was about (indeed, two referrals that likely pertain to Stone were redacted in that November 2020 release, which they shouldn’t have been if the cases were really closed).

The most important referral from the Mueller investigation, then — the one that Billy Barr was hired to make go away — simply got deep-sixed sometime in the months when it looked like Trump would lose the election, with no explanation as to what the investigation even was. And, again, it appears to have happened between September 18 and November 2, 2020.

As it happens, DOJ rolled out an indictment against GRU on October 19, just 15 days before the election (and just 14 days before DOJ released the language pertaining to Stone). It covered six GRU attacks, though focused especially on the 2018 Olympic Destroyer attack on the Pyeongchang Olympics.

But it included, almost as a throwaway, GRU’s role in the 2017 MacronLeaks campaign. By description, it held just one of the charged individuals accountable for the spearphishing part of the MacronLeaks campaign: Anatoliy Kovalev, the one guy (as noted) also charged in the DNC hack.

Defendant ANATOLIY SERGEYEVICH KOVALEV was a Russian military intelligence officer assigned to Military Unit 74455. KOVALEV sent spearphishing emails targeting a wide variety of entities and individuals, including those associated with French local government entities, political parties, and campaigns; the 2018 Winter Olympics; the DSTL; and a Georgian media entity. KOVALEV also engaged in spearphishing campaigns for apparent personal profit, including campaigns targeting large Russian real estate companies, auto dealers, and cryptocurrency miners, as well as cryptocurrency exchanges located outside of Russia. KOVALEV is a charged defendant in federal indictment number 18-CR-215 in the District of Columbia. [my emphasis]

In the Mueller indictment of the GRU, Kovalev is described as the guy responsible for the hacking that targeted voting infrastructure — the kind of stuff that really could have affected the outcome, especially in North Carolina.

72. In or around July 2016, KOVALEV and his co-conspirators hacked the website of a state board of elections (“SBOE 1”) and stole information related to approximately 500,000 voters, including names, addresses, partial social security numbers, dates of birth, and driver’s license numbers.

[snip]

75. In or around October 2016, KOVALEV and his co-conspirators further targeted state and county offices responsible for administering the 2016 U.S. elections. For example, on or about October 28, 2016, KOVALEV and his co-conspirators visited the websites of certain counties in Georgia, Iowa, and Florida to identify vulnerabilities.

76. In or around November 2016 and prior to the 2016 U.S. presidential election, KOVALEV and his co-conspirators used an email account designed to look like a Vendor 1 email address to send over 100 spearphishing emails to organizations and personnel involved in administering elections in numerous Florida counties. The spearphishing emails contained malware that the Conspirators embedded into Word documents bearing Vendor 1’s logo.

The Olympic Destroyer indictment obtained weeks before the election held Kovalev (and the GRU) accountable for the spearphish and communications with some French participants.

27. From on or about April 3, 2017, through on or about May 3, 2017 (during the days leading up to the May 7, 201 7, presidential election in France), the Conspirators conducted seven spearphishing campaigns targeting more than 100 individuals who were members of now-President Macron’s “La Republique En Marche!” (“En Marche!”) political party, other French politicians and high-profile individuals, and several email addresses associated with local French governments. The topics of these campaigns included public security announcements regarding terrorist attacks, email account lockouts, software updates for voting machines, journalist scoops on political scandals, En Marche! press relationships, and En Marchel internal cybersecurity recommendations.

28. KOVALEV participated in some of these campaigns. For example, on or about April 21, 2017, KOVALEV developed and tested a technique for sending spearphishing emails themed around file sharing through Google Docs. KOVALEV then crafted a malware-laced document entitled “Qui_peut_parler_ aux journalists.docx” (which translates to “Who can talk to journalists”) that purported to list nine En Marche! staff members who could talk to journalists about the previous day’s terrorist attack on the Champs-Elysees in Paris. Later that day, the Conspirators used an email account that mimicked the name of then-candidate Macron’s press secretary to send a Google Docs-themed spearphishing email to approximately 30 En Marche! staff members or advisors, which purported to share this document.

29. From on or about April 12, 2017, until on or about April 26, 2017, a GRU-controlled social media account communicated with various French individuals offering to provide them with internal documents from En Marche! that the user(s) of the account claimed to possess.

But it professed utter and complete ignorance about how the stolen documents started to get leaked.

30. On or about May 3 and May 5, 2017, unidentified individuals began to leak documents purporting to be from the En Marche! campaign’s email accounts.

But they weren’t unidentified, at least not all of them! As a DFIR report released 15-months before this indictment laid out, while there was a Latvian IP address that hadn’t been publicly identified at that point (one the FBI surely had some ability to unpack), the American alt-right, including Stone associate Jack Posobiec, made the campaign go viral, all in conjunction with WikiLeaks.

First there was a rumor spread from that Latvian IP to 4Chan to William Craddick to Jack Posobiec.

Last but not least came the “#MacronGate” rumor. Two hours before the final televised debate between Macron and Le Pen, on Wednesday, May 3, at 7:00 p.m.,41 a user with a Latvian IP address posted two fake documents on 4chan. The documents suggested that Macron had a company registered in Nevis, a small Caribbean island, and a secret offshore bank account at the First Caribbean Bank, based in the Cayman Islands. Again, the rumor itself was not entirely new. Macron himself had seen it coming. More than two weeks earlier on TV he warned that this type of rumor was likely to appear: “This week, you will hear ‘Mr. Macron has a hidden account in a tax haven, he has money hidden at this or that place.’ This is totally false, I always paid all my taxes in France and I always had my accounts in France.”42 What was new this time, however, was the release of two documents supposedly proving this rumor. The user who posted the two documents on 4chan did it purposefully on the evening on the final televised debate to attract more attention, and even suggested a French hashtag: “If we can get #MacronCacheCash trending in France for the debates tonight, it might discourage French voters from voting Macron”43.

