Internet Research Agency Archives

Posts

Eleven Days after Releasing Their Report, DOJ IG Clarified What Crimes FBI Investigated

December 23, 2019/41 Comments/in 2016 Presidential Election, FISA, Mueller Probe /by emptywheel

The DOJ IG’s office has made two sets of corrections to their Report on Carter Page, the first on December 11 (two days after its release) and a second on December 20 (eleven days after its release). Three of those corrections fix overstatements of their case against the FBI (but which don’t catch all their overstatements and errors in making that case). One correction explains that more information has been declassified (without explaining an inconsistent approach to Sergei Millian as compared with other people named in the Mueller Report). And one correction — one of the changes made Friday — fixes a legal reference.

Here’s that correction:

On page 57, we added the specific provision of the United States Code where the Foreign Agents Registration Act (FARA) is codified, and revised a footnote in order to reference prior OIG work examining the Department’s enforcement and administration of FARA.

The correction changed this passage…

Crossfire Hurricane was opened by [FBI’s Cyber and Counterintelligence Division] and was assigned a case number used by the FBI for possible violations of the Foreign Agents Registration Act (FARA), Title 18 U.S.C. § 951, which makes it a crime to act as an agent of a foreign government without making periodic public disclosures of the relationship. 170

170 The FARA statute defines an “agent of a foreign government” as an individual who agrees to operate in the United States subject to the direction or control of a foreign government or official. 18 U.S.C. § 951(d).

To read like this:

Crossfire Hurricane was opened by CD and was assigned a case number used by the FBI for possible violations of the Foreign Agents Registration Act (FARA), 22 U.S.C. § 611, et seq., and 18 U.S.C. § 951 (Agents of Foreign Governments). 170

170 We have previously found differing understandings between FBI agents and federal prosecutors and NSD officials about the intent of FARA as well as what constitutes a “FARA case.” See DOJ OIG, Audit of the National Security Division~ Enforcement and Administration of the Foreign Agents Registration Act, Audit Division 16-24 (September 2016), https://oig.justice.gov/reports/2016/al624.pdf (accessed December 19, 2019)

The error appears harmless on its face, just a minor citation error that conflated FARA with 951 in the original report. But both in this instantiation and in the IG Report as a whole, the error may totally undermine its analysis and, indeed, the analytical framework of this entire IG investigation. That’s because if the people conducting this analysis did not understand the difference between the two statutes — and the error goes well beyond the citation enhancement described in the correction, because it exhibits utter lack of knowledge that there are two foreign agent statutes — then the Report’s analysis on the First Amendment may be problematic (and almost certainly is with respect to Page).

As I’ve written at length and as the cited IG Report from 2016 explains, the boundary between 22 USC 611 (FARA) and 18 USC 951 (Foreign Agent), both laws about what makes someone a “foreign agent,” remains ambiguous. Maria Butina, Anna Chapman, and the Russians who tried to recruit Carter Page were prosecuted under 18 USC 951 (though often that gets charged as a conspiracy because proving it requires less classified evidence), Paul Manafort, Rick Gates, and Sam Patten pled guilty to FARA violations. Mike Flynn’s former partner, Bijan Kian, was charged with conspiring to file a false FARA filing and acting as a Foreign Agent, invoking both statutes in one conspiracy charge; partly because of the way he was charged and partly because Flynn reneged on his statements regarding their activities, Judge Anthony Trenga acquitted him after he was found guilty, which may suggest the boundary between the two will present legal difficulties for prosecuting such cases.

18 USC 951 is sometimes called “espionage light,” though that phrase ignores that DOJ will often charge a known foreign spy under 951 — like the SVR (foreign intelligence) agents who tried to recruit Page — because proving it requires far less classified information. It requires the person be working on behalf of a foreign government, not just a foreign principal, and can but does not necessarily include information collection. FARA, however, only requires a person to be working on behalf of a foreign principal (which might be a political party or a company), and generally pertains to political influence peddling (it includes political activities, lobbying, and PR in its definitions, along with some financial stuff). 18 USC 951 will more often be clandestine, though as Butina’s case shows, it does not have to be, whereas FARA may cover activities that are overt if the person engaging in them does not register properly. A recent Lawfare post describes how DOJ’s superseding indictment of the Internet Research Agency relies on an interesting and potentially troubling new application of FARA.

In Mueller’s description of how the two laws might be applied criminally, he suggests 951 does not require willfulness, but a criminal violation of FARA would.

The Office next assessed the potential liability of Campaign-affiliated individuals under federal statutes regulating actions on behalf of, or work done for, a foreign government.

a. Governing Law

Under 18 U.S.C. § 951, it is generally illegal to act in the United States as an agent of a foreign government without providing notice to the Attorney General. Although the defendant must act on behalf of a foreign government (as opposed to other kinds of foreign entities), the acts need not involve espionage; rather, acts of any type suffice for liability. See United States v. Duran, 596 F.3d 1283, 1293-94 (11th Cir. 2010); United States v. Latchin, 554 F.3d 709, 715 (7th Cir. 2009); United States v. Dumeisi, 424 F.3d 566, 581 (7th Cir. 2005). An “agent of a foreign government” is an ” individual” who “agrees to operate” in the United States “subject to the direction or control of a foreign government or official.” 18 U.S.C. § 951 ( d).

The crime defined by Section 951 is complete upon knowingly acting in the United States as an unregistered foreign-government agent. 18 U.S.C. § 95l(a). The statute does not require willfulness, and knowledge of the notification requirement is not an element of the offense. United States v. Campa, 529 F.3d 980, 998-99 (11th Cir. 2008); Duran, 596 F.3d at 1291-94; Dumeisi, 424 F.3d at 581.

The Foreign Agents Registration Act (FARA) generally makes it illegal to act as an agent of a foreign principal by engaging in certain (largely political) activities in the United States without registering with the Attorney General. 22 U.S.C. §§ 611-621. The triggering agency relationship must be with a foreign principal or “a person any of whose activities are directly or indirectly supervised, directed, controlled, financed, or subsidized in whole or in major part by a foreign principal.” 22 U.S.C. § 61 l(c)(l). That includes a foreign government or political party and various foreign individuals and entities. 22 U.S.C. § 611(6). A covered relationship exists if a person “acts as an agent, representative, employee, or servant” or “in any other capacity at the order, request, or under the [foreign principal’s] direction or control.” 22 U.S.C. § 61 l(c)(l). It is sufficient if the person “agrees, consents, assumes or purports to act as, or who is or holds himself out to be, whether or not pursuant to contractual relationship, an agent of a foreign principal.” 22 U.S.C. § 61 l(c)(2).

The triggering activity is that the agent “directly or through any other person” in the United States (1) engages in “political activities for or in the interests of [the] foreign principal,” which includes attempts to influence federal officials or the public; (2) acts as “public relations counsel, publicity agent, information-service employee or political consultant for or in the interests of such foreign principal”; (3) ” solicits, collects, disburses, or dispenses contributions, loans, money, or other things of value for or in the interest of such foreign principal”; or ( 4) “represents the interests of such foreign principal” before any federal agency or official. 22 U .S.C. § 611 ( c )(1 ).

It is a crime to engage in a “[w]illful violation of any provision of the Act or any regulation thereunder.” 22 U.S.C. § 618(a)(l). It is also a crime willfully to make false statements or omissions of material facts in FARA registration statements or supplements. 22 U.S.C. § 618(a)(2). Most violations have a maximum penalty of five years of imprisonment and a $10,000 fine. 22 U.S.C. § 618. [my emphasis]

So back to the DOJ IG Report. As the revised footnote notes, at least until 2016, the FBI used the same case number for FARA and 951 cases. That probably makes sense from an investigative standpoint, as it’s often not clear whether someone is working for a foreign company or whether that company is a cut-out hiding a foreign government paymaster (as the government alleged in Flynn’s case). But it makes tracking how these cases get investigated more difficult, and obscures those cases where there’s a clear 951 predicate from the start.

The original text of this passage of the IG Report suggests that at least the person who wrote it — and possibly the entire DOJ IG team investigating this case — were not aware of what I’ve just laid out, that there’s significant overlap between 951 and FARA, but that clear 951 cases and clear FARA cases will both use this case designation. That’s important because one of these statutes involves politics (and so presents serious First Amendment considerations), whereas the other one does not have to (and did not, in Carter Page’s case).

It’s unclear whether this error was repeated in several other places in the Report. The passage describing how the individualized investigations were opened says these were all FARA cases:

After conducting preliminary open source and FBI database inquiries, intelligence analysts on the Crossfire Hurricane team identified three individuals–Carter Page, Paul Manafort, and Michael Flynn–associated with the Trump campaign with either ties to Russia or a history of travel to Russia. On August 10, 2016, the team opened separate counterintelligence FARA cases on Carter Page, Manafort, and Papadopoulos, under code names assigned by the FBI. On August 16, 2016, a counterintelligence FARA case was opened on Flynn under a code name assigned by the FBI. The opening ECs for all four investigations were drafted by either of the two Special Agents assigned to serve as the Case Agents for the investigation (Case Agent 1 or Case Agent 2) and were approved by Strzok, as required by the DIOG.

But if the person writing this did not know that a “foreign agent” case might be FARA, 951, or both, then it would mean this passage may misstate what the investigations were.

And the analysis over whether the investigation was appropriately predicated uses just FARA.

The FBI’s opening EC referenced the Foreign Agents Registration Act (FARA) and stated, “[b]ased on the information provided by [the FBI Legal Attache], this investigation is being opened to determine whether individual(s) associated with the Trump campaign are witting of and/or coordinating activities with the Government of Russia.”

In other words, it seems that this entire report is based on the assumption that the FBI was conducting an investigation into whether these four men were engaged in influence peddling that should have been registered and not also considering whether they were acting as clandestine agents for Russia.

That certainly appears to be the case for some of these men. For example, the first known warrant investigating Paul Manafort — which was focused on his Ukrainian work — listed only FARA, not 951. The derogatory language on George Papadopoulos speaks in terms of explicit, shameless influence peddling (which I’ll review in a follow-up post).

That said, the predication of the Flynn investigation would have included his past ties to the GRU, the agency that had hacked the DNC, and non-political relationships with Russian companies RT, Kaspersky, and Volga-Dnepr Airlines. He notified the Defense Intelligence Agency of all those things, though the government claims some of his briefings on this stuff includes inculpatory information. And he excused his payments from other Russian sources because his speakers bureau, and not Russia itself, made the payments, which might be considered a cut-out.

When Mueller got around to describing his prosecutorial decisions about these four men, he described both statutes (and explained that the office found that Manafort and Gates had violated FARA with Ukraine, Flynn had violated what it calls FARA with Turkey but elsewhere they’ve said included 951, and there was evidence Papadopoulos was an Agent of Israel under either 951 or FARA but not sufficient to charge.

Finally, the Office investigated whether one of the above campaign advisors-George Papadopoulos-acted as an agent of, or at the direction and control of, the government of Israel. While the investigation revealed significant ties between Papadopoulos and Israel (and search warrants were obtained in part on that basis), the Office ultimately determined that the evidence was not sufficient to obtain and sustain a conviction under FARA or Section 951

So it’s unclear whether the investigations into Papadopoulos, Flynn, and Manafort really were just FARA cases when they began, or were 951.

But the language Mueller used to describe his declination for Page (which includes a redacted sentence about his activities) makes it sound like his FISA applications alleged him to be — as would have to be the case for a FISA order — an Agent of Russia, implicating 951.

On four occasions, the Foreign Intelligence Surveillance Court (FISC) issued warrants based on a finding of probable cause to believe that Page was an agent of a foreign power. 50 U.S.C. §§ 1801 (b ), 1805(a)(2)(A). The FISC’s probable-cause finding was based on a different (and lower) standard than the one governing the Office’s decision whether to bring charges against Page, which is whether admissible evidence would likely be sufficient to prove beyond a reasonable doubt that Page acted as an agent of the Russian Federation during the period at issue. Cf United States v. Cardoza, 713 F.3d 656, 660 (D.C. Cir. 2013) ( explaining that probable cause requires only “a fair probability,” and not “certainty, or proof beyond a reasonable doubt, or proof by a preponderance of the evidence”).

Indeed, the IG Report provides abundant reason to believe this is the case. That’s because the FBI Field Office opened an investigation into Page in April 2016 based on a March 2016 interview pertaining exclusively to what are called “continued contacts” with SVR intelligence officers who tried to recruit him starting at least in 2009, interactions that they had been tracking for seven years.

An FBI counterintelligence agent in NYFO (NYFO CI Agent) with extensive experience in Russian matters told the OIG that Carter Page had been on NYFO’s radar since 2009, when he had contact with a known Russian intelligence officer (Intelligence Officer 1). According to the EC documenting NYFO’s June 2009 interview with Page, Page told NYFO agents that he knew and kept in regular contact with Intelligence Officer 1 and provided him with a copy of a non-public annual report from an American company. The EC stated that Page “immediately advised [the agents] that due to his work and overseas experiences, he has been questioned by and provides information to representatives of [another U.S. government agency] on an ongoing basis.” The EC also noted that agents did not ask Page any questions about his dealings with the other U.S. government agency during the interviews. 180

NYFO CI agents believed that Carter Page was “passed” from Intelligence Officer 1 to a successor Russian intelligence officer (Intelligence Officer 2) in 2013 and that Page would continue to be introduced to other Russian intelligence officers in the future. 181 In June 2013, NYFO CI agents interviewed Carter Page about these contacts. Page acknowledged meeting Intelligence Officer 2 following an introduction earlier in 2013. When agents intimated to Carter Page during the interview that Intelligence Officer 2 may be a Russian intelligence officer, specifically, an “SVR” officer, Page told them he believed in “openness” and because he did not have access to classified information, his acquaintance with Intelligence Officer 2 was a “positive” for him. In August 2013, NYFO CI agents again interviewed Page regarding his contacts with Intelligence Officer 2. Page acknowledged meeting with Intelligence Officer 2 since his June 2013 FBI interview.

