Posts

Trump’s Reneges on Promised Significant Fourth Amendment Filing

As you no doubt know, Trump filed a document that purports to be a request for a Special Master last night, over a week after discussing privilege issues with DOJ and three days after promising a significant Fourth Amendment filing.

This document is a lot of things:

One thing it is not is a significant Fourth Amendment filing. Trump couldn’t even manage that competently.

My thread on it is here.

I’m going to go update my “known and likely affidavit contents” post with more basis for probable cause with claims from this and the NARA letter to Trump (PDF via NARA) John Solomon released.

emptywheel Trump Espionage coverage

Trump’s Reneges on Promised Significant Fourth Amendment Filing

Next Steps in the Trump Stolen Documents Investigation

Maggie Haberman: Heads It’s Only Obstruction, Tails It’s Not Obstruction

The French President May Be Contained Inside the Roger Stone Clemency

Which of the Many Investigations Trump Has Obstructed Is DOJ Investigating?

The Known and Likely Content of Trump’s Search Warrant

The ABCs (and Provisions e, f, and g) of the Espionage Act

Trump’s Latest Tirade Proves Any Temporary Restraining Order May Come Too Late

How Trump’s Search Worked, with Nifty Graphic

Pat Philbin Knows Why the Bodies Are Buried

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

18 USC 793e in the Time of Shadow Brokers and Donald Trump

[from Rayne] Other Possible Classified Materials in Trump’s Safe

Trump’s Stolen Documents

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

[from Peterr] Merrick Garland Preaches to an Overseas Audience

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

Merrick Garland Calls Trump’s Bluff

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

[from Rayne] Expected Response is Expected: Trump and Right-Wing DARVO

DOJ’s June Mar-a-Lago Trip Helps Prove 18 USC 793e

The Likely Content of a Trump Search Affidavit

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

Some Likely Exacerbating Factors that Would Contribute to a Trump Search

FBI Executes a Search Warrant at 1100 S Ocean Blvd, Palm Beach, FL 33480

 

Next Steps in the Trump Stolen Documents Investigation

A number of people have gotten impatient that the search of the former President’s golf resort has not yet yielded an indictment. “If you or I did what he did,” a common refrain goes, “we’d already be in prison.”

I often point to the example of Joshua Schulte, the former CIA coder convicted last month of the Vault 7 and 8 leaks. He wasn’t jailed until almost nine months after the initial search of his apartment, and only then because he violated bail conditions on charges related to Child Sexual Abuse Materials allegedly found on his server. He wasn’t charged on the Espionage Act charges until 15 months after that initial search.

And it sounds like Trump won’t be charged anytime soon. At a hearing before Magistrate Judge Bruce Reinhart last week, the head of DOJ’s counterintelligence section, Jay Bratt, said the investigation is in its “early stages.” That may suggest that Trump or others are suspected of more than just storing classified information in insecure conditions and refusing to give it back. Perhaps the people entering and exiting the storage closet at Mar-a-Lago did something more than just hide stuff from DOJ. Or perhaps the obstruction investigation — which may be obstruction of this investigation or others — is more complex than we imagine (which isn’t hard, because most journalists are simply ignoring that suspected crime).

Whatever the reason Bratt stated that DOJ will need to do significant further investigation, there are steps that would be required in any case. There are four steps that the FBI would take before considering charges.

Filter Review

There are two kinds of reviews that the FBI will do of this material: A filter review and a scope review (though these words are getting muddled in the coverage, including in this piece, which is the only one that has reported on the process).

The filter review is done by agents who are not part of the investigative team. They make sure that nothing privileged gets to the investigative team.

According to reportsand Bratt’s email to Trump’s lawyers — at least some of the agents who did the search at Mar-a-Lago were a filter team (which makes sense, because they were sorting through the contents of boxes onsite). According to Fox News, the materials on one of two receipts — what I call the SSA receipt — included privileged material.

In other words, the FBI had cause to seize stuff that involves Trump’s communications with his lawyers. That’s not surprising. Among the crimes under investigation is the destruction, alteration, or concealment of materials to obstruct an or multiple investigations. I’ve previously pointed to a number of instances where Trump did that with the assistance of lawyers (I’ve taken out a paragraph of Trump Organization examples, because only government documents were permitted to be seized on the search warrant):

  • One thing Trump is likely to have withheld is the Perfect Transcript between him and Volodymyr Zelenskyy, which is something Congress was entitled to get during impeachment. That transcript was hidden from Congress by White House lawyer John Eisenberg, among other lawyers, thereby according the transcript a weak privilege claim, but one easily overcome by the obstructive nature of the choice to withhold it.
  • While one draft of Trump’s termination letter to Jim Comey was ultimately turned over to Mueller (after reports that the only extant copy was one preserved by DOJ lawyers), the Mueller Report narrative surrounding it makes it clear that Trump and Stephen Miller worked over several drafts before the one shared with others. Those earlier drafts were likely not turned over, in part because White House Counsel lawyers advised Trump that these drafts should “[n]ot [see the] light of day.” Again, that’s legal advice, but also proof of documents that were illegally withheld from the Mueller investigation.
  • I don’t want to even imagine what advice from Rudy Giuliani that Trump has withheld from various investigations, particularly pertaining to January 6. Most of that would be (shitty) legal advice. If it was also withheld from proper investigations, though, it’d also be proof of obstruction under 18 USC 1519.

Given the Fox News report of ongoing filter review, it’s likely those materials, at least, will be reviewed a second time to make sure they’re proof of obstruction before being shared with investigators.

Scope Review

Then there’s a separate review, usually by agents who are part of the investigative team, to pull out only the documents that are relevant to the investigation.

In this case, however, and because the warrant permitted the seizure of materials stored with classified information but the crimes under investigation all pertain to Federal documents, there may be an initial review to pull out anything that is not a government record, so that can be returned to the Former.

Then a team will review the seized materials to see if it is evidence of a crime — either that Trump took documents that should have been sent to the Archives, he kept classified documents at Mar-a-Lago after being asked and subpoenaed for them, or that Trump attempted to destroy, alter, or conceal records relating to an or several investigations. The first category — government documents that would be evidence of 18 USC 2071 but not other crimes — might be copied and catalogued and sent to the Archives.

Classification Review

As part of the process both of determining whether something is classified and assessing whether a viable prosecution could be pursued, the agencies whose classified information ended up in a poorly protected closet at a golf resort will need to conduct classification reviews to make sure the information really is classified.

A former CIA lawyer did a long thread the other day describing this process; I’ve included three key points below.

That’s all part of the process of figuring out whether Trump committed a crime. Before DOJ ever charged Trump for any of this, they would also have to work with the agencies to find documents that the agencies would be willing to expose to the prosecution process, which would involve sharing with Trump and his cleared defense attorneys. If Trump went to trial on Espionage Act charges, DOJ would have to declassify or “substitute” classified information (I wrote about that process here; here’s another good overview). And the agencies would not want to do this with the most sensitive documents.

If Trump were ever charged, DOJ would likely pick a subset of the documents that conveyed the gravity of what Trump had taken but that the agencies were willing to subject to this process. In the case of Hal Martin, who also took stacks and stacks of classified documents home from work, he was indicted for twenty documents out of the stacks and stacks of stuff he took.

Inventory

Trump is suspected not just of stealing classified documents, there are known documents that he was suspected of hoarding at his home — according to the WaPo, including documents about nuclear weapons.

So in addition to all the other reviews and an inventory that the FBI will make of what it seized, between FBI and NARA, they’re going to need to compare the seized documents with the existing catalog to see whether all the documents known to be missing were seized and whether the seized documents identify other missing documents.

If there are known documents that witnesses say had been at Mar-a-Lago but they weren’t found in the search … then things will get really interesting.

emptywheel Trump Espionage coverage

Maggie Haberman: Heads It’s Only Obstruction, Tails It’s Not Obstruction

The French President May Be Contained Inside the Roger Stone Clemency

Which of the Many Investigations Trump Has Obstructed Is DOJ Investigating?

The Known and Likely Content of Trump’s Search Warrant

The ABCs (and Provisions e, f, and g) of the Espionage Act

Trump’s Latest Tirade Proves Any Temporary Restraining Order May Come Too Late

How Trump’s Search Worked, with Nifty Graphic

Pat Philbin Knows Why the Bodies Are Buried

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

18 USC 793e in the Time of Shadow Brokers and Donald Trump

[from Rayne] Other Possible Classified Materials in Trump’s Safe

Trump’s Stolen Documents

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

[from Peterr] Merrick Garland Preaches to an Overseas Audience

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

Merrick Garland Calls Trump’s Bluff

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

[from Rayne] Expected Response is Expected: Trump and Right-Wing DARVO

DOJ’s June Mar-a-Lago Trip Helps Prove 18 USC 793e

The Likely Content of a Trump Search Affidavit

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

Some Likely Exacerbating Factors that Would Contribute to a Trump Search

FBI Executes a Search Warrant at 1100 S Ocean Blvd, Palm Beach, FL 33480

The Known and Likely Content of Trump’s Search Warrant

Yesterday, Magistrate Judge Bruce Reinhart found that, “the Government has not met its burden of showing that the entire [Trump search warrant] affidavit should remain sealed.” He ordered DOJ to provide a sealed version of proposed redactions for the warrant affidavit for Trump’s search by August 25 at noon.

Two days after the search of Mar-a-Lago I did a post laying out the likely content of what’s in that search warrant (which pretty accurately predicted what we’ve seen since). Because a warrant affidavit is one of the best ways to show how DOJ and the FBI think of the events of the last 18 months, I wanted to do a second version including all the things we have learned since.

For comparison, here are the warrants for Reality Winner and Josh Schulte, both of which were also, at least in part, warrants for a 793 investigation. Here are warrants to search Roger Stone and Oath Keeper Jeremy Brown’s houses, both Federal searches in Florida related to investigations conducted in DC (the search of Brown’s house even found allegedly classified documents, albeit only at the Secret level). Stone’s showed probable cause for a different part of the obstruction statute. Here’s the warrant Robert Mueller’s team used to get Michael Cohen’s Trump Organization emails from Microsoft.

Cover Sheet to Warrant Application

[link]

This cover sheet shows that DOJ swore out the affidavit to Magistrate Judge Bruce Reinhart over WhatsApp, who signed it on August 5.

It describes applying for a warrant to search for evidence of crimes and for contraband (a reference to the illegally possessed Presidential records). It doesn’t permit the seizure of property used in the commission of a crime so, unsurprisingly, the FBI didn’t have authority to seize Mar-a-Lago.

The cover sheet describes the three crimes under investigation this way.

The Search Warrant

[link]

The search warrant notes the docket number 22-mj-8332 that the entire country has been watching for 10 days now.

The search warrant authorizes the FBI to conduct a search of 1100 S. Ocean Blvd., Palm Beach, FL.

It was signed by Reinhart, who was the Duty Magistrate, at 12:12PM on August 5.