Then the rumor spread on Twitter. The 4chan link was first posted by Nathan Damigo, founder of the American neo-Nazi and white-supremacist group Identity Evropa, and was further circulated by William Craddick, founder of Disobedient Media and notorious for his contribution to the Pizzagate conspiracy theory that targeted the US Democratic Party during the 2016 American presidential campaign. The first real amplifier was Jack Posobiec—an American alt-right and pro-Trump activist with 111,000 followers at the time: his tweet was retweeted almost 3,000 times. Only after 10:00 p.m. did the rumor begin to spread in French, mostly through far-right accounts using the #MacronCacheCash hashtag. The first tweets in French seemed to have been automatically translated from English.44

[snip]

The same user with the Latvian IP address who posted the fake documents on Wednesday announced on Friday morning that more were coming, promising, “We will soon have swiftnet logs going back months and will eventually decode Macron’s web of corruption.”49 Those responsible for #MacronGate thereby provided evidence that they were the same people responsible for the #MacronLeaks that were released later that day.

Then there were the leaked files themselves, which followed the same pattern: an anonymous leak to Craddick to Posobiec to WikiLeaks.

The files were initially posted on Archive.org, an online library site, supposedly in the morning63 (the time of first release on the website cannot be determined, as these original threads have since been deleted). At 7:59 p.m., the links to the threads were posted on PasteBin, a file-sharing site, under the name “EMLEAKS.” At 8:35 p.m., they were shared on 4chan. Then came their appearance on Twitter: Craddick was again the first to share the link to the PasteBin dump at 8:47 p.m., quickly followed by Jack Posobiec at 8:49 p.m., who provided a link to the 4chan thread with, for the first time, the hashtag #MacronLeaks.64 Contrary to what would later become a widespread misconception, Posobiec was not the first to tweet, Craddick was. However, Posobiec was the first to use the hashtag that would lend its name to the entire operation, hence the confusion. Posobiec’s tweet and hashtag was retweeted eighty-seven times within five minutes. He later said he had been alerted to the incoming dump by the user with a Latvian IP address who had posted the #MacronGate fake documents two days prior: “The same poster of the financial documents said to stay tuned tomorrow for a bigger story–so I pretty much spent the next 24 hours hitting refresh on the site.”65

So far, this conversation was exclusively Anglophone. This makes it clear that the hashtag #MacronLeaks was launched and spread in the United States, by the American alt-right. It was WikiLeaks that internationalized the spread, at 9:31 p.m., by tweeting: “#MacronLeaks: A significant leak. It is not economically feasible to fabricate the whole. We are now checking parts,” with a link to the files on PasteBin. Only then came the first French amplifiers, who happened to be Le Pen supporters

MacronLeaks was, openly and proudly, a joint venture between the GRU, far right influencers in Stone’s immediate orbit, and WikiLeaks. It was an attempt to repeat the 2016 miracle that elected Donald Trump, by supporting the Russian-supporting Marine Le Pen by damaging Macron.

There’s something unusual about the indictment, too. Alone among the indictments obtained by the Pittsburgh US Attorney’s office that month (October 2020), it was the single one signed in wet blue ink by the US Attorney, Scott Brady. Both the copy released by DOJ and the one docketed in PACER also lacked a jury foreperson’s signature.

Admittedly, most of the indictments WDPA obtained that month were fairly podunk crimes that wouldn’t need heightened security: a fentanyl dealer, a cocaine dealer, two unhoused men charged with theft, an aggravated assault, manufacturing a controlled substance, Social Security fraud, VA benefit fraud, all were signed in black ink, at least some of them electronically. But a child sexual trafficking indictment and a CSAM possession indictment, both originally filed under seal, also bear the foreperson’s signature and that black ink signature. Even a ransomware indictment rolled out nationally on October 15 — which would have the same kind of international sensitivities and national coordination as the GRU indictment — had a normal jury foreperson’s signature.

While Brady was not a surprising choice for US Attorney in Pittsburgh (he had previously been an AUSA), he was perhaps the most politicized of Trump’s US Attorneys. He’s the guy whom Barr put in charge of ingesting the dirt on Hunter Biden that Rudy Giuliani was getting from suspected Russian agents.

To be clear: There’s no public allegation that Stone had anything to do with MacronLeaks, though HateWatch places him at a Milo Yiannopoulos party where MacronLeaks appears to have come up, after the leaks but before the French election. I’m not saying that Stone was involved in the MacronLeaks operation.

But the response to the Stone reference in the subpoena receipt has assumed that the Stone reference cannot be related to the French President reference, all assumptions made by journalists that never covered the ongoing aspects into whether Stone conspired with Russia on a hack. If Trump did issue his rat-fucker a secret pardon for follow-on cooperation with Russian hackers, though, it would explain a number of things about the aftermath of the Mueller investigation, including what happened to the investigation into whether Stone conspired with Russia on hacking campaigns.

For his part, Trump included a bit of a tirade about the Stone reference in his motion for a Special Master last night.

In addition, did the affiant to the warrant fairly disclose any pretextual “dual” purpose at work in obtaining the warrant? For example, the Receipt for Property largely fails to identify seized documents with particularity, but it does refer to the seizure of an item labelled “Executive Grant of Clemency re: Roger Jason Stone, Jr.” Aside from demonstrating that this was an unlawful general search, it also suggests that DOJ simply wanted the camel’s nose under the tent so they could rummage for either politically helpful documents or support other efforts to thwart President Trump from running again, such as the January 6 investigation.

This is legally and politically nonsensical. If the pardon is the known pardon, then it’s not politically damaging at all. If it’s a real pardon of any kind — as a pardon written on a cocktail napkin arguably would be — then it’s a Presidential Record and squarely within the scope of the warrant (which permits seizure of any Presidential record created during Trump’s term). If the information about the French President is part of the document and appears to be sensitive, then it would qualify as a likely classified document. If the pardon were found in Trump’s safe next to his leatherbound box of TS/SCI documents, then it would be covered by the proximal search protocol laid out in the warrant. The pardon was legally seized.

Trump’s claims are nonsensical. But they’re also the the kind of squealing that invites further attention to what the clemency document really is.

Maggie Haberman: Heads It’s Only Obstruction, Tails It’s Not Obstruction

Maggie Haberman had a column last week that pissed a lot of people off, in which she wrote 1,600 words presenting what she claimed were “the main possibilities” for why oh why Trump might have stolen Presidential documents.