In January 2015, three Russian intelligence officers, including Intelligence Officer 2, were charged in a sealed complaint, and subsequently indicted, in the Southern District of New York (SDNY) for conspiring to act in the United States as unregistered agents of the Russian Federation. 182 The indictment referenced Intelligence Officer 2’s attempts to recruit “Male-1” as an asset for gathering intelligence on behalf of Russia.

On March 2, 2016, the NYFO CI Agent and SDNY Assistant United States Attorneys interviewed Carter Page in preparation for the trial of one of the indicted Russian intelligence officers. During the interview, Page stated that he knew he was the person referred to as Male-1 in the indictment and further said that he had identified himself as Male-1 to a Russian Minister and various Russian officials at a United Nations event in “the spirit of openness.” The NYFO CI Agent told us she returned to her office after the interview and discussed with her supervisor opening a counterintelligence case on Page based on his statement to Russian officials that he believed he was Male-1 in the indictment and his continued contact with Russian intelligence officers.

The FBI’s NYFO CI squad supervisor (NYFO CI Supervisor) told us she believed she should have opened a counterintelligence case on Carter Page prior to March 2, 2016 based on his continued contacts with Russian intelligence officers; however, she said the squad was preparing for a big trial, and they did not focus on Page until he was interviewed again on March 2. She told us that after the March 2 interview, she called CD’s Counterespionage Section at FBI Headquarters to determine whether Page had any security clearances and to ask for guidance as to what type of investigation to open on Page. 183 On April 1, 2016, the NYFO CI Supervisor received an email from the Counterespionage Section advising her to open a [~9-character redaction] investigation on Page. The NYFO CI Supervisor said that [3 lines redacted] In addition, according to FBI records, the relevant CD section at FBI Headquarters, in consultation with OGC, determined at that time that the Page investigation opened by NYFO was not a SIM, but also noted, “should his status change, the appropriate case modification would be made.” The NYFO CI Supervisor told us that based on what was documented in the file and what was known at that time, the NYFO Carter Page investigation was not a SIM.

Although Carter Page was announced as a foreign policy advisor for the Trump campaign prior to NYFO receiving this guidance from FBI Headquarters, the NYFO CI Supervisor and CI Agent both told the OIG that this announcement did not influence their decision to open a case on Page and that their concerns about Page, particularly his disclosure to the Russians about his role in the indictment, predated the announcement. However, the NYFO CI Supervisor said that the announcement required noting his new position in the case file should his new position require he obtain a security clearance.

On April 6, 2016, NYFO opened a counterintelligence [8-9 character redaction] investigation on Carter Page under a code name the FBI assigned to him (NYFO investigation) based on his contacts with Russian intelligence officers and his statement to Russian officials that he was “Male-1” in the SONY indictment.

181 CI agents refer to this as “slot succession,” whereby a departing intelligence officer “passes” his or her contacts to an incoming intelligence officer.

182 Intelligence Officer 3 pied guilty in March 2016. The remaining two indicted Russian intelligence officers were no longer in the United States.

183 CI agents in NYFO told us that the databases containing security clearance information were located at FBI Headquarters. When a subject possesses a security clearance, the FBI opens an espionage investigation; if the subject does not possess a security clearance, the FBI typically opens a counterintelligence investigation. [my emphasis]

I’ve discussed Page’s designation as a “contact approval” until 2013 by CIA here, though to reiterate, his last contact with the CIA was in 2011, and while they knew about his contacts with Alexander Bulatov, a Russian intelligence officer working under cover as a consular official in NY, they apparently did not know or ask him about his contacts with Victor Podobnyy. This previous relationship with the CIA absolutely should have been disclosed, but does not cover activity in 2015, when he would have discussed his inclusion in the Podobnyy/Evgeny Buryakov indictment with a person described as a Russian minister.

The NYFO believed they should have opened an investigation into Page even before the interview, on March 2, 2016, when he admitted telling Russians he was Male-1 in the indictment and (per the Mueller Report), said he “didn’t do anything,” perhaps disavowing any help to the FBI investigation. The IG Report notes that Page provided Intelligence Officer 1 (who must be Bulatov) a copy of a non-public annual report from an American company.” The Podobnyy indictment notes that Page provided Podobnyy — someone he knew to be a foreign intelligence officer — documents about the energy business. The NYFO CI Agent’s description of Page’s, “continued contact with Russian intelligence officers” seems to suggest the person described as a Russian Minister is known or believed to be an intelligence officer (otherwise she would not have described this as ongoing contact).

Notably, NYFO’s focus was not on whether Page was engaged in political activities, whether he was a Sensitive Investigative Matter (SIM) or not. Indeed, at the time they opened the investigation in April 2016, they didn’t know he had a tie to the Trump campaign.

Rather, their focus was on whether Page, whose deployments in the Navy included at least one intelligence operation, had a security clearance, because that dictated whether the investigation into him would be an Espionage one or a Counterintelligence one. The actual type of investigation remains redacted (the word cannot be either “counterintelligence,” because of length, or “espionage” because the article preceding it forecloses the word starting with a vowel), but it is described as a counterintelligence investigation. Given the nature of the non-public information Page shared, that redacted word may pertain to economic information, perhaps to either 18 USC 1831 or 1832. Even going forward, NYFO was primarily interested in whether he would obtain a clearance that would increase the risk that the information he was happily sharing with known Russian intelligence officers would damage the US.

The counterintelligence case into Page was opened — and the FISA order targeting him was significantly predicated on — his voluntary sharing of non-public economic information with known Russian intelligence officers over a period of years. That’s almost certainly not a FARA investigation because at that point NYFO had no knowledge that Page was even engaging in politics.

And that’s important because of the IG Report’s analysis of whether and how obtaining a FISA order on Page implicated his First Amendment activities.

In its analysis of how FISA treats First Amendment activities, the Report includes the following discussion, once again citing FARA, relying on House and Senate reports on the original passage of FISA.

FISA provides that a U.S. person may not be found to be a foreign power or an agent of a foreign power solely upon the basis of activities protected by the First Amendment. 129 Congress added this language to reinforce that lawful political activities may not serve as the only basis for a probable cause finding, recognizing that “there may often be a narrow line between covert action and lawful activities undertaken by Americans in the exercise of the [F]irst [A]mendment rights,” particularly between legitimate political activity and “other clandestine intelligence activities. “130 The Report by SSCI accompanying the passage of FISA states that there must be “willful” deception about the origin or intent of political activity to support a finding that it constitutes “other clandestine intelligence activities”:

If…foreign intelligence services hide behind the cover of some person or organization in order to influence American political events and deceive Americans into believing that the opinions or influence are of domestic origin and initiative and such deception is willfully maintained in violation of the Foreign Agents Registration Act, then electronic surveillance might be justified under [“other clandestine intelligence activities”] if all the other criteria of [FISA] were met. 131

129 See 50 U.S.C. §§ 1805(a)(2)(A), 1824(a)(2)(A).

130 H. Rep. 95-1283 at 41, 79-80; FISA guidance at 7-8; see also Rosen, 447 F. Supp. 2d at 547-48 (probable cause finding may be based partly on First Amendment protected activity).

131 See S. Rep. 95-701 at 24-25. The Foreign Agents Registration Act, 22 U.S.C. § 611 et seq., is a disclosure statute that requires persons acting as agents of foreign principals such as a foreign government or foreign political party in a political or quasi-political capacity to make periodic public disclosure of their relationship with the foreign principal, as well as activities, receipts and disbursements in support of those activities.

The first citation to the House report says only that an American must be working with an intelligence service and must involve a violation of Federal criminal law, which may include registration statutes. The second citation says only that political activities should never be the sole basis of a finding of probable cause that a US person was an agent of a foreign power. Neither would apply to Carter Page, since the evidence against him also included sharing non-public information that had nothing to do with politics, and he shared that information with known intelligence officers.

The citation to the Senate report is a miscitation. The quoted language appears on page 29. The cited passage spanning pages 24 and 25, however, emphasizes that someone can only be targeted for activities that involve First Amendment activities if they involve an intelligence agency.

It is the intent of this requirement that even if there is some substantial contact between domestic groups or individual citizens and a foreign power, as defined in this bill, no electronic surveillance wider this subparagraph may be authorized unless the American is acting under the direction of an intelligence service of a foreign power.

With Page, the FBI had his admitted and sustained willingness to share non-public information with known intelligence officers, the Steele allegations suggesting he might be involved in a conspiracy tied to the hack and leak of Hillary’s emails, and his stated plans to set up a think tank that would serve as the kind of cover organization that would hide Russia’s role in pushing Page’s pro-Russian views.

The question of whether Page met probable cause for being a foreign agent doesn’t, in my mind, pivot on any analysis of First Amendment activities, because he had a clear, knowing tie with Russian intelligence officers with whom he was sharing non-public information. The question pivots on whether he could be said to doing so clandestinely, since he happily admitted the fact, if asked, to both the CIA and FBI. Both the Steele allegations (until such point, after his first application, that they had been significantly undermined) and Page’s enthusiasm to set up a Russian-funded think tank probably get beyond that bar.

And remember, for better and worse, this is probable cause, not proof beyond a reasonable doubt.

The DOJ IG Report analysis all seems premised on assessing FARA violations, not violations of 18 USC 951. That may be the appropriate lens through which to assess the actions of Papadopoulos, Flynn, and Manafort.

But the evidence presented in the report seems to suggest that’s a mistaken lens through which to assess the FISA application targeting Carter Page, the only Trump flunky who was so targeted. And given the evidence that at least some of the people who wrote the report did not understand how the two statutes overlap when they conducted the analysis, it raises real questions about whether all that analysis rests on mistaken understandings of the law.

Update: I’ve corrected the introduction of this to note that DOJ or FBI declassifies information, not DOJ IG.

The Steele Dossier and the Mueller Investigation: Michael Cohen

July 19, 2019/62 Comments/in 2016 Presidential Election, emptywheel, Mueller Probe /by emptywheel

Update: I’m reposting this on July 20 because these warrants have been re-released in less redacted form. As noted below in the update on Section C, that previously redacted section does pertain to Michael Cohen’s hush payments to Stormy Daniels, meaning the only mention of the Steele Dossier in the earliest warrant on Cohen is just to a post-dossier WSJ article used exclusively to explain Cohen’s own description of how he served as Trump’s fixer.

Because the frothy right thinks it’s an important question but won’t actually consult the public record, I’m doing a series on what that public record says about the relationship between the allegations in the Steele dossier and the known investigative steps against Trump’s associates. In this post, I argued that the way the Steele dossier influenced the Carter Page investigation may be slightly different than generally understood: it appears that the dossier appeared to predict — just like George Papadopoulos had — the release of the DNC emails on July 22. From that point forward, Page continued to do things — such as telling people in Moscow he was representing Donald Trump in December 2016, including on Ukraine policy — that were consistent with the general theory (though not the specific facts) laid out in the Steele dossier. That is, Page kept acting like the the Steele dossier said he would. That said, the government had plenty of reason before the Steele dossier to investigate Page for his stated willingness to share information with Russian spies, and his ongoing behavior continued to give them reason.

I’m more interested in the example of Michael Cohen.

The Steele dossier eventually describes Michael Cohen as the villain of coordination with Russia

The dossier makes allegations against Cohen four times, all after the time when Steele and Fusion GPS were shopping the dossier to the press, increasing the likelihood Russia got wind of the project and were shopping disinformation.

The first three mentions came on three consecutive days (probably based on just two sub-source to Kremlin insider conversations), all apparently sourced to the same second-hand access to a Kremlin insider, and evolving significantly over those three days. Importantly, the sub-source is also the source for the claim that Page had been offered the brokerage of the publicly announced Rosneft sale, meaning this person purportedly had access to Igor Sechin and a Kremlin insider, and if this source was intentionally feeding disinformation, it would account for the most obviously suspect claims in the dossier.

October 18, 2016 (134): A Kremlin insider tells the sub-source that Michael Cohen was playing a key role in the Trump campaign’s relationship with the Kremlin.

October 19, 2016 (135): The Kremlin insider tells his source that Cohen met with Presidential Administration officials in August 2016 to discuss how to contain Manafort’s Russia/Ukraine scandal and Page’s secret meetings with Russian leaders. Since that August meeting Trump-Russian conversations increasingly took place via pro-government policy institutes.

October 20, 2016 (136): In a communication that “had to be cryptic for security reasons,” a Kremlin insider tells a friend on October 19 that the reported meeting with Cohen took place in Prague using Rossotrudnichestvo as a cover. It involved Duma Head of Foreign Relations Committee Konstantin Kosachev. This is notably different from the PA claim made just the day before.

Then there’s the final report, which Steele has claimed was provided for “free,” dated after David Corn and Kurt Eichenwald’s exposure of the dossier, after the election, after the Obama Administration ratcheted up the investigation on December 9, and after Steele had interested John McCain in the dossier. In addition to offering a report that seems to project blame onto Webzilla for what the Internet Research Agency did, this report alleges what would be a veritable smoking gun, missing from the earlier reports: that Cohen had helped pay for the hackers.

December 13, 2016 (166): The August meeting in Prague was no longer about how to manage the Manafort and Page scandals, but instead to figure out how to make deniable cash payments to hackers (located in Europe, including Romania, where the original Guccifer had come from, not Russia), who were managed by the Presidential Administration, not GRU.

This December report is really the only one that claims Trump had a criminal role in the hack-and-leak, but the claims in the report all engage with already public claims: situating the hackers where the persona Guccifer 2.0 claimed to be from, Romania, suggesting the hackers were independent hackers who had to be paid rather than Russian military officers, and blaming Webzilla rather than Internet Research Agency for disinformation. That is, more than any other, this report looks like it was tailored to the Russian cover story.