The warrant gave the FBI two weeks, until August 19, to conduct the search and limited the search to daytime hours (defined as 6AM to 10PM, which Trumpsters often complain amounts to a pre-dawn raid).

Attachment A

[link]

Attachment A describes Mar-a-Lago as a “resort, club, and residence” with approximately 58 bedrooms and 33 bathrooms. The warrant permitted the FBI to search all parts of Mar-a-Lago accessible to Trump (whom they refer to as FPOTUS) and his staff, except those currently occupied (at the time of the search) by Members or guests. It mentioned the “45 Office” explicitly and storage rooms, but did not describe the storage room at the center of much reporting on the search.

Attachment B

[link]

Attachment B authorized the FBI to seize “documents and records constituting evidence, contraband, fruits of crime, or other items illegally possessed” in violation of 18 USC 793, 18 USC 2071, or 18 USC 1519.

This post describes the search protocol authorized in Attachment B, with nifty graphic.

Return

Search warrant forms have a return form (describing what was seized) included in them. But here, the FBI provided that list to Trump in the form of two receipts, one signed by a Supervisory Special Agent, and one signed by a Special Agent; I’ve dubbed the latter the “CLASS receipt,” because all the classified documents described are included on that one.

The receipt lists:

  • 27 boxes, one of which is described as leatherbound; 11 are described to contain documents marked classified
  • Executive grant of clemency for Roger Stone
  • Potential Presidential record
  • 2 binders of photos
  • Handwritten note
  • Other documents catalogued on the SSA receipt

See these two posts for more on the significance of the two different receipts.

Christina Bobb signed for both receipts at 6:19PM on August 8.

Affidavit

This would start with:

  • Several paragraphs describing the affiant’s background and training
  • An assertion that the affiant believed there was probable cause that the FBI would find evidence of violations of 18 USC 793, 18 USC 2071, and 18 USC 1519 at Mar-a-Lago.

Particularly given the novel legal issues implicating a search of the former President, I think there’s likely a section describing the statutes involved. It’s likely to include:

Note: If there’s a version of this statutory language, it may be among the things DOJ would acquiesce to releasing, particularly if it implied that Trump was under investigation for stealing nuclear documents. But they might be unwilling to do that if they’re not yet sure they’ve gotten all known nuclear documents back. 

Then there’d be a section describing who was involved (the Roger Stone warrant has such paragraphs). There will be a paragraph about Trump that looks like:

Donald J. Trump (Former President of the United States, FPOTUS) is a businessman who owns and resides at 1100 S. Ocean Blvd., Palm Beach, FL. From January 20, 2017 at 12:00PM until January 20, 2021 at 12:00PM, he was the President of the United States. He ceased exercising the constitutional authorities of the President at 12:00PM on January 20, 2021. On February 5, 2021, the current President of the United States, Joe Biden, discontinued classified briefings for FPOTUS.

In addition, there are likely descriptions of the National Archives and its statutory duties.

There may be descriptions of Patrick Philbin, Pat Cipollone, Mark Meadows (all of whom were involved in negotiations with NARA over retrieving the documents), anyone caught on surveillance video entering or exiting the storage closet, of Kash Patel and John Solomon (including past security concerns raised about both), and the Trump lawyers involved in the June meeting.

There may be a paragraph describing MAL in more depth. It might describe the SCIF used during Trump’s presidency and its apparent removal. It might describe the arrest and prosecution of Yujing Zhang, who breached MAL and might include other known foreign intelligence targeting of MAL. It might describe Trump’s refusal to use secure facilities at MAL, including a 2017 meeting with Shinzo Abe, though it would likely rely on public reports for this, not classified intelligence. It might describe the tunnels underneath and — and the public availability of historic diagrams of them. It might describe the known employees at MAL, including any foreign citizens. Finally, it might describe both the terms of membership and the ease with which others could access the golf club.

Timeline

The rest is probably a timeline of the investigation. The following known details are likely to appear.

On December 30, 2020, DOJ provided Trump a binder of material from the Russian investigation.

On January 8, 2021, Mike Ellis attempted to retain a compartmented NSA report for White House archives, initially refusing efforts to return it.

On January 14, 2021, the White House returned the compartmented NSA report to NSA.

On January 17, 2021, the FBI provided a list of continuing objections to Trump’s declassification of Crossfire Hurricane materials.

On January 19, 2021, via letter to Archivist of the United States David Ferriero, FPOTUS designated (among others) Pasquale (Pat) Cipollone and Patrick Philbin as his representatives with the NARA.

On January 19, 2021, FPOTUS wrote a letter authorizing the declassification of records pertaining to FBI’s investigation into Russian ties with FPOTUS’ campaign that had not yet been declassified. Patel later described the materials to include:

transcripts of intercepts made by the FBI of Trump aides, a declassified copy of the final FISA warrant approved by an intelligence court, and the tasking orders and debriefings of the two main confidential human sources, Christopher Steele and Stefan Halper, the bureau used to investigate whether Trump had colluded with Russia to steal the 2016 election.

Patel’s description appears to conflict with Trump’s order, which explicitly, “does not extend to materials that must be protected from disclosure pursuant to orders of the Foreign Intelligence Surveillance Court.”

On January 20, 2021, Meadows sent “The Attorney General” a memo, citing the January 19 order from FPOTUS, ordering “the Department must expeditiously conduct a Privacy Act review under the standards that the Department of Justice would normally apply, redact material appropriately, and release the remaining material with redactions applied.”

On January 20, 2021, FPOTUS ceased exercising the authorities of the President of the United States.

On January XX, records deemed to be the final production of Presidential Records arrived at NARA.

The affidavit would describe the inventorying process and then describe known documents that were not included.

  • Love letters from Kim Jong Un
  • Altered map of Hurricane Dorian

It would also include a description of evidence of document destruction, including any evidence those records pertained to a Congressional investigation, impeachment, or a criminal investigation.

Starting on May 6, 2021, NARA General Counsel Gary Stern communicated with Philbin regarding the missing records. [This will cite the date of each communication and quote anything that captures Trump’s refusal to return the documents.]

Having not secured identified records, starting in Fall 2021, Stern communicated with Trump attorney (probably Cipollone) to arrange turning over the records.

October 18, 2021: Trump sues to prevent the Archives from complying with January 6 Committee subpoena.

November 10, 2021: Judge Tanya Chutkan denies Trump’s motion for an injunction against NARA. (While it wouldn’t appear in the affidavit, in recent days Paul Sperry has claimed that Trump withheld documents to prevent NARA from turning them over to the January 6 Committee.)

On December XX, 2021, XX informed NARA certain missing records had been located.

December 9, 2021: DC Circuit upholds Judge Chutkan’s decision releasing Trump records to the January 6 Committee.

On January 17, 2022, NARA retrieved 15 boxes of Records from 1100 S. Ocean Blvd, Palm Beach, FL.

January 19, 2022: SCOTUS upholds Chutkan’s decision.

On January 31, 2022, NARA completed an initial inventory of the retrieved documents. It discovered over 100 documents with classification markings, comprising more than 700 pages. Some include the highest levels of classification, including Special Access Program (SAP) material.

On February xx (possibly February 8), 2022, NARA reported FPOTUS’ failures to comply with the Presidential Records Act to the Department of Justice and requested an investigation.

DOJ and FBI likely conducted interviews between February and May, which would be listed.

On April 11, 2022, Biden’s White House Counsel instructed NARA provide FBI access to the 15 boxes of materials returned from Mar-a-Lago.

On April 12, 2022, NARA instructed the Trump team of that decision, and informing him that the FBI would start to access the documents on April 18.

On April XX, Trump’s attorneys ask the White House counsel for more time before the review of the documents; Biden extends the date to April 29.

On May 5, 2022, Corcoran proposed reviewing the records at NARA.

On May 5, 2022, Kash Patel made public claims that the contents of materials returned to NARA had been declassified, describing that FPOTUS wanted to release,

information that Trump felt spoke to matters regarding everything from Russiagate to the Ukraine impeachment fiasco to major national security matters of great public importance — anything the president felt the American people had a right to know is in there and more.

FBI conducted early interviews during this period, likely including Philbin, Scott Gast, Derek Lyons, and Cipollone, and possibly Mark Meadows. Philbin and Cipollone would have described their own inspections of records, including their knowledge that identified missing records had been at MAL when they had conducted records searches.

FBI would include multiple interviews of people describing Trump saying the Presidential Records belonged to him.

On May 10, 2022, Acting Archivist informed Evan Corcoran the FBI would get access to the records on May 12.

On May 11, 2022, FBI subpoenaed Trump for documents remaining at Mar-a-Lago bearing classification marks.

On May 12, pursuant to a subpoena, FBI accessed the 15 boxes turned over in January.

From May 16-18, FBI conducted a preliminary review of. the documents and discovered:

  • 67 Confidential documents
  • 92 Secret documents
  • 25 Top Secret documents
  • Documents marked HCS, FISA, ORCON, NOFORN, and SI
  • Handwritten notes

On May XX, 2022, DOJ subpoenaed FPOTUS for any remaining documents bearing classification marks.

Surveillance video from this period, later obtained with a subpoena, showed people moving documents in and out of the storage room. The people and dates would be included.

On June 3, 2022, Jay Bratt and three investigators met with Evan Corcoran and Christina Bobb to collect the subpoenaed materials.

  • FPOTUS joined the meeting and acknowledged the effort to retrieve classified materials.
  • Bobb and Corcoran provided XX documents marked with classification marks.
  • One of the lawyers signed an attestation that all classified documents had been turned over.
  • Bratt informed Bobb and Corcoran all records covered by the Presidential and Federal Records Act were US government property.
  • Bratt informed Bobb and Corcoran about the regulations guiding storage of classified records.
  • Bratt and investigators inspect storage facility, find storage facility fails to meet required standards for storage.

On June 8, Bratt emailed Corcoran. He said, in part, that,

We ask that the room at Mar-a-Lago where the documents had been stored be secured and that all the boxes that were moved from the White House to Mar-a-Lago (along with any other items in that room) be preserved in that room in their current condition until further notice

It’s likely either at the meeting on June 3 or in the email, Bratt also informed Corcoran that the storage closet did not comply with CFR guidelines.

On June 9, Corcoran wrote saying only, “I write to acknowledge receipt of this letter.”

On June 19, FPOTUS sent a letter to NARA designating Patel and Solomon as representatives to access “Presidential records of my administration.”

NARA, possibly Gary Stern, likely informed DOJ of the designation of Patel and Solomon and (probably) Trump’s reference to “Presidential records,” generally, not records at NARA.

On June 22, DOJ subpoenaed surveillance video of the storage closet for a 60-day period. Analysis of the video showed uncleared people entering in and out of the storage closet.

DOJ likely had follow-up interviews after the Bratt meeting and the surveillance video return, in part to identify who had access to the storage closet and to identify documents believed to remain outstanding.

The affidavit would include a description of known documents that remain extant, including documents that were altered or mutilated (perhaps transcripts of Trump’s meetings with Russia) and known classified documents, including those pertaining to nuclear weapons. 