The only reasons she could come up with were:

  • He gets his rocks off looking at important documents
  • He thinks he’s Louis XIV
  • He has a compulsion to rip up paper
  • He was collecting information about friends and foes

It was facile analysis and in two respects probably erroneous.

But it pissed me off less than it did others (at least at first) because I think it is important to remember that Trump’s narcissism explains a significant part of his theft.

Maggie’s an expert of Trump’s narcissism.

Still, at one level the document is a remarkable confession on Maggie’s part of her own inconsistencies as a Trump enabler (and as I said, in two ways, it may be factually wrong).

That’s because Maggie, who has covered this search for the same two weeks I have, doesn’t even mention the possibility laid out explicitly in search warrant: Obstruction.

To obtain this warrant, the government showed probable cause that Trump ripped up, flushed, and hid documents to obstruct investigations. But having (presumably) read that warrant, Maggie instead claims that Trump rips up documents just for shits and giggles.

Ripping up paper

Although Trump White House officials were warned about the proper handling of sensitive material, aides said Mr. Trump had little interest in the security of government documents or protocols to keep them protected.

Early on, Mr. Trump became known among his staff as a hoarder who threw all manner of paper — sensitive material, news clips and various other items — into cardboard boxes that a valet or other personal aide would cart around with him wherever he went.

Mr. Trump repeatedly had material sent up to the White House residence, and it was not always clear what happened to it. He sometimes asked to keep material after his intelligence briefings, but aides said he was so uninterested in the paperwork during the briefings themselves that they never understood what he wanted it for.

He also had a habit of ripping up paper, from routine documents to classified material, and leaving the pieces strewn around the floor or in a trash can. Officials would have to rummage through the shreds and tape them back together to recreate the documents in order to store them as required under the Presidential Records Act.

On some occasions, Mr. Trump would rip up documents — some with his handwriting on them — and throw the pieces in a toilet, which occasionally clogged the pipes in the White House. He did the same thing on at least two foreign trips, former officials said.

The government has told us all that they have shown probable cause that some of this ripping, flushing, and hiding was designed to withhold evidence from a, or multiple, investigations. But Maggie, apparently, either doesn’t understand that or decided without seeing the evidence that the government simply misunderstands Trump’s quirky ripping, flushing, and hiding fetish.

Where this column struck me as particularly ridiculous, however, is the way it’s a perfect mirror for Maggie’s Mueller investigation coverage.

With Mike Schmidt, after all, Maggie largely set the narrative that Mueller was only investigating Trump for obstructing the investigation. In July 2018 they reported as breaking news that Mueller was just investigating Trump for tweets, not what they called “collusion.” In August 2018, they kept repeating that word — obstruct obstruct obstruct obstruct obstruct obstruct obstruct obstruct obstruct obstruct obstruct obstruct obstruct obstruct — as if the only thing being investigated was obstruction. In February 2019, Maggie (with Peter Baker that time) spun Trump describing a bribe and not answering questions about the Stone indictment as the opposite. Last October, when Maggie complained about my piece quoting Roger Stone and Rick Gates describing how they used her and Ken Vogel, she claimed I had predicted Mueller would go further than he had — when the reality is that she has still uncorrected errors about the Manafort investigation, never reported on the investigation into whether Stone conspired with Russia that continued even after Mueller finished, and missed the bribery prong of the investigation. I’m also not aware that she ever matched the WaPo’s reporting that Mueller told Trump’s lawyers that the President was at risk, himself, of prosecution in the CFAA conspiracy with Russia, the same part of the Stone investigation she missed.

During the Mueller investigation, Maggie spent years reporting — falsely, the records unsealed since prove — that an investigation into whether Trump conspired with Russia was really just an obstruction investigation.

This time around the government told us — explicitly!! — that Trump is under investigation for obstructing investigation(s) by ripping and flushing and hiding documents, and Maggie’s “analysis” concludes that all that ripping and flushing and hiding is instead just a quirk.

Which brings me to her second possible error, on top of ignoring the obstruction investigation: here’s how Maggie explains the mention of a French President in the warrant receipt.

Other advisers wondered if Mr. Trump kept some documents because they contained details about people he knew.

Among the items that presidents are given on overseas trips are biographies of foreign leaders, a former administration official said. One version is unclassified and fairly routine. But the other is classified and can contain numerous personal details.

One of the files the F.B.I. seized at Mar-a-Lago was marked “info re: President of France,” about Emmanuel Macron.

It’s hard to tell whether Maggie is reporting here — confirming what most of us have assumed, that the reference to a French President was most likely a reference to Macron. To substantiate that, she cites only the same warrant that mentions the obstruction investigation she somehow missed. If she has confirmed that’s about Macron, this error may be all the more remarkable.

But for the reasons I laid out here, the most obvious reading of that reference is that the information about a French President is linked in some way to Executive Clemency for Maggie’s old BFF, Roger Stone.

The reference to a French President — Maggie tells us it is Macron — may well be contained in an Executive Grant of Clemency for Stone.

If that’s the case, then it’s in Trump’s files not because he saw a scrap of gossip about Macron and stuck it in a box or hoarded a classified pre-trip biography from years ago, which Maggie says are the best explanations, but because he wrote something down about Macron (or whichever President), quite possibly in conjunction with clemency for his rat-fucker.

To be sure, Maggie is not the only reporter covering this search who has entirely ignored the obstruction prong of the investigation. Many reporters have. But for a reporter publishing the book on Trump’s ripping, flushing, and hiding that seems to be at the core of that investigation, it seems a significant oversight.

Update: In an article Saturday that appears, in significant part, to be an attempt to underbus Mark Meadows, Maggie and others included this remarkable paragraph about an investigation into both Espionage Act violations and obstruction.

Where all of that material ended up is not clear. What is plain, though, is that Mr. Trump’s haphazard handling of government documents — a chronic problem — contributed to the chaos he created after he refused to accept his loss in November, unleashed a mob on Congress and set the stage for his second impeachment. His unwillingness to let go of power, including refusing to return government documents collected while he was in office, has led to a potentially damaging, and entirely avoidable, legal battle that threatens to engulf the former president and some of his aides.