The way this story evolved over time should have raised concerns, as should have other obvious problems with the December report. But it’s worth noting that there are two grains of truth in it. Cohen had been the key interlocutor between the Trump campaign and the Presidential Administration during the campaign, but to discuss the building of a Trump Tower in Moscow in January, not how to steal the election in October. Few people (at least in the US) should have known that he had played that interlocutor role; how many knew in Russia is something else entirely. Cohen was also someone that people who had done business with Trump Organization, like Giorgi Rtslchiladze and people associated with Aras Agalarov’s Crocus Group, would know to be Trump’s fixer. That fact would have been far more widely known.

Nevertheless, by the end of it, Cohen was the biggest Trump-associate villain in the Steele dossier. If the Steele dossier had been directing the investigative priorities of the FBI, then Cohen should have been a focus for his role in the hack-and-leak as soon as the FBI received this report. Nothing in the public record suggests that happened. Indeed, at the time the FBI briefed the Gang of Eight on March 9, 2017, Cohen was not among the people described as subjects. Just Roger Stone had been added to the initial four subjects (Page, Manafort, George Papadopoulos, and Mike Flynn) by that point. Congress, including the Devin Nunes-led House Intelligence Committee, would focus closely on Cohen more quickly than the FBI appears to have.

That’s true even though Cohen was doing some of the things he would later be investigated for, including — immediately after the election — establishing financial ties with Viktor Vekselberg even while Felix Sater pitched him on a Ukraine deal.

Suspicious Activity Reports and the investigation into Cohen

The investigation into Cohen appears to have started — given this July 18, 2017 warrant application — as an investigation into suspicious payments, both Cohen’s payments to Stormy Daniels and payments from large, often foreign companies, particularly Columbus Nova, with which Viktor Vekelsberg has close ties, but also including Novartis, Korean Airlines, and Kazkommertsnank. The investigation probably started based off a Suspicious Activity Report submitted by First Republic Bank, where Cohen had multiple accounts, including one for Essential Consulting, where those foreign payments were deposited.

Cohen opened that Essential Consultants account on October 26, 2016, ostensibly to collect fees for domestic real estate consulting work, but in fact to pay off Stormy Daniels. His use of it to accept all those foreign payments would have properly attracted attention and a SAR from the bank under Know Your Customer mandates, particularly with his political exposure through Trump. Sometime in June 2017, First Republic submitted the first of at least three SARs on this account, covering seven months of activity on the account; that SAR and a later one was subsequently made unavailable in the Treasury system as part of a sensitive investigation, which led to a big stink in 2018 and ultimately to charges against an IRS investigator who leaked the other reports. The language of the third one appears to closely match the language in the warrant applications, including a reference to Viktor Vekselberg’s donations to Trump’s inauguration.

The first warrant application against Cohen

On June 21, the FBI served a preservation request to Google for his Gmail and to Microsoft for Cohen’s Trump Organization emails (see this post for the significance of Microsoft’s role). Generally that suggests that already by that point, FBI decided they would likely want that email, but needed to put together the case to get it. The preservation order on Microsoft suggests they may have worried that people at Trump’s company might destroy damning emails. It also suggests the FBI knew that there was something damaging in those emails, which almost certainly came in part from contact information the bank had and call records showing contacts with Felix Sater and Columbus Nova; it might also suggest the NSA may have intercepted some of Cohen’s contacts with Russians in normal collection targeting those Russians.

That July 2017 warrant (confirmed in later warrants to be the first one used against Cohen) lists Acting as a Foreign Agent (18 USC 951) and false statements to a financial institution. It explains:

[T]he FBI is investigating COHEN in connection with, inter alia, statements he made to a known financial institution (hereinafter “Bank 1”) in the course of opening a bank account held in the name of Essential Consultants, LLC and controlled by COHEN. The FBI is also investigating COHEN in connection with funds he received from entities controlled by foreign governments and/or foreign principals, and the activities he engaged in in the United States on their behalf without properly disclosing such relationships to the United States government.

In other words, the predicate for the investigation was his bank account — one in conjunction with which he would eventually plead guilty to several crimes — not the dossier. Had Cohen told the truth about why he was opening that bank account (to pay off the candidate’s former sex partners!), had he not conducted his international graft with it, had he been honest he was going to be accepting large payments from foreign companies, then he might not have been investigated. It’s possible that the public reporting on the dossier made the bank pay more attention, but his actions already reached the level that the bank was required to report it.

In the unredacted parts of the application, there is one citation of the dossier, but only to the title of a WSJ report on Cohen written in the wake of the dossier release, “Intelligence Dossier Puts Longtime Trump Fixer in Spotlight.” It uses the article in a section introducing who he is to cite Cohen explaining that he’s Trump’s “fìx-it guy . . . . Anything that [then-President-elect Trump] needs to be done, any issues that concern him, I handle,” not to describe any allegations in the dossier.

From there, it introduces the bank account, Essential Consulting.

Redacted section C

Update, 7/19: These warrants have now been unsealed, and — as media outlets originally reported — this section is about the hush payment to Stormy Daniels. The section also confirms that much of this investigation came from the KYC work of Cohen’s bank. I’ve marked the paragraphs that consider the possibility this section pertains to Russia with strike-through text.

The next section, C, is six paragraphs long (¶¶13 to 18), and remains entirely redacted. If the substance of the dossier appears in the warrant application, it would appear here. But such a redacted passage does not appear at all in a search warrant application for Paul Manafort from May, and no redacted passage appears as prominently in a Manafort warrant application from ten days later — which describes his relationship with three Russian oligarchs and the June 9 meeting — though there is a six page redaction describing the investigative interest in the June 9 meeting. The difference is significant because the dossier alleged that Manafort was managing relations with Russia until he left the campaign (including during June), so if there were redacted language about the dossier on Cohen, we would expect it to play a similar role in applications on Manafort, but nothing public suggests it does.

Some background on this redacted section. We got the Mueller-related warrants on Cohen because a bunch of media outlets asked Chief Judge Beryl Howell to liberate them on March 26, the week after Mueller officially finished his investigation. At first, Jonathan Kravis, the DC AUSA who has taken the lead in much of the ongoing Mueller word, noticed an appearance to respond. But it was actually Thomas McKay, one of the SDNY AUSA who prosecuted Cohen there, who responded to the request, along with another SDNY attorney.

Although the Warrant Materials were sought and obtained by the Special Counsel’s Office (“SCO”), the Government is represented in this matter by the undersigned attorneys from the United States Attorney’s Office for the Southern District of New York (“SDNY”), as the SCO’s investigation is now complete.

They argue that they’re willing to release the warrant materials under terms consistent with the terms used in SDNY, where information about the FBI affiants and information we know deals with the hush payments investigation got redacted.

Judge Pauley ruled that “the portions of the Materials relating to Cohen’s campaign finance crimes shall be redacted” to protect an ongoing law enforcement investigation, along with “the paragraphs of the search warrant affidavits describing the agents’ experience or law enforcement techniques and procedures.” Cohen, 2019 WL 472577, at *6. By contrast, Judge Pauley ordered that the portions of the materials that did not relate to the campaign finance investigation be unsealed, subject to limited redactions to protect the privacy interests of certain uncharged third parties. Id. at *6-7. Judge Pauley’s decision in these respects is also consistent with prior decisions of this Court, which have recognized the distinction between law enforcement interests in ongoing, as opposed to closed, investigations, as well as the importance of respecting privacy concerns for uncharged third parties. See, e.g., Matter of the Application of WP Company LLC, 16-mc-351 (BAH), 2016 WL 1604976, at *2 & n.2 (D.D.C. Apr. 1, 2016).

Consistent with the foregoing, the Government does not oppose the Petitioners’ request for partial unsealing, but respectfully requests that the Court authorize redactions consistent with those authorized by Judge Pauley in the SDNY litigation.

Because of this language, some people assume the redacted passage C relates to the hush payments, which were, after all, the reason Cohen opened the account in the first place. That may well be the case: if so, the logic of the warrant application would flow like this:

A: Michael Cohen

B: Essential Consultants, LLC

C: Use of Essential Consultants to pay hush payments

[Later warrants would include a new section, D, that described Cohen’s lies about his net worth to First Republic]

D: Foreign Transactions in the Essential Consultants Account with a Russian Nexus

i. Deposits by Columbus Nova, LLC

ii. Plan to Life Russian Sanctions

E: Other Foreign Transactions in the Essential Consultants Account

That would explain McKay’s role in submitting the redactions, as well as his discussion of redacting the warrant consistent with what was done in SDNY, to protect ongoing investigations. (The government will have to provide a status report in August on whether these files still need to be redacted.)

That said, it was not until April 7, 2018 that anyone first asked for a warrant to access Cohen’s email accounts in conjunction with the campaign finance crimes. And some SARs submitted in conjunction with the hush payments, such as one associated with the $130,000 payment on October 27, 2016 to then Daniels lawyer Keith Davidson and one from JP Morgan Chase reflecting the transfer from the Essentials Consulting account to Davidson’s were not restricted in May 2018 in conjunction with a sensitive investigation (nor was the third one reflecting the foreign payments described above), suggesting they weren’t the most sensitive bits in May 2018. Of note, the Elliot Broidy payments to Essential Consulting would post-date this period of the investigation.

That leaves a possibility (though not that likely of one) that Section C could describe the Russian investigation. The next passage after the redacted one describes the “foreign transactions in the Essential Consultants Account with a Russian nexus” (though, as noted, subsequent warrants describe Cohen’s lies in the following paragraph). It describes the $416,664 in payments from Columbus Nova, and describes the tie between Columbus Nova and Vekselberg. After introducing the payments, the affidavit describes the public report on a back channel peace plan pitched by Felix Sater on behalf of Ukrainian politician Andrii Artemenko.

~~Another possibility is that it describes Trump’s inauguration graft, which embroils Cohen and Broidy (though the investigation into Broidy is in EDNY, not SDNY).~~

Perhaps most likely, however, is that that section just describes other reasons why that Essential Consulting account merited a SAR. For example, it might describe how Cohen set up a shell company to register the company, something that doesn’t show up in the unredacted sections, but which is a key part of the hush payment prosecution.

If the section does not mention the Russian investigation generally (and the dossier specifically), then it means there is no substantive mention of it in the warrant at all, meaning it played at most a secondary role in the focus on Cohen.

As the timeline of the investigation into Cohen below shows, that redacted section would grow by one paragraph in the next warrant application, for Cohen’s Trump Organization emails, obtained just two weeks later. It would remain that length for all the other unsealed Mueller warrants.

Felix Sater and the investigation into Cohen

The way in which Sater is mentioned in the warrants against Cohen presents conflicting information about what might be in that redacted section. Significantly, Sater (described as Person 3) is introduced as if for the first time, in the discussion of the Ukrainian deal that appears after the redaction. That means that he doesn’t appear in the redacted material. That’s important because Sater would be one other possible focus of any introduction to why Cohen would become the focus of the Russian investigation (aside from the dossier).

The next warrant would also note numerous calls with Sater, reflecting legal process for call records not identified here (the government almost certainly had a PRTT on Cohen’s phones by then). But those calls, as described, were in early 2017 (tied to the suspected Ukrainian peace plan), not in 2015-2016 when the two men were discussing a Trump Tower Moscow.

Mueller interviewed Sater on September 19, 2017, the first of two FBI interviews (he also appeared before the grand jury on an unknown date).

One of the most interesting changes to the Mueller warrants happens after that: In warrant applications submitted on November 13, the unredacted discussion of the Ukraine peace deal gets dropped. It’s unlikely Mueller’s investigation of it was eliminated entirely, because Mike Flynn, who allegedly ultimately received that deal, is not known to have been cooperating yet (his first known proffer was three days later, on November 16), and Mueller was still interested in interviewing Andrii Artemenko — the Ukrainian politician who pitched the deal — in June 2018.

In addition, based off the details in the Mueller Report cited to Sater’s September interview, Mueller was already investigating the Trump Tower deal. That suggests both topics — the Trump Tower deal and the Ukranian peace pitch — could appear in the redacted passage. Indeed, while the unredacted passages don’t explain it, one important reason to obtain the earlier emails would be to obtain the communications between Sater and Cohen during that period.

None of these warrants explain why Mueller became convinced that Cohen had lied to Congress, but by the second December interview of Sater, he presumably knew that Cohen had lied. But he probably didn’t have all the documents on the deal until he subpoenaed Trump Organization in March 2018.

All of which is to say, the treatment of the warrants’ Sater’s ties to Cohen, so important in any consideration of Cohen’s ties to Russia, ultimately don’t help determine what’s in that section.

If Mueller obtained Cohen’s location data, it was only second-hand

Finally, there’s one other detail not shown in the Mueller warrants you might expect to have if the Steele dossier was central to the Cohen investigation: a concerted effort to confirm his location during August 2016, when the dossier claimed he had been in Prague.

Granted, by obtaining records from Google, Mueller would get lots of information helpful to confirming location. For example, Google would have provided all the IP addresses from which Cohen accessed his account going back to January 2016. He would have obtained calendar data, if Cohen used that Google function. The warrant (as all warrants to Google would) asks for “evidence … to determine the geographic and chronological context of account access” and describes the various ways investigators can use Google to ID location (though it doesn’t specifically talk about location data in conjunction with Google Maps).

Mueller would get even more information from the Apple warrant obtained on August 7, 2017. The warrant for Cohen’s iCloud account on August 7 focused on a new iPhone (a 4s!!!) he obtained on September 28, 2016 and used for a function that gets redacted (which, again, could be the hush payments). It described his use of Dust and WhatsApp on the phone (Dust was what he used with Felix Sater), meaning one reason they were interested in the account was not for Cohen’s Apple content, but for anything associated with the apps he used on his phone (remember that Mueller got Manafort’s otherwise encrypted WhatsApp chats from Apple; the Apple specific language notes that some users back up their WhatsApp texts to iCloud). That said, the language on Apple (as all warrants on it would) specified that users sometimes capture location data with the apps on their phones.

Apple allows applications and websites to use information from cellular, Wi-Fi, Global Positioning System (“GPS”) networks, and Bluetooth, to determine a user’s approximate location.