Finally, the affidavit would include a conclusion stating that all this amounts to probable cause that Trump was in possession of documents that were covered by the PRA, some subset of which were believed to be classified and some other subset of which had either been hidden or damaged in an effort to obstruct either this or other investigations.

emptywheel Trump Espionage coverage

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

18 USC 793e in the Time of Shadow Brokers and Donald Trump

[from Rayne] Other Possible Classified Materials in Trump’s Safe

Trump’s Stolen Documents

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

[from Peterr] Merrick Garland Preaches to an Overseas Audience

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

Merrick Garland Calls Trump’s Bluff

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

[from Rayne] Expected Response is Expected: Trump and Right-Wing DARVO

DOJ’s June Mar-a-Lago Trip Helps Prove 18 USC 793e

The Likely Content of a Trump Search Affidavit

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

Some Likely Exacerbating Factors that Would Contribute to a Trump Search

FBI Executes a Search Warrant at 1100 S Ocean Blvd, Palm Beach, FL 33480

The ABCs (and Provisions e, f, and g) of the Espionage Act

Trump’s Latest Tirade Proves Any Temporary Restraining Order May Come Too Late

How Trump’s Search Worked, with Nifty Graphic

Pat Philbin Knows Why the Bodies Are Buried

Rule of Law: DOJ Obtained Trump’s Privilege-Waived Documents in May

The French President May Be Contained Inside the Roger Stone Clemency

Which of the Many Investigations Trump Has Obstructed Is DOJ Investigating?

The Known and Likely Content of Trump’s Search Warrant

Which of the Many Investigations Trump Has Obstructed Is DOJ Investigating?

As I’ve written in the past, there are several different theories about how DOJ is applying the obstruction statute, 18 USC 1519, in its investigation into Trump’s stolen documents. Three possibilities have been floated:

  1. DOJ is investigating Trump for obstructing the investigation it opened in February of Trump’s theft of classified documents by moving documents at Mar-a-Lago around to hide them from DOJ and his own lawyers
  2. DOJ is investigating Trump for obstructing prior investigations and current January 6 investigations (both the January 6 Committee and DOJ’s own investigation) by trying to keep incriminating Presidential Records out of the Archives, either by destroying documents or hiding them
  3. DOJ is investigating Trump for obstructing the Archives’ ability to fulfill the requirements of the Presidential Records Act

The differences are subtle, but important for assessing how significant Trump’s legal exposure on this count might be.

Two details revealed yesterday seem to rule out theory 3, that DOJ is investigating Trump for obstructing the Archives’ work.

The search authorization tied to obstruction in the warrant was vague, permitting FBI to collect evidence of the knowing alteration, destruction, or concealment of any Presidential or classified documents.

Any evidence of the knowing alteration, destruction, or concealment of any government and/or Presidential Records, or of any documents with classification markings.

That left open the possibility DOJ was investigating Trump’s obstruction of the Archives generally.

But the cover page unsealed yesterday described obstruction to apply to a federal investigation.

Also, at the hearing on unsealing the affidavit in Palm Beach, DOJ’s head of counterintelligence Jay Bratt raised Trump’s suspected obstruction to highlight the danger that unsealing the warrant affidavit would pose a risk to witnesses.

A Justice Department lawyer said during the hearing that the probable cause affidavit used to get a warrant described how prosecutors might find “evidence of obstruction” on the grounds of the Florida property — a possible crime that the search warrant itself revealed was under investigation. “In this case, the court has found probable cause there’s a violation of one of the obstruction statutes, and that evidence of obstruction would be found at Mar-a-Lago” said Jay Bratt, who heads the Justice Department’s counterintelligence section. Obstruction of justice was one of the three statutes listed on the search warrant for Mar-a-Lago, which was unsealed last week, and Reinhart said during the hearing Thursday that he “found there is probable cause” that the statutes had been violated. Bratt made the comments about obstruction being investigated while he was trying to highlight DOJ’s fear that future witnesses may not be willing to provide information if too much was to come out about the investigation so far.

Both these details — the description on the warrant cover page and Bratt’s own comments — seem to make it clear that DOJ is investigating obstruction of an investigation, not just the Archives’ ordinary work.

Bratt’s comments strongly suggest that the obstruction prong is about efforts to obstruct this investigation.

Three things still suggest it may be broader than that, though.

First, as I’ve noted, the earliest reporting on the criminal referral described two things that would be criminal: retaining classified documents and ripping, burning, or flushing them.

The National Archives and Records Administration has asked the Justice Department to examine Donald Trump’s handling of White House records, sparking discussions among federal law enforcement officials about whether they should investigate the former president for a possible crime, according to two people familiar with the matter.

The referral from the National Archives came amid recent revelations that officials recovered 15 boxes of materials from the former president’s Mar-a-Lago residence in Florida that were not handed back in to the government as they should have been, and that Trump had turned over other White House records that had been torn up. Archives officials suspected Trump had possibly violated laws concerning the handling of government documents — including those that might be considered classified — and reached out to the Justice Department, the people familiar with the matter said.

[snip]

Trump’s years-long defiance of the Presidential Records Act, which requires the preservation of memos, letters, notes, emails, faxes and other written communications related to a president’s official duties, has long raised concerns among historians and legal observers. His penchant for ripping up official documents was first reported by Politico in 2018, but it has drawn new scrutiny in recent weeks because of a House select committee’s investigation of the Jan. 6, 2021, attack on the U.S. Capitol.

The Washington Post reported late last month that some of the White House records the National Archives turned over to the committee appeared to have been torn apart and then taped back together. The Post later found — and the Archives confirmed — that officials had recovered 15 boxes of presidential records from Mar-a-Lago. [my emphasis]

This reporting suggests that Trump’s efforts to destroy documents — including documents pertinent to investigations of January 6 that started the day of the attack — were part of the Archives’ referral from the start, before Trump had an opportunity to start obstructing this investigation.

With Trump, he’s always already obstructing.

In that case, the initial referral would have implicated obstruction of other investigations. And it might not be limited to those ripped up documents provided to the January 6 Committee.

As I laid out, there are multiple known examples where Trump or his aides or his lawyers destroyed or withheld evidence from then-ongoing investigations. So if DOJ were investigating under theory 2, it might provide a way to reopen those earlier investigations under extended statutes of limitation tied to his theft of documents.

Then there are the two receipts, just one of which (if you can believe Fox News) is known to record the seizure of attorney-client privileged materials. There are five boxes plus some other documents on that receipt. It may be that the only distinguisher is attorney-client materials, but if it’s more than that, five boxes is far too much material to relate exclusively to this investigation.

Finally, there’s the statute used, 18 USC 1519 instead of 18 USC 1505, which includes obstructing committee proceedings, or 18 USC 1512, which includes witness tampering and (as applied in the January 6 context) otherwise obstructing a proceeding. A recent SCOTUS decision, Yates v. US, limits the application of 1519 (the one named in the warrant) to evidence, not fish. It squarely applies to things like Presidential Records. But because of that recent ruling, DOJ is not going to try to stretch the bounds of 1519 with the former President. If they were ever to charge Trump with witness tampering — the concern Bratt raised — or more amorphous kinds of obstruction, it would be under 18 USC 1512.

And thus far at least, the obstruction of this current investigation that has been publicly reported has been limited to lying and hiding. Hiding the documents by moving them out of the closet DOJ was about to inspect absolutely qualifies as “concealing” Presidential Records and the lying served that purpose as well. But the FBI was authorized to seize documents more broadly than that, including those that were altered or destroyed (as ripping, flushing, burning, or eating would do). The documents we know Trump has ripped, flushed, burned or eaten were evidence in other investigations, not (thus far at least) this one.

That said, the way in which DOJ refers to 18 USC 2071 in this warrant — removing or concealing records — might suggest DOJ is focusing on that, the concealment of records.

It seems increasingly likely DOJ is investigating Trump’s obstruction of investigations (rather than the normal functions of the Archives). It’s just not clear, yet, which investigations are included in the scope.

Update: I realized something as I was revising this post on the likely contents of the Trump search warrant affidavit: Trump originally withheld the SharpieGate map in which he lied about the path of Hurricane Dorian. That in and of itself would be proof Trump altered or concealed evidence in an investigation, because the Commerce Department Inspector General did a report on the pressure to uphold Trump’s false claims.

emptywheel Trump Espionage coverage

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

18 USC 793e in the Time of Shadow Brokers and Donald Trump

[from Rayne] Other Possible Classified Materials in Trump’s Safe

Trump’s Stolen Documents

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

[from Peterr] Merrick Garland Preaches to an Overseas Audience

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

Merrick Garland Calls Trump’s Bluff

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

[from Rayne] Expected Response is Expected: Trump and Right-Wing DARVO

DOJ’s June Mar-a-Lago Trip Helps Prove 18 USC 793e

The Likely Content of a Trump Search Affidavit

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

Some Likely Exacerbating Factors that Would Contribute to a Trump Search

FBI Executes a Search Warrant at 1100 S Ocean Blvd, Palm Beach, FL 33480

The ABCs (and Provisions e, f, and g) of the Espionage Act

Trump’s Latest Tirade Proves Any Temporary Restraining Order May Come Too Late

How Trump’s Search Worked, with Nifty Graphic

Pat Philbin Knows Why the Bodies Are Buried

Rule of Law: DOJ Obtained Trump’s Privilege-Waived Documents in May

The French President May Be Contained Inside the Roger Stone Clemency

Which of the Many Investigations Trump Has Obstructed Is DOJ Investigating?

The French President May Be Contained Inside the Roger Stone Clemency

These are pictures the FBI took during their March 2017 search of Josh Schulte’s apartment for evidence that he violated 18 USC 793, one of the same crimes for which Trump is being investigated. (I’ve not included links and included just fragments of the images to minimize privacy impact.)

I thought they’d be useful background to the search of Trump’s golf resort and the receipts included on the publicly released warrant. As I understand it, the FBI takes these pictures for several reasons:

  • To document the condition of a search location before they start their search in case of an attempt to suppress the seizure
  • To record the original location and condition of each item that will be seized
  • To assist the inventory process

In Schulte’s case, the FBI put a post-it bearing a letter A-G in the framing picture they took of every room in his apartment (I’ve shown B, the closet, and D, his living room), then used additional post-its to identify the items they would seize from those rooms. The pictures make it easy to show (for example) that the FBI took item B1, probably a server, from the closet where it had been stored next to the Kingsford Charcoal bag and under the vacuum cleaner.

FBI’s use of this kind of process is one of the reasons that I think the grant of executive clemency for Roger Stone described in the inventory of the search of Mar-a-Lago is probably neither the commutation nor the pardon that we already know about: Stone’s get out of jail free card for lying to cover-up whatever real back-channel he had to Russia’s hack-and-leak effort.

It appears to show that the “Info re: President of France” was contained inside the “Executive Grant of Clemency re: Roger Jason Stone Jr.”