This is another story that treats this all as one big misunderstanding and not an investigation into willful conduct designed to obstruct one or more investigations.

Maggie seems quite happy that this claim has been picked up.

The single source it relies on, described as “a person with knowledge of the situation,” speaks of their belief, not their certainty. And aside from people inside the investigation, there is no single person competent to make that claim, in part because only the family are reported to have known of the leather box in which Trump kept the Top Secret/SCI documents seized, and none of the family would know the full inventories of the boxes that were seized from storage closets.

emptywheel Trump Espionage coverage

Maggie Haberman: Heads It’s Only Obstruction, Tails It’s Not Obstruction

The French President May Be Contained Inside the Roger Stone Clemency

Which of the Many Investigations Trump Has Obstructed Is DOJ Investigating?

The Known and Likely Content of Trump’s Search Warrant

The ABCs (and Provisions e, f, and g) of the Espionage Act

Trump’s Latest Tirade Proves Any Temporary Restraining Order May Come Too Late

How Trump’s Search Worked, with Nifty Graphic

Pat Philbin Knows Why the Bodies Are Buried

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

18 USC 793e in the Time of Shadow Brokers and Donald Trump

[from Rayne] Other Possible Classified Materials in Trump’s Safe

Trump’s Stolen Documents

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

[from Peterr] Merrick Garland Preaches to an Overseas Audience

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

Merrick Garland Calls Trump’s Bluff

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

[from Rayne] Expected Response is Expected: Trump and Right-Wing DARVO

DOJ’s June Mar-a-Lago Trip Helps Prove 18 USC 793e

The Likely Content of a Trump Search Affidavit

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

Some Likely Exacerbating Factors that Would Contribute to a Trump Search

FBI Executes a Search Warrant at 1100 S Ocean Blvd, Palm Beach, FL 33480

Why Accuracy about Wikileaks Matters

Let me preface this post by saying that I’m perfectly willing to accept that Julian Assange is a narcissist, accused rapist, destructive hypocrite serving as a willful tool of Russia. I’m also happy to concede that his role in publishing the DNC and Podesta emails may have played a significant part in getting Donald Trump elected (though I think it’s down the list behind Comey and Hillary’s own (in)actions). Please loathe Julian Assange–that is your right.

But please, also, try to be accurate about him and Wikileaks.

There have been two funny claims about Wikileaks since the leak of hacked emails from Emmanuel Macron associates was announced on 4Chan on Friday. First, analysis of how the hashtag #MacronLeaks spread emphasized that Wikileaks got more pickup than right wing propagandist Jack Posobiec or the other right wing promoters of it.

The most important surge came when WikiLeaks began tweeting the hashtag. The tweet itself was cautious, pointing out that the leak “could be a 4chan practical joke,” but it was retweeted over 2,000 times, compared with over 600 times for Posobiec.

Yet people have taken that to suggest that everyone who shared Wikileaks’ links to the materials were themselves promoting the emails positively. That is, they ignored the extent to which people share Wikileaks tweets critically, which itself added to the buzz about the dump. The surge in attention, in other words, was in part critical attention to what Wikileaks was doing with respect to the leak.

More troubling, still, outlets including NPR claimed that Wikileaks posted the documents (it has since issued a correction).

Finally, there are absurd pieces like this which, after babbling that, “Macron, by contrast, is favored by those who want … a France looking to the future rather than clinging to the fearful and fictional nostalgia promulgated by Le Pen,” states,

Literally at the 11th hour, before the blackout would silence it, the Macron campaign issued a statement saying it had been hacked and many of the documents that were dumped on the American 4Chan site and re-posted by Wikileaks were fakes.

On top of being poorly edited — Macron’s statement said nothing at all about who dumped the documents — the claims as to both 4Chan and Wikileaks are not technically correct. The documents weren’t dumped on 4Chan, a post on 4Chan included a link to a Pastebin with them. More importantly, Wikileaks didn’t “re-post” them, though it did post magnet links to them.

The importance of the distinction becomes evident just two paragraphs later when the article notes that some of the tweets in which Wikileaks linked to the documents described the vetting process it was undertaking.

Meanwhile, Wikileaks jumped on the document dump, but didn’t seem to be familiar with the material in it. Responding to the Macron statement that some of the items were bogus, Wikileaks tweeted, “We have not yet discovered fakes in #MacronLeaks & we are very skeptical that the Macron campaign is faster than us.”

Curiously, the article doesn’t link to WL’s first tweet, posted less than an hour after the 4Chan post, which said it could be a 4Chan practical joke.

In any case, contrary to what some idiotic readings of this article claim — that Macron succeeded in fooling Wikileaks — in fact, Macron has not succeeded, at least not yet, because Wikileaks has not posted the documents on its own site (Wikileaks could yet claim it had determined the documents to be real only to have Macron present proof they weren’t). Indeed, while Wikileaks expressed skepticism from the start, one thing that really raised questions for Wikileaks was that Macron so quickly claimed to have determined some were fake.

Plus, it’s not actually clear that Macron did fool the hackers who passed them onto the 4Chan source. Here’s the full description from Mounir Mahjoubi, the head of Macron’s digital team, on what their counteroffensive looked like.

“We also do counteroffensive against them,” says Mahjoubi.

[snip]

“We believe that they didn’t break through. We are sure of it,” said Mahjoubi. “But the only way to be ready is to train the people. Because what happened during the Hillary Clinton campaign is that one man, the most powerful, [campaign chairman] John Podesta, logged on to his [fake] page.”

To keep the entire Macron campaign aware of such dangers, Mahjoubi said, “Every week we send to the team screen captures of all the phishing addresses we have found during the week.” But that’s just the first phase of the response. Then the Macron team starts filling in the forms on the fake sites: “You can flood these addresses with multiple passwords and log-ins, true ones, false ones, so the people behind them use up a lot of time trying to figure them out.”

If Mahjoubi was being honest about his certainty the hackers didn’t succeed, then the campaign would have no reason or means to feed disinformation. And the details offered here appear to be about disinformation in response to phishing probes — that is, disinformation about metadata — not disinformation about content.