This is a way the FBI has increasingly gotten location data in recent years, via the apps that access it from your phone. So the FBI would have gotten information that would have helped them rule out a Cohen trip to Prague in 2016.

That said, it’s not until April 7 that the government obtained the only known warrant for cell location data. That warrant focused only on the campaign finance crimes, and it obtained historical data only started on October 1, 2016 — pointedly excluding the August 2016 period when Steele’s dossier alleged Cohen was in Prague.

In short, along the way, Mueller obtained plenty of information that would help him exclude a Prague meeting (and subpoenas and other government information — such as his Homeland Security file — could have helped further exclude a meeting). But there’s no sign in the public record that Mueller investigated the Steele dossier Prague meeting itself.

To sum up: while it’s possible the redacted portions discuss Russia and therefore potentially the dossier. But there are a lot of reasons to think that’s not the case. It is hypothetically possible that between March (when FBI wasn’t investigating Cohen) and May (when Mueller took over) the FBI had done something to chase down the dossier allegations on Cohen. But, there’s no evidence that Mueller investigated them. On the contrary, it appears that the investigation into Cohen arose from the Bank Secrecy Act operating the way it is designed to — to alert the Feds to suspect activity in timely fashion.

In another world, that should placate the frothy right. After all, they complain that the dossier was used in Carter Page’s FISA application. You’d think they’d be happy that, in the eight months between the time FBI obtained that order and started investigating Cohen aggressively, they hadn’t predicated an investigation into the dossier. By that time, there were overt things — like Vekselberg’s donation to the inauguration and the Ukraine plan — that were suspect and grounded in direct evidence.

Timeline

May 18, 2017: Possible date for meeting involving Jay Sekulow, Trump, and Cohen.

May 31, 2017: Cohen and lawfirm subpoenaed by HPSCI.

June 2017: A SAR from Cohen’s bank reflects seven months of suspicious activity in conjunction with this Essential Consulting account

June 2017: Federal Agents review Cohen’s bank accounts.

June 21, 2017: FBI sends a preservation request to Microsoft for Cohen’s Trump Org account.

July 14, 2017: FBI sends a preservation request to Microsoft for all Trump Org accounts.

July 18, 2017: FBI obtains a warrant for Cohen’s Gmail account focused on FARA charges tied primarily to the Columbus Nova stuff, but also his other foreign payments). ¶¶13-18 redacted.

July 20, 2017 and July 25, 2017: Microsoft responds to grand jury subpoenas about both Cohen’s account and TrumpOrg domain generally.

August 1, 2017: FBI obtains a warrant for Cohen’s Trump Org email account (which they obtained from Microsoft), adding bank fraud, money laundering, and FARA (as distinct from 951) to potential charges. ¶¶13-19 redacted. ¶¶20 to 24 note irregularities in claims to First Republic. ¶28 details how Cohen and Andrew Intrater started texting in large amounts on November 8, 2016, showing over 230 calls and 950 texts between then and July 14, 2017. ¶30 includes email reflecting visit to Columbus Nova. ¶31 reflects probable subpoena to bank (rather than just SARs). ¶32 describes Renova paying Cohen through Columbus Nova. ¶36 reflects phone records showing 20 calls with Felix Sater between January 5, 2017 and February 20, 2017, and one with Flynn on January 11, 2017. ¶39, ¶41 include new evidence from Google search.

August 7, 2017: FBI obtains a warrant for Cohen’s Apple ID (tied to his Google email). ¶¶14-20 redacted. ¶50-54 describes Cohen obtaining a new Apple iPhone 4s on September 28, 2016 and using it for a redacted purpose. It describes Cohen downloading Dust (the same encrypted program he used with Felix Sater) the day he set up the phone, and downloading WhatsApp on February 7, 2017.

August 17, 2017: FBI obtains second warrant on Cohen’s Gmail, not publicly released, but identified in second Google warrant. It probably added wire fraud to existing charges being investigated.

August 27-28, 2017: Cohen conducts a preemptive limited hangout on the Trump Tower story feeding WaPo, WSJ, and NYT.

August 31, 2017: Cohen releases the letter his attorney had sent — two weeks earlier — along with two earlier tranches of documents for Congress.

September 19, 2017: FBI interviews Sater. Cohen attempts to preempt an interview with SSCI by releasing a partial statement before testifying, only to have SSCI balk and reschedule the interview.

October 4, 2017: Additional SAR restricted because of ongoing sensitive investigations.

October 20, 2017: Cohen included in expanded scope of investigation.

October 24, 2017: HPSCI interviews Cohen.

October 25, 2017: SSCI interviews Cohen.

November 7, 2017: Mueller extends PR/TT on Cohen Gmail.

November 13, 2017: FBI obtains Cohen’s Gmail going back to June 1, 2015 and his 1&1 email. Adds wire fraud. ¶14-20 redacted.¶23a-25 adds Taxi medallion liability. Eliminates Ukraine/sanctions plan in unredacted section. Adds section F, payments in connection with political activities (associated with AT&T, expand Novartis, add Michael D Cohen and Associates.

December 15, 2017: FBI interviews Sater.

January 4, 2018: Mueller extends PR/TT on Cohen Gmail.

February 8, 2018: Mueller provides SDNY with Gmail and 1&1 email returns.

February 16, 2018: SDNY obtains d-order for header information on 1&1 account.

February 28, 2018: SDNY obtains warrant for emails sent after November 14, 2017 and warrant for emails Mueller handed over in conjunction with different conspiracy, false statements to a bank, wire fraud, and and bank fraud charges.

March 7, 2018: Mueller provides SDNY with iCloud returns.

March 15, 2018: Press reports that Mueller subpoenaed Trump Organization.

April 5, 2018: After CLOUD Act passes, SDNY applies for Google content that had been stored overseas and withheld in February 28 warrant.

April 7, 2018: FBI obtains warrant for cell location for two cell phones, tied only to illegal campaign donation investigation (the FBI would use this to use a triggerfish to identify which room he was in at Loews). FBI obtains warrant to access prior content for use in campaign donation investigation. This is the first warrant that lists 52 USC 30116 and 30109 as crimes being investigated.

April 8, 2018: FBI obtains warrant for cell location for two cell phones, tied only to illegal campaign donation investigation.FBI obtains warrant to search Cohen’s house, office, safe deposit box, hotel room, and two iPhones.

April 9, 2018: FBI obtains a warrant to correct Cohen’s hotel room.

June 20, 2018: Cohen steps down from RNC position.

July 27, 2018: Sources claim Cohen is willing to testify he was present, with others, when Trump approved of the June 9 meeting with the Russians.

August 7, 2018: First Cohen proffer to Mueller.

August 21, 2018: Cohen pleads guilty to SDNY charges. Warner and Burr publicly note that Cohen’s claim to know about the June 9 meeting ahead of time conflicts with his testimony to the committee.

September 12, 2018: Second proffer.

September 18, 2018: Third proffer.

October 8, 2018: Fourth proffer.

October 17, 2018: Fifth proffer.

November 12, 2018: Sixth proffer.

November 20, 2018: Seventh proffer.

November 29, 2018: Cohen pleads guilty to false statements charge.

As I disclosed last July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post.

Unwinding a Multithreaded Beast

January 28, 2019/100 Comments/in Russian hacks, Trump Administration /by Rayne

This is more than the usual caveat asking readers to note the byline on this post. I’m not the expert at this site on the investigations by Special Counsel’s Office or any other law enforcement body — for that see Marcy’s or bmaz’s posts and comments.

However I spend a lot of time on information technology, which is how I ended up reading a report on internet-mediated information warfare.

Last year the Senate Select Committee on Intelligence held a hearing about Foreign Influence on Social Media. One of the commissioned and invited research organizations was New Knowledge (NK), a cybersecurity/information integrity consultancy. NK’s director of research delivered prepared remarks and a whitepaper providing an overview of Russia’s influence operations and information warfare program.

The paper is a peppy read; it will little surprise those who have followed the Trump-Russia investigation and the role social media played in the 2016 election. But there are still bits which are intriguing — more so months after the paper was first delivered, in light of long-time ratfucker Roger Stone’s indictment this past week.

Note these two excerpts from the report:

There wasn’t a link in the indictment last year of the Russian Internet Research Agency personnel with Stone’s indictment. The IRA charges don’t overlap with Stone’s at all (count numbers from indictments in paren.).

Stone:
(1) Obstruction of Proceeding
(2-6) False Statements
(7) Witness Tampering

IRA:
(1) Conspiracy (to gain unauthorized access, hack and steal information)
(1) Wire Fraud Conspiracy
(3-7) Wire Fraud
(8,9) Aggravated Identity Theft
(10) Conspiracy Commit to Money Laundering

But Stone’s indictment reveals an interesting overlap of threads between Stone’s efforts on behalf of the Trump campaign and the information warfare operation the IRA conducted in 2016.

Why was the IRA propelling content to fluff Assange’s credibility in the days before the release of the hacked emails Stone was trying to manage? This is a rather odd service to offer as a tenth anniversary gift to a so-called journalism outlet which should be able to point to its achievements on its own.

The IRA wasn’t alone in its Assange cred-fluffing. What a coincidence the UK tabloid DailyMail also touted Assange’s ability to affect Clinton’s campaign with a release of hacked emails — and at nearly the same time the IRA was pumping up Assange’s image.

How odd this DailyMail piece was pegged to Wikileaks’ anniversary, but the headline on the article and subhead treat the anniversary as an afterthought compared to the hacked emails and their effect on the Clinton campaign.

It doesn’t look like social media alone manipulated public perception, or that manipulation was confined to U.S. media.

Perhaps these two threads — the IRA’s influence operation/information warfare and Stone’s hacked email ratfucking — weren’t directed by a common entity. The public may not know depending on the course of SCO’s criminal and counterintelligence investigations and what information is released. But they certainly sewed toward the same outcome.

Two Details That Many Are Missing in/about the Stone Indictment

January 27, 2019/209 Comments/in 2016 Presidential Election, Mueller Probe /by emptywheel

I’ve been traveling most of the day to get out of the Midwest before the snow and record low temperatures show up, and will be buried for three days working on things that have nothing to do with any investigation Mueller has been involved in since 2013.

But I do want to add two details to the parlor game going on about whether or not the Roger Stone indictment is the tip of a conspiracy-burg or evidence there’s no there there. Joyce White Vance argues that Mueller charged Stone the way he did to hide the rest of the conspiracy prosecution.

Why didn’t Mueller charge Stone with conspiracy? The rules in federal cases require that prosecutors provide defendants with broad discovery. By indicting Stone on a fairly narrow set of charges, Mueller limits what has to be disclosed & can protect ongoing investigation.

Randall Eliason offers a respectable version of the argument that the indictment suggests there won’t be a conspiracy case.

There have always been at least two possible end games for the Mueller investigation. He could uncover evidence of a widespread criminal conspiracy between the Trump campaign and Russians to influence the election. Or he could conclude that the campaign’s numerous documented interactions with Russians seeking to help Trump win were not criminal, but people close to Trump lied to cover up those interactions because revealing them would have been politically devastating.

Stone’s indictment falls into the coverup category. Mueller may have evidence of the broader conspiracy, and more charges may well be coming. But every case like Stone’s, or those against former campaign manager Paul Manafort, that is filed without charging a conspiracy with the Russians makes it seem more likely that criminal charges brought by the special counsel will end up being primarily about the coverups.

Andy McCarthy offers a less respectable version of the same.

Neither Eliason nor McCarthy account for one of the only new details in the indictment, showing that an unidentified Steve Bannon associate congratulated Stone on October 7.

On or about October 7, 2016, Organization 1 released the first set of emails stolen from the Clinton Campaign chairman. Shortly after Organization 1’s release, an associate of the high-ranking Trump Campaign official sent a text message to STONE that read “well done.” In subsequent conversations with senior Trump Campaign officials, STONE claimed credit for having correctly predicted the October 7, 2016 release.

This detail shows that the Trump campaign at least believed that Stone succeeded in getting WikiLeaks to drop the John Podesta emails to distract attention from the Access Hollywood video, which in turn is consistent with a claim Jerome Corsi made about Stone having advance knowledge of the Access Hollywood video and that he and Stone succeeded in timing the email release.

Corsi wrote in his forthcoming 57,000-word book that he told Zelinsky that Stone told him in advance that the “Access Hollywood” tape would be released.

He wrote that “although I could not remember exactly when Roger told me, or the precise substance of the discussion, I remembered Roger told me before the Washington Post went to press with the Billy Bush tape that the tape was coming and that it would be a bombshell.”

Corsi said he had three phone calls with Stone in the hours before the release of the tape.

“I know nothing about that, either does Jerry Corsi,” Stone told TheDCNF. When asked why Corsi might be motivated to make a false claim, Stone said: “He’s saying this because the prosecutors induced him to say it.”

Corsi also wrote that Zelinsky revealed that prosecutors had evidence of an email exchange between he and Stone “in which Stone expressed pleasure that Assange had released the Podesta emails as instructed.”

Corsi said he replied that he and Stone “should be given credit” for the release.

While Stone disputes Corsi’s claim and Corsi feigns forgetfulness about precisely what happened, by including a communication showing Stone getting credit for the timing, Mueller is suggesting that Corsi is right — and that he has credible, corroborating evidence to prove it.

That’s more coordination — between Corsi and Stone, but more importantly between some go-between and WikiLeaks — than would be the case if Stone’s indictment were all Mueller had. It would put Stone and Corsi in a conspiracy with WikiLeaks and their go-between(s).

Then there’s this detail from the motion to seal Stone’s indictment that no one has yet offered a full explanation for (indeed, most of the reports that noted that Amy Berman Jackson had been assigned the case didn’t explain this detail at all).