While we can’t be sure, it appears that the FBI used a similar labeling system as used in the search of Schulte to identify all the boxes the found when they arrived at Mar-a-Lago, A-1 through at least A-73, then went through, room by room, to determine whether those boxes were covered by the scope of the warrant. Ultimately, the FBI seized 27 boxes out of what appears to be at least 73 they inspected.

The warrant permitted the FBI to seize anything that was obviously evidence of two of the three crimes under investigation:

  • Presidential or Governmental Records created during Trump’s term, which because they weren’t turned over under the Presidential or Federal Records Act, might be evidence that someone removed records from a public office and therefore a potential violation of 18 USC 2071
  • Any evidence of the knowing alteration, destruction, or concealment of Government and/or Presidential Records, or of any documents with classification markings, which in addition to being a potential violation of 18 USC 2071, might also be evidence that Trump obstructed the Archives’ efforts to fulfill its duties under 18 USC 1519

The way in which the warrant authorized the collection of evidence for the third crime, 18 USC 793, was two-fold. First, the FBI could collect any document about the storage of classified information. Responsive records might include a post-it note saying, “Sekrit, Keep Out,” the email from Jay Bratt telling Trump’s lawyers his storage facilities didn’t comply with regulations setting standards for storing classified documents, or cover sheets for classified documents that were discarded (the FBI found some of those in Schulte’s shredder and used those as evidence at trial to prove he knew he had CIA documents). The FBI would use such things to show that Trump or his staff knew how they were supposed to keep classified documents.

In addition, the FBI was allowed to seize documents with classification markings, stuff in the same box as such documents, and stuff in the same storage location as such boxes.

Any physical documents with classification markings, along with any containers/boxes (including any other contents) in which such documents are located, as well as any other containers/boxes that are collectively stored or found together with the aforementioned documents and containers/boxes;

As I showed in my nifty graphic the other day, that might might explain how the FBI seized three of Trump’s passports. If they were in a box with classified documents — here shown by Trump’s diplomatic passport in the leatherbound box where he allegedly also had TS/SCI documents — or in a box in the same closet as boxes that stored classified documents — shown here as a box with no classified documents but stored in the same closet where he had boxes with Top Secret and Secret documents — then FBI would be permitted to seize them, but would (and did) return them once they confirmed they were out of scope.

This proximal search protocol may be part of the reason why the FBI seems to have used sub-entries to describe the contents of 11 boxes.

Items 1 through 7 or 8 may have come from either Trump’s office or residence (wherever he stored the leatherbound box that, according to a Guardian story, only his family knew about).

If so, under the proximal protocol, all could be seized if they were stored in the same place as Item 2, a leatherbound box, in which there were documents marked TS/SCI. (Of course, they could also be seized if they fit one of the two other search criteria, a possible Presidential Record — as item 3 is described — or proof of obstruction.)

There are no classified documents identified in boxes A-12, A-13, A-14, or A-17, but they were likely stored in close proximity to boxes A-15, A-16, and A-18, which are described to contain documents with classification marks. There are no classified documents identified in boxes A-22, A-24, or A-26, but boxes A-23, A-27, and A-28 are listed as containing documents classified at various levels. Boxes A-71 and A-73 may have been stored in an entirely different place at Mar-a-Lago, but the former could have been seized under the proximal search protocol if it were stored in the same place as box A-73, which is listed as containing Top Secret documents.

If this is right, then these labels on boxes (and their inclusion in the inventory) would serve several purposes. It would signal which boxes had to be treated with greater care in seizing them and taking them to the FBI inventory. It would make it easy for those doing intake to identify where the most sensitive documents were and which documents needed to be sent for classification review. It would reveal to the public that the FBI found precisely what it expected to find: stolen classified documents. And it would at least hint that the FBI did follow this proximal protocol, taking just 27 out of at least 73 boxes it reviewed, almost all of which appear to have been in close proximity to other classified documents.

The single solitary exception to what appears to be a practice of listing the contents of boxes in this entire inventory is the Roger Stone clemency.

It’s possible 1A, the information on the French President, wasn’t part of the clemency. Maybe Trump has a folder full of blackmail on people, and his blackmail on Emmanuel Macron was paper-clipped to his pardon for Stone. Maybe his filing system is just even more chaotic than reported, and Stone and Macron simply ended up in the same box, swimming through Trump’s mementos for all eternity together.

But the most likely explanation of this, given the rest of the inventory, is that the information about a President of France is information included inside the Stone clemency.

If that’s right, the reasons the FBI might have recorded the content of what would be a previously unknown Executive Grant of Clemency could be similar to the reasons listing the classified documents Trump had stored away. If this document is not a Presidential Record, a classified document, or proof of obstruction via evidence impairment (using a pardon to obstruct justice would not qualify under 18 USC 1519, unless the FBI were seizing it under a Plain View claim), then the FBI had no business taking it unless by dint of proximity to the leatherbound box containing TS/SCI documents. If this apparent grant of clemency weren’t on official letterhead, for example, it’s not clear that it would be a real grant of clemency, and so not a Presidential Record. Maybe Trump and his rat-fucker just engage in pardon cosplay together to relive the old times, and they have a game to think up the most outlandish pardon? That may be one of the purposes of including the reference to a French President, if it’s really part of the clemency. For example, the reference may appear potentially classified, perhaps non-public information obtained via intelligence intercepts, which would be another proper reason to seize the document under the warrant.

Of course, the FBI also might have recorded that tidbit for the same reason I keep coming back to it, because the agent looked at it and said WTF, and wanted to make sure someone else chased down what this is about.

Again, this is not definitive. But given the convention that seems to be used elsewhere in the warrant receipt, there is more evidence this is not the known commutation and pardon for Stone than that it is, because it appears to include something — some tie to a President of France — that neither of those do.

In a follow-up, I’ll explain why this is not as outlandish as it seems.

Update: Here’s a bureaucratic manual on FBI evidence collection. It’s not really helpful but it’s a guide to all the forms that are being filed to catalog stuff seized from Trump’s home.

emptywheel Trump Espionage coverage

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

18 USC 793e in the Time of Shadow Brokers and Donald Trump

[from Rayne] Other Possible Classified Materials in Trump’s Safe

Trump’s Stolen Documents

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

[from Peterr] Merrick Garland Preaches to an Overseas Audience

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

Merrick Garland Calls Trump’s Bluff

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

[from Rayne] Expected Response is Expected: Trump and Right-Wing DARVO

DOJ’s June Mar-a-Lago Trip Helps Prove 18 USC 793e

The Likely Content of a Trump Search Affidavit

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

Some Likely Exacerbating Factors that Would Contribute to a Trump Search

FBI Executes a Search Warrant at 1100 S Ocean Blvd, Palm Beach, FL 33480

The ABCs (and Provisions e, f, and g) of the Espionage Act

Trump’s Latest Tirade Proves Any Temporary Restraining Order May Come Too Late

How Trump’s Search Worked, with Nifty Graphic

Pat Philbin Knows Why the Bodies Are Buried

Rule of Law: DOJ Obtained Trump’s Privilege-Waived Documents in May

The French President May Be Contained Inside the Roger Stone Clemency

Pat Philbin Knows Why the Bodies Are Buried

Back on August 11, I predicted that Pat Philbin would have been one of the witnesses whom DOJ interviewed in advance of the search of Trump’s golf resort.

Pat Philbin is likely the lawyer described in earlier reports who attempted, but failed, to negotiate transfer of Trump’s stolen documents to the Archives.

Longtime Archives lawyer Gary Stern first reached out to a person from the White House counsel’s office who had been designated as the President Records Act point of contact about the record-keeping issue, hoping to locate the missing items and initiate their swift transfer back to NARA, said multiple sources familiar with the matter. The person had served as one of Trump’s impeachment defense attorneys months earlier and, as deputy counsel, was among the White House officials typically involved in ensuring records were properly preserved during the transfer of power and Trump’s departure from office.

But after an extended back and forth over several months and after multiple steps taken by Trump’s team to resolve the issue, Stern sought the intervention of another Trump attorney last fall as his frustration mounted over the pace of the document turnover.

If Philbin was the person who tried but failed to resolve the Archives’ concerns, he is a direct, material witness to the issue of whether Trump had willfully withheld classified documents the Archives was asking for, something the Archives would have made clear in its referral to DOJ. And because of the way the Espionage statute is written (note the Newsweek article, if accurate, mentions National Defense Information, language specific to the Espionage Act), Philbin would have personal legal exposure if he did not fully disclose information about Trump continuing to hoard stolen classified documents. Plus, Philbin has been involved in national security law since the 00s, and probably would like to retain his clearance to represent clients in national security cases.

Yesterday, Maggie Haberman confirmed that I was correct (and also reported that Pat Cipollone was also interviewed; Cipollone may have been the lawyer the Archives called after Philbin failed to get Trump to return the documents).

Mr. Philbin was interviewed in the spring, according to two of the people familiar with the matter, as investigators reached out to members of Mr. Trump’s circle to find out how 15 boxes of material — some of it marked as classified — made its way to Mar-a-Lago. It was unclear when Mr. Cipollone was interviewed.

Mr. Cipollone and Mr. Philbin were two of Mr. Trump’s representatives to deal with the National Archives; they were named to the positions shortly before the president’s term ended, in January 2021. Another was Mark Meadows, the former White House chief of staff.

At some point after National Archives officials realized they did not have Trump White House documents, which are required to be preserved under the Presidential Records Act, they contacted Mr. Philbin for help returning them.

A spokesperson for Mr. Philbin did not immediately respond to a request for comment.

Mr. Philbin tried to help the National Archives retrieve the material, two of the people familiar with the discussions said. But the former president repeatedly resisted entreaties from his advisers.

“It’s not theirs, it’s mine,” several advisers say Mr. Trump told them.

For the reasons I laid out above, it’s unsurprising that FBI interviewed Philbin (and Cipollone, if he is the other lawyer NARA appealed to). This was a referral from NARA, and they would have explained to FBI what CNN explained in February: that NARA had worked patiently with Philbin, but that Philbin failed to persuade Trump to comply with the Presidential Records Act.

Philbin’s early role in DOJ’s investigation is complicated, however, because the investigation implicates (at least!) three legal relationships Philbin has had with Trump:

  1. As a member of the White House Counsel Office that, among other things, first altered, and then withheld the full transcript of the Perfect Phone Call between Trump and Volodymyr Zelenskyy, provided legal advice about classification issues, and also advised staff as Trump’s team packed up
  2. As a member of Trump’s first impeachment defense team, which might have turned out differently if that full transcript had been shared with Congress
  3. As a liaison with NARA at a time when Trump was no longer President, probably formally within the context of his designation as a Trump representative to NARA

Philbin’s ethical obligations and legal exposure from all three of those relationships are different, but knowledge gained from all three positions would be of acute interest to the FBI.