But now, between the Daily Beast’s gloating and the sharing of it with even less factual gloating, coupled with Macron’s quick declaration that the dump included fake documents, raises real (but potentially unjustified!) questions about whether the campaign added the Cyrillic metadata that got so much attention. Not only has Wikileaks’ vetting process not (yet) been exposed as a fraud, but the reporting may create even more distrust and uncertainty than there was. [Note, I posted a tweet to that effect that I have deleted now that I’m convinced there’s no evidence Macron faked any documents.]

Moreover, even if it is the case that GRU hacked Macron and Wikileaks would have happily published the emails if they passed its vetting process (which are both likely true), Wikileaks didn’t get and post the documents, which itself is worth noting and understanding.

In other words, some inaccuracies — and the rush to gloat against Wikileaks — may actually have been counterproductive to the truth and even the ability to understand what happened.

And this is not the only time. The other most celebrated case where inaccurate accusations against Wikileaks may have been counterproductive was last summer when something akin to what happened with the Macron leak did. Wikileaks posted a link to Michael Best’s archived copy of the AKP Turkish emails that doxed a bunch of Turkish women. A number of people — principally Zeynep Tufekci — blamed Wikileaks, not Best, for making the emails available, and in so doing (and like the Macron dump) brought attention to precisely what she was rightly furious about — the exposure of people to privacy violations and worse. Best argues that had Tufekci spoken to him directly rather than writing a piece drawing attention to the problem, some of the harm might have been avoided.

But I also think the stink surrounding Wikileaks distracted focus from the story behind the curious provenance of that leak. Here’s how Motherboard described it.

Here’s what happened:

First, Phineas Fisher, the hacker notorious for breaching surveillance companies Hacking Team and FinFisher, penetrated a network of the AKP, Turkey’s ruling party, according to their own statement. The hacker was sharing data with others in Rojava and Bakur, Turkey; there was apparently a bit of miscommunication, and someone sent a large file containing around half of akparti.org.tr’s emails to WikiLeaks.

WikiLeaks then published these emails on July 19, and as some pointed out, the emails didn’t actually seem to contain much public interest material.

Then Phineas Fisher dumped more files themselves. Thomas White, a UK-based activist also known as The Cthulhu, also dumped a mirror of the data, including the contentious databases of personal info. This is where Best, who uploaded a copy to the Internet Archive, comes in.

Best said he didn’t check the contents of the data beforehand in part because the files had already been released.

“I was archiving public information,” he said. “Given the volume, the source, the language barrier and the fact that it was being publicly circulated already, I basically took it on faith and archived a copy of it.”

Without laying out all the details here, I think there are some interesting issues about this hack-and-leak that might have gotten more scrutiny if the focus weren’t Wikileaks. But instead, the focus was entirely on what Wikileaks did (or actually, on blaming Wikileaks for what Best did), rather than how the hack-and-leak really happened.

I get that people have the need, emotionally, to attack Assange, and I have no problem with that. But when emotion disrupts any effort to understand what is really going on, it may make it more difficult to combat the larger problem (or, as lefties embrace coverage of the Bradley Foundation based on hacked documents and more mass hack-and-leak reporting gets journalism awards, to set norms for what might be legitimate and illegitimate hack-and-leaks).

If you hate Assange, your best approach may be to ignore him. But barring that, there really is a case for aspiring to factual accuracy even for Wikileaks.

Update: Fixed description of what WL actually linked to — h/t ErrataRob.

Update: This article provides more detail on the hack and Macron’s attempts to counter the hackers.

“Il y a des dossiers qui ont été ajoutés à ces archives. Des dossiers dont on ne sait pas à quoi ils correspondent. Qui ne sont pas des dossiers d’emails, par exemple. Ensuite, il y a des faux emails qui ont été ajoutés, qui ont été complétés. Il y a aussi des informations que nous-même on avait envoyées en contre-représailles des tentatives de phishing !”, a expliqué Mounir Mahjoubi.

So some of the added documents (which, incidentally, are the ones that show Cyrillic metadata) are from someplace unknown, not the five hacked email boxes. There are fake emails, described has “having been completed,” which may mean (this is a guess) the hackers sent emails that were sitting in draft; if so there might be fake emails that nevertheless come with authenticating DKIM codes. The description of what the campaign did — counter-attacks to phishing attempts — is still not clear as to whether it is metadata (faked emails) or content, but still seems most likely to be metadata.

The Macron Hack: Sometimes the Metadata Is (Part of) the Message

After he claimed he hadn’t been hacked, 4Chan released documents from some of Emmanuel Macron’s associates (along with a whole lot of crap) last night, just minutes before by French law the candidates and press have to stop talking about the election. Given that the hacking group believed to be associated with Russia’s military intelligence GRU had been trying to phish Macron’s campaign, it is widely assumed that these files came from GRU. That’s a safe starting assumption but it has not been proven.

Here’s one review of what we know about the documents so far. Here’s advice for France on how to avoid having this become the centerpiece of the next few days.

Thus far, the most remarked aspect of individual documents from the dump (which I haven’t started reading yet) is the metadata. For example, a good number of the Microsoft documents have Russian names or metadata in them. In addition, some people are claiming that metadata associated with forgeries in the dump point to specific equipment.

As a result, a number of people have uncritically said that this makes the dump just like the DNC dump, which is further proof that the same sloppy Russians did it.

Except in doing so, most reveal untested assumptions from that DNC dump.

Back when the DNC documents came out, a number of (these very same) people noted that there was Russian metadata in those documents, as well as the name Felix Drzezhinsky, the founder of the Soviet secret police. This was described, persistently, as an accident.

The metadata in the leaked documents are perhaps most revealing: one dumped document was modified using Russian language settings, by a user named “Феликс Эдмундович,” a code name referring to the founder of the Soviet Secret Police, the Cheka, memorialised in a 15-ton iron statue in front of the old KGB headquarters during Soviet times. The original intruders made other errors: one leaked document included hyperlink error messages in Cyrillic, the result of editing the file on a computer with Russian language settings. After this mistake became public, the intruders removed the Cyrillic information from the metadata in the next dump and carefully used made-up user names from different world regions, thereby confirming they had made a mistake in the first round.