Someone — and it would almost certainly have to be the prosecutors (including one who, DC US Attorney’s office prosecutor Jonathan Kravis, is on the internet Research Agency case), — told the court that Stone’s namby pamby “process crime” is related to the big conspiracy case involving WIkiLeaks with a bunch of Russian hackers. (I’ve updated my running docket of Mueller and potentially related cases to reflect Stone’s indictment.) And while it’s true that Stone is described in the GRU indictment, he is not named in a way that the court would identify that by themselves. WikiLeaks shows up in both, but there’s no need to tie WikiLeaks cases together unless some defendant is going to show up to face prosecution (and WikiLeaks is does not take any of the overt acts described in the Stone indictment).

I don’t pretend to understand how this happened or what it all means. But there’s nothing about the Stone obstruction prosecution that would overlap with the evidence in the GRU indictment. And, as charged, the GRU indictment won’t be prosecuted at all until Julian Assange or someone else involved in it ends up in DC to face charges.

By all means, continue the parlor game. But at least explain how those two details fit into your theory of nothing-“berder” or grand conspiracy.

Update: By popular demand, I’m including the definition of a “related case” under DC’s local rules.

A related case for the purpose of this Rule means as follows:

(1) Criminal cases are deemed related when

(i) a superseding indictment has been filed, or

(ii) more than one indictment is filed or pending against the same defendant or defendants, or

(iii) prosecution against different defendants arises from a common wiretap, search warrant, or activities which are a part of the same alleged criminal event or transaction. A case is considered pending until a defendant has been sentenced.

Certainly, WikiLeaks is named as a co-conspirator in both. But it is not yet a defendant. Though both cases may rely on a wiretap targeting Wikileaks. Or perhaps Stone’s search warrant included his conversations with Guccifer 2.0, and so the other indictment.

Someone Has Already Been Charged for Most of the Actions the Steele Dossier Attributes to Michael Cohen

December 29, 2018/116 Comments/in 2016 Presidential Election, emptywheel, Mueller Probe /by emptywheel

Because of a McClatchy story claiming two new details corroborating a Steele dossier claim that Michael Cohen had a meeting with people serving the interests of Putin’s Administration, people have gotten themselves into a tizzy again about what a smoking gun it would be if the allegations in the Steele dossier were proven true.

It’s an utterly bizarre tizzy, both because the allegations in the Steele dossier not only don’t match some more damning allegations Cohen has already pled guilty to, but because Mueller has already charged other people for some of the allegations about Cohen made in the dossier. In other words, the McClatchy story has people excited about the wrong allegations, rather than focusing on the damning things Cohen (and others) have already been charged with.

Indeed, most functional allegations made in the Steele dossier have already been publicly explained in either court filings or sworn testimony. That doesn’t rule out that Cohen had a role in some of them, however. Indeed, one detail from Cohen’s SDNY plea — that among the things Trump Organization reimbursed Cohen for in January 2017 was a $50,000 payment to a tech services company — actually could confirm a detail made in the dossier. But generally, Mueller and other entities have already explained away many of the allegations made against Cohen in the dossier.

I’ve put the substantive claims the Steele dossier made about Cohen below. I’ll take each and show public reporting that explains who did something attributed to Cohen in the dossier.

Cohen met with Russian Presidential Administration Legal Department officials

The central allegation involving Cohen is that he met with people from Putin’s Presidential Administration’s legal department or, in a later version, someone acting on their behalf.

By the time that allegedly happened in August or maybe September, however, Cohen had already established a paper trail with someone more central than some anonymous lawyers. Cohen’s Mueller plea describes Cohen receiving an email on January 20, 2016 from Dmitry Peskov’s personal assistant and shortly thereafter calling her. Somehow Mueller knows that the assistant “asked detailed questions and took notes.” The day after Cohen spoke with the personal assistant, someone from Putin’s office called Felix Sater.

Given that Cohen made reservations to travel to St. Petersburg (for a possible meeting directly with Putin) on June 9, then canceled those reservations on June 14 (after Russia’s role in the DNC hack was made public), those communications about a Trump Tower deal surely tie to the hack-and-leak operation.

It’s certainly possible that, later in the summer (or in the fall, during Cohen’s known trips to London), Cohen would attempt to reschedule that meeting, though the purpose was originally and probably would remain more central to a quid pro quo trading a Trump Tower and election assistance for sanctions relief and policy considerations. But having already exchanged easily collectable communications directly with Peskov’s office (whom the dossier calls “the main protagonist” in the operation), it’s not clear how helpful using Rossotrudnichestvo would be to hide the Trump role. Furthermore, there are other known cut-outs for related matters, including Steele dossier source Sergei Millian and the Agalrovs.

Cohen aimed to contain the Paul Manafort scandal

The three Cohen reports in October all claim that Cohen got involved to tamp down scandals connecting Trump to Russia. That’s not, at all, far-fetched. After all, Cohen was Trump’s fixer and he told a bunch of lies to Congress in an effort to hide Trump’s Moscow Project.

That said, a filing explaining why Mueller might have to mention the Trump campaign in Manafort’s aborted DC trial and a filing in Alex Van der Zwaan’s prosecution show that Manafort and Rick Gates themselves — with the direct involvement of Oleg Deripaska associate Konstantin Kilimnik — worked to contain this scandal.

As Mueller laid out in numerous ways, the Manafort-Gates-Kilimnik team went on a crime spree in the fall trying to cover up their past activities with Russian-backed oligarchs.

Indeed, that a claim that Cohen managed this pushback (and its timing) appeared in the dossier is particularly tantalizing for two reasons. First, one of the things Manafort reportedly lied about after agreeing to cooperate with Mueller pertained a boat trip he took with Tom Barrack; Mueller seems to know that Kilimnik joined the two men. If that happened, then it would show that someone did indeed hold a meeting in August to contain the damage of Manafort’s burgeoning scandals, but that meeting would have been between a key Trump funder, Manafort himself, and someone suspected of ongoing ties with GRU, the agency that conducted the DNC hack.

More intriguing still, as I noted above, Kilimnik was Manafort’s go-between with Oleg Deripaska. That’s interesting because in 2016, Christopher Steele was attempting to convince DOJ’s Bruce Ohr that Deripaska could be a useful source on Russian organized crime. If Steele thought Deripaska would be a useful source for DOJ, he may well have been relying on Deripaska himself. If so, the report that Cohen (who in fact did have communications with Peskov!) was containing the damage of Manafort’s ties to Russian oligarchs might be an attempt to distract from the way that a Russian oligarch was actually working through his handler, Kilimnik, to minimize that damage himself.

Cohen aimed to contain the Carter Page scandal

It likewise seems unlikely that Cohen was the one to try to contain the Carter Page scandal. While he shouldn’t be relied on for anything, several claims in Page’s testimony to HPSCI provide an alternate explanation about who was containing the scandal tied to him.

Page denied ever speaking to Cohen.

But he did describe Keith Kellogg discussing the allegations with him. And he did describe Steve Bannon, both by himself and with the assistance of Trump’s election lawfirm, Jones Day, trying to minimize the Page scandal.

That’s consistent with a number of on-the-record claims from the campaign in the days following Page’s resignation in September. Which is to say, minimizing the Page scandal fell to the campaign itself.

The people who carried out the information operation had been paid by Russia and Trump

The three initial reports on Cohen came, in suspiciously quick succession, in October, after the number of reporters briefed on the Steele dossier started to expand.

The one other report implicating Cohen was the December 13 report, based on intelligence Steele claimed he obtained for “free.”

The report is most notable for the legal battle it caused. The allegations most clearly resemble what Adrian Chen had identified and attributed to the Internet Research Agency year earlier and there had been extensive reporting on it all through the campaign. But instead of blaming Internet Research Agency, the report blames all that on Webzilla. And Webzilla’s owner, Aleksei Gubarev was sufficiently comfortable facing the prospect of discovery to sue BuzzFeed right away (though he lost his lawsuit a few weeks back).

There’s another reference in the report to a long debunked claim made by the Russians — that a Romanian hacker was involved, presumably an allusion to Guccifer 2.0’s half-hearted claim to be Romanian.

Still, much of that last report instead presented the most inflammatory claim in the entire dossier: that Trump’s campaign had helped pay for the information operation targeting Hillary.

On its face, that claim makes zero sense. The scenario as a whole assumes that the hack was done by independent hackers coerced to work for the FSB — perhaps people like Yevgeniy Nikulin, who had already been arrested in Prague by this point. As far as Mueller has shown publicly, however, the information operation was instead done by two entities: Russians in the employ of Putin crony Yevgeniy Prigozhin’s Internet Research Agency and officers in the employ of Russia’s military intelligence agency, GRU. In indictments of both conspirators, Mueller provided details about how the money was handled.

So we’ve already got explanations for how the information operation was funded: by Prigozhin and the Russian state, using a range of money laundering techniques to hide Russia’s role. We even have evidence that — contrary to the claim about information warriors’ loyalty to Sergei Ivanov — Prighozhin’s employees even sucked up to him in one of their dry runs getting Americans to perform IRL actions.

Cohen arranged deniable cash payments to hackers working in Europe against the Clinton campaign

As noted, the December report involving Cohen made the most incendiary claim of all: that the Trump organization planned to pay for some of the hackers that targeted Hillary.

In spite of the fact that Mueller has already explained how the two main groups of participants in the information operation got funded, this allegation gets more interesting given details laid out in Cohen’s SDNY plea. Several of his SDNY crimes, after all, involving making deniable payments, in that case to Stormy Daniels and Karen McDougal.

That shows Cohen’s modus operandi for paying off Trump’s illicit debts. Mind you, it shows that he didn’t use cash. He laundered the funds using more sophisticated money laundering. But it does show that Cohen was the guy who did that kind of thing.

Which makes this detail included — but not explained — in the same plea document intriguing.

Cohen paid some tech company $50,000 in connection with the campaign.

That’s not a whole lot of money, in any case. And if it went to pay off part of the information operation, it would have to have involved some part of the operation not yet publicly identified. Even the one known instance of Trump supporters reaching out to hackers in Europe — Peter Smith’s reported consultation of Weev — is known to have been paid for by other means (in that case, Smith’s own fundraising).

Still, it’s certainly possible that that $50,000 went to some still unidentified entity that played a role in the information operation that, for some reason, didn’t get paid for by Putin’s cronies or the Russian state.

As I disclosed in July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post.

18 October

Speaking separately to the same compatriot in mid-October 2016, a Kremlin insider with direct access to the leadership confirmed that a key role in the secret TRUMP campaign/Kremlin was being played by the Republican candidates personal lawyer Michael COHEN. [redacted line]

19 October

1. Speaking in confidence to a longstanding compatriot friend in mid-October 2016, a Kremlin insider highlighted the importance of Republican presidential candidate Donald TRUMP’s lawyer, Michael COHEN, in the ongoing secret liaison relationship between the New York tycoon’s campaign and the Russian leadership. COHEN’s role had grown following the departure of Paul MANNAFORT as campaign manager in August 2016. Prior to that MANNAFORT had led for the TRUMP side.

2. According to the Kremlin insider, COHEN now was heavily engaged in a cover up and damage limitation operation in the attempt to prevent the full details of relationship with Russia being exposed. In pursuit of this aim, COHEN had met secretly with several Russian Presidential Administration (PA) Legal Department officials in an EU country in August 2016. The immediate issues had been to contain further scandals involving MANNAFORT’s commercial and political role in Russia/Ukraine and to limit the damage arising from exposure of former TRUMP foreign policy advisor, Carter PAGE’s secret meetings with Russian leadership figures in Moscow the previous month. The overall objective had been to “to sweep it all under the carpet and make sure no connections could be fully established or proven”

3. Things had become even “hotter” since August on the TRUMP-Russia track. According to the Kremlin insider, this had meant that direct contact between the TRUMP team and Russia had been farmed out by the Kremlin to trusted agents of influence working in pro-government policy institutes like that of Law and Comparative Jurisprudence. COHEN however continued to lead for the TRUMP team.

[snip]

The Kremlin insider was unsure of the identities of the PA officials with whom COHEN met secretly in August, or the exact date/s and locations of the meeting/s. There were significant internal security barriers being erected in the PA as the TRUMP issue became more controversial and damaging. However s/he continued to try to obtain these.

20 October

1. Speaking to a compatriot and friend on 19 October 2016, a Kremlin insider provided further details of reported clandestine meeting/s between Republican presidential candidate, Donald lawyer Michael COHEN and Kremlin representatives in August 2016. Although the communication between them had to be cryptic for security reasons, the Kremlin insider clearly indicated to his/her friend that the reported contact/s took place in Prague, Czech Republic.

2. Continuing on this theme, the Kremlin insider highlighted the importance of the Russian parastatal organisation, Rossotrudnichestvo, in this contact between TRUMP campaign representative/3 and Kremlin officials. Rossotrudnichestvo was being used as cover for this relationship and its office in Prague may well have been used to host the COHEN Russian Presidential Administration (PA) meeting/s. It was considered a “plausibly deniable” vehicle for this, whilst remaining entirely under Kremlin control.

3. The Kremlin insider went on to identify leading pro-PUTIN Duma figure, Konstantin KOSACHEV (Head of the Foreign Relations Committee) as an important figure in the TRUMP campaign-Kremlin liaison operation. KOSACHEV, also “plausibly deniable” being part of the Russian legislature rather than executive, had facilitated the contact in Prague and by implication, may have attended the meeting/s with COHEN there in August.

Company Comment

We reported previously, in our Company Intelligence Report 2016/135 of 19 October 2016 from the same source, that COHEN met officials from the PA Legal Department clandestinely in an EU country in August 2016. This was in order to clean up the mess left behind by western media revelations of TRUMP ex-campaign manager corrupt relationship with the former pro-Russian YANUKOVYCH regime in Ukraine and TRUMP foreign policy advisor, Carter secret meetings in Moscow with senior regime figures in July 2016. According to the Kremlin advisor, these meeting/s were originally scheduled for COHEN in Moscow but shifted to what was considered an operationally “soft” EU country when it was judged too compromising for him to travel to the Russian capital.