Plus, Philbin has a deep background in national security law from the George W. Bush Administration. He played a key role in the review of John Yoo’s shoddy OLC memos and the related hospital confrontation between Jim Comey and Dick Cheney. Particularly after NARA referred the issue to FBI, it wouldn’t take long for Philbin to have appreciated the problem posed by all those unprotected files sitting in a closet in a golf resort targeted by foreign intelligence services. Nor would Philbin miss the legal gravity under the Espionage Act — for Trump, as well as for anyone who conspired with the person refusing to return stolen classified documents — implicated by Trump’s refusal to turn over what he had taken. And as a lawyer with at least another decade of private practice before him, I imagine Philbin would want to keep his clearance.

Those factors are important because Philbin knows why the bodies are buried — the decision-making process Trump used to handle classified information and the rationale Trump gave him during the period when Philbin was trying to negotiate the documents’ return.

Philbin may not have recent knowledge of where the bodies are buried: where Trump stored documents at Mar-a-Lago. But because he tried to chase these documents down in 2021, he would have a general understanding of what Trump’s storage practices were until such time as someone else inherited the problem, including whether they complied with CFR rules about minimum standards for storing classified documents (DOJ told Trump in June that they did not).

He would have a general idea of what bodies are buried. Because he tried to negotiate their return over the course of months, he would know the general scope of the documents Trump took with him in 2020 and may well have specific knowledge of individual documents NARA identified to be missing. He may know, for example, about specific documents that Trump was particularly opposed to returning. Speaking just hypothetically, that could even include the full transcript of that Perfect Phone Call that Philbin’s office had helped to keep out of the hands of Congress, potentially a violation of 18 USC 1519. It might also include documents Philbin saw in the lead-up to January 6, documents that would have been responsive to the known January 6 Committee subpoenas to NARA for Trump’s records. That means Philbin is among the people who may have been able to confirm to the FBI that documents excluded from the 15 boxes returned earlier this year were at Mar-a-Lago during the period he was negotiating their return. Such information is the kind of thing that the FBI would have included in the subpoena to search MAL.

But the most important thing that Philbin would know from his various interactions with Trump has to do with motive: Why the bodies got buried. Maggie quotes several advisers, possibly including one or both of the two Pats, that Trump told them, “It’s not theirs, it’s mine.” And it may be that’s the only motivation Trump ever expressed to Philbin. Trump is such a narcissist he really may just verbalize his theft of these documents by claiming ownership. But Philbin had firsthand knowledge of other efforts to withhold materials, as evidenced by the Perfect Phone Call transcript. He likely knows of Trump’s habit of ripping up burning eating or flushing damning documents. Philbin was still trying to get Trump to return documents after the time the January 6 Committee was convened, so Trump may have stated to Philbin what Paul Sperry claimed yesterday: that the reason Trump is withholding documents is because he knows NARA is legally obligated to share those documents with J6C.

Given the complex ethical issues he’d face, Philbin might not have been able or willing to share some of what he knows with the FBI, at least not at first. But the risks of an Espionage Act and obstruction investigation, including 18 USC 793g, which can be used to charge anyone involved in refusing to return classified documents even if they don’t share the motive of refusing to return them, might change Philbin’s ethical calculus. An experienced NatSec lawyer like Philbin would know that the Espionage Act carries an affirmative obligation to give classified documents back, particularly if their lawful owner, NARA, has asked. Once FBI got involved, Philbin would want to avoid any legal liability for his failure to convince Trump to comply, and Trump’s continued failure to comply would be a crime that might give Philbin the ethical leeway to do that.

When NARA asked Philbin to help them get those documents back, Philbin failed. That puts him in situation where he may have real incentive to explain both what Trump said to explain his refusal to comply with the Presidential Records Act, but also what, in Philbin’s personal knowledge gained two years as Deputy WHCO, several months during an impeachment defense, and much of a year as Trump’s NARA representative, Trump did when he took steps to make documents covered by the PRA unavailable to the NARA.

Update: As you consider the import of Philbin’s testimony, consider the significance of this reference in the government opposition to further unsealing of the Trump warrant.

Disclosure of the government’s affidavit at this stage would also likely chill future cooperation by witnesses whose assistance may be sought as this investigation progresses, as well as in other high-profile investigations.

Philbin has been subpoenaed in other investigations of Trump. But this passage suggests that if the extent and terms of his cooperation are made public, it may lead him and others to hesitate before cooperating in other investigations.

emptywheel Trump Espionage coverage

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

18 USC 793e in the Time of Shadow Brokers and Donald Trump

[from Rayne] Other Possible Classified Materials in Trump’s Safe

Trump’s Stolen Documents

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

[from Peterr] Merrick Garland Preaches to an Overseas Audience

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

Merrick Garland Calls Trump’s Bluff

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

[from Rayne] Expected Response is Expected: Trump and Right-Wing DARVO

DOJ’s June Mar-a-Lago Trip Helps Prove 18 USC 793e

The Likely Content of a Trump Search Affidavit

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

Some Likely Exacerbating Factors that Would Contribute to a Trump Search

FBI Executes a Search Warrant at 1100 S Ocean Blvd, Palm Beach, FL 33480

The ABCs (and Provisions e, f, and g) of the Espionage Act

Trump’s Latest Tirade Proves Any Temporary Restraining Order May Come Too Late

How Trump’s Search Worked, with Nifty Graphic

Pat Philbin Knows Why the Bodies Are Buried

How Trump’s Search Worked, with Nifty Graphic

 

I did a really rough, overly-simplified graphic explaining what we know about Trump’s search.

Round-edged boxes above are documents. Ovals are physical objects. Grey boxes are the boxes that documents were contained in. Turquoise represents documents that were not known to be classified or otherwise proof of any crime except (possibly, but not necessarily) a violation of the Presidential Records Act. The other colors for documents show various kinds of criminal evidence that a document might represent.

The search warrant authorizes the seizure of evidence that Trump:

  • Retained classified documents he’s not authorized to have
  • Took government documents he was obligated under the Presidential Records Act to turn over to the Archives
  • Obstructed investigations and government functions by destroying or concealing evidence

But the search method permits agents to take documents marked as classified, the boxes they’re in (with everything else in the boxes), and other boxes stored in the same place.

Any physical documents with classification markings, along with any containers/boxes (including any other contents) in which such documents are located, as well as any other containers/boxes that are collectively stored or found together with the aforementioned documents and containers/boxes;

Agents were allowed to search any part of Mar-a-Lago that Trump or his staff could access, but two locations we know they searched were his office and a storage closet (which I’ve indicated by two separate boxes, above).

Here are things that were seized that might have been found in Trump’s office (indicated above by the top horizontal black box):

  • A leatherbound box (that long horizontal grey box in the graphic)
    • Top Secret/SCI documents in that box
    • Everything else in that box
    • Trump’s diplomatic passport
  • Photo albums
  • An Executive Grant of clemency for Roger Stone
    • Information in that executive grant of clemency about the President of France
  • A handwritten note
  • Other documents that include privileged information which may be evidence of obstruction

Here are things that were seized that might have been in that storage closet (indicated above by the bottom horizontal black box):

  • Boxes with Top Secret documents and everything else in the boxes
  • Boxes with Secret documents and everything else in the boxes
  • Boxes with Confidential documents and everything else in the boxes
  • All the other boxes stored with the boxes with classified documents
  • Boxes that happen to include Trump’s expired passports
  • Boxes that include privileged documents which may be evidence of obstruction

At least some of the agents that did the search were a filter team, which means they’re agents who are not part of the primary investigative team. Before any agents from the primary investigative team looked at the materials, these filter agents sorted through the evidence and determined what documents were privileged or what boxes included privileged information. Everything that was deemed unprivileged seems to have been inventoried on what I’ve called the “CLASS receipt” signed by a Special Agent. (See these two posts for further discussions of the two receipts.) Those are marked by the lefthand green box above.

Then, it appears that someone else (possibly the Supervisory Special Agent) reviewed those privileged documents and identified any that could be seized anyway — either because they included classified documents, or because they were proof of obstruction. According to a Fox News report, those were all inventoried on what I’ve called the “SSA receipt.” That seems to indicate that anything privileged, regardless of where it was discovered (for example, if it was in the leatherbound box, as I showed above), was seized and inventoried separately. I’ve bolded those in my list above and marked them with the righthand green box.

So the process for Trump’s search likely looked like this:

  1. Is it a government document dated January 20, 2017 to January 20, 2021? If no, go to step 2; if yes, go to step 3
  2. Is it classified, in a box w/classified, or a closet with classified?
  3. If yes, is it privileged?
  4. If no, then put in CLASS inventory
  5. If yes, is it proof of obstruction?
  6. If yes, then put it in the SSA inventory

Since the seizure, agents appear to have at least started the scope review — the process of sorting through which materials are proof that Trump stole classified information, documents otherwise covered by the Presidential Records Act, or proof of obstruction. The stuff that is not covered in the investigative scope, the FBI will return to Trump.

The first such items — his current diplomatic passport and two expired ones — were returned yesterday. Those likely were seized because they were stored in a box that either contained classified documents or were stored in a closet with other boxes that contained classified documents. Above, I’ve suggested that Trump’s diplo passport may have been seized in that leatherbound box where he allegedly kept TS/SCI documents, and I’ve shown how the other passports may have been in a box of documents that were in the storage closet with other boxes which had classified documents.

emptywheel Trump Espionage coverage

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

18 USC 793e in the Time of Shadow Brokers and Donald Trump

[from Rayne] Other Possible Classified Materials in Trump’s Safe

Trump’s Stolen Documents

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

[from Peterr] Merrick Garland Preaches to an Overseas Audience

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

Merrick Garland Calls Trump’s Bluff

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

[from Rayne] Expected Response is Expected: Trump and Right-Wing DARVO

DOJ’s June Mar-a-Lago Trip Helps Prove 18 USC 793e

The Likely Content of a Trump Search Affidavit

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

Some Likely Exacerbating Factors that Would Contribute to a Trump Search

FBI Executes a Search Warrant at 1100 S Ocean Blvd, Palm Beach, FL 33480

The ABCs (and Provisions e, f, and g) of the Espionage Act

Trump’s Latest Tirade Proves Any Temporary Restraining Order May Come Too Late

How Trump’s Search Worked, with Nifty Graphic

Trump’s Latest Tirade Proves Any Temporary Restraining Order May Come Too Late

At 12:49ET yesterday, the head of DOJ’s espionage section, Jay Bratt, informed Trump’s lawyers that the Agents who conducted the search of Mar-a-Lago had seized two expired passports and his still-active diplomatic passport; he invited someone to come get them after 2.

Later in the day, the former President went on his shitty website and claimed that the FBI, which attempted to return the passports within a week, had “stole” them.

Not long after, Norah O’Donnell tweeted that DOJ was not in possession of Trump’s passports.

In response, Trump’s spox Taylor Budowich accused O’Donnell of Fake News. He screencapped the Bratt letter to Trump’s lawyers showing that when the FBI discovered the passport, they made efforts to return them, effectively confirming O’Donnell’s statement that by the time of Trump’s tweet, the passports had been retrieved.

Given the way the warrant was written, there’s an easy explanation for how the FBI could have seized the passports. As I laid out in more detail here, the search worked from classified documents outward. The FBI was permitted to take any box that had a classified document in it, and any boxes stored where boxes storing classified documents were stashed.