I noted, even at the time, the claim that someone who deliberately adopted the name of Iron Felix just accidentally saved the document with cyrillic characters made zero sense.

Particularly with regards to the Russian metadata, you don’t both adopt a notable Russian spook’s ID while engaging in a false flag but then “accidentally” leave metadata in the files, although the second paragraph here pertains to Guccifer 2 and not the Crowdstrike IDed hackers.

Moreover, Guccifer 2 himself pointed out what Sam Biddle had already reported: the identity metadata was not limited to Iron Felix, but included Che Guevara and (I’ve been informed) Zhu De.

Since then, some folks have looked closer and compellingly argued that the Russian metadata “accidentally” left in the documents was actually made at significant effort by opening a word document, putting some settings onto Russian language, and then copying one after another document into that document.

That said, that doesn’t mean — as some of the same folks suspect — that a Hillary staffer made the documents. This post provides five alternative possibilities.

And one thing that those arguing the Guccifer figure was created to obfuscate Russia’s role didn’t connect that claim that — as I’ve heard and Jim Comey recently confirmed — this second DNC hacker was obnoxiously loud in the DNC servers.

COMEY: The only thing I’d add is they were unusually loud in their intervention. It’s almost as if they didn’t care that we knew what they were doing or that they wanted us to see what they were doing. It was very noisy, their intrusions in different institutions.

Effectively, then, the second DNC hacker (usually attributed to GRU) was leaving graffiti inside the DNC servers and Guccifer 2 effectively left graffiti on the documents he released.

In any case, the same rush to interpret the metadata is happening now on the Macron hack as it did with the DNC hack, with repeated claims the hackers — whom people assume are the same as the ones that targeted DNC — are sloppily leaving metadata again.

If they are the same hackers (which has not yet been proven) then we sure as hell ought not assume that the metadata is there accidentally. Again, that doesn’t mean this isn’t GRU. But it does mean the last time people made such assumptions they ended up arguing ridiculously that someone trying to obscure his ties to Russia was at the same time paying tribute to them.

Sometimes, it turns out, the metadata is the message.

What Fake French News Looks Like (to a British Consulting Company)

Along with reports that APT 28 targeted Emmanuel Macron that don’t prominently reveal that Macron believes he withstood the efforts to phish his campaign, the post-mortem on the first round of the French election has also focused on the fake news that supported Marine Le Pen.

As a result, this study — the headline from which claimed 25% of links shared during the French election pointed to fake news — has gotten a lot of attention.

The study, completed by a British consulting firm (though the lead on the study is a former French journalist) and released in full only in English, is as interesting for its assumptions as anything else.

Engagement studies aren’t clear what they’re showing, but this one is aware of that

Before I explain why, let me stipulate that accept the report’s conclusion that a ton of Le Pen supporters (though it doesn’t approach it from that direction) relied on fake news and/or Russian sources. The methodology appears to suffer from the same problem some of BuzzFeed’s reporting on fake news does, in that it doesn’t measure the value of shared news, but at least it admits that methodological problem (and promises to discuss it at more length in a follow-up).

Sharing is the overt act of taking an article or video or image that one sees in social media and, literally, sharing it digitally with one’s own followers or even into the public domain. Sharing therefore implies an elevated level of interest: people share articles that they feel others should see. While there are tools that help us track and quantify how many articles are shared, they cannot explain the sharer’s intention. It seems plausible, particularly in a political context, that sharing implies endorsement, yet even this is problematic as sharing can often imply shock and disagreement. In the third instalment [sic] of this study, Bakamo will explore in depth the extent to which people agree or disagree with what they share, but for this report (and the second, updated version), the simple act of sharing—whatever the intention—is nonetheless highly relevant. It provides a way of gauging activity and engagement.

[snip]

These are the “likes” or “shares” in Facebook, or “favourites” or “retweets” in Twitter. While these can be counted, we do not know whether the person has actually clicked through to read the content being shared before they like or retweet. This information is only available to the account owner. One of the questions that is often raised about social media is whether users do indeed read the article or respond simply to the headlines that appear in their newsfeed. We are unable to comment on this.

In real word terms, engagement can be two things. It can be agreement—whether reflexive or reflective—with the content shared. It can also, however, be disagreement: Facebook’s nuanced “like” system (in which anger is a valid form of engagement) or Twitter’s citations that enable a user to comment on the link while sharing it both permit these negative expressions.

The study is perhaps most interesting for what it shows about the differing sharing habits from different parts of its media economy, with no overlap between those who share what it deems “traditional” media and those who share what I’d deem conspiracist media. That finding, more than almost any other one, suggests what might be needed to engage in a dialogue across these clusters. Ultimately, what the study shows is increased media polarization not on partisan grounds, but on response to globalization.

Russian media looks very important when you only track Russian media

As I noted, one of the headlines that has been taken away from this study is that Le Pen voters shared a lot of Russian news sources — and I don’t contest that.

But there are two interesting details about how that finding came to be that important to this study.

First, the study defines everything in contradistinction from what it calls “traditional” media.

There are broad five sections of the Media Map. They are defined by their editorial distance from traditional media narratives. The less accepting a source is of traditional media narratives, the farther away it is (spatially) on the Map.

In the section defining traditional media, the study focuses on establishment and commercialism (including advertising), even while pointing to — but not proving — that all traditional media “adher[e] to journalistic standards” (which is perhaps a fairer assumption still in France than in the US or UK, but nevertheless it is an assumption).

This section of the Media Map is populated by media sources that belong to the established commercial and conventional media landscape, such as websites of national and regional newspapers, TV and radio stations, online portals adhering to journalistic standards, and news aggregators.

It does this, but insists that this structure that privileges “traditional” media without proving that it merits that privilege is not meant to “pass moral judgement or to define what is ‘good’ or ‘evil’.”

Most interesting of all, the study includes — without detail or interrogation — international media sources “exhibiting these same characteristics” in its traditional media category.

These are principally France-based sources; however, French-speaking international media sources exhibiting these same characteristics were also placed into the Traditional Media section.

But, having defined some international news sources as “traditional,” the study then uses Russian influence as a measure of whether a media cluster was non-traditional.