13 December

1. We reported previously (2016/135 and /136) on secret meeting/s held in Prague, Czech Republic in August 2016 between then Republican presidential candidate Donald TRUMP’s representative, Michael COHEN and his interlocutors from the Kremlin working under cover of Russian ‘NGO’ Rossotrudnichestvo.

2. [two lines redacted] provided further details of these meeting/s and associated anti- CLINTON/Democratic Party operations. COHEN had been accompanied to Prague by 3 colleagues and the timing of the visit was either in the last week of August or the first week of September. One of their main Russian interlocutors was Oleg SOLODUKHIN operating under Rossotrudnichestvo cover. According to [redacted] the agenda comprised questions on how deniable cash payments were to be made to hackers who had worked in Europe under Kremlin direction against the CLINTON campaign and various contingencies for covering up these operations and Moscow’s secret liaison with the TRUMP team more generally.

3. [redacted] reported that over the period March-September 2016 a company called XBT/Webzilla and its affiliates had been using botnets and porn traffic to transmit viruses, plant bugs, steal data and conduct “altering operations” against the Democratic Party leadership. Entities linked to one Aleksei GUBAROV were involved and he and another hacking expert, both recruited under duress by the FSB, Seva KAPSUGOVICH, were significant players in this operation. In Prague, COHEN agreed contingency plans for various scenarios to protect the Operation, but in particular what was to be done in the event that Hillary CLINTON won the presidency. It was important in this event that all cash payments owed were made quickly and discreetly and that cyber and other operators were stood down/able to go effectively to ground to cover their traces. (We reported earlier that the involvement of political operatives Paul MANAFORT and Carter PAGE in the secret TRUMP-Kremlin liaison had been exposed in the media in the run-up to Prague and that damage limitation of these also was discussed by COHEN with the Kremlin representatives).

In terms of practical measures to be taken, it was agreed by the two sides in Prague to stand down various “Romanian hackers” (presumably based in their homeland or neighboring eastern Europe) and that other operatives should head for a bolt-hole in Plovdiv, Bulgaria where they should “lay low”. On payments, IVANOV’s associate said that the operatives involved had been paid by both TRUMP’s team and the Kremlin, though their orders and ultimately loyalty lay with IVANOV, as Head of the PA and thus ultimately responsible for the operation, and his designator successor/s after he was dismissed by president PUTIN in connection with the anti-CLINTON operation in mid August.

Yevgeniy Prigozhin Continues to Troll Both Online and in the Courts

November 25, 2018/21 Comments/in 2016 Presidential Election, 2018 Mid-Term Election, Blogs Internet and New Media, emptywheel /by emptywheel

xkcd comic used under Creative Commons license — available online at https://imgs.xkcd.com/comics/free_speech.png

The trolls are engaging in lawfare again.

For some time, I’ve been fascinated by the way, particularly in the wake of the 2016 election tampering, Russians have engaged in lawfare to score political points against the US. There were the multiple lawsuits pertaining to the Steele dossier. There was Concord Management’s unexpected defense in the Internet Research Agency indictment. Last week, Yevgeniy Prigozhin’s trolls struck again, this time suing Facebook for deleting the account of Federal Agency of News on April 3, 2018.

I’m a bit mystified by this suit. It may be a moonshot bid to learn more about Mueller’s investigation and insinuate that Facebook is an agent of the US government. More likely, it may be as much about pressuring Facebook in Russia as it is about winning reinstatement on Facebook.

Another Prigozhin attempt to use lawfare to embarrass the US government (and their willing partner Facebook!)

As with Concord’s defense, Prigozhin has hired legit American lawyers for the lawfare. But unlike Concord’s defense, it’s not clear how seriously to take this effort. The suit complains, in significant part, that Facebook has deprived FAN of its First Amendment rights.

FAN’s publications and posts on Facebook were the exercise of its constitutionally protected freedom of speech to inform the general public of historical and current events in politics, entertainment and other areas of public interest.

Facebook violated FAN’s First Amendment rights by deleting the contents of FAN’s Facebook Page and blocking FAN’s access to its Facebook account.

Facebook took action against FAN in an effort to silence and deter FAN’s free speech.

Facebook violated FAN’s First Amendment rights solely on account of its and its members’ national origin.

As xkcd famously explained once, that’s not the way the First Amendment works. It only prevents the government from limiting speech. Facebook is a private company, and it can boot whatever users it sees fit. But FAN may be trying to do two things. First, by treating Facebook’s terms of service as a contract, it claims it fulfilled its side of the relationship, but Facebook nevertheless deleted its account.

FAN complied with the terms of the Contract by properly registering with Facebook, paying any fees that were due and complying with all applicable terms of service.

At no time did FAN violate the terms of the contract.

Despite its contractual obligation to provide FAN with access to Facebook. Facebook breached the contract by removing FAN’s Facebook account and blocking FAN’s content without a legitimate reason.

Then, by tying Facebook’s efforts to crack down on Russian trolls to US government efforts to respond to Russia’s 2016 operation, I suspect it is trying to argue that Facebook deleted FAN’s account as an agent of the US government, thereby amounting to a First Amendment violation. The very first section of the complaint’s Background description details, “Facebook and the United States Government Target Russian Websites.” Among other details to substantiate that effort, it cites:

The January 2017 Intelligence Community Assessment that described “a close Putin ally with ties to Russian intelligence” funding the Internet Research Agency
Former Facebook CISO Alex Stamos’ statements, which went overboard in trying to assure people they were hunting down all Russian influence operations, “even those with very weak signals of a connection and not associated with any known organized effort”
Mark Zuckerberg’s comments that Facebook was “actively working with the U.S. government on its ongoing investigations into Russian interference”

As the lawsuit lays out, when Facebook removed FAN’s account in April, both Stamos and Zuck said they were doing so solely because FAN was controlled by the Internet Research Association.

All that said, it’s still highly unlikely this will work. I’m not sure if any of the CA-specific complaints will either, but like I said, this is a moonshot.

Prigozhin’s corporate laundromat

To make the argument at all, of course, FAN has to dismiss the presumed and explicit reasons Facebook banned them, starting with the accusation that they’re tied to IRA. In part, that involves claiming that IRA was disbanded in 2016.

Upon information and belief, the IRA was liquidated on or about December 28, 2016.

It also describes the new digs FAN got in 2015, after cohabiting with IRA for a year.

At the time of FAN’s incorporation and until in or about the middle of 2015, FAN and the IRA were located in the same building at 55A Savushkina Street, Saint Petersburg, the Russian Federation, 197183.

In or about the beginning of 2015, FAN searched for new premises that would be more convenient for its business with regard to a larger space for the office premises. On July 1, 2015, FAN moved to a business center at 23J Krasnogvardeiskiy Lane, Saint Petersburg, 197342.

But it also involves denying claims made in the complaint against Elena Alekseevna Khusyaynova that was filed in September but not unsealed until October, events that post-dated Facebook’s banning of FAN by over five months. In that complaint, FBI Agent David Holt had alleged that FAN was one of the entities that helped obscure Project Lakhta’s disinformation efforts.

Beginning in or around mid-2014 and continuing to the present, Project Lakhta obscured its conduct by operating through a number of Russian entities, including Internet Research Agency LLC (“IRA”), Internet Research LLC, MediaSintez LLC, GlavSet LLC, MixInfo LLC, Azimut LLC, NovInfo LLC, Nevskiy News LLC (a/k/a “NevNov”), Economy Today LLC, National News LLC, Federal News Agency LLC (a/k/a “FAN”), and International News Agency (a/k/a “MAN”).

The complaint claims FAN has nothing to do with these efforts, in part by denying (correctly, by all public accounts) that Lakhta is a legal entity.

FAN has no knowledge of “Project Lakhta”. There is no known business or other organization in the Russian Federation that operates under such name. To the extent it is some sort of informal organization, FAN is unaware of its membership, goals or methods of operation.

FAN is not an entity within “Project Lakhta” and has no relationship with “Project Lakhta”, the IRA or GlavSet. To the contrary, FAN is a news gathering and dissemination organization. In that capacity, FAN gathers news from conventional sources and adheres to journalistic standards in its operations.

Denying any tie to IRA and Lakhta, however, also involves making claims about Khusyaynova that directly conflict with the claims in the complaint. Khusyaynova, the lawsuit claims, is FAN’s accountant, but that’s the only place she works.

Ms. Khusyaynova has been FAN’s chief accountant since at least August 2, 2016. As such, Ms. Khusyaynova has been involved in FAN’s day-to-day accounting operations, including the purchase of office equipment and furniture and payments for advertising or other business contracts as assigned by Mr. Zubarev in his capacity as the General Director of FAN.

As the Chief Accountant, Ms. Khusyaynova’s duties are akin to those of a bookkeeper in the United States. She is not an officer of FAN, does not exercise discretionary authority over the editorial content of FAN’s publications and is not aware of what stories are going to be published or not published.

To the best of FAN’s knowledge, Ms. Khusyaynova’s sole employment is with FAN. In fact, she has explicitly stated that FAN is her sole employer and that she does not provide any services to any other entity and denies any involvement with “Project Lakhta”.

FAN has no reason to believe that Ms. Khusyaynova or any of its employees were providing services to another entity, much less to an entity under the umbrella of “Project Lakhta”.

And it’s not just Khusyaynova about whom FAN must make claims that dispute those made by the US government. The complaint does the same of Aleksandra Yurievna Krylova, who was accused in the IRA indictment of planning and carrying out an intelligence gathering trip to the US in 2014.

Defendant ALEKSANDRA YURYEVNA KRYLOVA (Крылова Александра Юрьевна) worked for the ORGANIZATION from at least in or around September 2013 to at least in or around November 2014. By approximately April 2014, KRYLOVA served as director and was the ORGANIZATION’s third-highest ranking employee. In 2014, KRYLOVA traveled to the United States under false pretenses for the purpose of collecting intelligence to inform the ORGANIZATION’s operations.

[snip]

Only KRYLOVA and BOGACHEVA received visas, and from approximately June 4, 2014 through June 26, 2014, KRYLOVA and BOGACHEVA traveled in and around the United States, including stops in Nevada, California, New Mexico, Colorado, Illinois, Michigan, Louisiana, Texas, and New York to gather intelligence. After the trip, KRYLOVA and BURCHIK exchanged an intelligence report regarding the trip.

Here, the lawsuit has a bit more difficulty just dismissing ties. It admits that Krylova was the founder and first director of FAN, but in that passage of the lawsuit declines to mention when that was.

The founder and first General Director of FAN was Aleksandra Yurievna Krylova. The Special Counsel has alleged that Krylova was an employee of the IRA from in or around September 2013 to in or around November 2014. FAN has no knowledge of this allegation and therefore does not know if it is accurate or not.

But as the lawsuit admits elsewhere, FAN was incorporated on May 22, 2014.

On May 22, 2014, FAN was incorporated in order to satisfy public needs of Russian and foreign legal entities and individuals by way of gathering, transmitting and supplying domestic and international news reports and other publications of public interest.

So at the time Krylova traveled to the US (while hiding her true purpose, thereby committing visa fraud), she had just recently formed FAN.

All this is no big deal, the lawsuit suggests, because FAN doesn’t know anything about it and besides it has been a long time.

Anna Vitalyevna Botneva succeeded Krylova as General Director of FAN, on November 17, 2014, and on December 24, 2014, Krylova sold 100% of the company’s shares to Botneva.

[snip]

At the time of Ms. Krylova’s indictment, she had no connection with FAN for more than three years.

At the time of Krylova’s indictment, of course, she also had had no connection with IRA for the same length of time.

FAN is silent about how long Botneva ran the show and how long she remained the sole shareholder. What it does make clear is that Evgeniy Lvovich Zubarev — the guy who’s being fronted as a plaintiff and the one who presumably would be asked to claim to have ignorance of IRA’s ties to FAN and Khusyaynova’s day job — became the sole shareholder last year.

Since August 2, 2016, Evgeniy Lvovich Zubarev has been the General Director of FAN, and since April 5, 2017, he has been the sole shareholder of the company.

In preparation of the Concord Management challenge of the IRA indictment, Prigozhin got himself named the director, which would give him the opportunity to claim to need to review discovery. This feels like the opposite: the creation of a figurehead who can claim to be dumb and dissociated from Prigozhin’s other efforts.

I highly doubt this well get very far (in part, because FAN would have to provide better proof than it has provided that these things are true).

A set-up to claim Facebook is conducting influence operations in Russia

Which finally brings us to where I think this is going. A First Amendment claim here in the US is unlikely to get anywhere, though it does give Russian propagandists an opportunity to claim Russia is being deplatformed by American social media along with the Nazis and terrorists.

But how Russia will use this argument within Russia is another matter. The lawsuit describes its injury, in part, in terms of a loss of access in Russia.

As of October 2018, FAN is ranked among the Top 35 most visited websites in Russia by LiveInternet, one of the largest Russian internet blogging platforms; among the Top 20 by Mail.ru, a Russian internet company which reaches approximately 86% of Russian internet users per month; and among the Top 25 by Rambler, a Russian search engine and one of the biggest Russian web portals.

Many of FAN’s subscribers are also Facebook users who for at least the past four years were able to access FAN through Facebook and who did, in fact, access FAN through Facebook.

That is, FAN is making an argument that it has lost Russian readers, not just American ones, because of Facebook’s actions.

And, in the last line of the introduction, the lawsuit uses language that (I could imagine) Russia might use in the future to accuse Facebook of conducting its own influence operations.

Facebook seeks to dictate news content based upon its own political view point thereby attempting to influence the public media coverage of internal political events in the Russian Federation.

After laying out a claim that Facebook was acting as an agent of the US government in cutting off trolls, it ends with a suggestion that Facebook’s real goal here is to influence “internal political events” within Russia.

That, I suspect, is the real purpose of this effort, setting up a future attack against Facebook operating in Russia.