Any physical documents with classification markings, along with any containers/boxes (including any other contents) in which such documents are located, as well as any other containers/boxes that are collectively stored or found together with the aforementioned documents and containers/boxes;

So if Trump stored his diplo passport in the leather-bound box where he stored the TS/SCI documents he stole, the FBI would have taken it under the search protocols. The same would happen if his expired passports were in a box in the storage closet where he stored his other stolen classified documents.

As the FBI explained in a statement, this is how it works.

In executing search warrants, the FBI follows search and seizure procedures ordered by courts, then returns items that do not need to be retained for law enforcement purposes.

And because Trump is a privileged white collar criminal suspect, he was lucky enough to get things that are out of scope immediately, rather than months later.

Unsurprisingly, then, Trump took an example of the FBI being diligent and used it to gin up outrage.

Worse for him, he is wasting his time.

As I noted Sunday, in response to similar searches implicating Donald Trump, lawyers filed for a Temporary Restraining Order within days.

I have been waiting all week for a docket to spring up with a Trump motion for a Temporary Restraining Order stalling any access to these files.

For comparison, the docket on a similar challenge from Michael Cohen in 2018 was created just 4 days after the search of his residences, and the discussions about the search began that same day.

On the same day as the seizures (April 9, 2018), the undersigned counsel requested in writing that the U.S. Attorney’s Office for the SDNY return all of the seized property and allow Mr. Cohen and his attorneys the opportunity to screen the materials for privilege, produce any relevant, non-privileged documents to the government, and provide a log of any documents withheld on privilege grounds. Id., ¶ 32, Ex. A. On Wednesday, April 11, 2018, the government responded by letter, rejecting defense counsel’s proposal and informing defense counsel that the government would begin to review the materials at noon on Friday, April 13, 2018. Id. ¶ 33, Ex. B. Accordingly, Mr. Cohen hereby moves for immediate injunctive and equitable relief seeking the opportunity to have his counsel review the seized documents in the first instance, before any review by any law enforcement personnel, for privilege and responsiveness, and, if the Court believes it necessary, for the appointment of a Special Master to supervise that review process.

Trump moved to intervene that same day, April 13, just four days after the seizures.

In the case of the search on Rudy’s phones, SDNY itself asked for a Special Master the next day (though Trump never intervened).

There have to be similar discussions going on now. There just have to be. Trump’s paucity of lawyers — and the conflict posed by the possibility that Evan Corcoran, his most competent current defense attorney, may be conflicted out by dint of having signed an affirmation that Trump turned over all his classified documents in June — cannot explain a full week delay.

But thus far, in spite of every media outlet and their mother filing motions to unseal the search affidavit itself, no one has started pushing to unseal an inevitable fight over access to the seized material. (Again, by comparison, the NYT filed to intervene the day the Cohen warrant docket was made public.)

There’s no sign of that happening here yet.

As of now, there are at most two unexplained sealed filings on the warrant docket.

Except they’re probably all accounted for: According to the government’s opposition to unsealing the warrant affidavit, Docket 57 contains all the other releasable materials (such DOJ’s own motion to seal), and the two prior entries are likely a motion to seal that filing and permission to do so. Each initially sealed docket entry in this docket has included two other sealed entries before it.

And time is running out for the Donald.

Contrary to what certain journalists have concluded from an email from Bratt that said, “the filter agents seized three passports belonging to President Trump,” that doesn’t mean a filter team currently working found the passports (though I assume a filter team may review materials seized under the SSA receipt a second time). It means that filter agents were used to do the search, as was reported contemporaneously. And now case agents — the people who determine which items are within scope of the investigation and which “items [] do not need to be retained for law enforcement purposes” — appear to be making scope determinations.

DOJ only needs to identify a single classified document to charge the former President under the Espionage Act. And given the way that Trump is ginning up outrage and attacks on FBI agents (which the government cited in explaining the need to keep the affidavit sealed), charging him with a single count indictment describing (hypothetically) the nuclear codes might be a good way to shut everyone up. They could use that to offer Trump a plea deal to lesser charges while they catalog other documents that each could bear a separate 10-year sentence.

If they’ve already singled out Trump’s passports, they surely are processing the stolen classified documents that could expose Trump to years in prison.

And Trump’s still at the manufactured outrage stage of his defense.

Update: Corrected time of Bratt’s email, which was shown with MDT.

emptywheel Trump Espionage coverage

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

18 USC 793e in the Time of Shadow Brokers and Donald Trump

[from Rayne] Other Possible Classified Materials in Trump’s Safe

Trump’s Stolen Documents

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

[from Peterr] Merrick Garland Preaches to an Overseas Audience

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

Merrick Garland Calls Trump’s Bluff

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

[from Rayne] Expected Response is Expected: Trump and Right-Wing DARVO

DOJ’s June Mar-a-Lago Trip Helps Prove 18 USC 793e

The Likely Content of a Trump Search Affidavit

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

Some Likely Exacerbating Factors that Would Contribute to a Trump Search

FBI Executes a Search Warrant at 1100 S Ocean Blvd, Palm Beach, FL 33480

The ABCs (and Provisions e, f, and g) of the Espionage Act

Trump’s Latest Tirade Proves Any Temporary Restraining Order May Come Too Late

The ABCs (and Provisions e, f, and g) of the Espionage Act

When Donald Trump wrote the Acting Archivist to give Kash Patel and John Solomon access to what they have since claimed were his Presidential Archives, he made a point of emphasizing that neither had been convicted of the crime that would disqualify them from accessing the records archived in official government archives at 700 Pennsylvania Avenue and elsewhere: “a crime that involves reviewing, retaining, removing, or destroying NARA records.”

Both individuals meet the requirements for access to records under 36 C.F.R. § 1270.44(a)(4).

That is, as far as we know, true. Neither has been convicted of a crime specifically involving access to the Archives.

But Solomon has long been publicly implicated in an investigation into a Dmitry Firtash-linked attempt to funnel Trump Russian-provided dirt. And The Hill’s review of his work included many details that might allow DOJ to treat him as something other than a journalist in that investigation.

As for Kash, at least in April 2021, he was reportedly under investigation for leaking classified information, something that might have led the government to strip his clearance if they hadn’t already.

Both would be wildly inappropriate people to give preferential access to Trump’s Presidential archives. But they nevertheless would qualify under statute.

But Trump wasn’t writing to give Kash and Solomon access to his Archives. His letter explicitly stated he was giving them access to, “Presidential records of my administration.” A week ago, the FBI carted away 27 boxes of “Presidential records of [Trump’s] administration” that had not been properly turned over to the custody of the Archives for safe keeping.

Those details from Trump’s letter, plus new reporting on the events of June, adds to the possibly that this letter was an attempt to retroactively justify access to classified records that, in addition to documents pertaining to the Russian investigation, also likely included even more sensitive documents.

In a largely insipid storyline of the search, Christina Bobb described the WaPo about DOJ’s request after touring the storage closet in which Trump was hoarding classified documents differently than previous, anonymous explanations that likely also come from her.

Bobb told The Post that the group toured the storage facility, opening boxes and flipping through the records inside. She said Justice Department officials indicated they did not believe the storage unit was properly secured, so Trump officials added a lock to the facility.

By description, that’s not (as earlier reported) a request that Trump buy a bigger lock. It almost certainly was a reminder that classified information must be stored according to certain guidelines. DOJ’s letter probably even included a citation to 20 CFR § 2001.43, which describes (among other things) the standard of lock that must be used to store classified documents (italicized below).

(a) General. Classified information shall be stored only under conditions designed to deter and detect unauthorized access to the information. Storage at overseas locations shall be at U.S. Government-controlled facilities unless otherwise stipulated in treaties or international agreements. Overseas storage standards for facilities under a Chief of Mission are promulgated under the authority of the Overseas Security Policy Board.

(b) Requirements for physical protection–

(1) Top Secret. Top Secret information shall be stored in a GSA-approved security container, a vault built to Federal Standard (FED STD) 832, or an open storage area constructed in accordance with Sec. 2001.53. In addition, supplemental controls are required as follows:

(i) For GSA-approved containers, one of the following supplemental controls:

(A) Inspection of the container every two hours by an employee cleared at least to the Secret level;

(B) An Intrusion Detection System (IDS) with the personnel responding to the alarm arriving within 15 minutes of the alarm annunciation. Acceptability of Intrusion Detection Equipment (IDE): All IDE must be in accordance with standards approved by ISOO. Government and proprietary installed, maintained, or furnished systems are subject to approval only by the agency head; or

(C) Security-In-Depth coverage of the area in which the container is located, provided the container is equipped with a lock meeting Federal Specification FF-L-2740.

(ii) For open storage areas covered by Security-In-Depth, an IDS with the personnel responding to the alarm arriving within 15 minutes of the alarm annunciation.

(iii) For open storage areas not covered by Security-In-Depth, personnel responding to the alarm shall arrive within five minutes of the alarm annunciation.

(2) Secret. Secret information shall be stored in the same manner as Top Secret information or, until October 1, 2012, in a non-GSA-approved container having a built-in combination lock or in a non-GSA-approved container secured with a rigid metal lockbar and an agency head approved padlock. Security-In-Depth is required in areas in which a non-GSA-approved container or open storage area is located. Except for storage in a GSA-approved container or a vault built to FED STD 832, one of the following supplemental controls is required:

(i) Inspection of the container or open storage area every four hours by an employee cleared at least to the Secret level; or

(ii) An IDS with the personnel responding to the alarm arriving within 30 minutes of the alarm annunciation.

(3) Confidential. Confidential information shall be stored in the same manner as prescribed for Top Secret or Secret information except that supplemental controls are not required.

(c) Combinations. Use and maintenance of dial-type locks and other changeable combination locks.

(1) Equipment in service. Combinations to dial-type locks shall be changed only by persons authorized access to the level of information protected unless other sufficient controls exist to prevent access to the lock or knowledge of the combination. Combinations shall be changed
under the following conditions:

(i) Whenever such equipment is placed into use;

(ii) Whenever a person knowing the combination no longer requires access to it unless other sufficient controls exist to prevent access to the lock; or

(iii) Whenever a combination has been subject to possible unauthorized disclosure.

(2) Equipment out of service. When security equipment is taken out of service, it shall be inspected to ensure that no classified information remains and the combination lock should be reset to a standard combination of 50-25-50 for built-in combination locks or 10- 20-30 for combination padlocks.

(d) Key operated locks. When special circumstances exist, an agency head may approve the use of key operated locks for the storage of Secret and Confidential information. Whenever such locks are used, administrative procedures for the control and accounting of keys and locks shall be included in implementing regulations required under section 5.4(d)(2) of the Order. [my emphasis]

This section of 32 CFR Parts 2001 and 2003 gets cited in search warrant affidavits for 18 USC 793e; here’s how it appeared, for example, in Reality Winner’s search warrant:

32 C.F.R. Parts 2001 and 2003 regulate the handling of classified information. Specifically, 32 C.F.R. § 2001.43, titled “Storage,” regulates the physical protection of classified information. This section prescribes that Secret and Top Secret information “shall be stored in a GSA-approved security container, a vault built to Federal Standard (FMD STD) 832, or an open storage area constructed in accordance with § 2001.53.” It also requires periodic inspection of the container and the use of an Intrusion Detection System, among other things.