The analysis only identified foreign influence connected with Russia. No other foreign source of influence was detected.

It did this — measuring Russian influence as a measure of non-traditional status — even though the study showed this was true primarily on the hard right and among conspiracists.

Syria as a measure of journalistic standards

Among the other kinds of content that this study measures, it repeatedly describes how those outlets it has clustered as non-traditional (primarily those it calls reframing outlets) deal with Syria.

It asserts that those who treat Bashar al-Assad as a “protagonist” in the Syrian civil war as being influenced by Russian sources.

A dominant theme reflected by sources where Russian influence is detected is the war in Syria, the various actors involved, and the refugee crisis. In these articles, Bachar Assad becomes the protagonist, a perspective opposite to that which is reported by traditional media. Articles touching on refugees and migrants tend to reinforce anti-Islam and anti-migrant positions.

The anti-imperialists focus on Trump’s ineffectual missile strike on Syria which — the study concludes — must derive from Russian influence.

Trump’s “téléréalité” attack on Syria is a more recent example of content in this cluster. This is not surprising, however, as Russian influence is detectable on a number of sites in this cluster.

It defines conspiracists as such because they say the US supports terrorist groups (and also because they portray Assad as trustworthy).

Syria is an important theme in this cluster. Per these sources, and contrary to reports in traditional media, the Western powers are supporting the terrorist, while Bashar Assad is trustworthy and tolerant leader, as witness reports prove.

The pro-Islam non-traditional (!!) cluster is defined not because of its distance from “traditional” news (which the study finds it generally is not) but in part because its outlets suggest the US has been supporting Assad.

American imperialism is another dominant theme in this cluster, driven by the belief that the US has been secretly supporting the Assad regime.

You can see, now, the problem here. It is a demonstrable fact that America’s covert funding did, for some time, support rebel groups that worked alongside Al Qaeda affiliates (and predictably and with the involvement of America’s Sunni allies saw supplies funneled to al Qaeda or ISIS as a result). It is also the case that both historically (when the US was rendering Maher Arar to Syria to be tortured) and as an interim measure to forestall the complete collapse of Syria under Obama, the US’ opposition to Assad has been half-hearted, which may not be support but certainly stopped short of condemnation for his atrocities.

And while we’re not supposed to talk about these things — and don’t, in part, because they are an openly acknowledged aspect of our covert operations — they are a better representation of the complex clusterfuck of American intervention in Syria than one might get — say — from the French edition of the BBC. They are, of course, similar to the American “traditional” news insistence that Obama has done “nothing” in Syria, long after Chuck Hagel confirmed our “covert” operations there. Both because the reality is too complex to discuss easily, and because there is a “tradition” of not reporting on even the most obvious covert actions if done by the US, Syria is a subject on which almost no one is providing an adequately complex picture of what is going on.

On both sides of the Atlantic, the measure of truth on Syria has become the simplified narrative you’re supposed to believe, not what the complexity of the facts show. And that’s before you get to where we are now, pretending to be allied with both Turkey and the Kurds they’re shooting at.

The shock at the breakdown of the left-right distinction

What’s most fascinating about the study, however, is the seeming distress with which it observes that “reframing” media — outlets it claims is reinterpreting the real news — doesn’t break down into a neat left-right axis.

Media sources in the Reframe section share the motivation to counter the Traditional Media narrative. The media sources see themselves as part of a struggle to “reinform” readers of the real contexts and meanings hidden from them when they are informed by Traditional Media sources. This section breaks with the traditions of journalism, expresses radical opinions, and refers to both traditional and alternative sources to craft a disruptive narrative. While there is still a left-right distinction in this section, a new narrative frame emerges where content is positioned as being for or against globalisation and not in left-right terms. Indeed, the further away media sources are from the Traditional section, the less a conventional left-right attribution is possible.

[snip]

The other narrative frame detectable through content analysis is the more recent development referred to in this study as the global versus local narrative frame. Content published in this narrative frame is positioned as being for or against globalisation and not in left-right terms. Indeed, the further away media sources are from the Traditional section, the less a conventional left-right attribution is possible. While there are media sources in the Reframe section on both on the hard right and hard left sides, they converge in the global versus local narrative frame. They take concepts from both left and right, but reframe them in a global-local context. One can find left or right leanings of media sources located in the middle of Reframe section, but this mainly relates to attitudes about Islam and migrants. Otherwise, left and right leaning media sources in the Reframe section share one common enemy: globalisation and the liberal economics that is associated with it.

Now, I think some of the study’s clustering is artificial to create this split (for example, in the way it treats environmentalism as an extend rather than reframe cluster).

But even more, I find the confusion fascinating. Particularly in the absence of — as it did for Syria coverage — any indication of what is considered the “true” or “false” news about globalization. Opposition to globalization, as such, is the marker, not a measure of whether an outlet is reporting in factual manner on the status and impact and success at delivering the goals of globalization.

And if the patterns of sharing in the study are in fact accurate, what the study actually shows is that the ideologies of globalization and nationalism have become completely incoherent to each other. And purveyors of globalization as the “traditional” view do not, here, consider the status of globalization (on either side) as a matter of truth or falseness, as a measure whether the media outlet taking a side in favor of or against globalization adheres to the truth.

I’ve written a fair amount of the failure of American ideology — and of the confusion among priests of that ideology as it no longer exacts unquestioning sway.

This study on fake news in France completed by a British consulting company in English is very much a symptom of that process.

But the Cold War is outdated!

Which brings me to the funniest part of the paper. As noted above, the paper claims that anti-imperialists are influenced by Russian sources, which it explains for criticism of Trump’s Patriot missile strike on Syria. But it’s actually talking about what it calls a rump Communist Cold War ideology.

This cluster contains the remains of the traditional Communist groupings. They publish articles on the imperialist system. They concentrate on foreign politics and ex-Third World countries. They frame their worldview through a Cold War logic: they see the West (mainly the US) versus the East, embodied by Russia. Russia is idolised, hence these sites have a visible anti-American and antiZionist stance. The antiquated nature of a Cold War frame given the geo-political transformations of the last 25 years means these sources are often forced to borrow ideas from the extreme right.