In What May Be a Second Bid to Go after Yevgeniy Prigozhin and Vladimir Putin, DOJ Charges Prigozhin’s Troll Accountant

October 19, 2018/10 Comments/in 2016 Presidential Election, Mueller Probe /by emptywheel

The Eastern District of VA just charged the accountant for Yevgeniy Prigozhin’s influence operation Project Lakhta, Elena Alekseevna Khusyaynova, with conspiring to defraud the US, the same charge that Prigozhin company laywers lawyers are aggressively fighting in DC right now. On top of everything else, this charge may be an effort to get a second bid at laying out the crimes behind Prigozhin’s influence operation, first laid out on Mueller’s Internet Research Agency indictment, in a sustainable way.

Khusyaynova may be named, but the real target is Prigozhin

The affadvit against Khusyaynova not only incorporates the IRA indictment by reference, it repeats the introductory paragraph on Concord Consulting (the entity that’s challenging the Mueller indictment), changing only the name (replacing ORGANIZATION, referring to Internet Research Agency, with Project Lakhta, and lumping both Concord entities into one).

Defendants Concord Management and Consulting LLC and Concord Catering (collectively, “Concord”) are related Russian entities with various Russian government contracts. Concord was the primary source of funding for Project Lakhta operations. Concord controlled funding, recommended personnel, and oversaw Project Lakhta activities through reporting and interaction with the management of the various Project Lakhta entities.

It also repeats a paragraph from the IRA indictment on how Lakhta laundered money through a bunch of bank accounts.

To conceal the nature of Project Lakhta activities, since at least January 2016 the Conspiracy labeled the funds paid by Concord to Project Lakhta as payments related to software support and development. Moreover, since at least January 2016, Concord distributed funds to Project Lakhta through approximately fourteen bank accounts held in the names of Concord affiliates, including Glavnaya Liniya LLC, Merkuriy LLC, Obshchepit LLC, Potentsial LLC, RSP LLC, ASP LLC, MTTs LLC, Kompleksservis LLC, SPb Kulinariya LLC, Almira LLC, Pishchevik LLC, Galant LLC, Rayteks LLC, and Standart LLC.

The complaint against Khusyaynova focuses closely on Prigozhin, even calling him “Putin’s Chef” (not something that appeared in the IRA indictment). It also presents the same theory of the case as laid out in the IRA indictment: that by obscuring their foreign identity, the trolls prevent DOJ from administration FARA and the FEC from administering FECA.

In other words, while Khusyaynova may be named, the focus in this complaint is on Prigozhin’s use of money laundering to move Concord’s money into a troll operation targeting the US.

Prigozhin continues to fund influence operations affecting US politics

The complaint then lays out the influence operations conducted under the larger Lakhta umbrella, including IRA but also GlavSet, Federal News Agency, and others, describing how Khusyaynova funded it all. Of significant note, it describes how she paid for advertising on social media sites.

In addition to administrative expenses, such as office rent, utility payments, and garbage disposal, the budget identified IT expenses, such as “registration of domain names” and the purchase of “proxy servers,” and social media marketing expenses, such as expenses for “purchasing posts for social networks,” “[a]dvertisement on Facebook,” [a]dvertisement on VKontakte,” “[a]dvertisement on Instagram,” “[p]romoting news postings on social networks,” and social media optimization software (such as Twidium and Novapress) (preliminary translation of Russian text). The budgets also contained a section on “USA, EU” activities, which included itemized expenditures for “Instragram,” “Facebook advertisement” and “Activists” (preliminary translation of Russian text).

Having laid out that Khusyaynova was funneling money from Concord to pay for these things, the affidavit lays out how this funding engaged in US politics.

Its description of the trolling makes it clear that the trolls are still being instructed to take a view that benefits Trump, down to attacking Mueller.

Special prosecutor Mueller is a puppet of the establishment. List scandals that took place when Mueller headed the FBI. Direct attention to the listed examples. State the following: It is a fact that the Special Prosecutor who leads the investigation against Trump represents the establishment: a politician with proven connections to the U.S. Democratic Party who says things that should either remove him from his position or disband the entire investigation commission. Summarize with a statement that Mueller is a very dependent and highly politicized figure; therefore, there will be no honest and open results from the investigation. Emphasize that the work of this commission is damaging to the country and is aimed to declare impeachment of Trump. Emphasize that it cannot be allowed, no matter what.

Another of the trolls posted this image:

Though other trolls called to take to the streets and protest if Trump fires Mueller. Several of the trolls even RTed…

Dear @realDonaldTrump: The DOJ indicted 13 Russian nationals at the Internet Research Agency for violating federal criminal law to help your campaign and hurt other campaigns. Still think this Russia thing is a hoax and a witch hunt? Because a lot of witches just got indicted.

Or tweeted on both sides of the Mueller indictment of the IRA.

Russians indicted today: 13 Illegal immigrants crossing Mexican border indicted today: 0 Anyway, I hope that all those Internet Research Agency f*ckers will be sent to gitmo.

We didn’t vote for Trump because of a couple of hastags shilled by the Russians. We voted for Trump because he convinced us to vote for Trump. And we are ready to vote for Trump again in 2020!

And one of the key allegations involves the effort to provide advertising in support of this flash mob against Trump, including collaborating with Move On and Code Pink. Another of the key allegations describes @CovfefeNationUS’ efforts to raise money targeting (among others) Tammy Baldwin, Claire McCaskill, Nancy Pelosi, Maxine Waters, and Elizabeth Warren.

All of this, of course, is political influence peddling. By citing paid influence peddling, including some that extended beyond the time of the IRA indictment (meaning Concord was on notice that they needed to register) you make it clear this is paid foreign tampering.

This complaint re-situates the charges against Concord in sustainable way

I said, above, that this complaint may be designed to make the charges against Prigozhin sustainable. It comes — with its preliminary translation of Russian passages suggesting some haste — on the heels of a legal challenge by Concord’s US lawyer — of the ConFraudUs theory in this case. Concord has argued that because the indictment doesn’t allege it knew it had to register under FECA and FARA, the conspiracy itself is unsustainable.

Earlier this week, there was a hearing on that challenge in which Trump appointee Dabney Friedrich showed some sympathy for Concord’s argument.

Mueller alleges Concord Management, along with other defendants named in the indictment, conspired to impede the ability of the Justice Department to enforce the Foreign Agents Registration Act — which requires people who are lobbying in the U.S. on behalf of foreign individuals or entities disclose that lobbying — and the ability of the FEC to administer its ban on foreign expenditures in elections, under the Federal Election Campaign Act (FECA) .

Concord Management is arguing that Mueller has not shown in the indictment that the Russians knew about their legal obligations under those regulations, which according to Dubelier is required to bring criminal charges under the law, and is using the conspiracy charge as a workaround.

“They don’t have the evidence to charge a substantive violation of FARA or a substantive passport violation or a substantive FECA violation, because there is no evidence anywhere that any of these foreign people knew anything about any of these laws or regulations, none,” Dubelier said at the hearing.

Prosecutors argued that to bring the conspiracy count, all they need to show is that defendants had some knowledge that the government regulated those areas and that they took actions to impede that enforcement through acts of deception.

“It doesn’t matter if they knew it was the FEC or the DOJ or some other agency,” Mueller prosecutor Jonathan Kravis argued Monday. “They know that there is a lawful government function here, and they are acting with a purpose of interfering with it.”

Kravis pointed to the Russian trolls’ alleged move to disguise not just their identities, but the origin of the computer networks they used to influence the election on social media.

Then today, the judge in that case, Friedrich, asked for more briefing from Mueller’s team.

By issuing this complaint, the government does several things.

First, because this is just a complaint, Prigozhin isn’t going to be able to challenge it; his employee, Khusyaynova, would first have to be indicted, and then would have to show up in person to contest the charges, which isn’t going to happen.

But also, because this complaint focuses on the accountant’s role, it focuses much more closely (though not exclusively) on the laundering of the money, and not the laundering of the Russian origin of the voices engaging in politics.

In addition, because the conduct charged in the indictment continued after Concord was indicted in February 2018, they can no longer claim (as they are in the challenge to Mueller) that they didn’t have the knowledge and intent they were breaking the law. In the Concord challenge they argue,

In the absence of allegations specifically showing that Concord intended to interfere, or entered a conspiracy to interfere, with a lawful function relating to a U.S. election in a deceitful and dishonest manner, there is no basis for a § 371 defraud conspiracy charge whether elections were interfered with or not.

… And go on to cite the newest Justice on the Supreme Court insisting that you can’t charge foreigners unless you can be sure they know their conduct is against the law.

[W]e caution the government that seeking criminal penalties for violations of [law regulating foreign nationals’ political contributions or expenditures] will require proof of defendant’s knowledge of the law. There are many aliens in this country who no doubt are unaware of the statutory ban on foreign expenditures

Imagine how easy it will be to respond to this claim, regarding conduct that continued for four months after the initial indictment for the same conduct.

The result compelled by these overarching constitutional principles with respect to a § 371 defraud conspiracy is plain enough: where an indictment purports to charge in a complex and technical regulatory environment like U.S. elections and likewise threatens to sweep in core political speech as part of the offense, the indictment must spell out how and why the targeted individual or entity knew it was violating the law.

Finally, because this complaint focuses on a different named defendant, is charged out of a different office with no visible overlap in team, and encompasses a more recent time period (showing that the government continues to collect solid information on Prigozhin’s operation), there’s no double jeopardy issue and Friedrich can’t touch this case.

I don’t know whether Mueller will just dismiss Concord from the other indictment, and be done with that nuisance once and for all, or whether this is just designed to ensure that the allegations, and the tie to Putin, remain intact regardless of what happens in DC. But it does seem like a hasty bid to solidify the charges in a way that hews closer to past legal precedent.

Update: This post has been updated since initial posting.

In Putin’s Russia, Trolls Fool Even You

September 20, 2018/66 Comments/in 2016 Presidential Election, Mueller Probe /by emptywheel

In a long story on the Russian hack that I believe falls for at least one piece of propaganda (I’m working on writing this up, but it will take time), Scott Shane and Mark Mazzetti quote Christopher Painter talking about how much people deny they’ve been duped by propaganda, but suggest only Trump supporters would be so naive.

He added that “people don’t like to admit they’ve been fooled” — hence the strenuous efforts from Mr. Trump and his supporters to deny or dismiss the significance of the Russian interference.

They then use Harry Miller — a Trump supporter who got paid to organize a rally with a fake Hillary in prison — to portray the kind of rubes who fall for propaganda.

A case in point would be Harry Miller, a devoted Trump supporter in Florida who was paid to organize a rally in which a woman portraying Mrs. Clinton sat behind bars on the back of his pickup truck. It turned out that the people who had ordered up the rally, “Matt Skiber” and “Joshua Milton,” were pseudonyms for Russians at the Internet Research Agency, according to the Mueller indictment.

But don’t tell that to Mr. Miller. Contacted via Twitter, he insisted that he had not been manipulated by Russian trolls.

“They were not Russians, and you know it,” Mr. Miller wrote, adding, “If you don’t then you are the one snookered.”

Here’s the part of the Internet Research Agency indictment that describes Miller getting duped.

In or around late July 2016, Defendants and their co-conspirators used the Facebook group “Being Patriotic,” the Twitter account @March_for_Trump, and other false U.S. personas to organize a series of coordinated rallies in Florida. The rallies were collectively referred to as “Florida Goes Trump” and held on August 20, 2016.

a. In or around August 2016, Defendants and their co-conspirators used false U.S. personas to communicate with Trump Campaign staff involved in local community outreach about the “Florida Goes Trump” rallies.

b. Defendants and their co-conspirators purchased advertisements on Facebook and Instagram to promote the “Florida Goes Trump” rallies.

c. Defendants and their co-conspirators also used false U.S. personas to contact multiple grassroots groups supporting then-candidate Trump in an unofficial capacity. Many of these groups agreed to participate in the “Florida Goes Trump” rallies and serve as local coordinators.

d. Defendants and their co-conspirators also used false U.S. personas to ask real U.S. persons to participate in the “Florida Goes Trump” rallies. Defendants and their co-conspirators asked certain of these individuals to perform tasks at the rallies.

For example, Defendants and their co-conspirators asked one U.S. person to build a cage on a flatbed truck and another U.S. person to wear a costume portraying Clinton in a prison uniform. Defendants and their co-conspirators paid these individuals to complete the requests.

Don’t get me wrong. I do believe that Miller was duped, just like I believe Shane and Mazzetti were duped. I believe I got duped in 2016 too!

But there’s a part of the IRA indictment that might help explain why Miller got duped, one that reporters ought to chase down before they single out others for being duped, because it might help them understand how they, too, might get duped.

76. On or about August 18, 2016, the real “Florida for Trump” Facebook account responded to the false U.S. persona “Matt Skiber” account with instructions to contact a member of the Trump Campaign (“Campaign Official 1”) involved in the campaign’s Florida operations and provided Campaign Official 1’s email address at the campaign domain donaldtrump.com. On approximately the same day, Defendants and their co-conspirators used the email address of a false U.S. persona, [email protected], to send an email to Campaign Official 1 at that donaldtrump.com email account, which read in part:

Hello [Campaign Official 1], [w]e are organizing a state-wide event in Florida on August, 20 to support Mr. Trump. Let us introduce ourselves first. “Being Patriotic” is a grassroots conservative online movement trying to unite people offline. . . . [W]e gained a huge lot of followers and decided to somehow help Mr. Trump get elected. You know, simple yelling on the Internet is not enough. There should be real action. We organized rallies in New York before. Now we’re focusing on purple states such as Florida.

The email also identified thirteen “confirmed locations” in Florida for the rallies and requested the campaign provide “assistance in each location.”

[snip]

78. On or about August 19, 2016, a supporter of the Trump Campaign sent a message to the ORGANIZATION-controlled “March for Trump” Twitter account about a member of the Trump Campaign (“Campaign Official 2”) who was involved in the campaign’s Florida operations and provided Campaign Official 2’s email address at the domain donaldtrump.com. On or about the same day, Defendants and their co-conspirators used the false U.S. persona [email protected] account to send an email to Campaign Official 2 at that donaldtrump.com email account.