In Trump’s search warrant, a similar paragraph or one following it would include language about how, when the head of DOJ’s Espionage division, Jay Bratt, went and inspected Trump’s storage facility storing documents classified at least at the Secret level on June 3, he found some easily picked lock from WalMart or whatever it was on the door.

Given that the email Bratt sent Trump on June 8 did not say, buy a new lock but instead said, you’re not complying with the requirements for storing classified information, it may also have made a request for proof that someone with clearance at the Secret level was coming to check his stash of documents every 4 hours (see the language bolded above). A refusal to provide that proof voluntarily (because Trump wasn’t complying) may explain why DOJ subpoenaed Trump for such information, reportedly on June 22. Or they may have had other reason to worry, such as Kash Patel’s claims, made on May 4, to have specific knowledge of which documents Trump had returned (which, if Kash’s clearance got stripped when he was under investigation for leaking, he would have no legal basis to know).

But DOJ did subpoena Trump for two months of security footage. And it turned out to show people moving documents in and out of the closet seemingly in conjunction of requests for DOJ.

The Justice Department also subpoenaed surveillance footage from Mar-a-Lago recorded over a 60-day period, including views from outside the storage room. According to a person briefed on the matter, the footage showed that, after one instance in which Justice Department officials were in contact with Mr. Trump’s team, boxes were moved in and out of the room.

That activity prompted concern among investigators about the handling of the material. It is not clear when precisely the footage was from during the lengthy back-and-forth between Justice Department officials and Mr. Trump’s advisers, or whether the subpoena to Mr. Trump seeking additional documents had already been issued.

Given that Trump had no reason to expect that DOJ would ask to see this storage closet on June 3, the moving of boxes may reflect an effort to hide the classified documents from the lawyer who affirmed there were no classified documents there, rather than an effort to hide them from DOJ (in which case the lawyer in question, possibly the suddenly-silent Evan Corcoran, would be in a legal conflict with Trump and might be forced to testify against him).

Which brings us to what is still a chicken-and-egg moment, which might be any of the following:

  • Trump refused to provide surveillance video voluntarily knowing it wouldn’t show compliance with the CFR but would show damning information, which led DOJ to subpoena it, which led to the discovery of uncleared people accessing classified materials (a violation of 18 USC 793f or g, in addition to the violation of 793e)
  • A Trump lawyer realizing the email about CFR compliance meant Trump was in trouble and needed to cover his tracks
  • DOJ finding other reason to be concerned, such as the Kash comments from May seeming to reflect personal knowledge of Trump’s classified documents or Trump’s letter to the Archives reflecting plans to give two people about whom DOJ would have particularized security concerns access to “Presidential records of my administration”

Like I said, thus far it’s a chicken-and-egg thing, but all these things came to a head in late June.

Ultimately, on June 19, Trump filed paperwork that provides the appearance of official access for Kash and Solomon, and (reportedly on June 22), DOJ served a subpoena asking for records showing who had entered and exited the closet. On June 22, so by reports, the same day that Trump got the subpoena but three days after Trump gave Kash the access, Kash went public with his claim to be accessing Trump’s records at the Archive, which is not what the letter asks for.

The problem, though, is that Trump was no longer an original classification authority after January 20 — even his own clearance would be limited! So while he could give Kash and Solomon monitored, privileged access at the Archives (because, while they were both security concerns, they had never been convicted of stealing records from the Archives), Trump had no authority to give them access to the Presidential records at his golf resort, because they included classified records that neither had clearance to access much less a need to know.

Here are all the ways that 18 USC 793 of the Espionage Act add to someone’s liability if they share classified information with people not entitled to receive it,

(d)Whoever, lawfully having possession of, access to, control over, or being entrusted with any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, or note relating to the national defense, or information relating to the national defense which information the possessor has reason to believe could be used to the injury of the United States or to the advantage of any foreign nation, willfully communicates, delivers, transmits or causes to be communicated, delivered, or transmitted or attempts to communicate, deliver, transmit or cause to be communicated, delivered or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it on demand to the officer or employee of the United States entitled to receive it; or

(e)Whoever having unauthorized possession of, access to, or control over any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, or note relating to the national defense, or information relating to the national defense which information the possessor has reason to believe could be used to the injury of the United States or to the advantage of any foreign nation, willfully communicates, delivers, transmits or causes to be communicated, delivered, or transmitted, or attempts to communicate, deliver, transmit or cause to be communicated, delivered, or transmitted the same to any person not entitled to receive it, or willfully retains the same and fails to deliver it to the officer or employee of the United States entitled to receive it; or

(f)Whoever, being entrusted with or having lawful possession or control of any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, note, or information, relating to the national defense, (1) through gross negligence permits the same to be removed from its proper place of custody or delivered to anyone in violation of his trust, or to be lost, stolen, abstracted, or destroyed, or (2) having knowledge that the same has been illegally removed from its proper place of custody or delivered to anyone in violation of its trust, or lost, or stolen, abstracted, or destroyed, and fails to make prompt report of such loss, theft, abstraction, or destruction to his superior officer—

Shall be fined under this title or imprisoned not more than ten years, or both.

(g) If two or more persons conspire to violate any of the foregoing provisions of this section, and one or more of such persons do any act to effect the object of the conspiracy, each of the parties to such conspiracy shall be subject to the punishment provided for the offense which is the object of such conspiracy. [my emphasis]

Note, I included 18 USC 793d, but I think that under the Presidential Records Act, Trump no longer had authorization to store those documents. I included it because, if Trump pushed the point, he could be charged under that statute instead of 793e.

Both before and, especially, since this has blown up, Kash Patel and John Solomon have been the loudest purveyors of false claims that this is about classified information. Both were insisting in July, for example, that they knew that all the Russian-related documents Trump tried to declassify in the last minutes during which he still had authority had in fact been declassified and remained declassified. Kash, especially, knows that the Espionage Act is not about classified information anyway, but instead National Defense Information.

I still don’t think that these events are primarily about Kash and Solomon. But I think Trump’s efforts to have them continue to purvey false claims that he had not actually been implicated with improper ties to Russia may have led him to do stupid things that expanded his own (and their) liability under the Espionage Act.

DOJ could have written the warrant to convey that Trump was only under investigation for 18 USC 793e, the most obvious clause covering his refusal to give documents back. They did not. And all the people around Trump should be more worried about their own legal liability right now than spreading false claims that any attempt by Trump to declassify National Defense Information could change his legal exposure.

emptywheel Trump Espionage coverage

Trump’s Timid (Non-Legal) Complaints about Attorney-Client Privilege

18 USC 793e in the Time of Shadow Brokers and Donald Trump

[from Rayne] Other Possible Classified Materials in Trump’s Safe

Trump’s Stolen Documents

John Solomon and Kash Patel May Be Implicated in the FBI’s Trump-Related Espionage Act Investigation

[from Peterr] Merrick Garland Preaches to an Overseas Audience

Three Ways Merrick Garland and DOJ Spoke of Trump as if He Might Be Indicted

The Legal and Political Significance of Nuclear Document[s] Trump Is Suspected to Have Stolen

Merrick Garland Calls Trump’s Bluff

Trump Keeps Using the Word “Cooperate.” I Do Not Think That Word Means What Trump Wants the Press To Think It Means

[from Rayne] Expected Response is Expected: Trump and Right-Wing DARVO

DOJ’s June Mar-a-Lago Trip Helps Prove 18 USC 793e

The Likely Content of a Trump Search Affidavit

All Republican Gang of Eight Members Condone Large-Scale Theft of Classified Information, Press Yawns

Some Likely Exacerbating Factors that Would Contribute to a Trump Search

FBI Executes a Search Warrant at 1100 S Ocean Blvd, Palm Beach, FL 33480

The ABCs (and Provisions e, f, and g) of the Espionage Act

Obstruction: The Two-Receipt Search of the Former President’s Golf Resort

There are two separate receipts for the search of Mar-a-Lago signed, in the same minute, by Trump lawyer Christina Bobb.

There’s the one consisting of five boxes and a separate category, “Documents,” not associated with any boxes, signed by the Supervisory Special Agent. There are no classified documents described. I’ll refer to that as the SSA Receipt in this post.

Then there’s the one that consists of 27 items, mostly boxes, many with sub-items, which are often descriptions of the kinds of classified documents contained in the box or the leather case they were seized in. It was signed by a Special Agent. I’ll refer to that as the CLASS Receipt in this post.

Bobb signed them both at 6:19PM, so unless she’s a shitty lawyer, these receipts were presented to her together as one running receipt.

Whatever else the FBI is, their searches are methodical. They come in, secure the location, serially take pictures of the rooms being searched (so the criminal suspects don’t claim evidence was planted, as criminal suspects are wont to do), label the things to be searched, start sorting through items according to a search protocol to see if they’re covered by the warrant, then inventory the things being seized. In this case, there would have been another part of the process to make sure no attorney-client privileged materials were seized.

In the search of Trump’s house, at least 73 boxes appear to have been labeled (based on the highest box label number), but just 26 boxes were seized.

By all appearances, these two receipts stem from the same methodical search. For example, the documents listed as item 4 on SSA receipt are in the same overall inventory as everything else, but appear out of sequence. They likely bear some proximal relation to low-item numbers in the CLASS receipt — things like the Roger Stone clemency and the binders of photos. Perhaps they were all found in Trump’s office or residence. But they are on the SSA receipt.

The series of box labels crosses both receipts. For example, it appears that boxes A-14 and A-13, which appear in the SSA receipt, were labeled in close proximity and time as boxes A-12 and A-15, which are among the lowest numbered boxes on the CLASS receipt. But they got listed on the SSA receipt, where all boxes appear together as the final five items on the combined inventory, items 29 through 33.

I’d like to talk more about the search, but first let me spoil the punchline: One likely (though not the only) explanation for the two receipts has to do with the venue in which Trump’s suspected crimes were committed and therefore the ultimate destination of the seized materials, with the SSA receipt materials being sent to DC as evidence of 18 USC 1519 and the CLASS receipt materials being kept in Miami as evidence of multiple violations of the Espionage Act that occurred at Mar-a-Lago.

But let’s go back.

I believe this warrant is the totality of the search on Trump’s mansion. While File411 suspects there’s another warrant (or two), I don’t believe those authorize a search of Trump’s house, not least because Judicial Watch has only asked to unseal one, and Trump’s people will have told them what they wanted unsealed. Merrick Garland referred to unsealing the documents relating to Trump’s house, and I’d be surprised if he played word games to hide further search materials when Trump would literally have receipts to call out any such obfuscation. That doesn’t rule out that the other warrants identified by File411 were related searches, perhaps of locations where Trump’s stolen documents may have been moved, but I believe we’re looking at the totality of the physical search at Mar-a-Lago. Update, August 15: DOJ has now confirmed that this is an entirely separate ongoing investigation. Remember that lots of January 6 suspects live in Florida, so it could be something like that or an entirely different type of crime.