Whatever the merit in its analysis here, consider what it means for a study the assumptions of which treat Russian influence as a special kind of international influence, even while conducting no reflection on whether the globalization/nationalization polarization it finds so striking can be measured in terms of fact claims.

The new Cold War seems unaware that the old Cold War isn’t so out of fashion after all.

NSA’s Spying on Le Pen Is Probably Working Better than GRU’s Spying on Macron

In advance of this report on APT 28 (the hacking group presumed to be tied to Russia’s military intelligence, GRU, blamed for the DNC hack-and-leak), Trend Micro got a lot of publicity for its report that APT 28 had targeted Emmanuel Macron, who just won the most votes in France’s presidential election and will face a run-off against Marine Le Pen in a few weeks.

At least according to Macron’s campaign, the attempts to phish his campaign were unsuccessful.

Mounir Mahjoubi, digital director of Mr. Macron’s campaign, confirmed the attempted hacking, saying that several staffers had received emails leading to the fake websites. The phishing emails were quickly identified and blocked, and it was unlikely others went undetected, Mr. Mahjoubi said.

“We can’t be 100% sure,” he said, “but as soon as we saw the intrusion attempts, we took measures to block access.”

The timing of all this is all rather interesting. Back in early February, France’s Le Canard Enchaîné exclusively reported that France’s security officials worried that Macron would be hacked, a vague report that was picked up really broadly without confirmation. Shortly thereafter, Macron claimed that his campaign had been the target of thousands of attacks from entities within Russia’s border, including a DDOS attack that took down his website for nine minutes. According to the sole mention of Macron in the Trend Micro report, the OneDrive-based phish targeting Macron took place a month later, on March 15.

These hacking attempts accompanied a great deal of fake news (and leaked gossip) targeting Macron. But at least if Macron’s own campaign is to believed, APT 28 never succeeded in its attempt to hack the favorite to be France’s next president, and so presumably has not yet succeeded in stealing emails that Russia might use to attack Macron during the run-off.

Which gives the hype about APT 28’s attempted hack a really curious character. It is treated as if Russia is the only state actor that might be spying on French presidential candidates.

Does anyone honestly believe that the United States is not spying on Le Pen, for example, given that the CIA and NSA have a history of spying on candidates with whom the US is even friendlier than Le Pen? Indeed, earlier this year, WikiLeaks published a tasking order for CIA to collect HUMINT and open source intelligence on all the parties in the 2012 French election, though without any cyber element specified. In 2010, the incumbent Pakistan People’s Party was included in NSA’s foreign government Section 702 certificate by name. And in 2012, CIA and NSA partnered to target Enrique Peña Nieto and nine of his closest associates in the weeks leading up to his victory. With both the PPP and EPN, these were nominally political parties friendly to US interests.

By comparison, it would seem that targeting Le Pen, at a time when the intelligence community has a very public concern about collusion between Russia and populist parties in Europe to destabilize Europe, would be a no-brainer.

And here’s what else gets left out of the coverage of GRU’s attempts to spy on Macron: how much easier a job the NSA might have than GRU, even ignoring NSA’s greater capabilities.

Many (though not all) of the phishing attempts detailed in the Trend Micro report pretend to be the email log-ins for US-based email providers: with virtually all the most detailed attention on Yahoo, Gmail, and Microsoft. The attempted Macron targeting exploited his campaign’s use of OneDrive. That means all the entities GRU targeted with phishes pretending to be US providers are available to NSA via Section 702, or PRISM.

In other words, to collect on the very same targets that GRU is targeting via phishing attacks that users continue to be better informed about (and that Macron claims to have withstood entirely), the NSA could just add LePen’s email address to the list over 93,000 targets being targeted under Section 702 (as they presumably did with PPP in 2010). And unlike a phishing campaign, which can be made more difficult with the use of two factor authentication, Le Pen would have no defense against collection targeting her or her campaign’s PRISM provider accounts, beyond encrypting everything that resided in an American-owned cloud (and even there, there would be a great deal of interesting metadata available). If she or key aides uses any of the major American tech providers, stealing their emails would be as easy as providing a foreign intelligence justification (one that would be bolstered by her close ties with Russia) and tracking to make sure her accounts are detasked when she comes to the US to visit Trump Tower.

All that’s on top of any more sophisticated targeting of Le Pen akin to what CIA and NSA did against EPN.

And therein lies the rub, the reason you shouldn’t be saying, “So what? We should spy on that fascist Le Pen, she’s a menace to civilization” (though I agree she is).

The NSA’s spying on Marine Le Pen is likely having more success than GRU’s spying on Emmanuel Macron. But is there any reason to believe — particularly given CIA’s targeting of all French parties in 2012 and given Trump’s stated preference for Le Pen — to think that NSA is not also targeting Macron, targeting his OneDrive in a way that would be immune from whatever defenses he is using against phishing attacks?

Here’s where folks will say, “but we don’t leak stolen communications,” in spite of some evidence that we have in the past, albeit perhaps not in a democratic election. (On that note, this Politico story exposing Mike Flynn’s ties, via his Turkish lobbying client, to Russia, relies on a WikiLeaks-released email, which is a notable instance where evidence made available by WikiLeaks may help those investigating Russia’s influence on the Trump administration.). Of course, GRU can only leak what it can steal, and Macron believes that GRU hasn’t succeeded in stealing anything.

Furthermore, we have no visibility what US policymakers in the past have done with intelligence collected on political parties. We certainly have no current limits on what Trump can do with it, aside from limits on the dissemination of that actual raw emails. We’ve always given the President great discretion on such issues, in the name of ensuring a unified foreign policy. And there are plenty of ways Trump’s administration could intervene to help Le Pen beyond just leaking any derogatory information on Macron.

All this is not to say that GRU’s reported continued attempts to hack democratic targets is not a concern (indeed, I’m at least as worried that FSB is conducting similar intelligence collection without the same easily identifiable tracks).

But it is to say that, particularly in the era where Donald Trump sets this country’s foreign policy, we need to be a lot more mindful of NSA’s own far more considerable ability to steal information on democratic candidates.