79. On or about August 19, 2016, the real “Florida for Trump” Facebook account sent another message to the false U.S. persona “Matt Skiber” account to contact a member of the Trump Campaign (“Campaign Official 3”) involved in the campaign’s Florida operations. On or about August 20, 2016, Defendants and their co-conspirators used the “Matt Skiber” Facebook account to contact Campaign Official 3.

During precisely the period when Miller was networking with Russian trolls to set up a real campaign event, the very same trolls using the very same fake identities were networking with actual Trump campaign staffers about the very same campaign events in the very same state that Miller was. That means it is quite possible that he had validation from real people he trusted that the trolls duping him were real.

Virtually anyone — including NYT reporters — might get fooled if the trolls duping them networked in via real trusted people.

As I disclosed July, I provided information to the FBI on issues related to the Mueller investigation, so I’m going to include disclosure statements on Mueller investigation posts from here on out. I will include the disclosure whether or not the stuff I shared with the FBI pertains to the subject of the post.

Andy McCarthy’s Misconception

August 26, 2018/30 Comments/in 2016 Presidential Election, Cybersecurity, Mueller Probe /by emptywheel

I was struck, in reading Andy McCarthy’s review of the Michael Cohen and Paul Manafort guilty outcomes last week (in which he measures Trump via a vastly different standard than he once measured Bill Clinton), by this erroneous claim:

The Trump camp continues to stress that Manafort’s case had nothing to do with the original rationale for Mueller’s investigation, “collusion with Russia.” But as we’ve pointed out any number of times, Mueller took over a counterintelligence investigation of Russia’s interference in the 2016 election. Possible Trump-campaign collusion with Russia was just one thread in the larger probe.

The claim that the Trump-campaign “collusion” was just one thread of what Mueller originally took over is false, but utterly critical for McCarthy’s sustained belief that Mueller has not found evidence of a conspiracy between Trump and Russia. While it is true that when Comey confirmed the investigation, he did not specify the structure of the investigation,

I have been authorized by the Department of Justice to confirm that the FBI, as part of our counterintelligence mission, is investigating the Russian government’s efforts to interfere in the 2016 presidential election and that includes investigating the nature of any links between individuals associated with the Trump campaign and the Russian government and whether there was any coordination between the campaign and Russia’s efforts. As with any counterintelligence investigation, this will also include an assessment of whether any crimes were committed.

When Rod Rosenstein appointed Mueller, he described Mueller’s scope to include,

any links and/or coordination between the Russian government and individuals associated with the campaign of President Donald Trump; and
any matters that arose or may arise directly from the investigation; and
any other matters within the scope of 28 C.F.R. § 600.4(a)

Why McCarthy made this error is clear: he uses the existence of and Mueller’s indictments in a broader counterintelligence investigation to sustain his belief that Mueller doesn’t have a “collusion” case against Trump or his associates.

At this point, it does not appear that Mueller has a collusion case against Trump associates. His indictments involving Russian hacking and troll farms do not suggest complicity by the Trump campaign. I also find it hard to believe Mueller sees Manafort as the key to making a case on Trump when Mueller has had Gates — Manafort’s partner — as a cooperator for six months. You have to figure Gates knows whatever Manafort knows about collusion. Yet, since Gates began cooperating with the special counsel, Mueller has filed the charges against Russians that do not implicate Trump, and has transferred those cases to other Justice Department components.

When it comes to the president, I believe the special counsel’s focus is obstruction, not collusion. When it comes to Manafort, I believe the special counsel’s focus is Russia — specifically, Manafort’s longtime connections to Kremlin-connected operatives. Mueller may well be interested in what Manafort can add to his inquiry into the June 2016 Trump Tower meeting (arranged by Donald Trump Jr. in futile hopes of obtaining campaign dirt from Russia on Hillary Clinton). That, however, is not the more serious “collusion” allegation that triggered the Trump thread of the investigation — cyberespionage conspiracy (i.e., Russian hacking of Democratic party emails).

That is, because Mueller indicted trolls and GRU hackers and then spun those prosecutions off to other teams (in the GRU case, back to one of the teams that originally investigated it), it is proof, in McCarthy’s mind, that Mueller isn’t targeting Trump and his associates for conspiring with Russia.

The actual background of the Mueller investigation suggests precisely the opposite. As I noted when Lawfare made precisely the same error in a post on the GRU indictment,

Friday’s indictment is, rather, the result of investigations conducted primarily in San Francisco and Pittsburgh. At the time Comey confirmed the counterintelligence investigation into Trump’s camp and at the time Comey got fired for not shutting the Trump counterintelligence investigation down, those San Francisco and Pittsburgh investigations were totally separate. Those two investigations almost certainly had little if any involvement from Peter Strzok (indeed, they involved a bunch of FBI cyber agents, a division of FBI that Strzok never tired of mocking in his texts to Lisa Page). The DOJ press release from Friday states that explicitly.

This case was investigated with the help of the FBI’s cyber teams in Pittsburgh, Philadelphia and San Francisco and the National Security Division.

Those two investigations (plus the separate one noted in Philadelphia that started later, as I understand it from what a lawyer who represented a witness in that investigation described to me) got moved under the Mueller umbrella sometime in or just before November, and now the GRU officer part of the investigation will be moved back to Pittsburgh where it started, to languish forever like some other nation-state hacker indictments investigated by Western District of Pennsylvania.

Given that both public reporting (starting in February 2017 and extending into November 2017) and Mueller team changes (not to mention my own reporting about the Philadelphia grand jury’s activity in the second half of May 2017 and my own knowledge about where I interviewed and where my interview materials subsequently got moved to) support this narrative, McCarthy (and the Lawfare crowd) might ask why Mueller decided to integrate the cybersecurity parts of the investigation, only to spin the Russian defendants back to other teams once they were indicted?

We can begin to get an answer from the two indictments that — Andy wants to believe — are themselves evidence that Mueller doesn’t have evidence on Trump’s associates but actually are. The Internet Research Agency indictment actually describes three Florida-based Trump campaign officials inconclusively, as if they were either still under investigation or at some legal risk.

On approximately the same day, Defendants and their co-conspirators used the email address of a false U.S. persona, [email protected], to send an email to Campaign Official 1 at that donaldtrump.com email account, which read in part:

Hello [Campaign Official 1], [w]e are organizing a state-wide event in Florida on August, 20 to support Mr. Trump. Let us introduce ourselves first. “Being Patriotic” is a grassroots conservative online movement trying to unite people offline. . . . [W]e gained a huge lot of followers and decided to somehow help Mr. Trump get elected. You know, simple yelling on the Internet is not enough. There should be real action. We organized rallies in New York before. Now we’re focusing on purple states such as Florida.

The email also identified thirteen “confirmed locations” in Florida for the rallies and requested the campaign provide “assistance in each location.”

[snip]

Defendants and their co-conspirators used the false U.S. persona [email protected] account to send an email to Campaign Official 2 at that donaldtrump.com email account.

[snip]

On or about August 20, 2016, Defendants and their co-conspirators used the “Matt Skiber” Facebook account to contact Campaign Official 3.

And while the GRU indictment (on top of key clauses being misread by virtually everyone who has read it) doesn’t use the same convention to describe Roger Stone’s communications with Guccifer 2.0…

On or about August 15, 2016, the Conspirators, posing as Guccifer 2.0, wrote to a person who wasin regular contact with senior members of the presidential campaign of Donald J. Trump, “thank u for writing back . . . do u find anyt[h]ing interesting in the docs i posted?” On or about August 17, 2016, the Conspirators added, “please tell me if i can help u anyhow . . . it would be a great pleasure to me.” On or about September 9, 2016, the Conspirators, again posing as Guccifer 2.0, referred to a stolen DCCC document posted online and asked the person, “what do u think of the info on the turnout model for the democrats entire presidential campaign.” The person responded, “[p]retty standard.”

It pointed to Russia’s response to Donald Trump’s request that they hack Hillary without referring to him one way or another.

For example, on or about July 27, 2016, the Conspirators attempted after hours to spearphish for the first time email accounts at a domain hosted by a thirdparty provider and used by Clinton’s personal office. At or around the same time, they also targeted seventy-six email addresses at the domain for the Clinton Campaign.

What Mueller has done with both of the counterintelligence indictments that McCarthy takes solace in is lay out the Russian side of a conspiracy (and both are charged as conspiracies) with very clear spots into which American co-conspirators may be dropped when Mueller is prepared to do so. (I laid this out at more length in this post.)

Importantly, the fact that some of this investigation started out in other parts of DOJ but then got moved under Mueller make it clear that something came up in the investigation that Mueller and Rosenstein believed required they be moved under Special Counsel when they weren’t there, originally.

Let’s put it this way: Mueller didn’t subsume investigations located elsewhere at DOJ because the Special Counsel needed to be the one to indict a bunch of Russians. He did it to set up the conspiracies that would — that will — later be occupied by Russians and Americans.

The Tea Leaves on Mueller’s Hand Off

July 5, 2018/117 Comments/in 2016 Presidential Election, Cybersecurity, Mueller Probe /by emptywheel

As part of writing this post, I confirmed for the first time that the prosecutor I spoke with regarding the Russian attack is not and never has been part of the Mueller team (among other things, I think that means Peter Strzok never got within a mile of my testimony, which is why I asked). But a prosecutor who was involved in discussions setting up my interview is, and the Special Counsel’s Office certainly seemed to recognize my interview as part of the investigation when I alerted them I was going to publish that text. Given that the FBI agents I spoke with didn’t know what topics I cover for a living (and seemed to get wiser about the person we were discussing over two breaks), my guess is that DOJ assigned a team segmented off from the investigation to ensure that no one accidentally dropped hints about the investigation. That’s all just a wildarseguess, though. DOJ has gone to great lengths to ensure I don’t learn anything from the process, as is proper.

Having that tiny glimpse into how DOJ used a prosecutor uninvolved in the case in chief to talk to me about what may have become part of the case in chief is background to explain why I doubt some of the conclusions made in this piece, reporting that Mueller has divvied up tasks to career prosecutors from elsewhere in DOJ.

As Mueller pursues his probe, he’s making more use of career prosecutors from the offices of U.S. attorneys and from Justice Department headquarters, as well as FBI agents — a sign that he may be laying the groundwork to hand off parts of his investigation eventually, several current and former U.S. officials said.

Mueller and his team of 17 federal prosecutors are coping with a higher-then-expected volume of court challenges that has added complexity in recent months, but there’s no political appetite at this time to increase the size of his staff, the officials said.

[snip]

Investigators in New York; Alexandria, Virginia; Pittsburgh and elsewhere have been tapped to supplement the work of Mueller’s team, the officials said. Mueller has already handed off one major investigation — into Trump’s personal lawyer, Michael Cohen — to the Southern District of New York.

The only thing that is clearly new in this paragraph is that Mueller has involved prosecutors in Pittsburgh. As the paragraph itself notes, [part of] the investigation into Michael Cohen got handed off to SDNY. But that’s because it involves conduct — a hush money payment that Cohen arranged from Manhattan and taxi medallion fraud — that don’t clearly relate to Russian election interference. Other reports suggest that conduct more closely tied to the election, such as Cohen’s involvement in inauguration graft, remains in Mueller’s hands.

Similarly, we know of at least one EDVA prosecutor involved in Mueller’s investigation. Uzo Asonye got moved onto the team to placate TS Ellis. He will presumably present a good part of the trial that starts later this month, freeing up another member of that team to focus on the DC side of Manafort’s corruption. But that move was driven, in significant part, from Ellis’ direction.

With Michael Cohen and Paul Manafort, there’s plenty of corruption to spread across multiple districts! Heck, Manafort’s former son-in-law is cooperating against him based off a case in LA, and Dmitri Firtash, who is under indictment in Chicago, is one of four oligarchs explicitly named in Manafort’s search warrant.

And, frankly, I’m offended by this passage.

Mueller indicted 13 Russian individuals and three entities in February on charges of violating criminal laws with the intent to interfere with the U.S. election through the manipulation of social media.

None of the targets are in the U.S., but one of them, the Internet Research Agency, has forced Mueller into another legal fight in federal court. The two sides have been sparring most recently over how to protect sensitive investigative materials from disclosure. Mueller has enlisted prosecutors with the U.S. Attorney’s office in Washington to handle the case.

I’m offended not just because the passage is factually false: the entity mounting a defense is Concord Management, not Internet Research Agency. But because one should never label a defendant mounting a defense as “forc[ing the prosecutor] into another legal fight.” Yes, Concord’s defense is trollish lawfare aiming to discover intelligence. But that is the risk of using indictments to lay out nation-state information operations.

Also, as I suggested in this post and this post, commentators have made far too much of the technical requirements of the Concord case. The government will use no classified data in the trial, if the trial ever really happens. Which suggests the case will be a glorified call records case, showing that the people running certain accounts were operating from certain IP addresses. That’s not to minimize the import of call records in proving crimes. But it’s just not the most technically difficult case to prove.

Which brings us back to Pittsburgh. In fact, Pittsburgh has already been involved in this case — back when the investigation of the hack of the DNC lived there, as many nation-state hacking cases do. Now, it is definitely true that the hack investigation had, at some point, been moved under Mueller; I know of a witness to the hack who was interviewed at Mueller’s office. But if Mueller’s team of 17 were focused more closely on the “collusion” case, I could imagine them moving the hack case back to where it started.

If that’s actually what happened, it would amount to a hand off, of sorts. But it may not be all that momentous a development. Rather, it might reflect Mueller’s (and Rod Rosenstein’s) continued efforts to keep the matters he will prosecute (as distinct from investigate) closely related to the “collusion” case. That seems like a sound decision both form a resourcing perspective, but it’s a good way to rebut claims that he’s a runaway prosecutor.