The warrant authorizes the FBI to search Trump’s office (the narcissist appears to have renamed it the 45 Office but it has been referred to as the bridal suite), all storage rooms (the one that Trump’s lawyers showed Jay Bratt when he visited in June is not identified by name), and anywhere else Trump or his staff might have stashed boxes or documents. We know from reports that that included Trump’s personal residence, but the FBI didn’t call it out by name. Curiously, the FBI made clear that when it said the search did not include spaces occupied by guests or other residents, they mean “currently,” as if there’s a room someone recently vacated that is of interest.

Attachment B, which describes the items to be searched for, is one of the things that may explain the two receipts. It starts by listing three crimes: 18 USC 793 (Gathering, transmitting or losing defense information, which is part of the Espionage Act), 18 USC 2071 (Concealment, removal, or mutilation [of official records] generally), and 18 USC 1519 (Destruction, alteration, or falsification of records in Federal investigations).

Despite the fact that every single leak to the press about the scope of the warrant claimed that two crimes were listed, “mishandling classified information” and the Presidential Records Act, those leaks were all false. The former was a transparent attempt to avoid saying the word “Espionage” and the latter is not listed on the warrant as a crime being investigated at all (though I would bet a great deal of money that it features prominently in the affidavit). 18 USC 2071, in this context, may serve as a proxy, criminalizing the removal of records covered by PRA. And one of the four bullets describing materials that can be seized, bullet c,  stems from PRA: “Any government and/or Presidential Record created between January 20, 2017, and January 20, 2021.” Because it would cover items implicated in the two other crimes, National Defense Information and evidence from Federal investigations, that bullet point serves as a larger umbrella in this search. If Trump tries to claim he declassified the items seized in the Espionage Act investigation, for example, the government will be able to say they still seized them lawfully given that bullet point and the inclusion of 18 USC 2071, because to still be at Mar-a-Lago at this point, they would have had to have been removed improperly from government control.

There are two bullet points scoping out materials relating to the Espionage count. Bullet point b authorizes the seizure of information about the storage of NDI or classified information.

Information, including communications in any form, regarding the retrieval, storage, or transmission of national defense information or classified material.

If Trump or his flunkies are charged under the Espionage Act, DOJ will have to rebut the claims being floated by Kash Patel and John Solomon that Trump declassified this material. One way to do that is to show that Trump or his lawyers instructed staffers to treat certain materials as if it was classified. If, for example, Trump put up post-it notes on his storage room saying “Danger: Sekrits. Keep Out,” it would prove that he was telling others to treat the documents with care. I’m only partly joking. We know there were efforts to prevent uncleared staffers from looking at classified information. Obtaining written proof of such instructions is one of the ways DOJ would prove that Trump did know this stuff remained classified. Even if those efforts were only enforced by his lawyers — the same lawyers who failed to turn over these materials in response to subpoena — it will be powerful evidence that those documents were being treated as if they remained classified.

The other bullet point authorizing evidence covered by the Espionage Act reminds me of Borges’s writings on classification.

Any physical documents with classification markings, along with any containers/boxes (including any other contents) in which such documents are located, as well as any other containers/boxes that are collectively stored or found together with the aforementioned documents and containers/boxes.

Effectively, this allows the FBI to seize documents with classification markings and then work out from there, seizing the box containing the document marked as classified, as well as the contents of the closet that a box containing a classified document was in. It’s fairly easy to understand why the FBI wrote it this way (and it may be tailored to overcome the justifications Trump made over the course of 18 months to try to retain certain materials). The President looks at — and in many cases, generates — a whole slew of things that are considered highly classified, but in a form that wouldn’t have classification marks on it, especially if he never shared it with a staffer. If Trump took notes with his Sharpie on a cocktail napkin during a phone call directly with Mohammed bin Salman, for example, it would not include classification marks, but it might be highly classified. So this bullet point allows FBI to seize stuff being treated the same way as documents that do have formal classification markings, which government classification experts can then apply the appropriate classification to.

How this might have worked in practice appears on the CLASS receipt. The second-most interesting item on the list (after the Roger Stone clemency that seems to have some tie to the French President) is the leather box in which the only documents inventoried as TS/SCI were stored.

Not all of these documents are TS/SCI; the inventory even notes that some are just classified. But given the way the warrant is written, the FBI was permitted to seize the entire box, which appears to contain Donald’s precious treasures, even if some of the documents in there are not labeled as classified. It may be that witnesses told the FBI of the existence of this box so the FBI knew to look for it. By seizing the entire box, the FBI would get things that might be even more sensitive than the TS/SCI stuff, but that don’t bear markings, like that hypothetical cocktail napkin with notes of Trump’s secret calls with MbS.

The thing is, these categories overlap. There may have led to some triage onsite about how to classify seized documents. I suggested that item 4 — documents — may have been stored with items 1 through 7 in Trump’s office or residence. If so, they could have been seized by proximal location. But they’re inventoried on the other receipt for some reason, potentially even taken out of a box or that leather case and seized separately as individual documents.

Similarly, boxes A-13 and A-14 were likely stored in close proximity to box A-15, which includes at least some Secret Documents, and box A-16, which includes at least some Top Secret Documents. So they could have been seized under the logic of proximity. But like item 4, they’re on a different receipt.

Which brings me to the final bullet describing the scope of the search (and back to my working hypothesis for the two different receipts, that the SSA receipt covers evidence of obstructive acts committed in DC). It authorizes the seizure of evidence of the destruction of records.

Any evidence of the knowing alteration, destruction, or concealment of any government and/or Presidential Records, or of any documents with classification markings.

This language comes right out of the obstruction statute, though leaves out the reference to “investigation[s] or proper administration:”

Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both.

This part of the warrant, not the reference to the Espionage Act, was the biggest secret of the week. I was not surprised that anonymous sources from the Trump camp soft-pedaled the word “Espionage.” It’s why I was pushing for pressure on Trump to release the warrant. It’s what I believed Trump most wanted to hide.

But remarkably, Trump’s leakers were hiding this part of the warrant even more aggressively. In the entire week of post-search coverage, there was never a hint that obstruction was on the warrant, too. The “Expert Explainers” gaming out what crimes might be on the warrant completely missed obstruction. I did too.

We shouldn’t have. The coverage of the Archives’ referral of Trump to DOJ described his destruction of evidence even more prominently than it did his theft of classified documents.

The National Archives and Records Administration has asked the Justice Department to examine Donald Trump’s handling of White House records, sparking discussions among federal law enforcement officials about whether they should investigate the former president for a possible crime, according to two people familiar with the matter.

The referral from the National Archives came amid recent revelations that officials recovered 15 boxes of materials from the former president’s Mar-a-Lago residence in Florida that were not handed back in to the government as they should have been, and that Trump had turned over other White House records that had been torn up. Archives officials suspected Trump had possibly violated laws concerning the handling of government documents — including those that might be considered classified — and reached out to the Justice Department, the people familiar with the matter said.

[snip]

Trump’s years-long defiance of the Presidential Records Act, which requires the preservation of memos, letters, notes, emails, faxes and other written communications related to a president’s official duties, has long raised concerns among historians and legal observers. His penchant for ripping up official documents was first reported by Politico in 2018, but it has drawn new scrutiny in recent weeks because of a House select committee’s investigation of the Jan. 6, 2021, attack on the U.S. Capitol.

The Washington Post reported late last month that some of the White House records the National Archives turned over to the committee appeared to have been torn apart and then taped back together. The Post later found — and the Archives confirmed — that officials had recovered 15 boxes of presidential records from Mar-a-Lago.

As described, by the time of its criminal referral, the Archives had already found that documents that were responsive to the January 6 Committee’s investigation (and so, derivatively, DOJ’s investigation of Trump personally) had been “altered, destroyed, or mutilated.” DOJ would have started this investigation knowing that Trump had attempted to destroy evidence implicating him in January 6 (though we actually have evidence of him attempting to destroy or alter evidence pertinent to other criminal investigations, too).

By description, when Trump tried to destroy evidence, he did so immediately, in the heat of the moment, in the White House. For that reason, and because the known federal investigations — his attempted coup on January 6, but also his ties to Russia, his coercion of Ukraine, even his inauguration graft — were all predicated in DC, the investigation into Trump’s obstruction of those investigations would be in DC too. That’s why I hypothesize that FBI may have inventoried everything and then, when compiling a final inventory to share with Trump, they distinguished between the suspected crimes that would have been committed in Florida, by storing classified information improperly and refusing to return it to the Federal government, and the suspected crimes that would have been committed in DC when — on January 20 or before, including between January 6 and January 20 — Trump ripped up, flushed, burned, or tried to eat incriminating evidence.

Unless Trump were to waive venue (which he would never do), any prosecution of Trump under the Espionage Act would happen in SDFL, because that’s where he illegally retained classified information after the government asked him to give it back. But any prosecution of Trump for obstruction would happen where the investigations he obstructed were and where he ripped up evidence, in DC.

Item 4, documents, might just be documents that bore visible signs of destruction that had some identifiable tie to January 6 or some other known investigation. They could even be classified! The obstruction bullet point includes classified documents! But they would have been seized, first and foremost, because they were evidence that Trump was trying to impede an investigation or some other government function by destroying evidence.

That has one more big implication, which may be why Trump’s team tried so hard to hide that FBI was looking for evidence of obstruction. There were also leaks (including leaks from the government side) that nothing on this search warrant pertains to January 6. Technically that’s true. Obstruction of the vote certification and conspiracy to defraud the government, the most obvious crimes covering Trump’s conduct leading up to and on January 6, aren’t on the warrant. But as that coverage of the original referral we all forgot to read makes clear, January 6 is at least one of the investigations that Trump is being investigated for obstructing. If the evidence of obstruction is being boxed up and sent back to DC where such an investigation would be predicated, then the evidence would thereby become available to investigators, both for evidence of Trump’s obstruction of an investigation, but also for evidence of Trump’s conduct as well.

Oh. And if Trump were found to have obstructed an investigation into conspiracy by destroying evidence, it might extend the statute of limitations on that conspiracy.

I wrote a long thread yesterday about how Trump epically fucked up by giving DOJ grave reasons to come search his home. DOJ would never have searched Mar-a-Lago for materials Trump withheld in violation of the PRA. They probably would never have searched MAL for evidence he withheld regarding January 6. But Trump kept refusing to turn over classified information DOJ knew he had, some of it reportedly incredibly sensitive. Trump dared Merrick Garland to come get those classified documents. And in so doing, Donald J. Trump gave the FBI urgent reason to come into his home to seize — along with at least 11 boxes containing classified documents — the evidence about January 6 and other investigations that is so sensitive Trump tried to destroy it before refusing to turn it over to the Archives.